=======================================
Sat, 12 Sep 2026 - Debian 13.7 released
=======================================
akonadi-search (4:24.12.3-1+deb13u1) trixie; urgency=medium
 .
   [ Fab Stz ]
   * Fix "akonadi_html_to_text is crashing a lot" (Closes: #1104598)
     * Added a patch to not crash on empty input.

alsa-lib (1.2.14-1+deb13u1) trixie; urgency=medium
 .
   * CVE-2026-25068 (Closes: #1126629)

ansible-core (2.19.11-0+deb13u1) trixie; urgency=medium
 .
   * d/salsa-ci.yml: Run lintian CI against trixie for this branch New upstream
   * New upstream version 2.19.5
     - Fix ``AnsibleModule.human_to_bytes()``, which was never adjusted after the
       standalone ``human_to_bytes()`` got a new parameter ``default_unit``
       (https://github.com/ansible/ansible/pull/85259).
     - Variable loading now uses file source instead of variables when invalidly
       formmated vars file is loaded.
     - ansible-test - The runtime-metadata sanity test now ignores pre-release
       and build identifiers in collection versions. This prevents errors if a
       tombstone version is ``X.0.0``, while the collection's version is
       ``X.0.0-prerelease`` (https://github.com/ansible/ansible/issues/85193)."
     - first_found - Correct the "Include tasks only if one of the files exists,
       otherwise skip" example.
     - get_url - fix regex for GNU Digest line which is used in comparing
       checksums (https://github.com/ansible/ansible/issues/86132).
   * New upstream version 2.19.6
     - ansible-test - Replace RHEL 10.0 remote with 10.1.
     - ansible-test - Replace RHEL 9.5 remote with 9.7.
     - Fix Windows LIB env var corruption.
     - ansible_local will no longer trigger variable injection default value
       deprecation.
     - package, service, gather_facts - fix templating module_defaults for
       modules executed by these action plugins.
     - winrm - Provide a better error message if a domain user is specified using
       a User Principal Name (UPN) but the pykerberos library is not installed so
       Kerberos is unavailable.
   * New upstream version 2.19.7
     - ansible-test - Update URL used to download FreeBSD wheels for managed
       remotes.
     - ansible-test - Use the new API endpoint for the Ansible Core CI service.
     - Fix up the Action plugin _make_tmp_path error to only include the command
       run rather than the shell's dataclass repr from mkdtemp.
     - local connection - Pass correct type to become plugins when checking
       password
   * New upstream version 2.19.8
     - ansible-test - Add container/remote aliases for more loosely specifying
       managed test environments.
     - ansible-test - Add support for using the Ansible Core CI service from
       GitHub Actions.
   * New upstream version 2.19.9
     - ansible-test - Generate dist_info when running tests.
     - ansible-test - Replace the parallels managed macOS provider with a new mac
       provider.
     - ansible-test - Switch managed macOS remotes from x86_64 to aarch64.
     - ansible-galaxy collection - Fix using the server configuration for
       validate_certs when downloading collections.
   * New upstream version 2.19.10
     - psrp - Do not log raw stdout/stderr on verbosity 5 when task has
       "no_log: true" set
     - winrm - Do not log raw stdout/stderr on verbosity 5 when task has
       "no_log: true" set
     - ansible-test remote alias - Alias values for `--controller` and
       `--target` are properly resolved for `remote`. Previously, remote
       alias values (e.g. `fedora/latest`) resolved correctly only for the
       legacy `--remote` arg, failing with unknown image error for newer args.
     - module_utils/basic.py - Fix `AnsibleModule.run_command()` to handle
       `None` return from non-blocking pipe reads
       (https://github.com/ansible/ansible/issues/86920).
   * New upstream version 2.19.11
     - ansible-test - Replace FreeBSD 14.2 with 14.3.
     - ansible-galaxy install - Ensure role requirements are passed as positional
       arguments to `git clone`. Previously, a malicious role author could
       inject arbitrary git configuration in role dependencies. (CVE-2026-11332)
       (Closes: #1139175)
     - module_utils sanitize_keys and remove_value functions now sort their input
       to ensure matching subsets are always obscured.
ansible-core (2.19.4-1) unstable; urgency=medium
 .
   * Stay on 2.19 for now since ansible-community 13 isn't released yet
   * New upstream version 2.19.4
   * Drop fix-play-tags-handler-regression.patch (applied upstream)
   * Explicit thanks to Colin Watson for debugging hard to reproduce CI failures
     and for providing a fix in the previous upload!

aom (3.12.1-1+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Backport upstream security fixes for four encoder vulnerabilities.
     - debian/patches/0004-CVE-2026-56209-56210-56211-svc-layer-id-bounds-check.patch:
       Validate the spatial and temporal layer ids passed to the
       AOME_SET_SPATIAL_LAYER_ID and AV1E_SET_SVC_LAYER_ID codec controls
       against the configured number of layers.
       Fixes: CVE-2026-56210, CVE-2026-56209 and CVE-2026-56211.
     - debian/patches/0005-CVE-2026-56208-lap-stats-buffer-overflow.patch:
       Size the first-pass stats buffer to at least MAX_GF_LENGTH_LAP + 1, use
       a compacting sliding window in Look-Ahead Processing mode and correct an
       off-by-one in the rest_frames computation, fixing an out-of-bounds
       access to the first-pass stats array triggered by a small
       g_lag_in_frames (CVE-2026-56208).
   * debian/patches/0006-svc-add-more-spatial-temporal-layer-validation.patch:
     Reject SVC spatial and temporal layer counts outside the supported range
     in AOME_SET_NUMBER_SPATIAL_LAYERS and AV1E_SET_SVC_PARAMS, and report an
     invalid parameter rather than relying on an assert() for the fixed-SVC
     layer count limit. This is a pre-existing out-of-bounds access in 3.12.1,
     included here because the layer id validation added above derives its
     bounds from these counts.

apr-util (1.6.3-3+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload on behalf of Apache Team.
     (Closes: #1143837)
   * Fix CVE-2025-49506:
     Function apr_password_validate() was not constant-time with
     regards to hashes or passwords comparisons, potentially leaking
     their content via a side channel timing attack.
   * Fix CVE-2026-32327:
     A stack recursion attack against any library consumer
     which parses XML from untrusted sources and uses the
     apr_xml_quote_elem() function
   * Fix CVE-2026-34191:
     Improper Neutralization of Special Elements used
     in an SQL Command (SQL Injection) vulnerability
     in Apache Portable Runtime Utility via apr_dbd_oracle provider.
   * Fix CVE-2026-34501:
     Heap-based Buffer Overflow vulnerability in Apache Portable
     Runtime Utility redis client.
   * Fix CVE-2026-34502:
     Heap-based Buffer Overflow vulnerability in Apache Portable
     Runtime Utility memcached client

at-spi2-core (2.56.2-1+deb13u2) trixie; urgency=medium
 .
   [ Valentin Haudiquet ]
   * patches/debian-atkversion-c-linkage.patch: Fix atkversion.h header for C++
     (Closes: #1145539)
at-spi2-core (2.56.2-1+deb13u2~bpo12+1) bookworm-backports; urgency=medium
 .
   * Backport to bookworm.
     - Revert t64 change.
     - Revert libgirepository1.0-dev build-dep change.

audit (1:4.0.2-2+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * d/p/04-riscv64.patch: backport riscv64 support from version 4.0.3
   * debian/rules: Pass --with-riscv to configure (Closes: #1136948)

auto-apt-proxy (16.8+deb13u2) trixie; urgency=medium
 .
   * hit(): prevent apt-helper call from recursing into auto-apt-proxy
     (Closes: #1142542)
   * wait for network to be online
   * debian/tests/timeout: fix tests to be more reliable

awffull (3.10.2-10+deb13u2) trixie; urgency=medium
 .
   * QA upload.
   * debian/patches/pcre2.patch: Fix Visits/Pages statistics, thanks Martin
     Argalas / CyberFoundry.net (Closes: #1129599).

base-files (13.8+deb13u7) trixie; urgency=medium
 .
   * Update debian_version and os-release for Debian 13.7 point release.
   * Add AGPL-3.0, Artistic-2.0, BSL-1.0, CC-BY-3.0, CC-BY-4.0, CC-BY-SA-3.0,
     CC-BY-SA-4.0, GFDL-1.1 and OFL-1.1 to common-licenses. Closes: #1136090.
     Packages in forky/sid which decide to refer to those licenses at their
     common-licenses location will now be easier to backport for trixie.

bcg729 (1.1.1-3+deb13u1) trixie; urgency=medium
 .
   * Fix SIGFPE due to a division by zero in bcg729Encoder().
     Patch taken from upstream.

bettercap (2.33.0-1+deb13u2) trixie; urgency=medium
 .
   * Non-maintainer upload.
 .
   [ Francisco Vilmar Cardoso Ruviaro ]
   * Drop debian/bettercap.install  to stop installing bettercap.service by
     default  (Closes: #1141754)
bettercap (2.33.0-1+deb13u1) trixie; urgency=medium
 .
   * Add debian/patches/CVE-2026-8276.patch.
     (Closes: #1136448, CVE-2026-8276)

bind9 (1:9.20.26-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream version 9.20.26
    + [CVE-2026-10723]: Correct verification of NSEC3 signer name.
    + [CVE-2026-10822]: Malformed DNSKEY records could trigger an
      assertion.
    + [CVE-2026-11331]: Fix handling of RPZ CNAME expansion that returns
      too-long name.
    + [CVE-2026-11605]: Prevent excessive validation work from crafted
      negative responses.
    + [CVE-2026-11622]: Prevent cache exhaustion under sustained attack.
    + [CVE-2026-11721]: Stop accepting invalid signed wildcard records.
    + [CVE-2026-12617]: Do not assert for some specific CNAME and DNAME
      queries.
    + [CVE-2026-13204]: Prevent crash from malformed NSEC/NSEC3 response.
    + [CVE-2026-13321]: Fix DNSSEC validation bypass via out-of-zone NSEC
      Next Field.
bind9 (1:9.20.26-1~deb13u1~bpo12+1) bookworm-backports; urgency=high
 .
   * Rebuild for trixie-backports.
bind9 (1:9.20.24-1) unstable; urgency=medium
 .
   * New upstream version 9.20.24
bind9 (1:9.20.23-1) unstable; urgency=high
 .
   * New upstream version 9.20.23
    + [CVE-2026-3592]: Limit resolver server list size.
    + [CVE-2026-3039]: Fix GSS-API resource leak.
    + [CVE-2026-5946]: Disable recursion, UPDATE, and NOTIFY for non-IN
      views.
    + [CVE-2026-5950]: Avoid unbounded recursion loop.
    + [CVE-2026-5947]: Fix crash in resolver when SIG(0)-signed responses
      are received under load.
    + [CVE-2026-3593]: Fix use-after-free error in DNS-over-HTTPS when
      processing HTTP/2 SETTINGS frames.

binwalk (2.4.3+dfsg1-2+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * d/p/*: Add prevent-path-traversal-in-wince.patch fixing CVE-2026-7179;
     thanks to Fukui Daichi for providing the patch (Closes: #1136010).

bubblewrap (0.12.0-1~deb13u1) trixie-security; urgency=high
 .
   * Merge new upstream release from unstable
     - Prevent sandbox escape via symlink traversal.
       If an app framework such as Flatpak mounts subdirectories into a
       directory controlled by the sandboxed app, a malicious or compromised
       sandboxed app could create symlinks in that directory to arrange for
       files/directories to be created on the host system.
       (GHSA-pxhw-h44j-8pfx, no known CVE ID; Closes: #1145655)
     - bubblewrap no longer supports running when setuid, matching the
       upstream default. This ensures that vulnerabilities similar to
       CVE-2026-41163 can't happen in future.
   * Debian 13 backport changes:
     - d/control, d/gbp.conf: Branch for Debian 13 stable updates
     - Revert packaging changes that are not appropriate for a stable release
   * Packaging changes since 0.11.0-2+deb13u1:
     - d/rules: Stop passing -Dsupport_setuid=false.
       The option no longer exists, and the new version of bubblewrap always
       behaves as though its value was false.
     - d/rules: Don't compile fallback code paths for kernel older than 5.10.
       This ensures that we're using the safest available mechanisms,
       using the openat2() syscall rather than emulating it in user-space.
       As a result, this version will not work on kernels older than the
       one found in Debian 11.
     - d/rules: Install NEWS.md as the upstream changelog
     - d/p/CVE-2026-41163/:
       Drop patches, no longer needed/applicable with the new upstream release
     - d/p/debian/Change-EPERM-error-message-to-show-Debian-specific-inform.patch:
       Adjust patch to apply to the new upstream release
     - d/README.Debian: Rewrite to reflect that setuid is no longer supported
     - d/copyright: Update license from LGPL-2+ to LGPL-2.1+, matching upstream
 .
 bubblewrap (0.12.0-1) unstable; urgency=high
 .
   * New upstream release
     - Prevent sandbox escape via symlink traversal.
       If an app framework such as Flatpak mounts subdirectories into a
       directory controlled by the sandboxed app, a malicious or compromised
       sandboxed app could create symlinks in that directory to arrange for
       files/directories to be created on the host system.
       (GHSA-pxhw-h44j-8pfx, no known CVE ID; Closes: #1145655)
     - d/rules: Stop passing -Dsupport_setuid=false.
       The option no longer exists, and the new version of bubblewrap always
       behaves as though its value was false.
     - d/copyright: Update license from LGPL-2+ to LGPL-2.1+, matching upstream
     - d/p/debian/Change-EPERM-error-message-to-show-Debian-specific-inform.patch:
       Adjust patch to apply to the new upstream release
   * d/rules: Don't compile fallback code paths for kernel older than 5.10.
     This ensures that we're using the safest available mechanisms,
     using the openat2() syscall rather than emulating it in user-space.
     As a result, this version will not work on kernels older than the
     one found in Debian 11.
 .
 bubblewrap (0.11.2-2) unstable; urgency=medium
 .
   * d/rules: Stop allowing bubblewrap to run when setuid, matching
     the upstream default. This ensures that vulnerabilities similar to
     CVE-2026-41163 can't happen in future.
   * d/control, d/NEWS, d/README.Debian: Update documentation accordingly
   * Standards-Version: 4.7.4 (no changes required)
bubblewrap (0.11.2-2) unstable; urgency=medium
 .
   * d/rules: Stop allowing bubblewrap to run when setuid, matching
     the upstream default. This ensures that vulnerabilities similar to
     CVE-2026-41163 can't happen in future.
   * d/control, d/NEWS, d/README.Debian: Update documentation accordingly
   * Standards-Version: 4.7.4 (no changes required)
bubblewrap (0.11.2-1) unstable; urgency=medium
 .
   * New upstream release
     - Fixes a root privilege escalation vulnerability if bwrap has been
       made setuid root locally (CVE-2026-41163, Closes: #1134704).
       Most Debian systems have a non-setuid bubblewrap and therefore
       are unaffected by this.
   * d/rules: Temporarily allow bubblewrap to be setuid root.
     This configuration is a security risk and rarely necessary, so the
     option is deprecated, and a future upstream version will
     unconditionally refuse to run if it detects that it has been run
     setuid root.
   * d/README.Debian: Update to reflect deprecation of setuid-root bwrap
   * d/NEWS: Mention deprecation of setuid-root mode
bubblewrap (0.11.1-1) unstable; urgency=medium
 .
   * New upstream release
   * Stop overriding kernel.unprivileged_userns_clone sysctl.
     The setting we use has been the default for several years.
   * d/control: Remove Recommends on procps.
     This was only needed as a way to force the required value of
     kernel.unprivileged_userns_clone during the transition from Debian 10
     to 11, and even then, only on non-systemd systems.
   * d/p/debian/Change-EPERM-error-message-to-show-Debian-specific-inform.patch:
     Refresh patch to apply after a grammatical fix upstream
   * d/control: Replace transitional libselinux1-dev with libselinux-dev
   * d/control: Bump Standards-Version to 4.7.3.
     Remove Priority: optional, no longer required with current dpkg-dev.
   * d/copyright: Stop quoting the FSF's former postal address
   * d/rules: Stop overriding build system.
     This was only necessary while bubblewrap supported both Meson and
     Autotools builds, which it hasn't since 0.11.0.
   * d/clean: Remove another Autotools remnant
   * d/rules: Install NEWS.md as the upstream changelog
   * Stop using debhelper's historical special case for a single binary
     package. Explicitly list what we intend to install, instead.
   * d/watch: Update to v5 format
   * d/README.Debian: Mention glycin as a prominent use of bubblewrap
   * d/README.Debian: Reduce focus on pre-Debian-10 kernels

caddy (2.6.2-12+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Backport upstream fixes for multiple security issues:
     CVE-2026-27585, CVE-2026-27587, CVE-2026-27588, CVE-2026-27589,
     CVE-2026-27590, CVE-2026-45692, CVE-2026-52845, CVE-2026-52846
   * d/control: change Built-Using to Static-Built-Using (as in 2.11.2-1).

chromium (150.0.7871.181-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-15899: Use after free in CameraCapture. Reported by Google.
     - CVE-2026-15900: Use after free in GPU. Reported by Google.
     - CVE-2026-15901: Use after free in Network. Reported by Google.
     - CVE-2026-15902: Use after free in Cast. Reported by Google.
     - CVE-2026-15903: Out of bounds read and write in V8.
       Reported by OpenAI Codex Security (amyb).
     - CVE-2026-15904: Use after free in Ozone. Reported by Google.
     - CVE-2026-15905: Use after free in Aura. Reported by Google.
     - CVE-2026-16420: Type Confusion in WebAudio.
       Reported by Found by XBOW and triaged by Brendan Dolan-Gavitt.
     - CVE-2026-16421: Inappropriate implementation in WebAudio.
       Reported by Found by XBOW and triaged by Brendan Dolan-Gavitt.
     - CVE-2026-16413: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-16414: Insufficient validation of untrusted input in
       Chromecast. Reported by Google.
     - CVE-2026-16415: Insufficient validation of untrusted input in
       Extensions. Reported by Google.
     - CVE-2026-16416: Integer overflow in Chromecast. Reported by Google.
     - CVE-2026-16417: Uninitialized Use in Skia. Reported by Google.
     - CVE-2026-16418: Stack buffer overflow in V8. Reported by Google.
     - CVE-2026-16419: Out of bounds read and write in ANGLE.
       Reported by Google.
     - CVE-2026-16422: Insufficient validation of untrusted input in
       Certificate. Reported by Google.
     - CVE-2026-16423: Use after free in UI. Reported by Google.
     - CVE-2026-16424: Use after free in GPU. Reported by Google.
chromium (150.0.7871.124-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-15764: Use after free in Ozone. Reported by Google.
     - CVE-2026-15765: Use after free in Ozone. Reported by Google.
     - CVE-2026-15766: Uninitialized Use in Skia. Reported by Google.
     - CVE-2026-15767: Heap buffer overflow in libyuv. Reported by Google.
     - CVE-2026-15768: Insufficient policy enforcement in HTML-in-Canvas.
       Reported by Google.
     - CVE-2026-15769: Insufficient validation of untrusted input in
       Linux Toolkit Theming. Reported by Google.
     - CVE-2026-15770: Uninitialized Use in V8. Reported by Google.
     - CVE-2026-15771: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-15772: Use after free in GPU. Reported by Google.
     - CVE-2026-15773: Use after free in Core.
       Reported by xinchaotian of Microsoft.
     - CVE-2026-15774: Use after free in Skia. Reported by Google.
     - CVE-2026-15775: Insufficient policy enforcement in V8.
       Reported by wang1r923096443@gmail.com.
     - CVE-2026-15776: Type Confusion in V8.
       Reported by Salvatore Gulizia (nickname: Serotav).
     - CVE-2026-15777: Use after free in UI. Reported by Google.
     - CVE-2026-15778: Insufficient validation of untrusted input in
       Navigation. Reported by Google.
   * d/patches/upstream/libyuv-loongarch-fix-row_lsx.cc-and-row_lasx.cc.patch:
     drop, merged upstream.
chromium (150.0.7871.124-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-15764: Use after free in Ozone. Reported by Google.
     - CVE-2026-15765: Use after free in Ozone. Reported by Google.
     - CVE-2026-15766: Uninitialized Use in Skia. Reported by Google.
     - CVE-2026-15767: Heap buffer overflow in libyuv. Reported by Google.
     - CVE-2026-15768: Insufficient policy enforcement in HTML-in-Canvas.
       Reported by Google.
     - CVE-2026-15769: Insufficient validation of untrusted input in
       Linux Toolkit Theming. Reported by Google.
     - CVE-2026-15770: Uninitialized Use in V8. Reported by Google.
     - CVE-2026-15771: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-15772: Use after free in GPU. Reported by Google.
     - CVE-2026-15773: Use after free in Core.
       Reported by xinchaotian of Microsoft.
     - CVE-2026-15774: Use after free in Skia. Reported by Google.
     - CVE-2026-15775: Insufficient policy enforcement in V8.
       Reported by wang1r923096443@gmail.com.
     - CVE-2026-15776: Type Confusion in V8.
       Reported by Salvatore Gulizia (nickname: Serotav).
     - CVE-2026-15777: Use after free in UI. Reported by Google.
     - CVE-2026-15778: Insufficient validation of untrusted input in
       Navigation. Reported by Google.
   * d/patches/upstream/libyuv-loongarch-fix-row_lsx.cc-and-row_lasx.cc.patch:
     drop, merged upstream.
chromium (150.0.7871.114-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-15112: Use after free in Ozone. Reported by Google.
     - CVE-2026-15129: Use after free in Views. Reported by Google.
     - CVE-2026-15132: Uninitialized Use in V8.
       Reported by Pierre Langlois from Arm.
     - CVE-2026-15133: Use after free in InterestGroups. Reported by Jihyeon
       Jeong (Compsec Lab, Seoul National University / Research Intern).
     - CVE-2026-15108: Integer overflow in Extensions API. Reported by Google.
     - CVE-2026-15109: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-15110: Use after free in Extensions. Reported by Google.
     - CVE-2026-15111: Use after free in Views. Reported by Google.
     - CVE-2026-15113: Use after free in Autofill. Reported by Google.
     - CVE-2026-15114: Out of bounds read and write in Codecs.
       Reported by Google.
     - CVE-2026-15115: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Google.
     - CVE-2026-15116: Use after free in Actor. Reported by Google.
     - CVE-2026-15117: Use after free in Payments. Reported by Google.
     - CVE-2026-15118: Use after free in Input. Reported by Google.
     - CVE-2026-15119: Inappropriate implementation in GetUserMedia.
       Reported by Google.
     - CVE-2026-15120: Use after free in Core. Reported by Google.
     - CVE-2026-15121: Use after free in WebRTC. Reported by Google.
     - CVE-2026-15122: Insufficient validation of untrusted input in Codecs.
       Reported by Google.
     - CVE-2026-15123: Insufficient data validation in DOM. Reported by Google
     - CVE-2026-15124: Insufficient policy enforcement in Passwords.
       Reported by Google.
     - CVE-2026-15125: Inappropriate implementation in Forms.
       Reported by Google.
     - CVE-2026-15126: Use after free in Forms. Reported by Google.
     - CVE-2026-15127: Inappropriate implementation in WebGL.
       Reported by Google.
     - CVE-2026-15128: Inappropriate implementation in Forms.
       Reported by Google.
     - CVE-2026-15130: Insufficient policy enforcement in Navigation.
       Reported by Google.
     - CVE-2026-15107: Use after free in IndexedDB.
       Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab.
     - CVE-2026-15131: Insufficient data validation in Navigation.
       Reported by Google.
chromium (150.0.7871.114-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-15112: Use after free in Ozone. Reported by Google.
     - CVE-2026-15129: Use after free in Views. Reported by Google.
     - CVE-2026-15132: Uninitialized Use in V8.
       Reported by Pierre Langlois from Arm.
     - CVE-2026-15133: Use after free in InterestGroups. Reported by Jihyeon
       Jeong (Compsec Lab, Seoul National University / Research Intern).
     - CVE-2026-15108: Integer overflow in Extensions API. Reported by Google.
     - CVE-2026-15109: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-15110: Use after free in Extensions. Reported by Google.
     - CVE-2026-15111: Use after free in Views. Reported by Google.
     - CVE-2026-15113: Use after free in Autofill. Reported by Google.
     - CVE-2026-15114: Out of bounds read and write in Codecs.
       Reported by Google.
     - CVE-2026-15115: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Google.
     - CVE-2026-15116: Use after free in Actor. Reported by Google.
     - CVE-2026-15117: Use after free in Payments. Reported by Google.
     - CVE-2026-15118: Use after free in Input. Reported by Google.
     - CVE-2026-15119: Inappropriate implementation in GetUserMedia.
       Reported by Google.
     - CVE-2026-15120: Use after free in Core. Reported by Google.
     - CVE-2026-15121: Use after free in WebRTC. Reported by Google.
     - CVE-2026-15122: Insufficient validation of untrusted input in Codecs.
       Reported by Google.
     - CVE-2026-15123: Insufficient data validation in DOM. Reported by Google
     - CVE-2026-15124: Insufficient policy enforcement in Passwords.
       Reported by Google.
     - CVE-2026-15125: Inappropriate implementation in Forms.
       Reported by Google.
     - CVE-2026-15126: Use after free in Forms. Reported by Google.
     - CVE-2026-15127: Inappropriate implementation in WebGL.
       Reported by Google.
     - CVE-2026-15128: Inappropriate implementation in Forms.
       Reported by Google.
     - CVE-2026-15130: Insufficient policy enforcement in Navigation.
       Reported by Google.
     - CVE-2026-15107: Use after free in IndexedDB.
       Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab.
     - CVE-2026-15131: Insufficient data validation in Navigation.
       Reported by Google.
chromium (150.0.7871.114-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-15112: Use after free in Ozone. Reported by Google.
     - CVE-2026-15129: Use after free in Views. Reported by Google.
     - CVE-2026-15132: Uninitialized Use in V8.
       Reported by Pierre Langlois from Arm.
     - CVE-2026-15133: Use after free in InterestGroups. Reported by Jihyeon
       Jeong (Compsec Lab, Seoul National University / Research Intern).
     - CVE-2026-15108: Integer overflow in Extensions API. Reported by Google.
     - CVE-2026-15109: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-15110: Use after free in Extensions. Reported by Google.
     - CVE-2026-15111: Use after free in Views. Reported by Google.
     - CVE-2026-15113: Use after free in Autofill. Reported by Google.
     - CVE-2026-15114: Out of bounds read and write in Codecs.
       Reported by Google.
     - CVE-2026-15115: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Google.
     - CVE-2026-15116: Use after free in Actor. Reported by Google.
     - CVE-2026-15117: Use after free in Payments. Reported by Google.
     - CVE-2026-15118: Use after free in Input. Reported by Google.
     - CVE-2026-15119: Inappropriate implementation in GetUserMedia.
       Reported by Google.
     - CVE-2026-15120: Use after free in Core. Reported by Google.
     - CVE-2026-15121: Use after free in WebRTC. Reported by Google.
     - CVE-2026-15122: Insufficient validation of untrusted input in Codecs.
       Reported by Google.
     - CVE-2026-15123: Insufficient data validation in DOM. Reported by Google
     - CVE-2026-15124: Insufficient policy enforcement in Passwords.
       Reported by Google.
     - CVE-2026-15125: Inappropriate implementation in Forms.
       Reported by Google.
     - CVE-2026-15126: Use after free in Forms. Reported by Google.
     - CVE-2026-15127: Inappropriate implementation in WebGL.
       Reported by Google.
     - CVE-2026-15128: Inappropriate implementation in Forms.
       Reported by Google.
     - CVE-2026-15130: Insufficient policy enforcement in Navigation.
       Reported by Google.
     - CVE-2026-15107: Use after free in IndexedDB.
       Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab.
     - CVE-2026-15131: Insufficient data validation in Navigation.
       Reported by Google.
chromium (150.0.7871.100-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE list still to be announced.
   * debian/patches/ungoogled/remove-navigation-source-param.patch: fix crash
     related to the previous version's resynch. Thanks to
     plmaneo <plmaneo@agent.qq.com> for the suggested patch (closes: #1141488).

cinnamon (6.4.10-2+deb13u1) trixie; urgency=medium
 .
   * d/patches: add upstream patch to gracefully handle a missing
     content-length header during downloads, fixing download and update
     of spices (applets, desklets, extensions and themes), broken by a
     server-side change (Closes: #1142724)

cockpit (337-1+deb13u2) trixie-security; urgency=medium
 .
   * ws: Free "language" string also when it comes from the cookie.
     Fixes remote unauthenticated DoS and huge memory usage (throttled at 75%
     and capped at 90% via systemd slice resource control).
     [CVE-2026-76235] (Closes: #1144975)
   * pkg/systemd: robustify argument quoting.  Fixes arbitrary command
     execution via crafted links to the system logs user interface.
     Patch backported from upstream commit e3a47d70f99a0d, and hand-applied in
     debian/rules to the built bundle, as this branch does not yet rebuild
     the bundles during package build. [CVE-2026-4802]
     has no effect; instead apply the equivalent change to the shipped
     dist/systemd/logs.js.gz via sed in debian/rules.

curl (8.14.1-2+deb13u5) trixie; urgency=medium
 .
   [ Carlos Henrique Lima Melara ]
   * d/p/CVE-2026-3784.patch: remove trailing whitespace from patch
 .
   [ Samuel Henrique ]
   * d/p/openssl_fix_openssl_engines.patch: New patch to fix engine support
     (closes: #1137539)

cyrus-imapd (3.10.2-1+deb13u2) trixie; urgency=medium
 .
   * Backport security fixes from upstream 3.10.3 (Closes: #1142925)
     (https://www.cyrusimap.org/imap/download/release-notes/3.10/x/3.10.3.html):
     - CVE-2026-47084: LOCALDELETE bypassed ACL checks, allowing non-admin
       users to delete mailboxes without permission.
     - CVE-2026-47086: GENURLAUTH issued URLAUTH tokens without checking
       ACL_READ on the target mailbox.
     - CVE-2026-47087: URLAUTH tokens kept working after the authorizer's
       access was revoked.
     - CVE-2026-47081: XAPPLEPUSHSERVICE allowed probing for mailbox
       existence and hijacking push notifications on other users' folders.
     - CVE-2026-47089: LISTRIGHTS was not restricted to users with admin
       access on the target mailbox.
     - CVE-2026-47085: URLAUTH tokens could be forged via a predictable
       empty mboxkey.
     - CVE-2026-47083: MULTISEARCH/ESEARCH allowed a cross-user folder and
       content enumeration oracle.
     - CVE-2026-47088: heap out-of-bounds read when parsing nested MIME
       comments in RFC 822 headers.
     - CVE-2026-47082: vacation "fcc" delivery skipped the ACL check on the
       destination mailbox.
   * This revision adds DEP-3 metadata to the new patches and restores
     upstream Cassandane regression tests that were missing from the initial
     debdiff (thanks, Codin!) for several of the fixes.
cyrus-imapd (3.10.2-1+deb13u1) trixie; urgency=medium
 .
   * http_jmap: allow JMAP EventSource without WebSocket/wslay; backport
     upstream commit d510b3d2b (released 3.12.0). (Closes: #1141956)

dcmtk (3.6.9-5+deb13u3) trixie; urgency=medium
 .
   * Team upload.
   * d/patches/*-CVE-2026-*.patch: new security patches.
     This change includes a patch queue addressing CVE-2026-50003,
     CVE-2026-50254, CVE-2026-35505, CVE-2026-52868 and CVE-2026-44628.
     The latter CVE-2026-44628 is divided into two patches to match
     upstream's commits.  These changes fix a range of issues, including
     risks of path traversals, denial of services and information leaks.
     (Closes: #1141411)

debian-edu-config (2.13.2~deb13u1) trixie; urgency=medium
 .
   * Release to trixie.
debian-edu-config (2.13.1) unstable; urgency=medium
 .
   [ Daniel Teichmann ]
   * testsuite/ldap-server: Check /var/lib/ldap exists and is owned by
     openldap:openldap. Regression check for Debian bug #1144741.
   * debian/debian-edu-config.lintian-overrides: Fix stale reference. (Fixes
     commit: 63575146)
   * Drop unused wicd preconnect hook.
     wicd is no longer in Debian. The hook was the only remaining wicd
     integration and is not referenced anywhere else in the package.
   * testsuite/hostname: escape regex dot and exit non-zero on failure.
     The unescaped dot in the 'tjener.intern' grep matched any character.
     Escape it so the FQDN check is exact. Both error paths now exit 1 so a
     broken hostname fails the test instead of silently passing.
   * share/debian-edu-config/d-i/pre-pkgsel: resolve leftover merge conflict.
   * debian/control: Depend on iproute2
   * testsuite/network: Stop using net-tools, use ip from iproute2 instead
   * ldap-tools/ldap-debian-edu-install: Get MAC addresses via ip link instead
     of ifconfig
   * share/debian-edu-config/testsuite-lib.sh: Use ss instead of netstat
   * testsuite/ldap-server: Use ss instead of netstat
   * debian/control: Drop Depends: net-tools
   * share/debian-edu-config/d-i/pre-pkgsel: Tighten hostname= parsing and
     sanitization from /proc/cmdline.
     Handle hostname= as first cmdline token, ignore empty values and
     strip characters invalid in hostnames.
   * share/debian-edu-config/d-i/pre-pkgsel: strip hyphens only when present.
     Use 's/^-+//' / 's/-+$//' instead of '-*' so the substitution only
     fires when there actually is a leading/trailing hyphen to remove.
   * tools/create-debian-edu-certs: Switch root CA and server key generation
     to ECDSA prime256v1.
     RSA with 2048 bits is the bare minimum with OpenSSL 3. Replace
     'openssl genrsa' with 'openssl genpkey -algorithm EC' using the
     prime256v1 (secp256r1 / NIST P-256) curve.
   * tools/create-server-cert: Switch key generation to ECDSA prime256v1 and
     drop keyEncipherment key usage
     keyEncipherment is only meaningful for RSA keys. For ECDSA server
     certificates only the digitalSignature key usage is applicable
     (RFC 5480).
   * v3.cnf: Drop keyEncipherment from server cert key usage
     keyEncipherment is not applicable to ECDSA keys (RFC 5480), only
     digitalSignature is required for TLS server certificates.
 .
   [ Mike Gabriel ]
   * debian/control: Add to D: (debian-edu-config): procps. (Closes: #1136493).
   * ldap-tools/ldap-debian-edu-install: Make sure interactions with debconf
     are UTF-8 based.
     This resolves GECOS field transliteration after having retrieved
     debian-edu-config/first-user-fullname from the debconf db.
     (Closes: #939717).
   * share/debian-edu-config/d-i/pre-pkgsel: white-space cleanup
   * share/debian-edu-config/d-i/pre-pkgsel: Use 'tjener' in /etc/hostname
     and derive FQDN from /etc/hosts. (Closes: #893394).
   * testsuite/hostname: Test that /etc/hostname on installation profile
     Main-Server is set correctly
   * cf3/cf.cfengine3: Stop cfengine3 service on all Debian Edu machines.
     Esp. cf-execd (calling cf-agent command) clobbers the log on all Debian
     Edu clients (Debian Edu 12 and onwards) and thus on syslog.intern (aka
     tjener).
     In Debian Edu, we use cfengine3 for managing configuration adjustments
     via manual invocation of the cf-agent command, but we don't support
     (yet?) to use cfengine3 for constant system management.
     Partially addresses #1051834.
   * sbin/debian-edu-ltsp-install: Use KERNEL_PARAMETERS variable, if we
     define it
   * sbin/debian-edu-ltsp-install: Fix variable interpretation in sed commands
     ... by using double quotes, not single quotes.
   * sbin/update-hostname-from-ip: white-space cleanup
   * sbin/update-hostname-from-ip: Stop using net-tools, use ip command from
     iproute2 instead
   * share/debian-edu-config/d-i/pre-pkgsel: Support hostname override via
     /proc/cmdline. (Closes: #1008597).
 .
   [ Wolfgang Schweer ]
   * share/debian-edu-config/d-i/pre-pkgsel: Cleanup pre-pkgsel from cruft.
     (Closes: #1055648).
 .
   [ Serhii Horichenko ]
   * ltsp: Add 'quiet splash' to hide boot details on clients.
     (Closes: #1065564).
   * etc/nagios3/debian-edu/commands.cfg: Add key -l for check_apt to list
     packages available for upgrade.
debian-edu-config (2.13.0) unstable; urgency=medium
 .
   [ Mike Gabriel ]
   * sbin/debian-edu-fsautoresize:
     - Avoid division by zero error on unused mountpoints.
   * sbin/debian-edu-pxeinstall:
     - Support overriding tasksel/desktop selection via mydesktop parameter in
       /etc/debian-edu/pxeinstall.conf.
     - Fix comment about mapping debconf template keywords to kernel cmdline
       keywords and drop unused variable assignment.
     - sbin/debian-edu-pxeinstall: Regression fix, only adjust desktop to
       mydesktop from pxeinstall.conf if we are processing the tasksel/desktop
       setting.
   * share/debian-edu-config/tools/copy-host-keytab:
     - Support SSH publickey login to tjener, if this is possible (e.g. if admin
       is using SSH agent forwarding).
 .
   [ Daniel Teichmann ]
   * Add new file 'debian-edu-router.ldif'. Empty proxy groups should be
     installed on all new Tjeners.
   * ldap-bootstrap/debian-edu-router.ldif: Add 'server-hosts' nisNetgroup
     to 'proxy-trusted' nisNetgroup, via 'memberNisNetgroup' attribute.
   * share/debian-edu-config/gosa.conf.template: Activate nisNetgroup tab
     for user accounts.
   * apache2 debian-edu-default.conf: Do not force HTTPS on *.crt (including
     Debian-Edu_rootCA.crt).
     (Closes: #1068388)
   * etc/dovecot/local.conf: Fix passdb block syntax for Dovecot 2.4.x
     compatibility.
   * debian/control: Add 'Conflicts: firefox-esr-mobile-config'.
     (Closes: #1126881)
   * v3CA.cnf: Fix Root CA X.509v3 extensions for OpenSSL 3 compatibility.
   * v3.cnf: Fix server cert X.509v3 extensions for OpenSSL 3 compatibility.
   * tools/create-debian-edu-certs: Fix script to apply correct configurations.
   * tools/create-server-cert: Add OpenSSL 3 extensions and fix base config.
debian-edu-config (2.12.904) unstable; urgency=medium
 .
   * share/glib-2.0/schemas/32-debian-edu.arctica-greeter.gschema.override:
     + Drop file. This setting is theme-specific and should be shipped in
       debian-edu-artwork-<THEME> if diverting from system defaults.
   * cf3/:
     + Support recognizing FAI based installations of Debian Edu systems (except
       from main server).
debian-edu-config (2.12.903) unstable; urgency=medium
 .
   * etc/apache2/sites-available/debian-edu-default.conf: Use SERVER_ADDRESS in
     RewriteRule instead of hard-coded 'www'. Supports https redirection if
     connected to e.g. a VPN IP owned by TJENER.
   * cf3/promises.cf: Regression fix: Drop desktop bundle from bundlesequence.
     The desktop bundle has been removed since d-e-c 2.12.901.

debian-edu-install (2.12.11+deb13u1) trixie; urgency=medium
 .
   [ Daniel Teichmann ]
   * preseed-values/defaults.main-server: Preseed
     icinga2-ido-mysql/dbconfig-install to false. Needed after
     debian-edu 2.13.1 (d5c688a7) and debian-edu-config 858a9689.

debian-installer (20250803+deb13u7) trixie; urgency=medium
 .
   * Bump Linux kernel ABI to 6.12.107+deb13.
   * Adjust linux-image build-deps accordingly.

debian-installer-netboot-images (20250803+deb13u7) trixie; urgency=medium
 .
   * Update to 20250803+deb13u7, from trixie-proposed-updates.

designate (1:20.0.0-2+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2026-71193, CVE-2026-71194 / OSSA-2026-034:
     - An authenticated tenant can bypass zone ownership checks by scheduling a
       zone to a different pool, creating overlapping zones that hijack or deny
       service to another tenant's DNS records. Any user with the default
       create_zone policy can exploit this when the AttributeFilter scheduler is
       enabled. Only deployments using the AttributeFilter scheduler with
       multiple pools are affected.
     - The mDNS handler performs pool-blind record lookups that fail when
       colliding zones exist across pools, causing deterministic DNS query
       failures. The NOTIFY handler path is reachable via unauthenticated UDP.
     Applied upstream patches:
     - Require TSIG keys for zones in non-default pools
     - Fix mDNS record query pool scoping for split-horizon DNS
     - Fix cross-tenant/cross-pool zone ownership bypass
     (Closes: #1144145).

dhcpcd (1:10.1.0-11+deb13u4) trixie; urgency=medium
 .
   * [patches]
     + Cherry-pick upstream fix for CVE-2026-14258 (commit 75289ca).
     = Refresh all patches.

dnsdist (1.9.16-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 1.9.16, fixing security issue
     CVE-2026-52682

dnsmasq (2.91-1+deb13u2) trixie; urgency=medium
 .
   * d/p/*:
     - CVE-2026-12725.patch: Fix heap-based buffer overflow.
     - CVE-2026-12969.patch: Fix out-of-bounds read vulnerability.

docker.io (26.1.5+dfsg1-9+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Engine fixes are cherry-picked from the upstream 25.0 LTS branch, which
     carries official backports of all of them; BuildKit fixes are taken from
     BuildKit v0.28.1 as vendored by moby/moby: CVE-2026-41568, CVE-2026-42306,
     CVE-2026-34040, CVE-2026-33997, CVE-2026-33747, CVE-2026-33748.
   * Add engine-go1.24-os-root-mkdirall.patch. The upstream CVE-2026-41568 fix
     calls os.Root.MkdirAll, added in Go 1.25; trixie has Go 1.24, so the two
     calls are replaced by an equivalent helper built on os.Root.Mkdir.

emacs (1:30.1+1-6+deb13u1) trixie-security; urgency=high
 .
   * Mark esh-proc-test/kill-pipeline as unstable for now.  Skip it since
     it fails sporadically on at least s390x.  Add
     0024-Mark-esh-proc-test-kill-pipeline-as-unstable-for-now.patch to
     address the issue.
 .
   * Fix an SVG-related vulnerability (CVE-2026-6861).  Add
     0025-src-image.c-svg_load_image-Fix-off-by-one-mistake-bu.patch which
     includes the upstream patch to fix the problem.  Thanks to Salvatore
     Bonaccorso for reporting the issue. (Closes: 1134692)
 .
   * Don't run bytecomp-tests--dest-mountpoint where bwrap doesn't work.
     Add 0026-bytecomp-tests-dest-mountpoint-only-run-test-if-bwra.patch to
     address the issue.  Thanks to Santiago Vila for reporting the
     issue. (Closes: 1129189)
 .
   * Skip two more proced-tests in debian that are skipped on darwin to
     avoid hanging during the tests.  Add
     0025-Skip-some-proced-tests-that-appear-to-be-hanging.patch to address
     the issue.
 .
   * Mitigate a risk of executing arbitrary code when opening a file.  The
     vulnerability that has been mitigated could allow a specially crafted
     file to trigger execution of arbitrary Emacs Lisp code immediately
     upon visiting it in Emacs.  The broader issue is described here:
     https://debbugs.gnu.org/80574
 .
     Add 0030-Mitigate-arbitrary-code-execution-vulnerability.patch to
     include the upstream patch addressing the problem.  Thanks to Nicholas
     D Steeves for reporting the issue.

erlang (1:27.3.4.1+dfsg-1+deb13u3) trixie-security; urgency=medium
 .
   [ Aron Xu ]
    * Add a series of patches by upstream, which fix a set of vulnerabilities:
     - Fix CVE-2026-48855: Exposure of Sensitive Information to an Unauthorized
       Actor vulnerability in Erlang OTP ssh application (ssh_sftpd module).
     - Fix CVE-2026-48856: Sensitive Data Exposure vulnerability in Erlang OTP
       inets application (httpc_response module).
     - Fix CVE-2026-48858: Server-Side Request Forgery (SSRF) vulnerability in
       Erlang/OTP ftp application (ftp_internal module).
     - Fix CVE-2026-48859: Observable Timing Discrepancy vulnerability in
       Erlang/OTP ssh application (ssh_auth, ssh_options modules).
     - Fix CVE-2026-48860: Reliance on IP Address for Authentication
       vulnerability in Erlang/OTP ssl application (inet_tls_dist module).
     - Fix CVE-2026-49759: Stack-based Buffer Overflow vulnerability in Erlang
       OTP erts (inet_drv).
     - Fix CVE-2026-49760: Stack-based Buffer Overflow vulnerability in Erlang
       OTP (erl_interface).
       Closes: #1139727, #1139823.
     - Fix CVE-2026-53422: Observable Response Discrepancy vulnerability in
       Erlang OTP ssh application (ssh_sftpd module).
     - Fix CVE-2026-54886: Loop with Unreachable Exit Condition ('Infinite
       Loop') vulnerability in Erlang OTP ssh application (ssh_sftpd module).
     - Fix CVE-2026-54887: Use of Default Cryptographic Key vulnerability in
       Erlang/OTP ssl application (DTLS server)
     - Fix CVE-2026-54891: Improper Enforcement of Message Integrity During
       Transmission in a Communication Channel vulnerability in Erlang/OTP ssl
       application (tls_gen_connection module).
     - Fix CVE-2026-55950: Time-of-check Time-of-use (TOCTOU) race condition
     vulnerability in Erlang/OTP ssl application (dtls_packet_demux module).
     - Fix CVE-2026-55952: The Erlang/OTP ssl application does not validate
       that the PSK identity list and binder list carried in a TLS 1.3
       ClientHello pre-shared key extension have equal length before passing
       them to the session ticket handler.
       Closes: #1141414.
     - Fix CVE-2026-42792: Improper Handling of Exceptional Conditions
       vulnerability in Erlang/OTP epmd daemon.
     - Fix CVE-2026-47078: Relative Path Traversal vulnerability in Erlang/OTP
       stdlib (zip module).
     - Fix CVE-2026-54890: Integer Underflow (Wrap or Wraparound) vulnerability
       in Erlang/OTP erts.
     - Fix CVE-2026-55737: Signed to Unsigned Conversion Error and
       Out-of-bounds Write vulnerability in Erlang/OTP erts.
     - Fix CVE-2026-55953: The Erlang/OTP ssl TLS and DTLS client does not
       verify that the cipher suite selected by the server in ServerHello
       was among the suites offered by the client in ClientHello.
     - Fix CVE-2026-58227: The Erlang/OTP ssl application does not detect
       cycles when reconstructing an incomplete peer certificate chain during
       a TLS or DTLS handshake.
     - Fix CVE-2026-59250: Buffer overflow in the Erlang/OTP megaco flex
       scanner C driver allows a remote unauthenticated attacker to corrupt
       the driver's memory.
     - Fix CVE-2026-59251: Allocation of resources without limits in Erlang/OTP
       public_key certificate path validation allows a remote unauthenticated
       attacker to cause denial of service.
       Closes: #1142985.
     - Fix CVE-2026-28808: Incorrect Authorization vulnerability in Erlang/OTP
       (inets modules) allows unauthenticated access to CGI scripts.
     - Fix CVE-2026-28810: Generation of Predictable Numbers or Identifiers
       vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows
       DNS Cache Poisoning.
     - Fix CVE-2026-32144: Improper Certificate Validation vulnerability in
       Erlang/OTP public_key (pubkey_ocsp module) allows OCSP
       designated-responder authorization bypass via missing signature
       verification.
     - Fix CVE-2026-32147: Vulnerability in the SFTP server where file
       attributes could be modified outside the configured root directory.
     - Fix CVE-2026-42789: Improper Following of a Certificate's Chain of Trust
       vulnerability in Erlang/OTP public_key application allows a non-CA
       certificate to be accepted as an intermediate issuer.
     - Fix CVE-2026-42790: Improper Certificate Validation vulnerability in
       Erlang/OTP public_key application allows a DNS nameConstraints bypass
       via subject CommonName fallback in TLS hostname verification.
     - Fix CVE-2026-42791: Improper Certificate Validation vulnerability in
       Erlang/OTP public_key application allows forged OCSP responses signed
       with an expired responder certificate to be accepted as valid.

exim4 (4.98.2-1+deb13u4) trixie-security; urgency=high
 .
   * Fix two local privilege escalation issues.
     EXIM-Security-2026-06-22.1 (GCVE-25-2026-07-45-1)
     Using command-line arguments intended for transferring queue-name
     through an Exim execution chain, files outside the spool area can be
     accessed.  This can be used for a privilege escalation. CVE-2026-66140
     EXIM-Security-2026-06-22.3 (GCVE-25-2026-07-45-3)
     A local user having a .forward file can use a string-expansion there.
     With certain Exim configurations this can be used as a privilege
     escalation. CVE-2026-66141

expat (2.8.3-1~deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Upload 2.8.3 to trixie-security.
expat (2.8.2-1) unstable; urgency=high
 .
   * New upstream release (closes: #1138862, #1140387, #1140388, #1140557):
     - fixes CVE-2026-56131: protect XML_ResumeParser() from being called from
       a handler,
     - fixes CVE-2026-56132: fix out-of-bound scaffolding index store in
       doProlog(),
     - fixes CVE-2026-50219: disallow calls to some functions to guard Expat
       bindings from memory corruption,
     - fixes CVE-2026-56403: integer overflow in storeAtts(),
     - fixes CVE-2026-56404: integer overflow in addBinding(),
     - fixes CVE-2026-56405: integer overflow in getAttributeId(),
     - fixes CVE-2026-56406: integer overflow in XML_ParseBuffer(),
     - fixes CVE-2026-56407: integer overflow in textLen handling,
     - fixes CVE-2026-56408: integer overflow in copyString(),
     - fixes CVE-2026-56409: integer overflow in output path join in xmlwf,
     - fixes CVE-2026-56410: integer overflow in resolveSystemId() in xmlwf,
     - fixes CVE-2026-56411: Integer overflow in notation list allocation
       in xmlwf,
     - fixes CVE-2026-56412: guard XML_TOK_DATA_CHARS handler calls
       in doCdataSection().
expat (2.8.2-1~deb13u1) trixie-security; urgency=high
 .
   * Upload 2.8.2 to trixie-security.
expat (2.8.1-1) unstable; urgency=medium
 .
   * New upstream release.
expat (2.8.0-2) unstable; urgency=high
 .
   * Backport upstream fixes for self-testing:
     - drop casts around malloc that C99 does not need,
     - drop casts around XML_GetUserData that C99 does not need.
   * Backport upstream fixes for CVE-2026-45186: attribute name collision
     checks allowed denial of service attacks through moderately sized
     crafted XML input (closes: #1136164).
expat (2.8.0-1) unstable; urgency=high
 .
   * New upstream release:
     - fixes CVE-2026-41080: improve protection against hash flooding
       (closes: #1134732).
   * Update libexpat1 symbols.
expat (2.7.5-1) unstable; urgency=high
 .
   * New upstream release:
     - fixes CVE-2026-32776: NULL function pointer dereference for empty
       external parameter entities (closes: #1131117),
     - fixes CVE-2026-32777: protect from XML_TOK_INSTANCE_START infinite
       loop in entityValueProcessor() (closes: #1131118),
     - fixes CVE-2026-32778: NULL dereference in setContext() on retry after
       an earlier ouf-of-memory condition (closes: #1131119).
expat (2.7.4-1) unstable; urgency=high
 .
   * New upstream release:
     - fixes CVE-2026-25210: integer overflow check for tag buffer
       reallocation (closes: #1126697),
     - no longer ships expat.m4 file.
   * Update watch file.
expat (2.7.3-2) unstable; urgency=high
 .
   * Backport upstream fix for CVE-2026-24515: make
     XML_ExternalEntityParserCreate() copy unknown encoding handler user data
     (closes: 1126277).
   * Remove now redundant Rules-Requires-Root value.
expat (2.7.3-1) unstable; urgency=high
 .
   * New upstream release:
     - fix alignment of internal allocations for some non-amd64
       architectures, fixes up on the fix to CVE-2025-59375,
     - fix a class of false positives where input should have been rejected
       with error XML_ERROR_ASYNC_ENTITY; regression from CVE-2024-8176.
expat (2.7.2-1) unstable; urgency=high
 .
   * New upstream release:
     - fixes CVE-2025-59375: disallow use of disproportional amounts of
       dynamic memory from within an Expat parser (closes: #1115298).
   * Update fix-expat-cmake patch.
   * Update libexpat1 symbols.
   * Update Standards-Version to 4.7.2 .

firefox-esr (140.15.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-84, also known as:
     CVE-2026-75874, CVE-2026-16365, CVE-2026-84119, CVE-2026-84120,
     CVE-2026-84121, CVE-2026-84122, CVE-2026-84124, CVE-2026-16371,
     CVE-2026-84131, CVE-2026-84143, CVE-2026-84145.
 .
   * third_party/rust/glslopt/.cargo-checksum.json,
     third_party/rust/glslopt/glsl-optimizer/include/c11/threads_posix.h:
     Fix conficting types for once_flag and call_once. Fixes: #1128875.
firefox-esr (140.14.0esr-2) unstable; urgency=medium
 .
   * third_party/rust/glslopt/.cargo-checksum.json,
     third_party/rust/glslopt/glsl-optimizer/include/c11/threads_posix.h:
     Fix conficting types for once_flag and call_once. Fixes: #1128875.
firefox-esr (140.14.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-70, also known as:
     CVE-2026-74934, CVE-2026-74935, CVE-2026-74936, CVE-2026-74939,
     CVE-2026-74940, CVE-2026-74941, CVE-2026-74942, CVE-2026-74943,
     CVE-2026-74944, CVE-2026-74945, CVE-2026-74946, CVE-2026-74948,
     CVE-2026-74949, CVE-2026-74953, CVE-2026-74957, CVE-2026-74959,
     CVE-2026-74960, CVE-2026-74962, CVE-2026-74963, CVE-2026-74964,
     CVE-2026-74965, CVE-2026-74967, CVE-2026-74969, CVE-2026-74971,
     CVE-2026-74972, CVE-2026-74973, CVE-2026-74974, CVE-2026-74976,
     CVE-2026-74983, CVE-2026-74987, CVE-2026-74990.
 .
   * python/mach/mach/command_util.py: Fix AST parsing in DecoratorVisitor for
     Python 3.14. bz#1993797.
   * python/mozbuild/mozbuild/frontend/reader.py,
     python/mozbuild/mozbuild/vendor/rewrite_mozbuild.py: Change uses of
     ast.Str with ast.Constant. bz#1969769.
   * python/mozbuild/mozbuild/vendor/vendor_python.py,
     third_party/python/jsonschema/jsonschema/validators.py: Patch jsonschema
     to work with Python 3.14+. bz#1983736.
firefox-esr (140.13.0esr-2) unstable; urgency=medium
 .
   * python/mach/mach/command_util.py: Fix AST parsing in DecoratorVisitor for
     Python 3.14. bz#1993797.
   * python/mozbuild/mozbuild/frontend/reader.py,
     python/mozbuild/mozbuild/vendor/rewrite_mozbuild.py: Change uses of
     ast.Str with ast.Constant. bz#1969769.
   * python/mozbuild/mozbuild/vendor/vendor_python.py,
     third_party/python/jsonschema/jsonschema/validators.py: Patch jsonschema
     to work with Python 3.14+. bz#1983736.
firefox-esr (140.13.0esr-1) unstable; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-70, also known as:
     CVE-2026-15718, CVE-2026-15719, CVE-2026-16349, CVE-2026-16350,
     CVE-2026-16362, CVE-2026-16351, CVE-2026-16352, CVE-2026-16363,
     CVE-2026-16353, CVE-2026-16354, CVE-2026-16368, CVE-2026-16369,
     CVE-2026-16355, CVE-2026-16356, CVE-2026-16357, CVE-2026-16371,
     CVE-2026-16374, CVE-2026-16375, CVE-2026-16377, CVE-2026-16379,
     CVE-2026-16358, CVE-2026-16381, CVE-2026-16383, CVE-2026-16387,
     CVE-2026-16390, CVE-2026-16391, CVE-2026-16359, CVE-2026-16396,
     CVE-2026-16405, CVE-2026-16412, CVE-2026-16360, CVE-2026-16361.
firefox-esr (140.13.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-70, also known as:
     CVE-2026-15718, CVE-2026-15719, CVE-2026-16349, CVE-2026-16350,
     CVE-2026-16362, CVE-2026-16351, CVE-2026-16352, CVE-2026-16363,
     CVE-2026-16353, CVE-2026-16354, CVE-2026-16368, CVE-2026-16369,
     CVE-2026-16355, CVE-2026-16356, CVE-2026-16357, CVE-2026-16371,
     CVE-2026-16374, CVE-2026-16375, CVE-2026-16377, CVE-2026-16379,
     CVE-2026-16358, CVE-2026-16381, CVE-2026-16383, CVE-2026-16387,
     CVE-2026-16390, CVE-2026-16391, CVE-2026-16359, CVE-2026-16396,
     CVE-2026-16405, CVE-2026-16412, CVE-2026-16360, CVE-2026-16361.
firefox-esr (140.12.0esr-1) unstable; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-58, also known as:
     CVE-2026-12289, CVE-2026-12290, CVE-2026-12291, CVE-2026-12292,
     CVE-2026-12294, CVE-2026-12295, CVE-2026-12298, CVE-2026-12296,
     CVE-2026-12297, CVE-2026-12299, CVE-2026-12329, CVE-2026-12302,
     CVE-2026-12304, CVE-2026-12305, CVE-2026-12306, CVE-2026-12307,
     CVE-2026-12308, CVE-2026-12309, CVE-2026-12310, CVE-2026-12311,
     CVE-2026-12312, CVE-2026-12313, CVE-2026-12314, CVE-2026-12315,
     CVE-2026-12330, CVE-2026-12324, CVE-2026-12325, CVE-2026-12327,
     CVE-2026-12328.

flask (3.1.1-1+deb13u1) trixie; urgency=medium
 .
   * Team upload
   * d/patches: backport upstream fix for CVE-2026-27205 (Closes: #1128620)

flatpak (1.16.6-1~deb13u2) trixie-security; urgency=high
 .
   * d/patches: Backport security fixes from 1.18.1 (Closes: #1144130)
     - d/p/libglnx/*.patch:
       Backport glnx_chase_and_mkdirat() utility function, required by some
       of the security fixes below
     - d/p/tests/*.patch:
       Backport unit tests fixes which are required by the tests for some
       of the security fixes below
     - d/p/GHSA-fqx6-vh4p-42cg-GHSA-8qxj-x646-phcm/*.patch:
       + GHSA-fqx6-vh4p-42cg:
         Fix writing outside installation directory via crafted commit metadata.
         A malicious or compromised Flatpak repository could write
         attacker-controlled files outside /var/lib/flatpak as root.
       + GHSA-8qxj-x646-phcm:
         Fix writing outside working directory in `flatpak build-init`.
         A malicious or compromised SDK could write outside the intended
         working directory when a developer starts using it for a build.
     - d/p/GHSA-qrwq-7qwx-q9rp/*.patch:
       Fix local privilege escalation involving revokefs.
       A malicious local user could write files outside /var/lib/flatpak
       as root by tampering with OSTree objects after signature verification.
     - d/p/GHSA-8688-9x26-hhxj/*.patch:
       Fix a sandbox escape involving directories inside ~/.var/app/APP_ID.
       A malicious or compromised Flatpak app could write to arbitrary files
       outside its sandbox.
     - d/p/GHSA-99wv-m8rp-g58x/*.patch:
       Fix a sandbox escape involving the ld.so cache.
       A malicious or compromised Flatpak app could write files with a fixed
       name and limited control over content outside the sandbox.
     - d/p/GHSA-v2gw-v9h5-9q4x/*.patch:
       Fix local privilege escalation involving crafted OCI architecture names.
       A malicious local user on a system with an OCI remote configured
       (unusual on non-Fedora systems) could trick the flatpak-system-helper
       process into writing outside /var/lib/flatpak.
     - d/p/GHSA-w69g-9x8j-7p8f/*.patch:
       Fix reading outside sandbox involving crafted extension metadata.
       A malicious or compromised Flatpak app could find out whether specific
       files exist outside the sandbox.
     - d/p/GHSA-q4gr-vc25-57m5/*.patch:
       Fix anti-downgrade checks for components installed system-wide.
       A malicious local user with an active local login session could
       downgrade an app, runtime or extension to an older, known-vulnerable
       version and use this to attack other local users.
     - d/p/GHSA-jr92-2v97-wgvc/*.patch:
       Fix a buffer overflow when installing or updating from a malicious OCI
       registry, not believed to be practically exploitable on 64-bit systems.
     - d/p/hardening/*.patch:
       Harden file accesses against path traversal, fixing issues that
       were initially thought to be security vulnerabilities similar to
       those above, but on further analysis do not seem to be exploitable.
     - d/p/GHSA-r7hp-698j-2h6c/*.patch:
       Correct xdg-dbus-proxy rules for receiving selected AT-SPI broadcasts
       so that GTK accessibility features work as intended.
       Previously, these accessibility features only worked accidentally as a
       result of an xdg-dbus-proxy security issue, fixed in 0.1.8.
   * d/patches: Add additional bug fixes from upstream 1.16.x branch
     - d/p/subprojects-Ignore-.wraplock-file-generated-by-recent-Mes.patch,
       d/p/bwrap-Clarify-a-comment.patch,
       d/p/subprojects-Update-dbus-proxy.wrap-to-v0.1.7.patch:
       Resync with upstream source, no functional changes
     - d/p/dir-Use-flatpak_bwrap_child_setup_inherit_fds_cb-to-apply.patch:
       Silence a spurious warning when apps use the extra_data mechanism
     - d/p/portal-Actually-use-the-AppInfo-hash-table.patch:
       Fix a memory leak and potential rare crashes in flatpak-portal

fluidsynth (2.4.4+dfsg-1+deb13u3) trixie; urgency=medium
 .
   * CVE-2026-58264
   * CVE-2026-61714

freecad (1.0.0+dfsg-8+deb13u3) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * CVE-2026-34398, CVE-2026-34399: arbitrary Python code execution via
     eval() on untrusted input in the BIM workbench
   * CVE-2026-34789: restrict imports to modules located under FreeCAD's
     own Mod and macro directories.
   * CVE-2026-73233: the escaping helper in the FEM displacement
     constraint task dialog neutralised quotation marks but not
     backslashes, allowing Python code injection through a crafted
     displacement formula.
   * CVE-2026-73235: the Xerces SAX2 reader for FCStd Document.xml
     resolved external entities and loaded external DTDs, allowing local
     file disclosure via file: URIs and SSRF via http: URIs.
   * CVE-2026-73234: PropertyFileIncluded::Restore() concatenated an
     attacker-controlled file attribute from Document.xml with the
     document transient path without rejecting directory components,
     absolute paths or parent references, so a crafted FCStd archive
     could write anywhere the user can write.

gimp (3.0.4-3+deb13u10) trixie-security; urgency=medium
 .
   * CVE-2026-18301
   * CVE-2026-18302
   * CVE-2026-18303
   * CVE-2026-18304
   * CVE-2026-18305
   * CVE-2026-18306
   * CVE-2026-18307
   * CVE-2026-18308
   * CVE-2026-42170
   * CVE-2026-58379 (Closes: #1141415)
   * CVE-2026-58380
   * CVE-2026-58381
   * CVE-2026-58384
   * CVE-2026-59088 (Closes: #1144528)
   * CVE-2026-59090 (Closes: #1144526)
   * CVE-2026-66758 (Closes: #1142991)
   * CVE-2026-66759 (Closes: #1142992)

glib2.0 (2.84.4-3~deb13u5) trixie; urgency=medium
 .
   * Add patches from upstream 2.89.x to fix parsing of XDG MIME magic
     datafiles
     - d/p/CVE-2026-16118/xdgmime-Check-if-caches-are-set-before-dumping-them.patch:
       Fix a crash when running tests on a minimal system
     - d/p/CVE-2026-16118/Fix-CVE-2026-16118-heap-buffer-overflow-in-xdgmimemagic.c.patch:
       Fix an out-of-bounds write if parsing attacker-controlled MIME-magic
       data. This is unlikely to be exploitable in practice, because an
       attacker with write access to $XDG_DATA_HOME/mime/magic is likely
       to have other ways to cause arbitrary code execution.
       (CVE-2026-16118, glib#3992 upstream, Closes: #1142717)
 .
 glib2.0 (2.84.4-3~deb13u4) trixie; urgency=medium
 .
   * Edit previous changelog entry to correlate CVE fixes with upstream
     bug numbers and releases
   * Add patches from upstream 2.86.5 to fix out-of-bounds accesses:
     - d/p/gvariant-Fix-an-off-by-one-error-in-an-offset-comparison.patch:
       Fix a potential out of bounds read by 1 byte
       (CVE-2026-58010, glib#3915 upstream)
     - d/p/gmarkup-Fix-potential-one-byte-overread-in-g_markup_escap.patch:
       Fix a potential out of bounds read by 1 byte when escaping text that
       is not valid UTF-8
       (not considered to be a vulnerability, glib#3916 upstream)
     - d/p/gdatetime-Factor-out-a-couple-of-magic-constants.patch,
       d/p/gdatetime-Add-missing-range-validation-to-g_date_time_add.patch:
       Fix an out of bounds read by up to 2 bytes after parsing an
       out-of-range date
       (CVE-2026-58011, glib#3917 upstream)
     - d/p/gregex-Fix-case-changing-substitutions-with-G_REGEX_RAW.patch:
       Fix a potential buffer overflow when changing the case of an incomplete
       UTF-8 sequence while using G_REGEX_RAW
       (CVE-2026-58012, glib#3918 upstream)
     - d/p/gregex-Fix-use-of-wrong-option-flags-set-for-checking-for.patch,
       d/p/gregex-Rename-the-compile_opts-members-to-clarify-their-t.patch:
       Fix an out-of-bounds read when g_regex_split_full() acts on
       invalid UTF-8
       (not considered to be a vulnerability, glib#3919 upstream)
   * Add patches from upstream 2.88.1 to fix several issues that were reported
     as potential security vulnerabilities:
     - d/p/giochannel-Fix-memcmp-off-the-end-of-the-buffer-with-long.patch:
       Fix out-of-bounds read if a GIOChannel is configured with a long
       line-terminator
       (CVE-2026-58013, glib#3825 upstream)
     - d/p/gkeyfile-Fix-a-one-byte-heap-under-read-with-g_key_file_g.patch:
       Fix out-of-bounds read if a list of locale-dependent strings in a
       GKeyFile is empty
       (CVE-2026-58014, glib#3930 upstream)
     - d/p/gdbusmessage-Fix-types-of-integer-arithmetic-in-message-l.patch:
       Fix an integer overflow that could lead to accepting overly large
       messages on peer-to-peer D-Bus connections
       (no CVE ID, glib#3933 upstream)
     - d/p/gdbusauthmechanismsha1-Validate-cookie-context.patch,
       d/p/gdbusauthmechanismsha1-Improve-validation-of-cookie-ID.patch,
       d/p/gdbusauthmechanism-Expose-client-reject-reason-as-a-new-v.patch,
       d/p/tests-Add-a-unit-test-for-GDBusAuthMechanismSha1-cookie-c.patch:
       Prevent path traversal and file-content disclosure if a D-Bus client
       connects to a malicious peer-to-peer D-Bus server
       (CVE-2026-58015, glib#3931 upstream)
   * Add patch from upstream 2.88.3 fixing a possible denial of service:
     - d/p/gdbusauth-Limit-length-of-lines-read-from-client.patch:
       Fix resource exhaustion if a malicious client can contact a
       GDBusServer
       (CVE-2026-15588, glib#3985 upstream, Closes: #1142835)
   * Add patches from upstream 2.89.0 to harden D-Bus introspection parsing
     - d/p/gdbusintrospection-Add-some-assertions-before-array-deref.patch,
       d/p/tests-Improve-D-Bus-introspection-test-paths.patch,
       d/p/gdbusintrospection-Fix-XML-parser-state-handling-for-node.patch,
       d/p/fuzzing-Add-a-fuzz-test-for-g_dbus_node_info_new_for_xml.patch:
       Avoid a possible integer underflow if parsing malformed D-Bus
       introspection XML sent by a malicious service
       (glib#3932 upstream, CVE-2026-58016, Closes: #1141316)
   * d/salsa-ci.yml: Disable uscan job as not relevant to this stable branch
glib2.0 (2.84.4-3~deb13u4) trixie; urgency=medium
 .
   * Edit previous changelog entry to correlate CVE fixes with upstream
     bug numbers and releases
   * Add patches from upstream 2.86.5 to fix out-of-bounds accesses:
     - d/p/gvariant-Fix-an-off-by-one-error-in-an-offset-comparison.patch:
       Fix a potential out of bounds read by 1 byte
       (CVE-2026-58010, glib#3915 upstream)
     - d/p/gmarkup-Fix-potential-one-byte-overread-in-g_markup_escap.patch:
       Fix a potential out of bounds read by 1 byte when escaping text that
       is not valid UTF-8
       (not considered to be a vulnerability, glib#3916 upstream)
     - d/p/gdatetime-Factor-out-a-couple-of-magic-constants.patch,
       d/p/gdatetime-Add-missing-range-validation-to-g_date_time_add.patch:
       Fix an out of bounds read by up to 2 bytes after parsing an
       out-of-range date
       (CVE-2026-58011, glib#3917 upstream)
     - d/p/gregex-Fix-case-changing-substitutions-with-G_REGEX_RAW.patch:
       Fix a potential buffer overflow when changing the case of an incomplete
       UTF-8 sequence while using G_REGEX_RAW
       (CVE-2026-58012, glib#3918 upstream)
     - d/p/gregex-Fix-use-of-wrong-option-flags-set-for-checking-for.patch,
       d/p/gregex-Rename-the-compile_opts-members-to-clarify-their-t.patch:
       Fix an out-of-bounds read when g_regex_split_full() acts on
       invalid UTF-8
       (not considered to be a vulnerability, glib#3919 upstream)
   * Add patches from upstream 2.88.1 to fix several issues that were reported
     as potential security vulnerabilities:
     - d/p/giochannel-Fix-memcmp-off-the-end-of-the-buffer-with-long.patch:
       Fix out-of-bounds read if a GIOChannel is configured with a long
       line-terminator
       (CVE-2026-58013, glib#3825 upstream)
     - d/p/gkeyfile-Fix-a-one-byte-heap-under-read-with-g_key_file_g.patch:
       Fix out-of-bounds read if a list of locale-dependent strings in a
       GKeyFile is empty
       (CVE-2026-58014, glib#3930 upstream)
     - d/p/gdbusmessage-Fix-types-of-integer-arithmetic-in-message-l.patch:
       Fix an integer overflow that could lead to accepting overly large
       messages on peer-to-peer D-Bus connections
       (no CVE ID, glib#3933 upstream)
     - d/p/gdbusauthmechanismsha1-Validate-cookie-context.patch,
       d/p/gdbusauthmechanismsha1-Improve-validation-of-cookie-ID.patch,
       d/p/gdbusauthmechanism-Expose-client-reject-reason-as-a-new-v.patch,
       d/p/tests-Add-a-unit-test-for-GDBusAuthMechanismSha1-cookie-c.patch:
       Prevent path traversal and file-content disclosure if a D-Bus client
       connects to a malicious peer-to-peer D-Bus server
       (CVE-2026-58015, glib#3931 upstream)
   * Add patch from upstream 2.88.3 fixing a possible denial of service:
     - d/p/gdbusauth-Limit-length-of-lines-read-from-client.patch:
       Fix resource exhaustion if a malicious client can contact a
       GDBusServer
       (CVE-2026-15588, glib#3985 upstream, Closes: #1142835)
   * Add patches from upstream 2.89.0 to harden D-Bus introspection parsing
     - d/p/gdbusintrospection-Add-some-assertions-before-array-deref.patch,
       d/p/tests-Improve-D-Bus-introspection-test-paths.patch,
       d/p/gdbusintrospection-Fix-XML-parser-state-handling-for-node.patch,
       d/p/fuzzing-Add-a-fuzz-test-for-g_dbus_node_info_new_for_xml.patch:
       Avoid a possible integer underflow if parsing malformed D-Bus
       introspection XML sent by a malicious service
       (glib#3932 upstream, CVE-2026-58016, Closes: #1141316)
   * d/salsa-ci.yml: Disable uscan job as not relevant to this stable branch

glibc (2.41-12+deb13u4) trixie; urgency=medium
 .
   * debian/patches/git-updates.diff: update from upstream stable branch:
     - Fix build against linux 7.0 headers.  Closes: #1135405.
     - Fix ungetwc operating on byte stream (CVE-2026-5928).  Closes: #1134544.
     - Fix buffer overflow in scanf %mc (CVE-2026-5450).  Closes: #1134543.
     - Suppress iconv intermediate errors with //TRANSLIT.

goaccess (1:1.9.3-1+deb13u1) trixie; urgency=high
 .
   * Apply security updates (Closes: #1143181)
     Includes fixes for the following vulnerabilities:
     - CVE-2026-54715: Heap Out-of-Bounds Write in GoAccess `parse_browser()`
     - CVE-2026-55768: GoAccess WebSocket server: signed 32 bit truncation of
       the 64 bit frame length causes a remote pre authentication denial of
       service
     - CVE-2026-55777: Out-of-bounds heap read in parse_ios() via crafted
       User-Agent (opesys.c:323) lead to remote crash/DoS
   * debian/salsa-ci.yml: disable uscan test for this branch

gpsd (3.25-5+deb13u2) trixie; urgency=medium
 .
   * Fix CVE-2026-58459 (see #1141962). A command injection vulnerability
     exists in the gpsprof client. The subtype field, sourced from a
     DEVICES JSON log entry or an NMEA PGRMT sentence, is written into
     the generated gnuplot program via a set title statement with only
     double quote characters escaped. An attacker who controls the GPS
     device subtype can embed backtick payloads and execute arbitrary
     shell commands as the user running gnuplot when the generated plot
     is rendered.
   * Fix CVE-2026-60122. A code injection vulnerability exists in the
     gpsprof client. The SKY.satellites[].used field is inserted
     unsanitized into a gnuplot heredoc data block. An attacker who
     controls the GPS input data can supply a used value containing the
     string EOD to terminate the heredoc early and append gnuplot
     system() calls, achieving OS command execution as the user running
     gpsprof when the generated plot script is processed by gnuplot in
     polar mode.

gst-plugins-bad1.0 (1.26.2-3+deb13u3) trixie-security; urgency=medium
 .
   * CVE-2026-19387
   * CVE-2026-52722
   * CVE-2026-52720
   * CVE-2026-12892
   * CVE-2026-12891

gzip (1.13-1+deb13u1) trixie; urgency=medium
 .
   * d/p/CVE-2026-41991-a.patch, d/p/CVE-2026-41991-b.patch: use -C if
     lacking mktemp, closes: #1141442, CVE-2026-41991
   * d/p/CVE-2026-41992.patch: gzip: don’t mishandle .lzh after .Z,
     closes: #1141443, CVE-2026-41992

hplip (3.22.10+dfsg0-8.1+deb13u1) trixie-security; urgency=high
 .
   * CVE-2026-8631 (Closes: #1137374)
     a potential security vulnerability might allow escalation of
     privileges and/or arbitrary code execution when handling crafted
     print data.
   * CVE-2026-8632
     a potential security vulnerability might allow escalation of
     privileges and/or arbitrary code execution via operating system
     command injection.
   * with the help of Marc Deslauriers from Ubuntu, patches are extracted
     from hplip 3.26.4

imagemagick (8:7.1.1.43+dfsg1-1+deb13u12) trixie; urgency=medium
 .
   * Fix CVE-2026-56362:
     A heap-buffer-overflow read vulnerability in GetPixelIndex caused
     by OpenPixelCache updating image channel metadata before pixel
     cache memory allocation. Attackers can trigger memory and
     disk allocation failures to cause a heap-buffer-overflow
     read affecting any writer calling GetPixelIndex.
   * Fix CVE-2026-56366:
     A memory leak vulnerability in the META reader
     when processing APP1JPEG input paths.
   * Fix CVE-2026-56372:
     A heap buffer overflow vulnerability in the magnify operation
     that allows attackers to read out of bounds memory.
   * Fix CVE-2026-56373:
     A use-after-free vulnerability in the PDB decoder that
     uses a stale pointer when memory allocation fails.
   * Fix CVE-2026-56374:
     A heap buffer overflow vulnerability in the FTXT encoder
     due to missing boundary checks when parsing ftxt:format.
   * Fix CVE-2026-56375:
     A memory leak vulnerability in the ASHLAR coder when
     an action fails
   * Fix CVE-2026-61464:
     A heap-based buffer over-write vulnerability that occurs
     when running an X11 import with a crafted window title.
   * Fix CVE-2026-61465:
     A missing a check was found, for the allowed memory allocation
     limit in matrix-backed operations such as -canny.
   * Fix CVE-2026-61857:
     A heap use-after-free vulnerability caused by missing null
     check when parsing XMP profiles.
   * Fix CVE-2026-61858:
     A policy bypass vulnerability in the APNG encoder and
     external delegates due to missing validation checks.
   * Fix CVE-2026-61859:
     A policy bypass vulnerability in the -script operation due
     to missing security policy checks.
   * Fix CVE-2026-61860:
     a use-after-free vulnerability that occurs when freetype
     initialization fails: the method does not exit and
     continues to use memory that was already freed.
   * Fix CVE-2026-61861:
     A use-after-free vulnerability in the FormatMagickCaption method
     when memory allocation fails.
   * Fix CVE-2026-61862:
     When a profile is displayed with the identify command and the
     profile value is not printable, a single byte at the end of the
     profile can be printed.
   * Fix CVE-2026-61863:
     A memory leak in the TIFF encoder that occurs when a temporary
     file cannot be created, resulting in a small memory leak.
   * Fix CVE-2026-61864:
     A memory leak in color transformation to the log colorspace:
     when the operation fails, a small amount of memory is not released.
   * Fix CVE-2026-61865:
     A memory leak in the hough lines operation: when a specific operation fails,
     a small memory leak occurs.
   * Fix CVE-2026-61866:
     A memory leak vulnerability in the JNG encoder when a blob cannot be opened.
   * Fix CVE-2026-61867:
     A memory leak vulnerability in the TIFF encoder when memory allocation fails.
   * Fix CVE-2026-61868:
     a memory leak in the YUV decoder that occurs when opening of the blob fails.
   * Fix CVE-2026-61869:
     A memory leak in the MIFF encoder that occurs when a memory allocation
     fails during MIFF image processing.
   * Fix CVE-2026-61870:
     A memory leak vulnerability in the VIFF encoder when memory allocation fails.
   * Fix CVE-2026-61871:
     A memory leak in the ICON decoder that occurs when a memory allocation fails.
   * Fix CVE-2026-61872:
     a memory leak in the TIFF encoder when an invalid tiff:tile-geometry
     is specified.
imagemagick (8:7.1.1.43+dfsg1-1+deb13u11) trixie-security; urgency=medium
 .
   * Fix CVE-2026-53466:
     An integer overflow in the XCF decoder can result in an out of bounds
     read when a crafted image is read, potentially resulting in a crash.
   * Fix CVE-2026-53467:
     The MNG decoder contains a possible heap information disclosure
     vulnerability because part of the pixels are left unchanged.
   * Backport MagickCore/draw.c from 7.1.2-26
   * Fix CVE-2026-55577:
     A heap buffer overflow occurs in the MVG decoder that could result
     in an out of bounds write when processing a crafted image.
   * Fix CVE-2026-55594:
     A missing depth check in the MVG decoder will result in a stack overflow
     when a crafted image is provided.
   * Fix CVE-2026-55597:
     An incorrect handling of arguments can cause a heap buffer over-write
     in the JP2 encoder
   * Fix CVE-2026-55628:
     The `-concatenate` operation is missing policy checks, potentially resulting
     in both reading and writing to paths disallowed by the security policy.
   * Fix CVE-2026-56361:
     Attackers can trigger heap buffer overflow by providing incorrect
     morphology parameters causing single pixel memory access violations.
   * Fix CVE-2026-56363:
     An attacker can supply a large binomial kernel value causing integer overflow,
     resulting in division by zero and application crash.
   * Fix CVE-2026-56364:
     A memory leak vulnerability in LoadOpenCLDeviceBenchmark() function
     when parsing malformed OpenCL device profile XML files with unclosed device
     elements. Attackers with write access to the OpenCL cache directory can place
     malicious XML files to exhaust memory and cause denial of service.
   * Fix CVE-2026-56365:
     A memory leak vulnerability in the PNG encoder when writing MNG images.
   * Fix CVE-2026-56367:
     An integer overflow in the PSB (PSD v2) RLE decoding path
     (ReadPSDChannelRLE in coders/psd.c) that causes a heap out-of-bounds read
     on 32-bit builds.
   * Fix CVE-2026-56368:
     A memory leak vulnerability in multiple coders that write raw pixel data
     where allocated objects are not properly freed. Attackers can trigger
     this leak by processing specially crafted images, causing memory exhaustion
     and denial of service.
   * Fix CVE-2026-56370:
     ImageMagick contains an out-of-bounds access vulnerability in
     ConnectedComponentsImage() when processing connected-components artifacts
     with invalid indices. Attackers can trigger access violations by
     specifying malformed connected-components definitions via CLI,
     causing denial of service or potential code execution.
   * Fix CVE-2026-56371;
     A memory leak in coders/txt.c when processing TXT files with texture
     attributes: the texture object allocated via ReadImage is not released
     when GetTypeMetrics fails, leaking memory each time a crafted TXT file
     with a texture attribute is processed.
   * Fix CVE-2026-56376:
     A heap use-after-free in the meta coder: when memory allocation fails,
     a single byte is written to a stale pointer. Remote attackers can trigger
     it by processing specially crafted image files, causing a denial of service.
   * Fix CVE-2026-56377:
     ImageMagick contains an incorrect policy check that allows attackers
     to create or truncate files disallowed by security policies.
   * Fix CVE-2026-56378:
     ImageMagick contains a heap out-of-bounds read in the PCD coder's DecodeImage
     loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read
     during image decoding, resulting in denial of service and potential
     disclosure of an adjacent heap byte.

incus (6.0.4-2+deb13u10) trixie; urgency=medium
 .
   * Cherry-pick fixes for the following security issues
     - CVE-2026-81500 / GHSA-9pqw-c7m4-xvg7
     - CVE-2026-81501 / GHSA-c6wx-8679-hpr9
incus (6.0.4-2+deb13u9) trixie-security; urgency=high
 .
   * Cherry-pick upstream fix for large nft ruleset performance
   * Cherry-pick fixes for the following security issues:
     - CVE-2026-62313 / GHSA-53cg-qvg7-m8vg
     - CVE-2026-62867 / GHSA-q7xw-r4w2-2wcm
     - CVE-2026-62940 / GHSA-qw5c-v953-38gw
     - CVE-2026-62941 / GHSA-mq9x-prm8-3vpw
     - CVE-2026-63125 / GHSA-6rqx-22hc-qm36
     - CVE-2026-63343 / GHSA-fmjx-5j3g-997p
     - GHSA-26gp-p5fw-3r2h
     - GHSA-4qxq-p5hm-3q3p
     - GHSA-67qw-68v3-36h6
     - GHSA-m3j6-p3v3-qmjv
     - GHSA-p2v3-6wvc-cv3p
   * Cherry-pick four additional security fixes not assigned CVEs

ironic (1:29.0.5-0+deb13u3) trixie-security; urgency=medium
 .
   * Add follow-up patch for CVE-2026-46447 (erata1): "Fix kernel parameter
     parsing for quoted values and whitespace".
   * CVE-2026-54421: Sensitive properties returned unredacted in POST and PATCH
     HTTP responses. Added upstream patch: "Fix sensitive properties returned on
     volume targets" (Closes: #1140012).
   * CVE-2026-43003 / OSSN-2026-0100: Command injection via chroot execution of
     tenant-controlled binaries. Added upstream patch: "Add an agent flag to
     disable installing boatloaders" (Closes: #1140187).
   * CVE-2026-44918: multiple related vulnerabilities in Ironic RBAC. An
     authenticated project manager can change the node associated with Volume
     Connectors or Volume Target objects, potentially changing the project
     permitted to access the object. Volume Connectors contain secrets in
     environments configuring boot from volume with iSCSI volumes. Applied
     upstream patch: "Prevent rehoming resources to nodes with different owner".
     (Closes: #1141716).
   * CVE-2026-54423: A malicious user with access to deploy a node directly via
     Ironic can specify the IPMI `send_raw` deployment step with a malicious
     payload and send commands to that nodes' BMC. Applied upstream patches:
     - Add operator-configurable step disallow lists
     - block vendor.send_raw
     (Closes: #1141717).
   * OSSN-0106: API ramdisk endpoints require network-level access controls.
     Added upstream patch: "Add [api] enable_ramdisk_endpoints config option"
     (Closes: #1144214).

jq (1.7.1-6+deb13u3) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Cherry-pick upstream commit for the following:
     CVE-2026-41256, CVE-2026-41257, CVE-2026-43896, CVE-2026-43895, CVE-2026-44777,
     CVE-2026-43894, CVE-2026-47770, CVE-2026-49839, CVE-2026-54679, CVE-2026-40612,
     GHSA-ggc9-rpv2-xgpm, GHSA-gvwx-xj9r-3frq, GHSA-gf4g-95wj-4q4r
   * Add missing patch for CVE-2026-32316, a prerequisite for CVE-2026-54679 fix.
   * Fix CVE-2024-53427 for real. The patch carried since 1.7.1-5 placed the
     NaN payload check inside the DEC_Conversion_syntax branch, which already
     returns JV_INVALID unconditionally, so it never had any effect and
     "NaN123" still parsed. Move the check to the decNumberIsNaN branch as
     upstream does, and update the two tests that encoded the old behaviour.
   * Do not abort when repeating a string past the length bound. The
     CVE-2026-32316 fix made jvp_string_append() able to return an invalid jv;
     binop_multiply() appended in a loop without checking, so an input like
     {"s":"abc","n":1000000000} with a filter of .s * .n aborted on an
     assertion. Reject the operation up front and stop the loop on failure.
   * Propagate invalid jv instead of aborting on it. The same change of
     contract affects jvp_string_append(), jv_string_concat() and jv_sort();
     callers written against the old always-valid contract abort on an
     assertion. Guard centrally in jv.c so the @base64, @csv, @tsv, @sh, @uri
     and escape_string loops are all covered, and guard jv_delpaths(),
     jv_dump_string_trunc() and the jv_dump_string() results printed by
     main.c. delpaths and the error-message paths are regressions against
     previous version; the string-format ones replace the CVE-2026-32316
     integer overflow with a proper error.

keystone (2:27.0.0-3+deb13u5) trixie-security; urgency=medium
 .
   * CVE-2026-80184: Delegation bypass in trust, OAuth1, and application
     credential operations.
   * CVE-2026-80182: Tokens obtained via application credential or EC2
     credential authentication can escape their intended project scope through
     token-method reauthentication. An application-credential token scoped to
     one project can be exchanged via POST /v3/auth/tokens with no explicit
     scope, causing Keystone to issue a new token scoped to the owner's default
     project. For EC2-derived tokens the bypass is broader: because they carry
     no delegation markers, they can rescope to any project where the underlying
     user has role assignments.
   * Add new patches (Closes: #1145669):
     - CVE-2026-80182_CVE-2026-80184_1_Block_app_credential_token_resco....patch
     - CVE-2026-80182_CVE-2026-80184_2_auth_encode_ec2credential_and_oa....patch
     - CVE-2026-80182_CVE-2026-80184_3_trusts_oauth1_app-creds_reject_d....patch
     - CVE-2026-80182_CVE-2026-80184_4_auth_reject_delegated_tokens_fro....patch
   * CVE-2026-80183 / OSSN-2026-0XXX: any authenticated user holding role:reader
     on any project can list every project-scoped role assignment under any
     domain by passing a domain ID as scope.project.id with include_subtree to
     the GET /v3/role_assignments endpoint. The domain's project record has
     domain_id=null, causing the policy domain_id check to pass for any caller.
     With include_names, the response discloses the names and home-domain IDs of
     every user, group, project, and role involved. The literal "default" domain
     ID works against any deployment created with keystone-manage bootstrap. An
     attacker can harvest domain IDs from the response and repeat the query to
     map role assignments across the entire cloud. This is caused by misuse of
     "None" in list_role_assignments_for_tree.
     Applied upstream patch (Closes: #1145816):
     - CVE-2026-80183_Prevent_unauthorized_project-scoped_assignment_list.patch

kitty (0.41.1-2+deb13u2) trixie-security; urgency=medium
 .
   * Re-diff 0016-CVE-2026-33633 patch
   * Fixing following CVEs: (Closes: #1139898)
     - CVE-2026-42850
     - CVE-2026-42851
     - CVE-2026-54055
     - CVE-2026-54057

lemonldap-ng (2.21.2+ds-1+deb13u3) trixie-security; urgency=medium
 .
   * Use OTP to store GitHub/LinkedIn states (Closes: CVE-2026-19349)
   * Improve CDC filtering (Closes: CVE-2026-12804)

libdatetime-timezone-perl (1:2.65-1+2026c) trixie; urgency=medium
 .
   * Update data to Olson database version 2026c.
     This update contains contemporary changes for Alberta, CA and Morocco.

libdbd-csv-perl (0.6200-1+deb13u1) trixie; urgency=medium
 .
   * Team upload.
 .
   [ gregor herrmann ]
   * Add patch from upstream Git to fix test failure. (Closes: #1139509)

libdbi-perl (1.652-2~deb13u1) trixie-security; urgency=high
 .
   * Team upload.
   * Rebuild for trixie-security
   * Revert "Remove «Priority: optional», which is the current default."
   * Revert "Remove «Rules-Requires-Root: no», which is the current default."
   * Revert "Declare compliance with Debian Policy 4.7.4."
   * Revert "Reformat debian/control."
 .
 libdbi-perl (1.652-2) unstable; urgency=medium
 .
   * Add patch from upstream Git to fix 32bit test failure.
     Thanks to Adrian Bunk for the bug report. (Closes: #1144851)
 .
 libdbi-perl (1.652-1) unstable; urgency=medium
 .
   * Import upstream version 1.652.
     + Limit statements to 292 Mb in preparse (CVE-2026-73193)
       (Closes: #1144470)
     + Force placeholder limit on :# and :p# too (CVE-2026-73194)
       (Closes: #1144471)
   * Install new SECURITY.md file.
   * Refresh t__40profile.t__NTP.patch (offset).
 .
 libdbi-perl (1.651-1) unstable; urgency=medium
 .
   * Import upstream version 1.651.
     - Fix inverted comparisons for strings in DBI::SQL::Nano
       (CVE-2026-15043)
     - Fix DBD::File to ensure that the table is not a symlink outside of f_dir
       (CVE-2026-15392)
     - Fix an out-of-bounds error when a statement handle has no fields but the
       source row is not empty (CVE-2026-60082)
     - Add an overridable upper bound $MAX_PATH_DEPTH for DBI::ProfileData
       (CVE-2026-60081)
     Closes: #1142072
 .
 libdbi-perl (1.650-1) unstable; urgency=medium
 .
   * Import upstream version 1.650.
     - Set a hard limit of 99999 on '?' placeholders
       (CVE-2026-14739)
     - Fix out-of-bounds read in preparse of SQL that starts with a comment
       (CVE-2026-14740)
     - Fix code injection via Profile DSN attribute or DBI_PROFILE variable
       (CVE-2026-14380)
     Closes: #1141667
   * Install new upstream document.
 .
 libdbi-perl (1.649-1) unstable; urgency=medium
 .
   * Import upstream version 1.649.
 .
 libdbi-perl (1.648-1) unstable; urgency=medium
 .
   * Import upstream version 1.648.
     Fixes CVE-2026-9698 and CVE-2026-10879.
   * Update years of upstream and packaging copyright.
   * Declare compliance with Debian Policy 4.7.4.
   * Remove «Rules-Requires-Root: no», which is the current default.
   * Remove «Priority: optional», which is the current default.
libdbi-perl (1.652-1) unstable; urgency=medium
 .
   * Import upstream version 1.652.
     + Limit statements to 292 Mb in preparse (CVE-2026-73193)
       (Closes: #1144470)
     + Force placeholder limit on :# and :p# too (CVE-2026-73194)
       (Closes: #1144471)
   * Install new SECURITY.md file.
   * Refresh t__40profile.t__NTP.patch (offset).
libdbi-perl (1.651-1) unstable; urgency=medium
 .
   * Import upstream version 1.651.
     - Fix inverted comparisons for strings in DBI::SQL::Nano
       (CVE-2026-15043)
     - Fix DBD::File to ensure that the table is not a symlink outside of f_dir
       (CVE-2026-15392)
     - Fix an out-of-bounds error when a statement handle has no fields but the
       source row is not empty (CVE-2026-60082)
     - Add an overridable upper bound $MAX_PATH_DEPTH for DBI::ProfileData
       (CVE-2026-60081)
     Closes: #1142072
libdbi-perl (1.650-1) unstable; urgency=medium
 .
   * Import upstream version 1.650.
     - Set a hard limit of 99999 on '?' placeholders
       (CVE-2026-14739)
     - Fix out-of-bounds read in preparse of SQL that starts with a comment
       (CVE-2026-14740)
     - Fix code injection via Profile DSN attribute or DBI_PROFILE variable
       (CVE-2026-14380)
     Closes: #1141667
   * Install new upstream document.
libdbi-perl (1.649-1) unstable; urgency=medium
 .
   * Import upstream version 1.649.
libdbi-perl (1.648-1) unstable; urgency=medium
 .
   * Import upstream version 1.648.
     Fixes CVE-2026-9698 and CVE-2026-10879.
   * Update years of upstream and packaging copyright.
   * Declare compliance with Debian Policy 4.7.4.
   * Remove «Rules-Requires-Root: no», which is the current default.
   * Remove «Priority: optional», which is the current default.

libde265 (1.0.15-1+deb13u2) trixie-security; urgency=medium
 .
   * CVE-2026-33164 (Closes: #1131469)
   * CVE-2026-33165 (Closes: #1131468)
libde265 (1.0.15-1+deb13u1) trixie-security; urgency=medium
 .
   * Non-maintainer upload by the Security Team.
   * Backport upstream security fixes
     CVE-2024-38949, CVE-2024-38950, CVE-2025-61147, CVE-2026-45382,
     CVE-2026-45383, CVE-2026-49295, CVE-2026-49337, CVE-2026-49346,
     CVE-2026-54240, CVE-2026-54241

libgd2 (2.3.3-14~deb13u1) trixie-security; urgency=high
 .
   * Change the homepage to https://libgd.github.io (Closes: #1143151)
   * libgd patch for CVE-2026-9672

libgit2 (1.9.0+ds-2+deb13u1) trixie-security; urgency=high
 .
   * Fix CVE-2026-5917: shell command injection in SSH transport
     (Closes: #1144465)
   * Fix CVE-2026-53583: inverted cert validity check for IP addresses
   * Fix CVE-2026-53584: unsanitized submodule paths
   * Fix CVE-2026-53585: limit pack object size to 2GiB
   * Fix CVE-2026-53586: pass correct hostname to auth layer after redirect
   * Fix CVE-2026-53587: read buffer overflow in capability check

libheif (1.19.8-1+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Fixed issues:
     CVE-2025-68431, CVE-2026-32882, CVE-2026-32740, CVE-2026-47247,
     CVE-2026-32741, CVE-2026-47709, CVE-2026-49271, CVE-2026-62292,
     CVE-2026-47714, CVE-2026-48029, CVE-2026-62289 and GHSA-2h34-fcv6-jqvh
   * Mitigated CVE-2026-47178: rejected files affected by the issue with
     heif_error_Unsupported_feature instead of being decoded.

libhttp-tiny-perl (0.090-1+deb13u1) trixie; urgency=medium
 .
   * [Security] CVE-2026-7010: CRLF-validation in HTTP::Tiny.
     (Closes: #1146064)
   * [Security] CVE-2026-7017: HTTP::Tiny credential forwarding on
     redirects.
     (Closes: #1141638)

libio-compress-perl (2.213-1+deb13u1) trixie; urgency=medium
 .
   * [Security] CVE-2025-15649: header parsing in IO::Uncompress::Unzip.
     (Closes: #1146065)
   * [Security] CVE-2026-48959: CPU exhaustion in IO::Uncompress::Unzip.
     (Closes: #1138051)
   * [Security] CVE-2026-48961: crash in zipdetails.
     (Closes: #1138052)
   * [Security] CVE-2026-48962: code execution in IO-Compress via output
     globs.
     (Closes: #1138055)
   * Add debian/source/include-binaries for CVE-2025-15649 test case.

libmodule-cpants-analyse-perl (1.02-1+deb13u1) trixie; urgency=medium
 .
   * Add 0001-Use-relative-rather-than-absolute-symlink-in-t-analy.patch.
     Backport fix for interoperability with Archive::Tar >= 3.08.
     Patch taken from upstream Git as included in 1.03.
     (Closes: #1146144)

libmongocrypt (1.13.2-1+deb13u1) trixie; urgency=medium
 .
   * Fix CVE-2026-81523: validate db and collection names

libnet-cidr-set-perl (0.15-1+deb13u1) trixie; urgency=medium
 .
   * CVE-2026-49940+49942.patch: Only accept ASCII digits for netmasks and
     IP addresses (Fixes CVE-2026-49940 and CVE-2026-49942).
   * CVE-2026-49941.patch: Improve strictness of IP address matching
     (Fixes CVE-2026-49941).
   * The newly added tests build-depend on libtest-exception-perl.

libnet-dns-perl (1.56-0+deb13u1) trixie-security; urgency=high
 .
   * Team upload.
   * Import upstream version 1.56.
     Includes fixes for CVE-2026-64193 and CVE-2026-64194.
     (Closes: #1142503)
libnet-dns-perl (1.55-1) unstable; urgency=medium
 .
   * Team upload.
   * Import upstream version 1.55.
   * Declare compliance with Debian Policy 4.7.4.
libnet-dns-perl (1.54-1) unstable; urgency=medium
 .
   * Team upload.
   * Import upstream version 1.54.
   * Declare compliance with Debian Policy 4.7.3.
libnet-dns-perl (1.53-1) unstable; urgency=medium
 .
   * Team upload.
   * Import upstream version 1.53.
   * Remove «Rules-Requires-Root: no», which is the current default.
   * Remove «Priority: optional», which is the current default.

libnfs (5.0.2-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload by the LTS Team.
   * CVE-2026-53689 (Closes: #1139731)
     fix validation of string size to prevent integer overflow
   * debian/control: fix Maintainer: entry

librabbitmq (0.15.0-1+deb13u2) trixie-security; urgency=medium
 .
   * [9bc0956] d/patches/CVE-2026-59986.patch: added from upstream.
     Fix amqp_decode_bytes size_t integer overflow bypasses bounds check on
     32-bit (OOB read) (GHSA-jgjf-7fwf-f3c7, CVE-2026-59986)
   * [58e0219] d/patches/CVE-2026-61547.patch: added from upstream.
     Fix Heap Buffer Overflow in amqp_send_frame() When Serializing Oversized
     AMQP_FRAME_BODY (GHSA-hfjv-vcp3-39wh, CVE-2026-61547)

libraw (0.21.4-2+deb13u1) trixie; urgency=high
 .
   * Non-maintainer upload.
   * Fix CVE-2026-5342: nikon_load_padded_packed_raw() out-of-bounds read
     due to missing buffer and dimension validation (closes: #1132655).
   * Fix CVE-2026-20884: deflate_dng_load_raw() integer overflow vulnerability
     (closes: #1133845).
   * Fix CVE-2026-20889: x3f_thumb_loader() heap-based buffer overflow
     vulnerability (closes: #1133845).
   * Fix CVE-2026-21413: lossless_jpeg_load_raw() heap-based buffer overflow
     vulnerability (closes: #1133845).
   * Fix CVE-2026-24450: uncompressed_fp_dng_load_raw() integer overflow
     vulnerability (closes: #1133845).
   * Fix CVE-2026-24660: x3f_load_huffman() heap-based buffer overflow
     vulnerability (closes: #1133845).
   * Add d/salsa-ci.yml for Salsa CI.

libsdl2-image (2.8.8+dfsg-1+deb13u1) trixie; urgency=medium
 .
   [ Aquila Macedo Costa ]
   * d/p/Fixed-out-of-bounds-read-in-XCF-image-loader-thanks-Sebas.patch:
     Import upstream patch for CVE-2026-35444 (Closes: #1133010)
   * d/patches: Add selected upstream malformed-image parser robustness fixes:
     - d/p/xpm-Remove-QUICK_COLORHASH-replace-it-with-inline-code-th.patch:
       check XPM color hash entries before use
     - d/p/Fix-heap-buffer-overflow-WRITE-in-LBM-palette-CWE-122.patch:
       fix LBM palette overflow
     - d/p/xcf-Fix-heap-buffer-overflow-READ-in-XCF-RLE-decoder-CWE-.patch:
       add XCF RLE decoder bounds checks
     - d/p/Fix-heap-buffer-overflow-READ-in-XCF-do_layer_surface-CWE.patch,
       d/p/xcf-Added-an-SDL_SetError-when-rejecting-out-of-bounds-ti.patch:
       add XCF do_layer_surface tile bounds check, report invalid XCF tile data
       through SDL_SetError()
     - d/p/xcf-fix-null-pointer-dereference-when-read_xcf_hierarchy-.patch:
       check XCF hierarchy read failures before dereferencing
     - d/p/tga-reject-images-with-zero-width-or-height.patch:
       reject TGA images with zero width or height
     - d/p/Fixed-out-of-bound-read-in-GIF-decoder.patch:
       fix out-of-bounds reads in the GIF decoder
 .
   [ Simon McVittie ]
   * d/control, d/gbp.conf: Branch for trixie
   * d/patches: Improve patch metadata: add CVE ID, Debian bug number,
     upstream commit references, etc.
   * d/patches: Re-export patches with their mechanically-generated names and
     apply them in the same order that upstream did, to make it more obvious
     how this version compares with 2.8.12
   * d/patches: Add additional robustness fixes for parsing malformed images:
     - d/p/xcf-Permit-empty-strings-in-read_string.patch:
       Avoid an out-of-bounds write if XCF files contain a zero-length string
     - d/p/IMG_xcf.c-read_string-add-back-the-positive-string-size-c.patch:
       Harden XCF parsing against extremely long strings

libsdl3-image (3.2.4+ds-1+deb13u1) trixie; urgency=medium
 .
   * d/control, d/gbp.conf: Branch for trixie
   * d/patches: Add a malformed-image parser robustness fix from 3.4.2:
     - d/p/Fixed-out-of-bounds-read-in-XCF-image-loader-thanks-Sebas.patch:
       Avoid an out-of-bounds read when loading invalid XCF images
       (CVE-2026-35444, same issue as #1133010 in libsdl2-image)
   * d/patches: Add selected upstream malformed-image parser robustness
     fixes from 3.4.4:
     - d/p/xpm-Remove-QUICK_COLORHASH-replace-it-with-inline-code-th.patch:
       Check XPM colour hash entries before use
     - d/p/Fix-heap-buffer-overflow-WRITE-in-LBM-palette-CWE-122.patch
       Avoid an out-of-bounds write when parsing LBM images
     - d/p/Fix-heap-underflow-WRITE-in-XCF-read_string-CWE-787.patch
       Avoid an out-of-bounds write if XCF files contain a zero-length string
     - d/p/Fix-heap-buffer-overflow-READ-in-XCF-do_layer_surface-CWE.patch,
       d/p/xcf-Added-an-SDL_SetError-when-rejecting-out-of-bounds-ti.patch:
       Avoid an out-of-bounds read when parsing XCF file tile data, and
       report the resulting error correctly
     - d/p/Fix-heap-buffer-overflow-READ-in-XCF-RLE-decoder-CWE-122.patch:
       Avoid an out-of-bounds read when parsing XCF files with RLE encoding
     - d/p/xcf-fix-null-pointer-dereference-when-read_xcf_hierarchy-.patch:
       Check XCF hierarchy read failures before dereferencing
     - d/p/tga-reject-images-with-zero-width-or-height.patch:
       Reject zero-sized TGA images as invalid
     - d/p/Fixed-out-of-bound-read-in-GIF-decoder.patch:
       Avoid out-of-bounds reads in the GIF decoder
   * d/patches: Add an additional parser robustness fix from upstream git:
     - d/p/IMG_xcf.c-read_string-add-back-the-positive-string-size-c.patch
       Harden XCF parsing against extremely long strings
   * Thanks to Aquila Macedo Costa

libsocket-perl (2.038-1+deb13u1) trixie; urgency=medium
 .
   [ Kentaro Hayashi ]
   * Backport patch to fix CVE-2026-12087
     (out-of-bounds heap read in pack_ip_mreq_source()).
     - Added CVE-2026-12087.patch
     - Added CVE-2026-12087-test.patch for testing
 .
     Closes: #1146063

libssh (0.11.5-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream security/bug fix release 0.11.4:
     - CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request()
     - CVE-2026-0965: Possible Denial of Service when parsing unexpected
       configuration files
     - CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input
     - CVE-2026-0967: Specially crafted patterns could cause DoS
     - CVE-2026-0968: OOB Read in sftp_parse_longname()
     - CVE-2026-3731: Read buffer overrun when handling SFTP extensions
     - Note: CVE-2025-14821 is Windows specific, does not apply to Linux
     https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/
     (Closes: #1127693)
   * New upstream security/bug fix release 0.11.5:
     - CVE-2026-15370: Stack buffer overflow in SFTP server longname
       construction
     - CVE-2026-59843: Denial of service via zero advertised channel packet
       size
     - CVE-2026-59844: Denial of service via oversized SFTP read length
     - CVE-2026-59845: Denial of service via unchecked ProxyCommand fork()
       failure
     - CVE-2026-59846: Information disclosure via ProxyCommand %r username
       expansion
     - CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification
     - CVE-2026-59848: Denial of service via SFTP responses with unknown
       request IDs
     - CVE-2026-59849: Denial of service via automatic certificate
       authentication loop
     - CVE-2026-59850: Use-after-free via data callbacks on closed channels
     - Zero-initialize every ssh_string
     https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/
     (Closes: #1142537)
libssh (0.11.3-1) unstable; urgency=medium
 .
   * New upstream security/bug fix release:
     - CVE-2025-8114: Fix NULL pointer dereference after allocation failure
       (Closes: #1109860)
     - CVE-2025-8277: Fix memory leak of ephemeral key pair during repeated
       wrong KEX (Closes: #1114859)
     - Potential use-after-free when send() fails during key exchange
     - Fix possible timeout during KEX if client sends authentication too early
     - Cleanup OpenSSL PKCS#11 provider when loaded
     - Zeroize buffers containing private key blobs during export

libssh2 (1.11.1-1+deb13u2) trixie; urgency=medium
 .
   * d/patches: Fix CVEs CVE-2026-66032 CVE-2026-66033 CVE-2026-66034
     CVE-2026-66035 CVE-2026-58050 CVE-2026-58051 (Backport from unstable)

libvirt (11.3.0-3+deb13u3) trixie; urgency=medium
 .
   * [7061212] patches: Add backports
     - backport/qemuMonitorJSONMigrate-Drop-detach-QMP-option.patch
       - Closes: #1145836
   * [eaa378a] patches: Add backports
     - backport/remote-Fix-integer-overflow-in-RPC-handler-[...]
       - CVE-2026-18917
   * [1b35d45] patches: Add backports
     - backport/conf-reject-line-breaks-in-DNS-TXT-record-[...]
     - backport/conf-reject-line-breaks-in-DNS-SRV-domain-[...]
     - backport/network-reject-line-breaks-before-writing-[...]
     - backport/tests-cover-line-break-rejection-in-DNS-[...]
       - CVE-2026-61477
   * [4378d69] patches: Add backports
     - backport/src-fix-crash-searching-for-XML-context-string-[...]
       - CVE-2026-61478
   * [fd7eaa5] patches: Add backports
     - backport/util-virFileChownFiles-do-not-follow-symlinks.patch
       - CVE-2026-63622
   * [eccf219] patches: Add backports
     - backport/storage-create-images-with-a-private-umask-[...]
       - CVE-2026-63623

libwebsockets (4.3.5-1+deb13u2) trixie; urgency=medium
 .
   * Backport upstream security fix for CVE-2026-10650: resource consumption
     in the lws_ssh_parse_plaintext() function (closes: #1139178).
   * Backport upstream security fix for CVE-2026-78161: LECP CBOR position
     out of bounds write (closes: #1145789).

libxfont (1:2.0.6-1+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * bitscale: fix integer overflow in BitmapScaleBitmaps bytestoalloc
     (CVE-2026-56001) (Closes: #1141702)
   * pcfread: validate bitmap sizes and offsets against per-glyph metrics
     (CVE-2026-56002) (Closes: #1141702)
   * bitscale: add bounds check to computeProps for property buffer
     (CVE-2026-56003) (Closes: #1141702)
libxfont (1:2.0.6-1+deb12u1) bookworm-security; urgency=medium
 .
   * Add upstream patches for security issues:
     - CVE-2026-56001: integer overflow in BitmapScaleBitmaps bytestoalloc
     - CVE-2026-56002: validate bitmap sizes and offsets in pcfread
     - CVE-2026-56003: bounds check to computeProps for property buffer

libyaml-syck-perl (1.34-2+deb13u3) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * fix: prevent buffer underflow in base60 (sexagesimal) parsing
     (CVE-2026-5089)
   * rebase: apply review feedback
   * fix: prevent memory leaks when Load/LoadJSON croak on parse errors
   * Fix four libsyck memory-safety CVEs reachable from YAML::Syck::Load()
     (CVE-2026-57075, CVE-2026-57076, CVE-2026-57077, CVE-2026-13713)
     (Closes: #1142267)

linux (6.12.107-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.106
     - PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
     - Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
     - ALSA: scarlett2: Use a private URB for the notification endpoint
     - rndis_host: add overflow check in rndis_rx_fixup()
     - gpio: ml-ioh: use raw_spinlock_t for the register lock (CVE-2026-80562)
     - gve: fix zero-length skb frag with header-split
     - hwmon: (ltc4286) Fix symbol namespace of MODULE_IMPORT_NS()
     - netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
       (CVE-2026-64216)
     - inet: frags: add inet_frag_putn() helper
     - ipv4: frags: remove ipq_put()
     - inet: frags: change inet_frag_kill() to defer refcount updates
     - inet: frags: save a pair of atomic operations in reassembly
     - inet: frags: publish queues before arming timer (CVE-2026-74662)
     - serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
       (CVE-2026-74653)
     - NTB: ntb_netdev: Preserve RX queue depth on allocation failure
       (CVE-2026-74626)
     - serial: amba-pl011: synchronize DMA teardown
     - serial: sc16is7xx: rename EFR mutex with generic name
     - serial: sc16is7xx: use guards for simple mutex locks
     - serial: sc16is7xx: enable THRI before filling TX FIFO
     - xfs: namespace the maximum length/refcount symbols
     - xfs: don't use a xfs_log_iovec for ri_buf in log recovery
     - xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)
     - xfs: hoist per-bucket unlinked list check to helper
     - xfs: don't livelock in scrub on a circular unlinked list
     - ALSA: dummy: Check card index validity at probe
     - ocfs2: fix missing metadata reservation for large xattrs
     - null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows
     - kcov: fix data corruption and race conditions on PREEMPT_RT
     - ext4: stop retrying saturated xattr cache entries
     - ext4: clear error before retrying inode xattr space fallback
     - ext4: propagate errors from fast commit range replay
     - xfs: validate attr entry pointer before field access
     - libceph: fix OOB read in decode_watchers() via missing bounds check
       (CVE-2026-80557)
     - nfc: digital: clamp SENSF_RES length to the destination buffer
     - nfc: fdp: bound the device-reported read length and fix an skb leak
     - nfc: microread: validate target discovery payload lengths
     - nfc: llcp: bound the connect_sn TLV walk to the skb
     - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
     - nfc: llcp: reject PDUs shorter than the LLCP header
     - nfc: pn533: purge fragmented skbs during cleanup
     - nfc: st21nfca: validate ATR_REQ length against the received frame
     - nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
     - nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
     - nfc: nci: free destination parameters when closing a connection
     - ndisc: ndisc_send_redirect() cleanup
     - Input: byd - synchronize timer deletion before freeing private data
       (CVE-2026-80572)
     - ipv4: reject undersized MTUs in ip_do_fragment()
     - ipv6: fix use-after-free in ip6_finish_output2()
     - nvmet-auth: zero the AUTH_RECEIVE response buffer
     - nvmet-fc: fix invalid free in LS IOD error path
     - nvmet-tcp: bound SGL data length before allocating command buffers
     - nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
     - mptcp: pm: fix data race in add_addr timer callback
     - [arm64] ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
       (CVE-2026-80583)
     - drm/xe: Fix DPT allocation paths.
     - HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
     - HID: magicmouse: re-enable multitouch after reset-resume
     - HID: magicmouse: do not keep a stale msc->input if no input is claimed
     - HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID
     - HID: core: fix OOB read of field->usage in hid_set_field()
     - net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
     - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (CVE-2026-64581)
     - ipv4: start using dst_dev_rcu() (CVE-2025-40074)
     - mptcp: pm: fix memory leak from alloc-during-teardown race
     - Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard
     - Input: atkbd - skip deactivate for HONOR ZQC-P
     - HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
     - HID: nintendo: register input device after capabilities are set
     - HID: nintendo: stop device IO before hid_hw_stop on probe failure
     - HID: core: fix number/pointer type confusion on long items
     - HID: sensor: custom: Fix use-after-free in enable_sensor
     - HID: hyperv: validate initial device info bounds
     - Bluetooth: hci_event: fix LE list UAF on reset
     - Bluetooth: hci_event: validate LE Set CIG Parameters response
     - Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync
     - Bluetooth: hci_aml: validate firmware segment lengths
     - net: gro: properly validate BIG TCP aggregation criteria
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.107
     - inet: frags: strip GSO state from fragments before reassembly
       (CVE-2026-80590)
linux (6.12.105-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.102
     - [amd64] x86/bugs: Make Safe-RET robust against interrupt injection
       (CVE-2026-68480)
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.103
     - netfilter: nf_conntrack_expect: restore helper propagation via expectation
     - netfilter: br_netfilter: Reallocate headroom if necessary in
       neigh_hh_bridge()
     - net: mpls: initialize rtm_tos in mpls_getroute()
     - HID: logitech-dj: Standardise hid_report_enum variable nomenclature
     - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB
       write
     - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report
     - bpf: Reset register bounds before narrowing retval range in
       check_mem_access()
     - netconsole: avoid OOB reads, msg is not nul-terminated (CVE-2026-43197)
     - [amd64] thunderbolt: Prevent XDomain delayed work use-after-free on
       disconnect
     - [arm64] pinctrl: qcom: Unconditionally mark gpio as wakeup enable
     - [arm64] pinctrl: qcom: sc8280xp: Add missing wakeup entries for
       GPIO143/151
     - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
     - [amd64] dmaengine: idxd: fix fdev setup failure cleanup in
       idxd_cdev_open()
     - gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe()
     - ata: sata_mv: accept 1 or 2 resources in platform probe
     - ata: libahci_platform: support non-consecutive port numbers
     - ahci: Introduce ahci_ignore_port() helper
     - ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
     - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup
     - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup
     - of: reserved_mem: Add code to dynamically allocate reserved_mem array
     - of: reserved_mem: prevent OOB when too many dynamic regions are defined
     - btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag
     - btrfs: zoned: fix deadlock between metadata writeback and transaction
       commit
     - [arm64] phy-zynqmp: Postpone getting clock rate until actually needed
     - [arm64] phy: zynqmp: fix clock error handling in xpsgtr_phy_init()
     - [arm64] phy: zynqmp: fix runtime PM leak on probe allocation failure
     - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in
       sip_help_tcp()
     - [arm64] drm/mediatek: Check CRTC state before freeing
     - Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep
       annotation
     - KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type
     - keys: fix out-of-bounds read in keyring_get_key_chunk()
     - keys: make keyring key-chunk byte order agree with keyring_diff_objects()
     - assoc_array: trim the final shortcut word using the current chunk end
     - netfilter: nf_tables: make nft_object rhltable per table
     - netfilter: xt_hashlimit: validate hashtable supports
       XT_HASHLIMIT_RATE_MATCH
     - ipvs: fix the checksum validations
     - ipvs: fix places with wrong packet offsets
     - ipvs: do not mangle ICMP replies for non-first fragments
     - netfilter: nft_payload: fix mask build for partial field offload
     - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled
       (CVE-2026-68322)
     - rds: tcp: hold the RCU lock across ipv6_chk_addr() in
       rds_tcp_laddr_check()
     - [amd64,arm64] pinctrl-amd: Don't clear S4 wake bits at probe
     - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
     - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection
       buffer
     - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
     - smb: client: fix buffer leaks in SMB1 read and write
     - spi: spi-cadence: supports transmission with bits_per_word of 16 and 32
     - spi: spi-cadence: Move TX FIFO full busy-wait into FIFO
     - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
     - hwmon: (ina2xx) Add support for has_alerts configuration flag
     - hwmon: (ina2xx) Add support for INA260
     - hwmon: (ina226) Add support for SY24655
     - hwmon: (ina2xx) Make it easier to add more devices
     - hwmon: (ina2xx) Add support for INA234
     - hwmon: (ina2xx) Shift INA234 shunt and current registers
     - hwmon: (ina2xx) Fix various overflow issues
     - hwmon: (ltc4282) Fix reading the minimum alarm voltage
     - hwmon: (sht3x) Fix unaligned accesses
     - hwmon: (lm90) Only report alarms if driver is ready
     - hwmon: (nzxt-smart2) DMA-align output buffer
     - net: do not send ICMP/NDISC Redirects when peer allocation fails
     - hwmon: (nct6775-core) Prevent access to unsupported weight registers
     - net: bridge: mrp: fix Option TLV length in MRP_Test frames
     - forcedeth: fix UAF of txrx_stats in nv_remove
     - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
     - hwmon: (adt7470) Fix cache updated before hardware write on I2C error
     - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
     - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()
     - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks
     - hwmon: (adt7470) Use cached PWM frequency value
     - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
     - hwmon: (adt7470) Fix PWM auto temp state array and bounds check
     - rtase: fix double free of multi-frag skb on DMA map failure
     - [powerpc*] boot: Fix simpleboot CPU node lookup check
     - [powerpc*] boot: Fix treeboot-currituck CPU node lookup check
     - [powerpc*] boot: Fix treeboot-akebono CPU node lookup check
     - net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
     - wifi: mac80211: validate individual TWT params before driver setup
     - net: ethernet: mtk_eth_soc: support named IRQs
     - net: ethernet: mtk_eth_soc: add consts for irq index
     - net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in
       poll_controller
     - hwmon: (pmbus) Fix return value from pmbus_update_byte_data()
     - [amd64,arm64] idpf: adjust TxQ ring count minimum
     - [amd64,arm64] idpf: Fix mailbox IRQ name leak on request failure
     - Bluetooth: ISO: clear iso_data always when detaching conn from hcon
     - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
     - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos
     - Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis()
     - Bluetooth: ISO: fix leaking sk after socket release
     - Bluetooth: ISO: avoid deadlocks in iso_sock_timeout
     - Bluetooth: btintel: Validate length before parsing diagnostics TLV
     - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists
     - Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
     - Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync
     - net: phylink: put link_gpio if phylink_create fails
     - scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
     - scsi: ufs: core: Cancel RTC work in active-active suspend
     - scsi: zfcp: Fix memory leak during adapter release by destroying
       gid_pn_req
     - scsi: target: Clear cmd_cnt when initial counter enrollment fails
     - net: sxgbe: free TX rings on RX allocation failure
     - net: sxgbe: check descriptor ring allocation failures
     - can: isotp: check register_netdevice_notifier() error in module init
     - tracing/mmiotrace: Reset dropped_count in mmio_reset_data()
     - tracing: Remove TRACE_EVENT_FL_FILTERED logic
     - tracing/mmiotrace: Remove reference to unused per CPU data pointer
     - tracing/mmiotrace: Add NULL check for mmio_trace_array in logging
       functions
     - [riscv64] mm: Fix out-of-bounds page-table walk during memory hot-remove
     - [arm64] net: dsa: mt7530: check bus->read() errors in the MDIO regmap
       backend
     - [arm64] net: dsa: mt7530: error out on failed reads in MT7531 PHY polling
     - net: libwx: fix FDIR ATR queue mismatch for software VLAN packets
     - [arm64] octeontx2-pf: Set correct sequence for carrier off and tx queue
       stop
     - sched/deadline: Use revised wakeup rule only for running dl_server
     - qede: sync udp_tunnel ports outside qede_lock in the recovery path
     - ksmbd: return success for deferred final close
     - ksmbd: fix use-after-free in __close_file_table_ids()
     - pinctrl: devicetree: don't free uninitialized dev_name on error path
     - erofs: cap LZMA stream pool size
     - pinctrl: bm1880: add missing select GENERIC_PINCONF
     - fortify: Disable -Wstringop-overread in tests
     - mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
     - fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes
     - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
     - mm/hugetlb: fix list corruption in allocate_file_region_entries()
     - mm/vmstat: fold stranded per-cpu node stats when a node comes online
     - tracing/probes: Reject $arg0 in meta argument expansion
     - [amd64] KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while
       L2 is active
     - [s390x] KVM: s390: pci: Reject adapter interrupt forwarding if already
       enabled
     - [s390x] KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
     - [s390x] KVM: s390: pci: Validate AIBV and AISB before pinning guest pages
     - sctp: validate Adaptation Indication parameter length
     - audit: fix potential integer overflow in audit_log_n_string()
     - audit: fix potential use-after-free in audit_del_rule()
     - Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()
     - Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()
     - Bluetooth: mgmt: fix pending command UAF in EIR updates
     - Bluetooth: mgmt: fix UAF in pair command cancellation
     - Bluetooth: hci_sync: Fix advertising data UAFs
     - Bluetooth: HIDP: reject frames without a transaction header
     - Bluetooth: HIDP: validate numbered report payloads
     - bpf: lwt: Fix dst reference leak on reroute failure
     - ALSA: 6fire: Fix UAF at error handling during probe
     - ALSA: lx6464es: fix period byte count for 16-bit streams
     - ALSA: pcm: wake linked drain waiters on unlink
     - ALSA: seq: Fix division by zero in initialize_timer()
     - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes
     - ALSA: ump: fix double free of out_cvts on rawmidi error
     - ASoC: tas2562: fix DVC coefficient write order
     - ASoC: tas2562: fix broken entries in the volume lookup table
     - ata: libata-eh: Increase STANDBY IMMEDIATE timeout
     - ata: libata-sata: fix ata_scsi_lpm_supported() iteration
     - ALSA: usb-audio: fix use-after-free in ump_to_endpoint()
     - ALSA: usb-audio: fix stack info leak in RME Digiface status
     - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
     - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
     - ALSA: usb-audio: Clamp frame size in implicit-feedback mode
     - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
     - e1000: fix memory leak in e1000_probe()
     - igbvf: Fix leak in TX DMA error cleanup
     - ipvs: do not propagate one-packet flag to synced conns
     - net/smc: fix socket use-after-free during link group termination
     - netfilter: ipset: do not update comments from kernel-side hash adds
     - tipc: avoid use-after-free in poll trace queue dumps
     - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames
     - binfmt_misc: reject a flag character as the field delimiter
     - binfmt_misc: don't let an 'F' entry pin its own instance
     - mm/page_reporting: use system_freezable_wq to fix UAF during suspend
     - mm: memcg: initialize *locked in memcg1_oom_prepare() stub
     - net: bridge: stop fast-leave after deleting a port group
     - net: ipv6: clear suppressed fib6 rule result
     - [powerpc*] ps3: Fix map failure path in dma_ioc0_map_pages()
     - veth: convert frag_list skbs before running XDP
     - vxlan: re-fetch eth header after route_shortcircuit()
     - vxlan: unclone skb head before modifying eth header in
       route_shortcircuit()
     - vxlan: use neigh_ha_snapshot() in route_shortcircuit()
     - vxlan: use pskb_network_may_pull() in route_shortcircuit()
     - ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()
     - tracing: Check return value of __register_event() in
       trace_module_add_events()
     - tracing/filters: Fix false positive match in regex_match_full()
     - spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure
     - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
     - sctp: reject stale cookies with mismatched verification tags
     - sctp: prevent peer transport count overflow
     - hwmon: (npcm750-pwm-fan): stop fan timer on device detach
     - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client
     - i2c: amd-mp2: Unregister callback on adapter add failure
     - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure
     - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
     - cpufreq: schedutil: Publish util hooks only after all sg_cpu are
       initialized
     - power: supply: bq25890: fix the -10 C NTC lookup entry
     - power: supply: max17040: handle missing status supplier
     - [s390x] pci: Fix s390_pci_mmio_write syscall error return without MIO
     - [s390x] qeth: Check CAP_NET_ADMIN for private ioctls
     - [s390x] dasd: Fix potential NULL pointer dereference
     - [s390x] dasd: Fix undersized format-check buffer
     - [s390x] zcrypt: Fix wrong domain value verification with EP11 CPRBs
     - [s390x] zcrypt: Validate length for CCA AES cipher key requests
     - [s390x] zcrypt: Validate length for CCA ECC private key requests
     - [arm64] phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
     - [arm64] phy: zynqmp: use read-modify-write for SERDES scrambler bypass
     - [arm64] phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
     - net: openvswitch: fix potential UAF on meter attach failure
     - net: openvswitch: fix skb leak on flow key update failure during
       recirculation
     - net: openvswitch: fix skb leak on flow key update failure during ct
     - ice: wait for reset completion in ice_resume()
     - ice: fix memory leak in ice_lbtest_prepare_rings()
     - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock
       deadlock
     - i2c: iproc: reset bus after timeout if START_BUSY is stuck
     - i2c: imx: Fix slave registration race and error handling
     - i2c: imx: Cancel hrtimer before clearing slave pointer
     - can: c_can: c_can_chip_config(): keep controller in init mode until
       bittiming is configured
     - can: ems_usb: validate CPC message lengths
     - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB
       resubmit failure
     - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb
       allocation failure
     - can: j1939: transport: j1939_session_fresh_new(): initialize receive
       buffer
     - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking
     - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in
       kvaser_usb_hydra_get_busparams()
     - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received
       command extents
     - can: softing: fw_parse(): validate firmware record spans
     - can: peak_usb: add bounds check for USB channel index
     - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB
       submit error
     - can: peak_usb: validate uCAN receive record lengths
     - can: ctucanfd: add missing MODULE_DEVICE_TABLE()
     - can: ctucanfd: use self-test mode for PRESUME_ACK
     - can: ctucanfd: unmap BAR0 using base address
     - can: ctucanfd: handle bus error interrupts
     - can: ctucanfd: mark error-active controller status valid
     - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs
     - [arm*] drm/vc4: Supply the overflow slot size in BPOS, not the whole bin
       BO size
     - [arm*] drm/vc4: Zero the tile state data array before each BIN job
     - [arm64] drm/panthor: reject firmware sections with oversized data
     - [arm64] drm/panthor: validate firmware interface structure sizes
     - [arm64] drm/mediatek: ovl_adaptor: balance component registrations
     - drm/amdgpu: restore UMD profile pstate after runtime resume
     - drm/amdgpu: cap GTT size to physical RAM on APUs
     - drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
     - drm/amd/display: use proper context for logging
     - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
     - drm/amdkfd: fix QID bit leak in pqm_create_queue()
     - drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
     - drm/amdkfd: Handle invalid event type in CRIU event restore
     - drm/amdkfd: hold event_mutex while checkpointing CRIU events
     - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
     - drm/vmwgfx: reject DX_BIND_QUERY without a DX context
     - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
     - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
     - drm/vmwgfx: bound DMA command body size against suffix pointer
     - drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
     - drm/vmwgfx: use check_add_overflow for shader size+offset bound
     - drm/vmwgfx: validate external BO copy bounds for both stride paths
     - spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX
     - HID: logitech-dj: Fix maxfield check in DJ short report validation
     - ata: libahci_platform: Do not set mask_port_map when not needed
     - ata: ahci: Make ahci_ignore_port() handle empty mask_port_map
     - of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array()
       fails
     - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release
     - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting
     - drm/xe: Introduce xe_gt_dbg_printer()
     - drm/xe: Apply whitelist to engine save-restore
     - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists
       (CVE-2026-68267)
     - drm/xe/rtp: Maintain OA whitelists separately
     - drm/xe/rtp: Keep track of non-OA nonpriv slots
     - drm/xe/rtp: Generalize whitelist_apply_to_hwe
     - drm/xe/rtp: Save OA nonpriv registers to register save/restore lists
     - drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs
     - drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt
     - drm/xe/oa: (De-)whitelist OA registers on OA stream open/release
     - drm/xe/rtp: Ensure locking/ref counting for OA whitelists
     - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
     - fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes
     - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
     - lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled()
     - mm/slab: prevent unbounded recursion in free path with new kmalloc type
     - gpio: pch: use raw_spinlock_t for the register lock
     - usb: gadget: f_tcm: synchronize delayed set_alt with teardown
       (CVE-2026-68367)
     - usb: typec: ucsi: split connector lock classes
     - usb: typec: ucsi: Fix race condition and ordering in port unregistration
     - media: i2c: imx219: Rename VTS to FRM_LENGTH
     - media: imx219: Fix maximum frame length in lines
     - media: chips-media: wave5: Support CBP profile
     - media: uapi: rkisp: Correct name version enum
     - wifi: brcmfmac: drain bus_reset work on device removal (CVE-2026-64586)
     - wifi: ath6kl: fix use-after-free in aggr_reset_state() (CVE-2026-68198)
     - wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW)
     - wifi: brcmfmac: set F2 blocksize to 256 for BCM43752
     - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change
     - mptcp: pm: avoid code duplication to lookup endp
     - mptcp: add mptcp_userspace_pm_lookup_addr helper
     - mptcp: pm: use addr entry for get_local_id
     - mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)
     - drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions
     - drm/amdgpu: Fix context pstate override handling (CVE-2026-68273)
     - drm/sched: Store the drm client_id in drm_sched_fence
     - drm/amdgpu: give each kernel job a unique id
     - drm/amdgpu/gfx: fix cleaner shader IB buffer overflow (CVE-2026-68276)
     - drm/fb-helper: Allocate and release fb_info in single place
     - drm/tegra: fbdev: Remove offset into framebuffer memory
     - drm/exec: Remove the index parameter from
       drm_exec_for_each_locked_obj[_reverse]
     - drm/xe: Wait on external BO kernel fences in exec IOCTL
     - [arm64] drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable()
     - [arm64] drm/i915/vrr: require valid min/max vfreq for VRR (CVE-2026-68254)
     - drm/xe: Rename ___xe_bo_create_locked()
     - drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266)
     - [arm64] drm/i915/hdcp: Move to using intel_display in intel_hdcp
     - [arm64] drm/i915/hdcp: require monotonically increasing seq_num_v
     - [arm64] drm/i915/hdcp: Skip inactive MST connectors when building stream
       list
     - [arm64] drm/i915/hdcp: check streams[] bounds before overflow
       (CVE-2026-68253)
     - drm/xe: Stub out new pagefault layer
     - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)
     - rxrpc: Generate rtt_min
     - rxrpc: Adjust the rxrpc_rtt_rx tracepoint
     - rxrpc: Fix the calculation and use of RTO
     - rxrpc: Manage RTT per-call rather than per-peer
     - rxrpc: Fix irq-disabled in local_bh_enable() (CVE-2025-38525)
     - can: use skb hash instead of private variable in headroom
     - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
     - usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
     - drm/fb-helper: Fix a locking bug in an error path
     - [arm64,armhf] drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.104
     - mount: honour SB_NOUSER in the new mount API
     - drm/amd/display: Add AV mute wait frames to dce110_set_avmute
     - drm/amd/display: Check for tg ops in dce110_set_avmute
     - [s390x] zcrypt: Fix missing mem scrub at clear key import in
       cca_clr2cipherkey()
     - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
     - [arm64] dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer
     - drm/bridge: ps8640: propagate AUX transfer register errors
     - [arm64] net: hns3: fix speed configuration residue after driver reload
     - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit"
     - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
     - enic: fix tx_hang_reset use-after-free on device removal
     - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock
     - pds_core: keep the health thread stopped during reset
     - pds_core: cancel pending PCI reset work on AER recovery
     - netfilter: ipset: switch ext_size to atomic64_t
     - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
     - ipvs: return the csum validation for forward hook
     - watchdog: bd96801_wdt: Fix timeout for enabled WDG
     - btrfs: fix memory leak in btrfs_do_encoded_write()
     - bpf: Preserve pointer state for commuted arithmetic
     - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in
       smc_llc_event_handler()
     - net/sched: cls_route: fix fastmap use-after-free on filter
     - [arm64] net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
     - devlink: fix net namespace reference leak in reload
     - net/mlx5: fw_tracer, return NULL on create error
     - counter: microchip-tcb-capture: Fix DT channel validation
     - bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch
     - bpf: tcp: Make sure iter->batch always contains a full bucket snapshot
     - bpf: tcp: Get rid of st_bucket_done
     - bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items
     - bpf: tcp: Avoid socket skips and repeats during iteration
     - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
     - vhost/vdpa: reject overflowing PA map page counts on 32-bit
     - vdpa/mlx5: Fix buffer length in create_direct_keys()
     - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss()
     - xsk: require at least 16 bytes of TX metadata
     - udp: fix potential use-after-free in tunnel segmentation
     - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
     - net/openvswitch: check Ethernet header length in key_extract()
     - net/sched: cls_api: Always acquire rtnl_lock when destroying locked
       classifiers
     - hwmon: (nzxt-smart2) Check return value of init_device() in probe
     - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations
     - bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss()
     - bnxt_en: Determine and store default RX ring in vnic structure
     - bnxt_en: Refresh VNIC default ring on queue restart if needed
     - bnxt_en: Fix PTP PPS setting bug
     - sctp: fix addip_serial increment on ASCONF_ACK allocation failure
     - tcp: fix TFO max_qlen accounting across reuseport migration
     - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
     - net: prestera: validate firmware header length
     - net: remove WARN_ON_ONCE() from sk_mc_loop()
     - net/smc: fix TOCTOU race between smc_listen_out() and listener close
     - [amd64] net: thunderbolt: Tear down DMA paths before stopping the rings
     - ata: pata_sl82c105: fix bridge revision use-after-free
     - net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
     - sctp: clear control chunk transport if it is being removed
     - tls: don't abort the connection on signal-interrupted sends
     - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string
       termination
     - hwmon: (ads7828) Fix external VREF regulator handling
     - hwmon: (ltc4282) Avoid overflow in maximum power calculation
     - hwmon: (ltc4282) Clamp negative current limits
     - hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt
     - mm/vmscan: wake up flushers conditionally to avoid cgroup OOM
       (Closes: #1143545)
     - net: fec: do not release NULL pages when RX buffer allocation fails
     - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
     - mtd: spinand: fix direct mapping creation sizes
     - mtd: spinand: try a regular dirmap if creating a dirmap for continuous
       reading fails
     - mtd: spinand: repeat reading in regular mode if continuous reading fails
     - swapfile: call cond_resched() before locking si->lock
     - Input: evdev - sanitize event type index when fetching event masks
     - ALSA: usb-audio: fix OOB write on Type II inbound URBs
     - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
     - [amd64] thunderbolt: icm: Preserve USB4 proxy data-valid bit
     - usb: cdnsp: fix incorrect endian conversions for APB timeout register
     - usb: gadget: f_ncm: Use unsigned int for ndp_index
     - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
     - net: usb: ipheth: fix carrier_work UAF on disconnect
     - vt: add permission check for KDSKBMETA ioctl
     - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
     - Input: evdev - fix information leak in evdev_pass_values()
     - ima: fix out-of-bounds read in xattr_verify()
     - ipvs: stop estimator after disabled calc phase
     - ipvs: add totalconns for dest
     - ipvs: properly update the overload flag on dest edit
     - ipvs: clear IPv4 options after rebasing tunnel ICMP errors
     - packet: use consistent hard_header_len in non-ring send paths
     - packet: use consistent hard_header_len in TX_RING send path
     - net/packet: reset the MAC header on the packet-socket transmit path
     - packet: synchronize pressure clearing with ring reconfiguration
     - net: fix skb length accounting after generic XDP frag adjustment
     - net: openvswitch: reallocate update replies for mismatched IDs
     - net/sched: reject overly deep qdisc hierarchies
     - net: octeontx2-pf: Fix UB in shift operation
     - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
     - mac802154: fix netdev use-after-free in beacon worker
     - netfilter: ebt_nflog: pin the NFLOG backend
     - net: bridge: mrp: fix uninitialised bytes on the wire
     - [s390x] KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
       (CVE-2026-74514)
     - [s390x] KVM: s390: pci: Fix missing error codes and memory unaccounting
     - [s390x] KVM: s390: pci: Fix resource leak on IRQ registration failure
     - [s390x] KVM: s390: pci: Fix aisb calculation
     - block: Reorder the request allocation code in blk_mq_submit_bio()
     - blk-mq: pop cached request if it is usable (CVE-2026-64017)
     - blk-mq: reinsert cached request to the list
     - dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk
     - [amd64] crypto: ccp - Add new SEV/SNP platform shutdown API
     - [amd64] KVM: SVM: Add support to initialize SEV/SNP functionality in KVM
     - [amd64] crypto: ccp - Fix checks for SNP_VLEK_LOAD input buffer length
     - [amd64] crypto: ccp - Abort doing SEV INIT if SNP INIT fails
     - futex: Prevent robust futex exit race some more
     - kunit/fortify: Replace "volatile" with OPTIMIZER_HIDE_VAR()
     - kunit/fortify: Add back "volatile" for sizeof() constants
     - pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
     - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
     - ipv4: fix use-after-free in fib_nhc_update_mtu()
     - mei: pull kvfree out of spinlock
     - nvmem: layouts: Add fixed-layout driver
     - serial: qcom-geni: fix TX DMA buffer flush
     - serial: 8250_dma: Clear stale RX state on shutdown
     - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
     - staging: rtl8723bs: fix OOB read in WMM_param_handler()
     - staging: rtl8723bs: fix missing shared-key auth challenge length check
     - staging: rtl8723bs: validate monitor transmit frame lengths
     - misc: fastrpc: fix channel ctx ref leak when session alloc fails
     - misc: fastrpc: Remove buffer from list prior to unmap operation
     - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
     - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
     - ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
     - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
     - ALSA: usx2y: bound the hwdep mmap fault offset
     - tracing: Fix race between update_event_fields and, event_define_fields
     - fbdev: bitblit: bound-check glyph index in bit_cursor()
     - ring-buffer: Prevent subbuf order change when resizing is disabled
     - mm/huge_memory: fix huge_zero_pfn race
     - net: smc: fix splice entry lifetime imbalance in smc_rx_splice
     - ipv6: prevent in6_dev_get() from resurrecting inet6_dev
     - netfilter: bridge: release template ct on non-IP path
     - netfilter: nf_conntrack: defer invalid log until after unlock
     - net: atlantic: free stranded TX buffers on ring deinit
     - net: atlantic: free RX pages of consumed but not refilled buffers
     - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
     - net/sched: act_gact, act_police: range check the fallback control action
     - ovl: don't warn when the mount is completed from another user namespace
     - binfmt_misc: don't warn when the mount is completed from another user
       namespace
     - Revert "drm/amdgpu: fix aperture mapping leak"
     - xdp: reject clones that overrun skb_shared_info tailroom
     - vxlan: do not arm the ageing timer on a device that is down
     - vsock/virtio: read virtqueues under worker locks
     - vsock/virtio: avoid refilling the RX queue after teardown
     - veth: fix skb length accounting after XDP frag adjustment
     - vhost: reset the vring metadata cache on vring reconfiguration
     - tls: don't leave a full plaintext sk_msg ring unpushed
     - tipc: read le->link under the node lock in tipc_node_link_down()
     - smb: client: Fix use-after-free in cifs_try_adding_channels()
     - [amd64] KVM: x86/mmu: WARN and clear role.invalid when creating a child
       shadow page
     - eventfs: Fix use-after-free in eventfs_remove_rec()
     - Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
     - ptp: ocp: Fix board ID over-read
     - ipv6: fix Route Information option length validation
     - ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
     - fscrypt: use the mount idmap for the owner check in
       fscrypt_ioctl_set_policy()
     - sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
     - ima: Instantiate file_truncate and path_truncate hooks
     - fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
     - fsverity: Fix silent truncation in bpf_get_fsverity_digest()
     - bpf, sockmap: Fix sk_redir use-after-free in send verdict
     - scsi: scsi_debug: Negate wrapped memcmp() result
     - sctp: keep chunk->transport in step with the list it is queued on
     - sctp: fix use-after-free of cached ASCONF chunk
     - sctp: clear new_transport when removing a peer
     - [amd64] thunderbolt: Bound the DROM dual link port number before indexing
       sw->ports
     - [amd64] thunderbolt: Fix bandwidth group reservation indexing
     - bpf: tcp: fix double sock release on batch realloc
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.105
     - block: stop the timeout timer when releasing a never added disk
     - bpf: Fix linked reg delta tracking when src_reg == dst_reg
       (CVE-2026-53092)
     - bpf: Clear delta when clearing reg id for non-{add,sub} ops
     - f2fs: fix UAF issue in f2fs_merge_page_bio() (CVE-2025-40054)
     - mtd: ubi: skip programming unused bits in ubi headers
     - ubi: fastmap: fix ubi->fm memory leak
     - mm/damon/ops-common: putback folios on invalid migrate nid
       (CVE-2026-74644)
     - mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD}
     - igc: fix netdev not re-attached after resume if interface is down
     - ipvs: separate destination availability state
     - net: mana: Fix EQ leak in mana_remove on NULL port
     - [amd64] crypto: ccp: Add external API interface for PSP module
       initialization
     - [amd64] KVM: SVM: Ensure PSP module is initialized if KVM module is
       built-in
     - selinux: require every boolean value to be defined
     - selinux: reject a class permission count below its inherited common
     - selinux: do not cancel a policy conversion that never started
     - selinux: reject an unclaimed class value in security_get_classes()
     - mptcp: avoid combining some incoming suboptions
     - mptcp: options: reset DSS fields in case of unexpected size
     - mptcp: fastopen: only mark MPTFO subflows with SYN data
     - [s390x] qeth: validate user buffer length in SNMP and ARP query ioctls
     - [amd64] ASoC: SOF: sof-audio: Fix error path in
       sof_widget_setup_unlocked()
     - fbdev: core: Fix pointer desynchronization in fb_io_read()
     - drm/panthor: skip zero-sized firmware sections
     - drm/amdgpu: reject oversized IBs with per-ring packet limits
     - drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12
     - drm/amdgpu: fix aperture iounmap skipped on device removal
     - [amd64] ASoC: SOF: topology: Use acpi mach from the machine driver
     - Input: xpad - add support for ZENAIM LEVERLESS
     - Input: cs40l50-vibra - validate custom data from user space
     - [powerpc*] pseries: pci - logic bug
     - Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
     - Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
     - Input: psxpad-spi - set driver data before use
     - Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
     - Input: iforce - validate input packet lengths
     - [powerpc*] pseries: lparcfg - fix kbuf[] underflow
     - Input: synaptics-rmi4 - zero report size on F54 work error
     - Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
     - Input: synaptics-rmi4 - block s_input when F54 queue is busy
     - Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
     - Input: hynitron_cstxxx - validate touch count and finger IDs
     - [arm64] crypto: qce - fix error path in devm_qce_register_algs
     - gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on
       unbind
     - [arm64] pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state
       0
     - libceph: fix multiple unsafe decodes in decode_locker()
     - ftrace: Protect direct_functions in ftrace_find_rec_direct
     - ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
     - Input: sur40 - fix input device registration ordering
     - Input: sur40 - fix V4L error path cleanup
     - libceph: Avoid using invalid osd indices from primary_temp
     - ceph: fix MDS random selection readiness predicate
     - libceph: tolerate addrvecs with multiple entries of the same type
     - [armhf] mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on
       32-bit
     - mmc: sdhci: unmap the bounce buffer before device release
     - mmc: sdhci: make tuning_err a signed int
     - drm/connector/hdmi: Fix out of bounds memory read
     - drm/xe: Order ring writes before ring tail updates
     - drm/radeon: fix autosuspend cleanup during teardown
     - [s390x] vfio_ccw: Free all memory if cp_init() fails
     - [s390x] vfio_ccw: Limit the number of channel program segments
     - [s390x] vfio_ccw: Cancel existing workqueues
     - [s390x] vfio_ccw: Ensure index for read/write regions are within range
     - [s390x] vfio_ccw: Ensure first IDAW remains constant
     - [s390x] vfio_ccw: Fix out of bounds check on CCW array
     - [s390x] vfio_ccw: Move cp cleanup out of not operational
     - [s390x] vfio_ccw: Selectively expand io_mutex
     - [s390x] vfio_ccw: Calculate idal length based on idaw type
     - [s390x] vfio_ccw: Implement a crw lock
     - drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix
     - drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE
     - drm/amdgpu: Reject UVD message with invalid number of h265 refs
     - drm/amdgpu: fix nbif 6.3.1 l1 low power not functional
     - drm/amdgpu: check ASPM on the dGPU host link
     - drm/amdgpu: validate GEM_CREATE domain combinations
     - drm/amdgpu: Reject UVD message with dimensions above 4096
     - drm/amdgpu: Implement insert_end for VCE 3
     - drm/amdgpu: Fix UVD min buffer sizes
     - drm/amdgpu: Fix UVD dpb min size calculation for H264
     - drm/amdgpu: Fix UVD decode image min size calculation
     - drm/amdgpu: disallow multiple FENCE chunks in one submit
     - xfs: clear zapped attr fork state when bmap repair finds no attr fork
     - xfs: zero i_nlink before repair puts inode on unlinked list
     - xfs: only check mergeability of bnobt records
     - xfs: don't double-lock when deleting a self-referential directory
     - xfs: set the prev pointer when reinserting an inode on the unlinked list
     - xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers
     - xfs: nlink scrub must take IOLOCK before determining ILOCK state
     - xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev
     - xfs: fix ilock leak on error in xfs_dq_get_next_id
     - xfs: don't zap the attr fork on repair when there are queued pptr updates
     - xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair
     - xfs: fix allocated inodes that show up in the unlinked list
     - xfs: fix another iunlink infinite loop bug in online fsck
     - xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers
     - xfs: avoid UAF on sc->tempip in xrep_tempfile_create
     - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN
     - xfs: don't swallow dquot recovery verification errors
     - xfs: check xfarray iteration errors when committing unlinked inode lists
     - xfs: check v5 superblock features early
     - ceph: Remove ceph_writepage()
     - ceph: Use a folio in ceph_page_mkwrite()
     - ceph: Convert ceph_find_incompatible() to take a folio
     - ceph: Convert writepage_nounlock() to write_folio_nounlock()
     - ceph: fix writeback_count leak in write_folio_nounlock()
     - ceph: avoid fs reclaim while using current->journal_info
     - ceph: fix hanging __ceph_get_caps() with stale mds_wanted
     - libceph: Amend checking to fix `make W=1` build breakage
     - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
       (CVE-2026-68159)
     - mm/khugepaged: guard is_zero_pfn() calls with pte_present()
     - userfaultfd: prevent registration of special VMAs (CVE-2026-68166)
     - libceph: fix two unsafe bare decodes in decode_lockers() (CVE-2026-68082)
     - net/sched: serialize qdisc_rtab_list against concurrent get/put
       (CVE-2026-68138)
     - super: remove pointless s_root checks
     - super: skip dying superblocks early
     - super: use a common iterator (Part 1)
     - super: use common iterator (Part 2)
     - fs/super: fix emergency thaw double-unlock of s_umount
     - super: fix emergency thaw deadlock on frozen block devices
       (CVE-2026-68132)
     - smb: move smb_version_values to common/smbglob.h
     - smb: move get_rfc1002_len() to common/smbglob.h
     - smb/server: rename include guard in smb_common.h
     - ksmbd: rename smb2_get_msg to smb_get_msg
     - smb/server: fix minimum SMB1 PDU size
     - smb/server: fix minimum SMB2 PDU size
     - ksmbd: validate minimum PDU size for transform requests (CVE-2026-68431)
     - eventpoll: pin files while checking reverse paths
     - tcp: Pass flags to __tcp_send_ack
     - tcp: fast path functions later
     - tcp: reorganize tcp_sock_write_txrx group for variables later
     - tcp: challenge ACK for non-exact RST in SYN-RECEIVED (CVE-2026-68118)
     - iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
     - btrfs: add debug build only WARN
     - btrfs: add space_info argument to btrfs_chunk_alloc()
     - btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg()
     - btrfs: zoned: fix missing chunk metadata reservation
     - [amd64] KVM: x86: Cancel delayed I/O APIC EOI handling before destroying
       vCPUs (CVE-2026-74517)
     - [arm64] ASoC: tas2562: Validate values for volume writes
     - ata: libata-scsi: terminate deferred commands on time out
     - igc: remove napi_synchronize() in igc_down()
     - ksmbd: conn lock to serialize smb2 negotiate
     - ksmbd: reject repeated SMB2 NEGOTIATE requests (CVE-2026-74494)
     - net: pktgen: fix code style (WARNING: Block comments)
     - net: pktgen: fix proc entry use-after-free (CVE-2026-74479)
     - binfmt_misc: don't leak the user namespace when the mount fails
       (CVE-2026-74483)
     - fsnotify, lsm: Decouple fsnotify from lsm
     - fsnotify: opt-in for permission events at file open time
     - fs: don't block write during exec on pre-content watched files
     - binfmt_misc: restore write access when removing an entry (CVE-2026-74487)
     - vrf: Make pcpu_dstats update functions available to other modules.
     - vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS.
     - vxlan: use pskb_network_may_pull() for transmit path header pulls
       (CVE-2026-74474)
     - ice: fix VF interrupts cleanup
     - include/linux/fs.h: add inode_lock_killable()
     - smb: client: fix race with fallocate(2) and AIO+DIO
     - cifs: add fscache_resize_cookie() to cifs_setsize()
     - can: rcar_canfd: change the initializing flow for clocks and resets
     - drm/amd/pm: Use same metric table for APU
     - drm/amd/pm: Use macro to initialize metrics table
     - drm/amd/pm: fix torn gpu metrics reads
     - drm/amdgpu: remove unused function parameter
     - drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
     - drm/amd/pm: adjust the visibility of pp_table sysfs node
     - drm/amd/pm: fix pptable use-after-free (CVE-2026-74450)
     - net: tap: set skb->dev before parsing virtio net header in
       tap_get_user_xdp() (CVE-2026-74684)
     - drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
     - ring-buffer: Simplify functions with __free(kfree) to free allocations
     - ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
       (CVE-2026-74602)
     - mm/pagewalk: split walk_page_range_novma() into kernel/user parts
     - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
       (CVE-2026-74672)
     - mm/ptdump: always stabilise against page table freeing using init_mm
       (CVE-2026-74599)
     - KVM: SVM: Serialize accesses to the owner and mirror list with separate
       lock (CVE-2026-74607)
     - ring-buffer: Simplify ring_buffer_read_page() with guard()
     - ring-buffer: Make ring_buffer_{un}map() simpler with guard(mutex)
     - ring-buffer: Prevent resizing of persistent ring buffer
     - [amd64] x86/mce: Remove __mcheck_cpu_init_early()
     - [amd64] x86/mce: Set CR4.MCE last during init
     - [amd64] x86/mce: Set up the polling timer before CMCI discovery
     - [amd64] ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget
       setup
     - net/x25: fix use-after-free of the socket by its timers (CVE-2026-74628)
     - [arm64] tegra: Add EL2 virtual timer interrupt for Tegra194
     - crypto: ccm - Set rfc4309 maxauthsize from child
     - netfilter: ipset: fix refcount race between list:set GC and swap
     - netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort
       path
     - netfilter: flowtable: publish GC-visible tuple last
     - netfilter: ipset: fix list type element drift bug
     - netfilter: ipset: let destroy callbacks adjust ext mem size
     - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
     - macvlan: inherit needed_headroom and needed_tailroom from lowerdev
     - veth: fix queue index used to wake the peer txq in veth_poll
     - tcp: fix icsk_ack.ato bitfield overflow
     - net: packet: fix wrong transport_header when sending VLAN-tagged frame
     - net/tls: Fail tls_sw_splice_read() after a failed async decrypt
     - af_packet: Don't send zero-byte data in tpacket_snd().
     - net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
     - net/sched: cls_u32: skip hash tables in u32_bind_class()
     - net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
     - net/sched: cls_bpf: reject dev-bound programs bound to a different device
     - drm/xe/oa: Fix sync entry leak on OA config emit failure
     - erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
     - perf: Unify perf_event_free_task() / perf_event_exit_task_context()
     - perf/core: Fix group leader use-after-free after sibling detach
       (CVE-2026-74637)
     - fs: unlock the superblock during iterate_supers_type
     - binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
     - net: harmonize tstats and dstats
     - ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS
     - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu()
     - ring-buffer: Use current_context for safe per-CPU buffer swap
       (CVE-2026-74601)
     - ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r
     - net: ethernet: mtk_eth_soc: only use legacy mode on missing IRQ name
     - net: ethernet: mtk_eth_soc: improve support for named interrupts
 .
   [ Salvatore Bonaccorso ]
   * drivers/mmc/host: Enable MMC_ALCOR as module (Closes: #1142912)
   * drivers/misc/cardreader: Enable MISC_ALCOR_PCI as module (Closes: #1142912)
linux (6.12.101-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.101
     - [amd64] platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU
       hotplug
     - net: airoha: Move airoha_eth driver in a dedicated folder
     - net: airoha: Fix skb->priority underflow in airoha_dev_select_queue()
     - bpf: Fix ld_{abs,ind} failure path analysis in subprogs (CVE-2026-53090)
     - netfilter: nft_counter: serialize reset with spinlock (CVE-2026-45897)
     - netfilter: nft_quota: use atomic64_xchg for reset
     - netfilter: nf_tables: revert commit_mutex usage in reset path
       (CVE-2026-45901)
     - drm/virtio: fix deadlock in display_info_cb by removing hotplug from
       dequeue worker
     - fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race
     - seqlock: Cure some more scoped_seqlock() optimization fails
     - seqlock: Allow KASAN to fail optimizing
     - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing
     - [amd64] KVM: x86: Check for invalid/obsolete root *after* making MMU pages
       available (CVE-2026-64561)
     - [amd64] KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on
       KVM_RUN
     - [amd64] KVM: nVMX: Hide shadow VMCS right after VMCLEAR (CVE-2026-64562)
     - [amd64] KVM: x86/mmu: Fix use-after-free on vendor module reload
     - can: bcm: add locking when updating filter and timer values
     - can: bcm: fix CAN frame rx/tx statistics
     - can: bcm: extend bcm_tx_lock usage for data and timer updates
     - can: bcm: validate frame length in bcm_rx_setup() for RTR replies
     - can: bcm: add missing device refcount for CAN filter removal
     - can: bcm: fix stale rx/tx ops after device removal
     - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
     - can: bcm: track a single source interface for ANYDEV timeout/throttle ops
     - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
     - can: isotp: serialize TX state transitions under so->rx_lock
     - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up
     - Revert "arm64: dts: ti: k3-am62a7-sk: Add bootph-all tag to vqmmc"
     - [arm64,armhf] gpu: host1x: Fix use-after-free in
       host1x_bo_clear_cached_mappings
     - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin
     - xprtrdma: Clear receive-side ownership pointers on release
     - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
       (CVE-2026-64565)
     - Input: ims-pcu - fix logic error in packet reset
     - [arm64] tegra: Fix CPU compatible string to cortex-a78ae on Tegra234
     - IB/mad: Drop unmatched RMPP responses before reassembly
     - mtd: mtdswap: remove debugfs stats file on teardown
     - mtd: nand: mtk-ecc: stop on ECC idle timeouts
     - btrfs: reject free space cache with more entries than pages
     - btrfs: fix root leak if its reloc root is unexpected in
       merge_reloc_roots()
     - RDMA/cma: Fix hardware address comparison length in netevent callback
     - RDMA/umem: Add pinned revocable dmabuf import interface
     - RDMA/irdma: Prevent rereg_mr for non-mem regions
     - RDMA/erdma: initialize ret for empty receive WR lists
     - [arm64] RDMA/hns: Fix potential integer overflow in mhop hem cleanup
     - RDMA/siw: publish QP after initialization
     - mtd: fix double free and WARN_ON in add_mtd_device() error paths
     - RDMA/irdma: Prevent overflows in memory contiguity checks
     - xfrm6: clear dst.dev on error to avoid double netdev_put in
       xfrm6_fill_dst()
     - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
     - wifi: cfg80211: cancel sched scan results work on unregister
     - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
     - wifi: mac80211_hwsim: clamp virtio RX length before skb_put
     - wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure
     - wifi: mac80211: fix fils_discovery double free on alloc failure
     - wifi: libertas: fix memory leak in helper_firmware_cb()
     - wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
     - wifi: cfg80211: pass net_device to .set_monitor_channel
     - wifi: cfg80211: define and use wiphy guard
     - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock
     - wifi: nl80211: free RNR data on MBSSID mismatch
     - wifi: cfg80211: derive S1G beacon TSF from S1G fields
     - wifi: nl80211: validate nested MBSSID IE blobs
     - wifi: cfg80211: validate PMSR measurement type data
     - wifi: cfg80211: validate PMSR FTM preamble range
     - wifi: cfg80211: reject unsupported PMSR FTM location requests
     - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
     - wifi: brcmfmac: initialize SDIO data work before cleanup
     - wifi: cfg80211: bound element ID read when checking non-inheritance
     - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop
     - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions()
     - ASoC: cs42l43: Correct report for forced microphone jack
     - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup
     - [arm64] firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context
     - cpufreq: Make cpufreq_update_pressure() fall back to cpuinfo.max_freq
     - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
     - ipv4: fib: free fib_alias with kfree_rcu() on insert error path
     - net/iucv: take a reference on the socket found in afiucv_hs_rcv()
     - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
     - scsi: core: wake eh reliably when using scsi_schedule_eh
     - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is
       registered
     - ata: sata_dwc_460ex: use platform_get_irq()
     - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending
       interrupts
     - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
     - [amd64] accel/ivpu: Fix wrong register read in LNL failure diagnostics
     - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC
     - Bluetooth: qca: fix NVM tag length underflow in TLV parser
     - Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update
     - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync
     - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds
     - Bluetooth: hci_qca: Clear memdump state on invalid dump size
     - smb/client: handle overlapping allocated ranges in fallocate
     - [amd64] drm/i915/gt: use correct selftest config symbol
     - [powerpc*] 85xx: Add fsl,ifc to common device ids
     - [powerpc*] time: Prepare to stop elapsing in dynticks-idle
     - [powerpc*] vtime: Initialize starttime at boot for native accounting
     - bpf, sockmap: Reject unhashed UDP sockets on sockmap update
     - [s390x] checksum: Fix csum_partial() without vector facility
     - [riscv64] hwprobe: Avoid uninitialized read in hwprobe_get_cpus()
     - can: j1939: fix lockless local-destination check
     - drm/xe/wopcm: fix WOPCM size for LNL+
     - smb: move some duplicate definitions to common/cifsglob.h
     - ksmbd: pin conn during async oplock break notification
     - ksmbd: validate compound request size before reading StructureSize2
     - net/sched: act_tunnel_key: Defer dst_release to RCU callback
     - sctp: fix auth_hmacs array size in struct sctp_cookie
     - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
     - usb: core: sysfs: add lock to bos_descriptors_read()
     - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()
     - usb: core: port: Deattach Type-C connector on component unbind
     - USB: storage: add NO_ATA_1X quirk for Longmai USB Key
     - usb: chipidea: fix usage_count leak when autosuspend_delay is negative
     - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback
     - usb: gadget: f_midi: cancel pending IN work before freeing the midi object
     - usb: gadget: printer: fix infinite loop in printer_read()
     - USB: gadget: snps-udc: fix device name leak on probe failure
     - USB: gadget: fsl-udc: fix device name leak on probe failure
     - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
     - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
     - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer
     - USB: serial: ftdi_sio: add support for E+H FXA291
     - USB: serial: io_edgeport: cap received transmit credits
     - USB: serial: keyspan_pda: fix data loss on receive throttling
     - USB: serial: option: add TDTECH MT5710-CN
     - crypto: rsa-pkcs1pad: Don't WARN on an empty digest
     - Revert "drm/amd/display: Add missing kdoc for ALLM parameters"
     - [riscv64] KVM: Serialize virtual interrupt pending state updates
     - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits
     - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware
       request
     - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin
     - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop
     - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop
     - hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop
     - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop
     - hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop
     - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
     - wifi: ath11k: fix potential buffer underflow in
       ath11k_hal_rx_msdu_list_get()
     - wifi: ath11k: Flush the posted write after writing to
       PCIE_SOC_GLOBAL_RESET
     - wifi: ath12k: Flush the posted write after writing to
       PCIE_SOC_GLOBAL_RESET
     - firewire: net: Fix fragmented datagram reassembly
     - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
     - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
     - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
     - wifi: carl9170: fix OOB read from off-by-two in TX status handler
     - wifi: carl9170: fix buffer overflow in rx_stream failover path
     - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8
     - btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps
     - btrfs: free mapping node on duplicate reloc root insert
     - ASoC: tas2781: bound firmware description string parsing
     - ALSA: hda: cs35l41: Fix NULL pointer dereference in
       cs35l41_get_acpi_mute_state() (CVE-2025-40098)
     - ALSA: hda: cs35l41: validate and free ACPI mute object
     - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI
     - ASoC: cs35l56: Don't use devres to unregister component
     - ASoC: cs35l56: Fix potential probe() deadlock
     - ASoC: cs35l56: Use complete_all() to signal init_completion
     - wifi: iwlwifi: mvm: validate SAR GEO response payload size
     - wifi: iwlwifi: mvm: fix read in wake packet notification handler
     - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
     - drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook()
     - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC
     - hwmon: (asus-ec-sensors) fix EC read intervals
     - hwmon: (asus-ec-sensors) add missed handle for ENOMEM
     - smb: client: validate DFS referral PathConsumed
     - hwmon: occ: validate poll response sensor blocks
     - regulator: mt6358: use regmap helper to read fixed LDO calibration
     - Bluetooth: btusb: validate Realtek vendor event length
     - netlink: specs: rt-link: convert bridge port flag attributes to u8
     - net/packet: avoid fanout hook re-registration after unregister
     - bonding: fix devconf_all NULL dereference when IPv6 is disabled
     - rds: drop incoming messages that cross network namespace boundaries
     - gtp: parse extension headers before reading inner protocol
     - [arm64] dpaa2-eth: put MAC endpoint device on disconnect
     - [amd64] iommu/amd: Wait for completion instead of returning early in
       iommu_completion_wait()
     - wifi: mac80211: tear down new links on vif update error path
     - nfp: Check resource mutex allocation
     - wan: wanxl: Only reset hardware after BAR mapping
     - wifi: mwifiex: bound uAP association event IEs to the event buffer
     - [amd64] iommu/amd: Bound the early ACPI HID map
     - [amd64] iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()
     - wifi: mac80211: recalculate TIM when a station enters power save
     - pds_core: reject component parameter in legacy firmware update
     - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN
     - net: txgbe: fix FDIR filter leak on remove
     - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
     - pds_core: fix deadlock between reset thread and remove
     - pds_core: fix use-after-free on workqueue during remove
     - pds_core: yield the CPU while waiting for the adminq to drain
     - pds_core: order completion reads after the ownership check
     - pds_core: fix auxiliary device add/del races
     - pds_core: check for workqueue allocation failure
     - sctp: validate stream count in sctp_process_strreset_inreq()
     - net: mctp i3c: clean up notifier and buses if driver register fails
     - tls: device: push pending open record on splice EOF
     - gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
     - nexthop: initialize extack in nh_res_bucket_migrate()
     - tipc: fix infinite loop in __tipc_nl_compat_dumpit
     - wifi: mt76: mt7925: guard link STA in decap offload
     - wifi: mt76: mt7915: guard HE capability lookups
     - wifi: mt76: connac: fix possible NULL-pointer deref in
       mt76_connac_mcu_uni_bss_he_tlv()
     - wifi: mt76: mt7925: fix possible NULL-pointer deref in
       mt7925_mcu_bss_he_tlv()
     - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()
     - wifi: mt76: mt7925: fix crash in reset link replay
     - wifi: mt76: mt7996: fix possible NULL-pointer deref in
       mt7996_mcu_sta_bfer_eht()
     - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning
     - ovl: fix trusted xattr escape prefix matching
     - amt: re-read skb header pointers after every pull
     - amt: make the head writable before rewriting the L2 header
     - net: bridge: vlan: fix vlan range dumps starting with pvid
     - net: hsr: fix memory leak on slave unregistration by removing synced VLANs
     - net: dpaa: fix mode setting
     - sctp: auth: verify auth requirement when auth_chunk is NULL
     - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
     - iomap: correct the range of a partial dirty clear
     - tipc: fix u16 MTU truncation in media and bearer MTU validation
     - net: stmmac: fix l3l4 filter rejecting unsupported offload requests
     - net: stmmac: reset residual action in L3L4 filters on delete
     - net: stmmac: enable the MAC on link up for all supported speeds
     - net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM
     - octeontx2-vf: set TC flower flag on MCAM entry allocation
     - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup
     - ppp: use IFF_NO_QUEUE in virtual interfaces
     - ppp: convert to percpu netstats
     - ppp: enable TX scatter-gather
     - ppp: annotate data races in ppp_generic
     - [amd64,arm64] hinic: remove unused ethtool RSS user configuration buffers
     - net: qrtr: restrict socket creation to the initial network namespace
     - dpll: add clock quality level attribute and op
     - net/mlx5: DPLL, Add clock quality level op implementation
     - net/mlx5: Remove newline at the end of a netlink error message
     - net/mlx5: Refactor EEPROM query error handling to return status separately
     - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads
     - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule
     - net/mlx5e: Report zero bandwidth for non-ETS traffic classes
     - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation
     - octeontx2-pf: tc: fix egress ratelimiting
     - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error
     - ice: allow creating VFs when !CONFIG_ICE_SWITCHDEV
     - ice: fix LAG recipe to profile association
     - rds: tcp: unregister sysctl before tearing down listen socket
     - net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets()
     - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
     - drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay
     - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()
     - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()
     - [arm64] drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply
       parsers
     - [arm64] drm/dp/mst: fix buffer overflows in sideband chunk accumulation
     - [arm64] drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply
       parsers
     - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at
       0 (v2)
     - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older
     - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT
     - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1
     - drm/nouveau: fix reversed error cleanup order in ucopy functions
     - drm/displayid: fix Tiled Display Topology ID size
     - [amd64] drm/i915/gem: Add missing nospec on parallel submit slot
     - drm/nouveau/acr: fix missing nvkm_done() in error path of
       nvkm_acr_oneinit()
     - drm/radeon: fix r100_copy_blit for large BOs
     - drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds
     - drm/amdkfd: Use kvcalloc to allocate arrays
     - drm/amdkfd: Check bounds in allocate_event_notification_slot
     - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation
     - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips
     - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path
       leaks prev_sink reference
     - drm/virtio: bound EDID block reads to the response buffer
     - drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()
     - [amd64] drm/i915: Return NULL on error in active_instance
     - [amd64] drm/i915/bios: range check LFP Data Block panel_type2
     - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()
     - [amd64] drm/i915/gem: Do not leak siblings[] on proto context error
     - [amd64] drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
     - drm/amd/pm: fix smu14 power limit range calculation
     - drm/gfx10: Program DB_RING_CONTROL
     - [arm64] drm/panthor: return error on truncated firmware
     - drm/amdgpu: Fix VFCT bus number matching with soft filter
     - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)
     - drm/amd/display: set new_stream to NULL after release
     - drm/amd/display: dce100: skip non-DP stream encoders for DP MST
     - drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge
     - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved
     - drm/vmwgfx: Validate vmw_surface_metadata::array_size
     - drm/vc4: Prevent shader BO mappings from becoming writable
     - media: airspy: Return queued buffers on start_streaming() failure
     - media: aspeed: fix missing of_reserved_mem_device_release() on probe
       failure
     - media: cec: seco: unregister adapter on IR probe failure
     - media: cedrus: clean up media device on probe failure
     - media: cedrus: Fix missing cleanup in error path
     - media: cedrus: skip invalid H.264 reference list entries
     - media: chips-media: wave5: Move src_buf Removal to finish_encode
     - media: cx231xx: fix devres lifetime
     - media: cx23885: add ioremap return check and cleanup
     - media: i2c: alvium: fix critical pointer access in alvium_ctrl_init
     - media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for
       overlapping ranges
     - media: marvell-cam: fix missing pci_disable_device() on remove
     - media: meson: vdec: Fix memory leak in error path of vdec_open
     - media: msi2500: Return queued buffers on start_streaming() failure
     - media: nuvoton: npcm-video: fix error handling in npcm_video_init()
     - media: nuvoton: npcm-video: fix memory leaks in probe and remove
     - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and
       pipe
     - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure
     - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error
       path
     - media: nxp: imx8-isi: Fix potential out-of-bounds issues
     - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding
     - media: pci: dm1105: Free allocated workqueue
     - media: pwc: Drain fill_buf on start_streaming() failure
     - media: pwc: Return queued buffers on start_streaming() failure
     - media: qcom: camss: Fix RDI streaming for CSID GEN2
     - media: radio-si476x: Unregister v4l2_device on probe failure
     - media: rtl2832: fix use-after-free in rtl2832_remove()
     - media: rtl2832_sdr: Return queued buffers on start_streaming() failure
     - media: saa7134: Fix a possible memory leak in saa7134_video_init1
     - media: stm32: dcmi: unregister notifier on probe failure
     - media: sun4i-csi: Return queued buffers on start_streaming() failure
     - media: tegra-video: vi: fix invalid u32 return value in format lookup
     - media: ti: vpe: unwind v4l2 device registration on probe error
     - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete()
     - media: v4l2-ctrls: validate HEVC active reference counts
     - media: v4l2-fwnode: Fix subdev owner overwritten in
       v4l2_async_register_subdev_sensor()
     - media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely
     - media: vb2: use ssize_t for vb2_read/vb2_write
     - media: vidtv: fix reference leak on failed device registration
     - media: vimc: fix reference leak on failed device registration
     - media: vivid: add vivid_update_reduced_fps()
     - media: vivid: check for vb2_is_busy() when toggling caps
     - media: vivid: fix cleanup bugs in vivid_init()
     - media: vpif_capture: fix OF node reference imbalance
     - ALSA: seq: close a re-opened queue timer in the destructor
     - ALSA: timer: drain a slave's callback before its master detaches it
     - ALSA: timer: don't re-enter an instance callback that is still running
     - wifi: ath6kl: fix OOB access from firmware ADDBA window size
     - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper
     - wifi: wilc1000: validate assoc response length before subtracting header
     - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses
     - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses
     - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses
     - wifi: brcmfmac: make release_scratchbuffers idempotent
     - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()
     - staging: rtl8723bs: fix inverted HT40 secondary channel offset
     - Bluetooth: hci_sync: Protect UUID list traversal
     - Bluetooth: RFCOMM: Fix session UAF in set_termios
     - exec: fix unsigned loop counter wrap in transfer_args_to_stack()
     - binfmt_misc: set have_execfd only once the interpreter is opened
     - objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0
     - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
     - firmware: stratix10-svc: fix memory leaks and list corruption bugs
     - [amd64] x86/boot/compressed: Disable jump tables
     - [amd64] comedi: comedi_parport: deal with premature interrupt
     - uio_hv_generic: Bind to FCopy device by default
     - serial: sc16is7xx: implement gpio get_direction() callback
     - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR
       platforms (Closes: #1143721)
     - mei: bus: access mei_device under device_lock on cleanup
     - [amd64] intel_th: fix MSC output device reference leak
     - misc: nsm: only unlock nsm_dev on post-lock error paths
     - misc: nsm: pin the module while the device is open
     - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev
     - tracing: Fix resource leak on mmiotrace trace_pipe close
     - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match()
     - tracing/probes: Avoid temporary buffer truncation in
       trace_probe_match_command_args()
     - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro
     - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()
     - [arm64] syscall: Ensure saved x0 is kept in-sync with tracer updates
     - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer
       updates"
     - mptcp: decrement subflows counter on failed passive join
     - mptcp: only set DATA_FIN when a mapping is present
     - sctp: don't free the ASCONF's own transport in DEL-IP processing
       (CVE-2026-64564)
     - sctp: avoid auth_enable sysctl UAF during netns teardown
     - sctp: close UDP tunnel sockets during netns teardown
     - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
     - ceph: fix refcount leak in ceph_readdir()
     - libceph: bound get_version reply decode to front len
     - libceph: Fix multiplication overflow in decode_new_up_state_weight()
     - libceph: guard missing CRUSH type name lookup
     - libceph: refresh auth->authorizer_buf{,_len} after authorizer update
     - libceph: Reject monmaps advertising zero monitors
     - libceph: reject zero bucket types in crush_decode
     - libceph: remove debugfs files before client teardown
     - amt: fix use-after-free in AMT delayed works
     - ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP
     - binfmt_elf_fdpic: only honour the first PT_INTERP
     - fs: preserve ACL_DONT_CACHE state in forget_cached_acl()
     - fscrypt: Add missing superblock check in find_or_insert_direct_key()
     - ftrace: Add global mutex to serialize trace_parser access
     - iomap: fix out-of-bounds bitmap_set() with zero-length range
     - [amd64] iommu/vt-d: Disallow SVA if page walk is not coherent
     - phonet: pep: fix use-after-free in pep_get_sb()
     - vxlan: require CAP_NET_ADMIN in the device netns for changelink
     - net: slip: serialize receive against buffer reallocation
     - geneve: require CAP_NET_ADMIN in the device netns for changelink
     - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
     - net/iucv: fix use-after-free of a severed iucv_path
     - net/mlx5e: Use sender devcom for MPV master-up
     - net/x25: fix use-after-free in x25_kill_by_neigh()
     - net: gro: fix double aggregation of flush-marked skbs
     - net: hip04: fix RX buffer leak on build_skb failure
     - proc: Fix broken error paths for namespace links
     - ice: fix PTP Call Trace during PTP release
     - rbd: Reset positive result codes to zero in object map update path
     - ksmbd: defer destroy_previous_session() until after NTLM authentication
     - ice: reject out-of-range ptype in ice_parser_profile_init
     - ice: use READ_ONCE() to access cached PHC time
     - ila: reload IPv6 header after pskb_may_pull in checksum adjust
     - mac802154: hold an interface reference across the scan worker
     - mac802154: llsec: reject frames shorter than the authentication tag
     - mctp: serial: handle zero-length frames to prevent rx buffer overflow
     - openvswitch: fix GSO userspace truncation underflow
     - pppoe: reload header pointer after dev_hard_header()
     - rtase: Workaround for TX hang caused by hardware packet parsing
     - tcp: initialize standalone TCP-AO response padding
     - tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
     - vsock/virtio: collapse receive queue under memory pressure
     - vxlan: mdb: Fix source list corruption on a failed replace
     - drm/amd/pm: fix amdgpu_pm_info power display units
     - drm/amd/pm: make pp_features read-only when scpm is enabled
     - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/gfx8: drop unecessary BUG_ON()
     - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/vce: fix integer overflow in image size
     - drm/amdgpu/vcn4: avoid rereading IB param length
     - drm/dp_mst: Handle torn-down topology gracefully in
       drm_dp_mst_topology_queue_probe()
     - drm/amdgpu: fix division by zero with invalid uvd dimensions
     - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
     - drm/amdgpu: fix aperture mapping leak
     - drm/amd/pm: fix smu13 power limit range calculation
     - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops
       (CVE-2026-53078)
     - net: qrtr: ns: Raise node count limit to 512
     - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
     - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
     - ksmbd: bound DACL dedup walk to copied ACEs
     - ksmbd: validate ACE size against SID sub-authorities
     - fscrypt: Avoid dynamic allocation in fscrypt_get_devices()
     - drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources
     - io_uring/rw: fix missing ERESTARTSYS conversion in read paths
     - net: pcs: xpcs: fix SGMII state reading
     - gve: fix Rx queue stall on alloc failure
     - mm/damon/core: validate ranges in damon_set_regions()
     - mm/damon/core: disallow overlapping input ranges for damon_set_regions()
     - iommufd: Reject invalid read count in iommufd_fault_fops_read()
     - iommufd: Break the loop on failure in iommufd_fault_fops_read()
       (CVE-2026-64290)
     - iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()
     - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
       (CVE-2026-64280)
     - i2c: davinci: Unregister cpufreq notifier on probe failure
     - VFS/audit: introduce kern_path_parent() for audit
     - audit: widen ino fields to u64
     - audit: use 'unsigned int' instead of 'unsigned'
     - audit: fix recursive locking deadlock in audit_dupe_exe()
     - i2c: i801: fix hardware state machine corruption in error path
       (CVE-2026-64205)
     - ALSA: hda: conexant: Remove mic bias threshold override
     - ALSA: hda: Fix cached processing coefficient verbs
     - rxrpc: Pull out certain app callback funcs into an ops table
     - rxrpc: serialize kernel accept preallocation with socket teardown
     - xfs: factor out xfs_attr3_leaf_init
     - xfs: don't replace the wrong part of the cow fork
     - fbcon: Rename struct fbcon_ops to struct fbcon_par
     - fbcon: Use correct type for vc_resize() return value
     - rxrpc: Fix CPU time starvation in I/O thread
     - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack
     - rxrpc: Use irq-disabling spinlocks between app and I/O thread
     - rxrpc: Fix notification vs call-release vs recvmsg
     - rxrpc: Fix socket notification race
     - tipc: restrict socket queue dumps in enqueue tracepoints
     - vduse: Use fixed 4KB bounce pages for non-4KB page size
     - vduse: remove unused vaddr parameter of vduse_domain_free_coherent
     - vduse: take out allocations from vduse_dev_alloc_coherent
     - VDUSE: avoid leaking information to userspace
     - octeontx2: Annotate mmio regions as __iomem
     - octeontx2-vf: clear stale mailbox IRQ state before request_irq()
     - octeontx2-pf: clear stale mailbox IRQ state before request_irq()
     - [arm64] dts: qcom: correct RBR opp entry
     - [arm64] dts: qcom: hamoa: Fix OPP tables for all DisplayPort controllers
     - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable
     - ASoC: mediatek: mt8192: Check runtime resume during probe
     - ASoC: mediatek: mt8183-afe-pcm: Shorten memif_data table using macros
     - ASoC: mediatek: mt8183-afe-pcm: Support >32 bit DMA addresses
     - ASoC: mediatek: mt8183-afe-pcm: use local `dev` pointer in driver
       callbacks
     - ASoC: mediatek: mt8183: Check runtime resume during probe
     - netfilter: nf_conntrack_sip: remove net variable shadowing
     - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
     - netfilter: bitwise: rename some boolean operation functions
     - netfilter: nf_tables: Remove unused nft_reduce_is_readonly()
     - netfilter: nf_tables: remove register tracking infrastructure
     - netfilter: nft_fib: reject fib expression on the netdev egress hook
     - gpu: Move DRM buddy allocator one level up (part two)
     - gpu/buddy: bail out of try_harder when alignment cannot be honoured
     - NFSD: pass nfsd_file to nfsd_iter_read()
     - sunrpc: allocate a separate bvec array for socket sends
     - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists
     - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow
     - remoteproc: xlnx: Check remote core state
     - mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch
     - mm/sparse-vmemmap: fix vmemmap accounting underflow
     - landlock: Prepare to use credential instead of domain for fowner
     - landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path
     - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages
     - mtd: maps: vmu-flash: fix fault in unaligned fixup
     - mm: prepare to move subsection_map_init() to mm/sparse-vmemmap.c
     - mm/sparse-vmemmap: fix DAX vmemmap accounting with optimization
     - dma: dw-edma: Fix build warning in dw_edma_pcie_probe()
     - dmaengine: dw-edma: Fix confusing cleanup.h syntax
     - dmaengine: dw-edma-pcie: Reject devices without driver data
     - i2c: imx: separate atomic, dma and non-dma use case
     - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
     - xfrm: Use nested-BH locking for nat_keepalive_sk_ipv[46]
     - xfrm: nat_keepalive: avoid double free on send error
     - tcp: defer md5sig_info kfree past RCU grace period in tcp_connect
     - tcp: Decrement tcp_md5_needed static branch
     - nvmet: Introduce nvmet_req_transfer_len()
     - nvmet-auth: reject short AUTH_RECEIVE buffers
     - ovl: use linked upper dentry in copy-up tmpfile
     - block: add helper add_disk_final()
     - block: remove redundant GD_NEED_PART_SCAN in add_disk_final()
     - dm-integrity: fix leaking uninitialized kernel memory
     - cleanup: add a scoped version of CLASS()
     - cleanup: fix scoped_class()
     - cred: add kernel_cred() helper
     - cred: add scoped_with_kernel_creds()
     - dm: avoid leaking the caller's thread keyring via the table device file
     - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
     - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()
     - net: mana: Validate the packet length reported by the NIC
     - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink
     - gve: fix header buffer corruption with header-split and HW-GRO
     - gpio: mt7621: avoid corruption of shared interrupt trigger state
     - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
     - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
     - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
     - ipmi: fix refcount leak in i_ipmi_request()
     - net/mlx5: HWS, Rearrange to prevent forward declaration
     - net/mlx5: HWS, fix matcher leak on resize target setup failure
     - octeontx2-pf: fix SQB pointer leak on init failure
     - ata: libata-core: Reject an invalid concurrent positioning ranges count
     - fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
     - net: macb: drop in-flight Tx SKBs on close
     - net: ipa: fix SMEM state handle leaks in SMP2P init
     - Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections
     - Bluetooth: hci_core: Fix not accounting for BIS/CIS/PA links separately
     - afs: Improve server refcount/active count tracing
     - afs: Make afs_lookup_cell() take a trace note
     - afs: Drop the net parameter from afs_unuse_cell()
     - rxrpc: Allow the app to store private data on peer structs
     - afs: Use the per-peer app data provided by rxrpc
     - afs: Fix afs_server ref accounting
     - afs: Simplify cell record handling
     - afs: Fix dynamic lookup to fail on cell lookup failure
     - afs: Fix lack of locking around modifications of net->cells_dyn_ino
     - USB: gadget: Use str_enable_disable-like helpers
     - USB: gadget: fsl-udc: fix dev_printk() device
     - usb: musb: omap2430: clean up probe error handling
     - usb: musb: omap2430: Do not put borrowed of_node in probe
     - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query
     - gpu: Fix uninitialized buddy for built-in drivers
     - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link
     - rxrpc: Fix locking issues with the peer record hash
     - wifi: nl80211: fix nl80211_start_radar_detection return value
     - net: ethernet: Remove accidental duplication in Kconfig file
     - afs: Set vllist to NULL if addr parsing fails
     - dpll: fix clock quality level reporting
     - afs: Fix delayed allocation of a cell's anonymous key
     - afs: handle CB.InitCallBackState3 requests without a server record
     - Bluetooth: hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK
     - Bluetooth: hci_conn: Fix not cleaning up Broadcaster/Broadcast Source
     - Bluetooth: hci_conn: Fix not cleaning up PA_LINK connections
     - Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
     - afs: Fix uninit var in afs_alloc_anon_key()
     - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after
       hotplug
 .
   [ Salvatore Bonaccorso ]
   * [rt] Refresh "locking/rt: Add sparse annotation for RCU." (context
     changes)
   * rhashtable: clear stale iter->p on table restart (CVE-2026-64563)
linux (6.12.100-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.97
     - smb/server: do not require delete access for non-replacing links
     - [amd64] iommu/vt-d: Clear Present bit before tearing down context entry
       (CVE-2026-45944)
     - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().
     - bpf: Support for hardening against JIT spraying (CVE-2026-64508)
     - [amd64] x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)
     - bpf: Restrict JIT predictor flush to cBPF
     - bpf: Skip redundant IBPB in pack allocator
     - bpf: Prefer packs that won't trigger an IBPB flush on allocation
     - bpf: Prefer dirty packs for eBPF allocations
     - sched/fair: Only update stats for allowed CPUs when looking for dst group
     - crypto: algif_skcipher - force synchronous processing
     - [arm64] KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU
       (CVE-2026-64287)
     - [arm64] KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp
       vCPU (CVE-2026-64286)
     - iommu: Pass old domain to set_dev_pasid op
     - [amd64] iommu/vt-d: Cleanup intel_context_flush_present()
     - [amd64] iommu/vt-d: Clear Present bit before tearing down scalable-mode
       context entry
     - timekeeping: Register default clocksource before taking tk_core.lock
     - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
       (CVE-2026-64534)
     - nvmet-tcp: Fix potential UAF when ddgst mismatch (CVE-2026-64535)
     - vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365)
     - vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970)
     - [armhf] crypto: sun4i-ss - Remove insecure and unused rng_alg
     - [amd64] iommu/amd: Use maximum Event log buffer size when SNP is enabled
       on Family 0x19
     - [amd64] iommu/amd: Use maximum PPR log buffer size when SNP is enabled on
       Family 0x19
     - [amd64] x86/mm: Fix check/use ordering in switch_mm_irqs_off()
     - net: dropreason: Gather SOCKET_ drop reasons.
     - af_unix: Set drop reason in unix_release_sock().
     - af_unix: Set drop reason in manage_oob().
     - af_unix: Set drop reason in unix_stream_read_skb().
     - af_unix/scm: fix whitespace errors
     - af_unix: Don't hold unix_state_lock() in __unix_dgram_recvmsg().
     - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb().
     - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb().
     - af_unix: Drop all SCM attributes for SOCKMAP. (CVE-2026-53005)
     - crypto: crypto4xx - Remove ahash-related code
     - crypto: crypto4xx - Remove insecure and unused rng_alg
     - crypto: hisi-trng - Remove crypto_rng interface
     - time/jiffies: Register jiffies clocksource before usage
     - time/jiffies: Change register_refined_jiffies() to void __init
     - media: uvcvideo: Use hw timestaming if the clock buffer is full
     - media: uvcvideo: Avoid partial metadata buffers
     - media: uvcvideo: Fix buffer sequence in frame gaps
     - media: uvcvideo: Fix dev_sof filtering in hw timestamp
     - media: uvcvideo: Do not add clock samples with small sof delta
     - media: uvcvideo: Relax the constrains for interpolating the hw clock
     - media: uvcvideo: Fix sequence number when no EOF
     - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties
     - dt-bindings: power: imx93: Add MIPI PHY power domain
     - serial: msm: Disable DMA for kernel console UART
     - serial: max310x: implement gpio_chip::get_direction()
     - serial: 8250_omap: clear rx_running on zero-length DMA completes
     - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc
     - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK)
     - afs: Fix netns teardown to cancel the preallocation charger
     - afs: fix NULL pointer dereference in afs_get_tree()
     - afs: Fix further netns teardown to cancel the preallocation charger
     - fbcon: fix NULL pointer dereference for a console without vc_data
     - clocksource/drivers/sun5i: Handle error returns from
       devm_reset_control_get_optional_exclusive()
     - drm/rockchip: Test for imported buffers with drm_gem_is_imported()
     - drm/tidss: Drop extra drm_mode_config_reset() call
     - drm/gpuvm: Do not prepare NULL objects
     - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch()
     - drm/radeon: fix integer overflow in radeon_align_pitch()
     - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure
     - libbpf: Report error when a negative kprobe offset is specified
     - drm/amd/pm: remove trailing semicolon from AMDGPU_PM_POLICY_ATTR macro
     - Documentation: proc: fix section numbering in table of contents
     - [arm64] dts: rockchip: Fix gmac0 reset pin for NanoPi R5S
     - [arm64] dts: qcom: sc8180x: Fix phy simple_bus_reg warning
     - [arm64] dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg
       warning
     - wifi: cfg80211: fix grammar in MLO group key error message
     - [arm64] tegra: Fix Tegra234 MGBE PTP clock
     - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block
     - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc
     - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()
     - wifi: rtw89: Correct data type for scan index to avoid infinite loop
     - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer
     - kconfig: fix potential NULL pointer dereference in conf_askvalue
     - soc: xilinx: Shutdown and free rx mailbox channel
     - wifi: ath9k: fix OOB access from firmware tx status queue ID
     - [armhf] dts: am335x-sl50: Fix audio bitclock and frame master endpoint
     - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH
     - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5
     - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register
       failure
     - media: cedrus: Fix failure to clean up hardware on probe failure
     - media: v4l2-common: Add YUV24 format info
     - memory: tegra: Wire up system sleep PM ops
     - [amd64] crypto: qat - fix heartbeat error injection
     - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path
     - drm/gpuvm: take refcount on DRM device
     - [arm64] dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc
     - [arm64] dts: imx8x-colibri: Correct SODIMM PAD settings
     - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
     - [amd64] crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one
     - crypto: atmel-sha204a - fix blocking and non-blocking rng logic
     - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve
     - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents
       (CVE-2026-64544)
     - dlm: fix add msg handle in send_queue ordered
     - nilfs2: fix backing_dev_info reference leak
     - media: qcom: camss: vfe: fix PIX subdev naming on VFE lite
     - [amd64] iommu/amd: Fix a stale comment about which legacy mode is user
       visible
     - [arm64] dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host
     - clk: scmi: Fix clock rate rounding
     - [arm64] dts: qcom: kodiak: Fix ICE reg size
     - [arm64] dts: qcom: sm8450: Fix ICE reg size
     - [arm64] drm/hisilicon/hibmc: move display contrl config to hibmc_probe()
     - [arm64] drm/hisilicon/hibmc: use clock to look up the PLL value
     - evm: terminate and bound the evm_xattrs read buffer
     - thermal: hwmon: Fix critical temperature attribute removal
     - clk: scpi: Unregister child clock providers on remove
     - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats()
     - crypto: ccp - Treat zero-length cert chain as query for blob lengths
     - spi: hisi-kunpeng: Use dev_err_probe() for host registration failure
     - net/sched: sch_htb: do not change sch->flags in htb_dump()
     - net/sched: sch_htb: annotate data-races (I)
     - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD
     - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier
     - RDMA/hns: Fix arithmetic overflow in calc_hem_config()
     - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference
     - RDMA/srpt: fix integer overflow in immediate data length check
     - [arm64] RDMA/hns: Initialize seqfile before creating file
     - drm/syncobj: Fix memory leak in drm_syncobj_find_fence()
     - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table()
     - media: atomisp: gc2235: fix UAF and memory leak
     - staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy()
     - firmware: arm_scmi: Read sensor config as 32-bit value
     - sysfs: clamp show() return value in sysfs_kf_read()
     - bitops: use common function parameter names
     - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions
     - net/sched: sch_drr: annotate data-races around cl->deficit
     - media: rockchip: rga: fix too small buffer size
     - [arm64] firmware: arm_scmi: Fix OOB in scmi_power_name_get()
     - [arm64] dts: qcom: sc7180: Add power-domain and iface clk for ice node
     - [arm64] dts: qcom: kodiak: Add power-domain and iface clk for ice node
     - [arm64] dts: qcom: sm8450: Add power-domain and iface clk for ice node
     - [arm64] dts: qcom: sm8650: Add power-domain and iface clk for ice node
     - tracing: Bound synthetic-field strings with seq_buf
     - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount()
     - device property: fix fwnode reference leak in
       fwnode_graph_get_endpoint_by_id()
     - driver core: Use mod_delayed_work to prevent lost deferred probe work
     - Revert "treewide: Fix probing of devices in DT overlays"
     - cpufreq: Documentation: fix sampling_down_factor range
     - cpufreq: conservative: Simplify frequency limit handling
     - pwm: imx27: Fix variable truncation in .apply()
     - RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed
     - bus: sunxi-rsb: Always check register address validity
     - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs
     - RDMA/rxe: Fix a use-after-free problem in rxe_mmap
     - IB/mlx4: Fix refcount leak in add_port() error path
     - [arm64] RDMA/hns: Fix warning in poll cq direct mode
     - [arm64] RDMA/hns: Fix log flood after cmd_mbox failure
     - RDMA/counter: Fix incorrect port index in rdma_counter_init() error
       cleanup
     - PM: sleep: Use complete() in device_pm_sleep_init()
     - jiffies: Define secs_to_jiffies()
     - driver core: Fix missing jiffies conversion in
       deferred_probe_extend_timeout()
     - driver core: Guard deferred probe timeout extension with
       delayed_work_pending()
     - mtd: spi-nor: Drop duplicate Kconfig dependency
     - ALSA: seq: midi: Serialize output teardown with event_input
     - pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table
     - pinctrl: cs42l43: Fix polarity on debounce
     - nvmet-tcp: fix page fragment cache leak in error path
     - nvme-multipath: fix flex array size in struct nvme_ns_head
     - workqueue: drop spurious '*' from print_worker_info() fn declaration
     - ipv6: guard against possible NULL deref in __in6_dev_stats_get()
     - net/sched: cls_bpf: prevent unbounded recursion in offload rollback
     - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client
       is registered
     - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove
     - gpu: host1x: Allow entries in BO caches to be freed
     - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output()
     - gpu: host1x: Fix iommu_map_sgtable() return value check
     - drm/tegra: Fix iommu_map_sgtable() return value check
     - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada
     - libbpf: Harden parse_vma_segs() path parsing
     - bpftool: Fix typo in struct_ops map FD generation for light skeleton
     - libbpf: Fix UAF in strset__add_str()
     - dax/kmem: account for partial discontiguous resource upon removal
     - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()
     - ocfs2: don't BUG_ON an invalid journal dinode
     - ocfs2: kill osb->system_file_mutex lock
     - crypto: hisilicon/qm - disable error report before flr
     - crypto: tegra - Fix dma_free_coherent size error
     - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm
     - sched/deadline: Always stop dl-server before changing parameters
     - sched/deadline: Reject debugfs dl_server writes for offline CPUs
     - [arm64] drm/msm/dp: fix HPD state status bit shift value
     - [arm64] drm/msm/dp: Fix the ISR_* enum values
     - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info
     - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe
     - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path
     - media: qcom: venus: drop extra padding in NV12 raw size calculation
     - media: qcom: venus: relax encoder frame/blur dimension steps on v4
     - media: qcom: venus: relax encoder frame/blur step size on v6
     - amba: use generic driver_override infrastructure
     - cdx: use generic driver_override infrastructure
     - Drivers: hv: vmbus: use generic driver_override infrastructure
     - rpmsg: use generic driver_override infrastructure
     - md/raid10: reset read_slot when reusing r10bio for discard
     - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback
     - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble
     - NFSD: Fix delegation reference leak in nfsd4_revoke_states
     - HID: wiimote: Fix table layout and whitespace errors
     - ata: libata: Fix ata_exec_internal()
     - nvdimm/btt: Handle preemption in BTT lane acquisition
     - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and
       multi-channel scans"
     - scsi: pm8001: Fix error code in non_fatal_log_show()
     - scsi: ufs: Fix wrong value printed in unexpected UPIU response case
     - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs
     - mm/fake-numa: fix under-allocation detection in uniform split
     - ext2: fix ignored return value of generic_write_sync()
     - sched: restore timer_slack_ns when resetting RT policy on fork
     - driver core: Use system_percpu_wq instead of system_wq
     - tick/sched: Fix TOCTOU in nohz idle time fetch
     - configfs_lookup(): don't leave ->s_dentry dangling on failure
     - drm/amdgpu: set sub_block_index for mca ras sub-blocks
     - bpftool: Use libbpf error code for flow dissector query
     - vhost: fix vhost_get_avail_idx for a non empty ring
     - [amd64] perf/x86/amd/core: Always use the NMI latency mitigation
     - [amd64] perf/x86/intel/uncore: Fix discovery unit lookup for multi-die
       systems
     - [amd64] perf/x86/amd/uncore: Use Node ID to identify DF and UMC domains
     - xfrm: fix NAT-related field inheritance in SA migration
     - drm/amdkfd: always resume_all after suspend_all
     - ocfs2: rebase copied fsdlm LVB pointers in locking_state
     - ocfs2: fix buffer head management in ocfs2_read_blocks()
     - ocfs2: reject FITRIM ranges shorter than a cluster
     - ocfs2/dlm: require a ref for locking_state debugfs open
     - ocfs2: fix race between ocfs2_control_install_private() and
       ocfs2_control_release()
     - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures
     - netfilter: nfnetlink_cthelper: use {READ,WRITE}_ONCE for accessing helper
       flags
     - netfilter: synproxy: drop packets if timestamp adjustment fails
     - netfilter: synproxy: adjust duplicate timestamp options
     - netfilter: synproxy: fix unaligned memory access in timestamp adjustment
     - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock
     - netfilter: conntrack: revert ct extension genid infrastructure
     - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is
       pptp
     - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path()
     - RDMA/irdma: Fix OOB read during CQ MR registration
     - RDMA/irdma: Initialize iwmr->access during MR registration
     - [arm64] dts: imx95: Correct PCIe outbound address space configuration
     - [arm64] dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as
       well
     - RDMA/siw: Fix endpoint/socket association handling
     - bpf: Check tail zero of bpf_prog_info
     - bpf: Update transport_header when encapsulating UDP tunnel in lwt
     - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response
     - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO
       indication
     - wifi: wcn36xx: fix OOB read from short trigger BA firmware response
     - ALSA: seq: Fix partial userptr event expansion
     - [riscv64] cpu_ops: Change return value type of cpu_is_stopped() to bool
     - [riscv64] stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe
     - ALSA: seq: Clear variable event pointer on read
     - ACPI: IPMI: Fix message kref handling on dead device
     - cpufreq: Documentation: fix conservative governor freq_step description
     - thermal: testing: reject missing command arguments
     - IB/mlx5: Don't take the rereg_mr fallback without a new translation
     - IB/mlx5: Properly support implicit ODP rereg_mr
     - spi: ep93xx: fix double-free of zeropage on DMA setup failure
     - [amd64] ASoC: amd: acp-sdw-sof: Bound DAI link iteration
     - firmware_loader: Fix recursive lock in device_cache_fw_images()
     - configfs: fix lockless traversals of ->s_children
     - watchdog: unregister PM notifier on watchdog unregister
     - scsi: target: Fix hexadecimal CHAP_I handling
     - scsi: target: Remove tcm_loop target reset handling
     - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins
       34-39
     - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins
       34-39
     - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()
     - hwspinlock: qcom: avoid uninitialized struct members
     - sched/fair: Fix cpu_util runnable_avg arithmetic
     - wifi: mt76: mt7925: clean up DMA on probe failure
     - wifi: mt76: mt7925: fix stale pointer comparisons in change_vif_links
     - wifi: mt76: mt7925: keep TX BA state in the primary WCID
     - wifi: mt76: mt792x: skip MLD header rewrite for 802.3 encap TX
     - wifi: mt76: fix argument to ieee80211_is_first_frag()
     - wifi: mt76: mt7915: fix potential tx_retries underflow
     - wifi: mt76: mt7921: fix potential tx_retries underflow
     - wifi: mt76: mt7925: fix potential tx_retries underflow
     - wifi: mt76: mt7996: fix potential tx_retries underflow
     - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()
     - fbdev: sm501fb: Fix buffer errors in OF binding code
     - hwmon: (it87) Clamp negative values to zero in set_fan()
     - btrfs: zoned: don't account data relocation space-info in statfs free
       space
     - btrfs: fix deadlock cloning inline extent when using flushoncommit
     - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified
     - NFSD: Handle layout stid in nfsd4_drop_revoked_stid()
     - spi: meson-spifc: fix runtime PM leak on remove
     - ASoC: codecs: aw88261: fix incorrect masks for boost regs
     - vduse: hold vduse_lock across IDR lookup in open path
     - vhost/vdpa: validate virtqueue index in mmap and fault paths
     - virtio_console: read size from config space during device init
     - vduse: Requeue failed read to send_list head
     - vhost/net: complete zerocopy ubufs only once
     - tools/virtio: check mmap return value in vringh_test
     - vdpa/octeon_ep: Fix PF->VF mailbox data address calculation
     - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove()
     - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails
     - bonding: 3ad: fix mux port state on oper down
     - ext4: fix kernel BUG in ext4_write_inline_data_end
     - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT
     - of: cpu: add check in __of_find_n_match_cpu_property()
     - vfio/qat: fix f_pos race in qat_vf_resume_write()
     - bpf: Tighten cgroup storage cookie checks for prog arrays
     - ASoC: cs35l56: Fix possible uninitialized value in
       cs35l56_spi_system_reset()
     - [s390x] process: Fix kernel thread function pointer type
     - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for
       non-serdev device
     - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD
       (CVE-2026-64539)
     - Bluetooth: hci_core: Fix UAF in hci_unregister_dev()
     - Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path
     - Bluetooth: hci: validate codec capability element length
     - Bluetooth: vhci: validate devcoredump state before side effects
     - fs: efs: remove unneeded debug prints
     - RDMA/mlx5: Remove DCT restrack tracking
     - RDMA/mlx5: Remove raw RSS QP restrack tracking
     - RDMA/mlx5: Fix undefined shift of user RQ WQE size
     - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one
     - ASoC: codecs: hdac_hdmi: Validate written enum value
     - ASoC: fsl: fsl_audmix: Validate written enum values
     - ASoC: tegra: tegra210_ahub: Validate written enum value
     - net: dsa: qca8k: fix led devicename when using external mdio bus
     - net/sched: cls_flow: Dont expose folded kernel pointers
     - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().
     - bridge: cfm: reject invalid CCM interval at configuration time
       (CVE-2026-64537)
     - sctp: validate embedded address parameter length
     - net: pfcp: allocate per-cpu tstats for PFCP netdevs
     - net/sched: sch_hfsc: Don't make class passive twice
     - tipc: require net admin for TIPCv2 netlink mutators
     - tipc: prevent snt_unacked underflow on CONN_ACK
     - tipc: reject inverted service ranges from peer bindings
     - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
     - crypto: cavium/cpt - fix DMA cleanup using wrong loop index
     - crypto: rng - Free default RNG on module exit
     - ALSA: seq: Fix kernel heap address leak in bounce_error_event()
     - spi: xilinx: use FIFO occupancy register to determine buffer size
     - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO
     - power: supply: core: fix supplied_from allocations
     - handshake: Require admin permission for DONE command
     - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek
       before restoring qlen
     - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek
       before restoring qlen
     - net: mana: initialize gdma queue id to INVALID_QUEUE_ID
     - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check
     - net: ethernet: mtk_wed: fix loading WO firmware for MT7986
     - bpf: Run generic devmap egress prog on private skb
     - net/mlx5: Check max_macs devlink param value against max capability
     - octeontx2-af: npc: Fix size of entry2cntr_map
     - net: ethernet: mtk_wed: debugfs: correct index in wed_amsdu_show()
     - net: wwan: t7xx: check skb_clone in control TX
     - dpll: add reference-sync netlink attribute
     - dpll: add reference sync get/set
     - dpll: Allow associating dpll pin with a firmware node
     - dpll: Add notifier chain for dpll events
     - dpll: Support dynamic pin index allocation
     - dpll: Enhance and consolidate reference counting logic
     - dpll: fix stale iteration in dpll_pin_on_pin_unregister()
     - dpll: send delete notification before unregister in on-pin rollback
     - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister()
     - dpll: guard sync-pair removal on full pin unregister
     - dpll: balance create/delete notifications in __dpll_pin_(un)register
     - landlock: Fix unmarked concurrent access to socket family
     - net: bcmgenet: Use weighted round-robin TX DMA arbitration
     - kcm: use WRITE_ONCE() when changing lower socket callbacks
     - netfilter: nf_conncount: callers must hold rcu read lock
     - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait()
     - cifs: remove all cifs files before kill super
     - smb/client: always return a value for FS_IOC_GETFLAGS
     - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket
     - udf: fix nls leak on udf_fill_super() failure
     - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
     - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check
     - [powerpc*] perf: fix preempt count underflow in fsl_emb_pmu_del
     - [powerpc*] powernv: fix preempt count leak in
       pnv_kexec_wait_secondaries_down
     - [powerpc*] kexec: fix double get_cpu() imbalance in kexec_prepare_cpus
     - KEYS: Use acquire when reading state in keyring search
     - tipc: fix UAF in tipc_l2_send_msg()
     - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
     - net: airoha: Introduce ndo_select_queue callback
     - net: airoha: Add sched ETS offload support
     - net: airoha: Fix always-true condition in PPE1 queue reservation loop
     - net: ethernet: oa_tc6: Remove FCS size in RX frame
     - ionic: Fix check in ionic_get_link_ext_stats
     - ksmbd: fix use-after-free in same_client_has_lease()
     - mfd: rsmu: Fix page register setup
     - mfd: cs42l43: Sanity check firmware size
     - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write
     - net/9p: fix race condition on rdma->state in trans_rdma.c
     - eventpoll: expand top-of-file overview / locking doc
     - eventpoll: rename attach_epitem() to ep_attach_file()
     - eventpoll: split ep_insert() into alloc + register stages
     - eventpoll: extract ep_deliver_event() from ep_send_events()
     - eventpoll: wrap EP_UNACTIVE_PTR in typed sentinel helpers
     - eventpoll: rename epi->next and txlist for clarity
     - eventpoll: Fix epoll_wait() report false negative
     - gpiolib: acpi: Only trigger ActiveBoth interrupts on boot
     - staging: nvec: fix use-after-free in nvec_rx_completed()
     - coresight: cti: Fix DT filter signals silently ignored
     - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore
     - PCI/ASPM: Don't reconfigure ASPM entering low-power state
     - PCI: Introduce named defines for PCI ROM
     - PCI: Check ROM header and data structure addr before accessing
     - [amd64] x86/platform/olpc: xo15: Drop wakeup source on driver removal
     - [amd64] platform/x86: xo15-ebook: Fix wakeup source and GPE handling
     - PCI: loongson: Do not ignore downstream devices on external bridges
     - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker()
     - PCI: qcom: Set max OPP before DBI access during resume
     - phy: phy-can-transceiver: Check driver match and driver data against NULL
     - clk: at91: sam9x7: Fix gmac_gclk clock definition
     - coresight: Fix source not disabled on idr_alloc_u32 failure
     - mailbox: mtk-adsp: fix UAF during device teardown
     - staging: most: video: avoid double free on video register failure
     - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()
     - usb: host: max3421: Reject hub port requests for non-existent ports
     - char: tlclk: fix use-after-free in tlclk_cleanup()
     - PCI: qcom: Disable ASPM L0s for SA8775P
     - iio: light: si1133: reset counter to prevent race condition
     - iio: light: si1133: prevent race condition on timeout
     - iio: magnetometer: ak8975: fix potential kernel stack memory leak
     - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling
     - iio: accel: mma8452: handle I2C read error(s) in mma8452_read()
     - iio: tcs3472: power down chip on probe failure
     - clk: at91: keep securam node alive while mapping it
     - HID: logitech-hidpp: remove excess kernel-doc member in
       hidpp_scroll_counter
     - fs/ntfs3: add bounds check to run_get_highest_vcn()
     - fs/ntfs3: fix mount failure on 64K page-size kernels
     - drm/amd/display: Add missing kdoc for ALLM parameters
     - [amd64] thunderbolt: debugfs: Fix margining error counter buffer leak
     - dmaengine: imx-sdma: Refine spba bus searching in probe
     - perf: Fix off-by-one stack buffer overflow in kallsyms__parse()
     - dmaengine: qcom: gpi: set DMA_PRIVATE capability
     - dmaengine: Fix possible use after free
     - dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc
     - dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor
     - clk: qcom: a53: Corrected frequency multiplier for 1152MHz
     - pNFS/filelayout: fix cheking if a layout is striped
     - xprtrdma: Avoid 250 ms delay on backlog wakeup
     - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot
     - xprtrdma: Post receive buffers after RPC completion
     - xprtrdma: Use sendctx DMA state for Send signaling
     - xprtrdma: Decouple req recycling from RPC completion
     - NFSv4/pnfs: defer return_range callbacks until after inode unlock
     - nfs: keep PG_UPTODATE clear after read errors in page groups
     - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors
     - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in
       pg_get_mirror_count_write
     - nfs: use nfsi->rwsem to protect traversal of the file lock list
     - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro
     - PCI: meson: Propagate devm_add_action_or_reset() failure
     - PCI: meson: Add missing remove callback
     - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size
     - PCI: rcar-host: Remove unused LIST_HEAD(res)
     - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE
     - xprtrdma: Initialize re_id before removal registration
     - xprtrdma: Check frwr_wp_create() during connect
     - xprtrdma: Document and assert reply-handler invariants
     - xprtrdma: Resize reply buffers before reposting receives
     - xprtrdma: Fix bcall rep leak and unbounded peek
     - xprtrdma: Sanitize the reply credit grant after parsing
     - xprtrdma: Repost Receive buffers for malformed replies
     - xprtrdma: Return sendctx slot after Send preparation failure
     - tools lib api: Fix missing null termination in filename__read_int/ull()
     - tools lib api: Fix filename__write_int() writing uninitialized stack data
     - tools lib api: Fix mount_overload() snprintf truncation and toupper range
     - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port()
     - PCI: mediatek: Use actual physical address instead of virt_to_phys()
     - Revert "PCI/MSI: Unmap MSI-X region on error"
     - security/apparmor/apparmorfs.c: conditionally compile
       get_loaddata_common_ref()
     - apparmor: check label build before no_new_privs test
     - apparmor: aa_label_alloc use aa_label_free on alloc failure
     - apparmor: fix rawdata_f_data implicit flex array
     - apparmor: grab ns lock and refresh when looking up changehat child
       profiles
     - apparmor: fix potential UAF in aa_replace_profiles
     - apparmor: remove or add symlinks to rawdata according to export_binary
     - apparmor: aa_getprocattr free procattr leak on format failure
     - apparmor: put secmark label after secid lookup
     - workqueue: Add new WQ_PERCPU flag
     - i3c: master: add WQ_PERCPU to alloc_workqueue users
     - i3c: master: Make hot-join workqueue freezable to block hot-join during
       suspend
     - i3c: master: Prevent reuse of dynamic address on device add failure
     - apparmor: fix label can not be immediately before a declaration
     - gpio: mlxbf3: fail probe if gpiochip registration fails
     - [amd64] drm/i915: clear CRTC color blob pointers after dropping refs
     - spi: dw: fix wrong BAUDR setting after resume
     - xfrm: Fix xfrm state cache insertion race
     - xfrm: annotate data-races around xfrm_policy_count[] and
       xfrm_policy_default[]
     - xfrm: validate selector family and prefixlen during match
     - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode
     - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free
     - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm
     - drm/amdgpu: initialize irq.lock spinlock earlier
     - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown
     - net: psample: fix info leak in PSAMPLE_ATTR_DATA (CVE-2026-64553)
     - sctp: hold socket lock when dumping endpoints in sctp_diag
     - PCI: iproc: Restore .map_irq() for the platform bus driver
     - spi: rpc-if: Use correct device for hardware reinitialization on resume
     - virtio-net: fix len check in receive_big() (CVE-2026-64552)
     - dpaa2-switch: fix VLAN upper check not rejecting bridge join
     - devlink: Fix parent ref leak in devl_rate_node_create()
     - flow_dissector: check device type before reading ETH_ADDRS
     - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints
     - [arm64] hw_breakpoint: reject unaligned watchpoints that would truncate
       BAS
     - thermal: intel: Fix dangling resources on thermal_throttle_online()
       failure
     - ACPI: resource: Amend kernel-doc style
     - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone()
     - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit()
     - ieee802154: fix kernel-infoleak in dgram_recvmsg()
     - mac802154: Prevent overwrite return code in
       mac802154_perform_association()
     - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry
     - netfilter: ipset: Fix data race between add and dump in all hash types
     - netfilter: ipset: annotate "pos" for concurrent readers/writers
     - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash
       types
     - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()
     - netfilter: ipset: make sure gc is properly stopped
     - netfilter: nf_reject: skip iphdr options when looking for icmp header
     - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak
     - mailbox: imx: Forward the timeout/ error in imx_mu_generic_tx()
     - irqchip/crossbar: Fix parent domain resource leak
     - net: marvell: prestera: initialize err in prestera_port_sfp_bind
     - tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
       (CVE-2026-64543)
     - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths
     - octeontx2-af: mcs: Fix unsupported secy stats read
     - octeontx2-pf: Clear stats of all resources when freeing resources
     - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown
     - net/sched: act_ct: fix nf_connlabels leak on two error paths
     - ipv6: ndisc: fix NULL deref in accept_untracked_na() (CVE-2026-64542)
     - dpaa2-switch: do not accept VLAN uppers while bridged
     - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags
     - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231
     - bpf: Fix stack slot index in nospec checks
     - bpftool: Fix vmlinux BTF leak in cgroup commands
     - bpf: zero-initialize the fib lookup flow struct
     - bpf: Fix effective prog array index with BPF_F_PREORDER
     - power: sequencing: fix ABBA deadlock in pwrseq_device_unregister()
     - drm/edid: fix OOB read in drm_parse_tiled_block() (CVE-2026-64546)
     - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0
     - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0
     - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()
     - ice: fix AQ error code comparison in ice_set_pauseparam()
     - ice: call netif_keep_dst() once when entering switchdev mode
     - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info
     - ice: dpll: fix memory leak in ice_dpll_init_info error paths
     - i40e: Fix i40e_debug() to use struct i40e_hw argument
     - rtc: msc313: fix NULL deref in shared IRQ handler at probe
     - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2
       NEGOTIATE
     - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). (CVE-2026-64538)
     - net: bnxt: use ethtool string helpers
     - eth: bnxt: gather and report HW-GRO stats
     - eth: bnxt: rename ring_err_stats -> ring_drv_stats
     - eth: bnxt: improve the timing of stats
     - ipv4: fib: Don't ignore error route in local/main tables.
     - md/raid5: use stripe state snapshot in break_stripe_batch_list()
     - md/raid5: avoid R5_Overlap races while breaking stripe batches
     - bpf: Disable xfrm_decode_session hook attachment
     - netfilter: nf_nat: avoid invalid nat_net pointer use on failed
       nf_nat_init()
     - netfilter: nf_conncount: prevent connlimit drops for early confirmed ct
       (Closes: #1130336)
     - netfilter: nft_synproxy: stop bypassing the priv->info snapshot
     - netfilter: nft_compat: ebtables emulation must reject non-bridge targets
     - gpio: davinci: fix IRQ domain leak on devm_kzalloc failure
     - NTB: epf: Make db_valid_mask cover only real doorbell bits
     - NTB: epf: Report 0-based doorbell vector via ntb_db_event()
     - NTB: epf: Fix doorbell bitmask and IRQ vector handling
     - net, bpf: check master for NULL in xdp_master_redirect() (CVE-2026-64545)
     - net: dsa: sja1105: round up PTP perout pin duration
     - veth: fix NAPI leak in XDP enable error path
     - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle
       (CVE-2026-64530)
     - ipv6: fix error handling in disable_ipv6 sysctl
     - ipv6: fix error handling in ignore_routes_with_linkdown sysctl
     - ipv6: fix error handling in forwarding sysctl
     - ipv6: fix error handling in disable_policy sysctl
     - rtnetlink: Add per-netns RTNL.
     - rtnetlink: Add assertion helpers for per-netns RTNL.
     - rtnetlink: Define rtnl_net_trylock().
     - ipv6: Add __in6_dev_get_rtnl_net().
     - ipv6: Convert net.ipv6.conf.${DEV}.XXX sysctl to per-netns RTNL.
     - ipv6: fix missing notification for ignore_routes_with_linkdown
     - thermal: testing: zone: Flush work items during cleanup
     - ACPI: processor_idle: Mark LPI enter functions as __cpuidle
     - smb/client: preserve errors from smb2_set_sparse()
     - rtc: ds1307: Fix off-by-one issue with wday for rx8130
     - rtc: cmos: unregister HPET IRQ handler on probe failure
     - net: dsa: realtek: fix memory leak in rtl8366rb_setup_led()
     - octeontx2-af: Validate NIX maximum LFs correctly
     - net: mvneta: re-enable percpu interrupt on resume
     - net: sungem: fix probe error cleanup
     - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove
     - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count
     - udp_tunnel: remove rtnl_lock dependency
     - net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync
     - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22"
       fallback
     - [arm64] net: hisilicon: hns3: use ethtool string helpers
     - [arm64] net: hns3: use string choices helper
     - [arm64] net: hns3: use hns3_get_ae_dev() helper to reduce the unnecessary
       middle layer conversion
     - [arm64] net: hns3: use hns3_get_ops() helper to reduce the unnecessary
       middle layer conversion
     - [arm64] net: hns3: clear hns alarm: comparison of integer expressions of
       different signedness
     - [arm64] net: hns3: unify copper port ksettings configuration path
     - [arm64] net: hns3: refactor MAC autoneg and speed configuration
     - [arm64] net: hns3: fix permanent link down deadlock after reset
     - [arm64] net: hns3: differentiate autoneg default values between copper and
       fiber
     - tracing: probes: fix typo in a log message
     - spi: sh-msiof: abort transfers when reset times out
     - gpio: mvebu: fail probe if gpiochip registration fails
     - gpio: htc-egpio: use managed gpiochip registration
     - seg6: validate SRH length before reading fixed fields
     - qede: fix out-of-bounds check for cqe->len_list[]
     - net: enetc: check the number of BDs needed for xdp_frame
     - sctp: fix SCTP_RESET_STREAMS stream list length limit
     - MIPS: DEC: Ensure RTC platform device deregistration upon failure
     - ASoC: codecs: lpass-va-macro: add SM6115 compatible
     - ASoC: codecs: lpass-va-macro: Fix LPASS Codec Version for SC7280
     - hwmon: adm1275: Prevent reading uninitialized stack
     - hwmon: (pmbus) Fix passing events to regulator core
     - hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against
       divide-by-zero
     - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump
     - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()
       (CVE-2026-64540)
     - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy
     - net: gianfar: dispose irq mappings on probe failure and device removal
     - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF
     - bridge: stp: Fix a potential use-after-free when deleting a bridge
     - [arm64] drm/panthor: Fix potential invalid pointer deref in
       group_process_tiler_oom()
     - [arm64] drm/panthor: Don't overrule pending immediate ticks in
       sched_resume_tick()
     - [arm64] drm/panthor: Fix a leak when a group is evicted before the tiler
       OOM is serviced
     - [arm64] drm/panthor: Interrupt group start/resumption if
       group_bind_locked() fails
     - tracing/events: Fix to check the simple_tsk_fn creation
     - tracing: eprobe: read the complete FILTER_PTR_STRING pointer
     - irqchip/gic-v3-its: Fix OF node reference leak
     - irqchip/ts4800: Fix missing chained handler cleanup on remove
     - virtio_net: disable cb when NAPI is busy-polled
     - cxgb4: Fix decode strings dump for T6 adapters
     - net/sched: act_bpf: use rcu_dereference_bh() to read the filter
     - ksmbd: reject undersized DACLs before parsing ACEs
     - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check
     - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe
     - pinctrl: meson: restore non-sleeping GPIO access
     - net/sched: hhf: clear heavy-hitter state on reset
     - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid
     - afs: Fix error code in afs_extract_vl_addrs()
     - afs: Fix double netfs initialisation in afs_root_iget()
     - afs: use kvfree() to free memory allocated by kvcalloc()
     - afs: Remove erroneous seq |= 1 in volume lookup loop
     - afs: Make /afs/.<cell> as well as /afs/<cell> mountpoints
     - afs: Add rootcell checks
     - afs: Make /afs/@cell and /afs/.@cell symlinks
     - afs: Fix afs_atcell_get_link() to handle RCU pathwalk
     - afs: Remove the "autocell" mount option
     - afs: Change dynroot to create contents on demand
     - afs: Fix misplaced inc of net->cells_outstanding
     - afs: Fix callback service message parsers to pass through -EAGAIN
     - afs: Fix missing NULL pointer check in afs_break_some_callbacks()
     - afs: Fix vllist leak
     - afs: Fix the volume AFS_VOLUME_RM_TREE is set on
     - afs: Fix unchecked-length string display in debug statement
     - minix: avoid overflow in bitmap block count calculation
     - ovl: fix comment about locking order
     - netfs: Fix writeback error handling
     - drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()
     - drm/xe/hw_engine: Fix double-free of managed BO in error path
     - drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays
     - netfs: Drop the error arg from netfs_read_subreq_terminated()
     - cifs: Fix missing credit release on failure in cifs_issue_read()
     - ata: sata_gemini: unwind clocks on IDE pinctrl errors
     - ata: libata-scsi: limit simulated SCSI command copy to response length
     - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()
     - HID: core: Fix OOB read in hid_get_report for numbered reports
     - [arm64] mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()
     - HID: bpf: Fix hid_bpf_get_data() range check
     - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
       (CVE-2026-64547)
     - gue: validate REMCSUM private option length
     - netfilter: xt_u32: reject invalid shift counts
     - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()
     - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop
     - netfilter: xt_connmark: reject invalid shift parameters
     - net/mlx5: LAG, MPESW, Fix missing complete() on devcom error
     - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation
     - net/mlx5e: Fix HV VHCA stats agent registration race
     - net: microchip: vcap: fix races on the shared Super VCAP block
     - qede: fix off-by-one in BD ring consumption on build_skb failure
     - net: qualcomm: rmnet: validate MAP frame length before ingress parsing
       (CVE-2026-64550)
     - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload
     - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
     - amt: fix size calculation in amt_get_size()
     - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control
     - Bluetooth: MGMT: Fix adv monitor add failure cleanup
     - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length
     - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
       (CVE-2026-64549)
     - ring-buffer: Fix event length with forced 8-byte alignment
     - net/tls: Consume empty data records in tls_sw_read_sock()
     - net: usb: lan78xx: move functions to avoid forward definitions
     - net: usb: lan78xx: disable VLAN filter in promiscuous mode
     - [arm64] drm/v3d: Reject invalid indirect BO handle in indirect CSD setup
     - net/sched: cake: reject overhead values that underflow length
     - octeontx2-pf: check DMAC extraction support before filtering
     - [amd64] perf/x86/amd/core: Avoid enabling BRS from the SVM reload path
     - gpio: mvebu: free generic chips on unbind
     - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
     - ipv6: mcast: Replace locking comments with lockdep annotations.
     - ipv6: mcast: Fix potential UAF in MLD delayed work
     - netfilter: nft_lookup: fix catchall element handling with inverted lookups
     - ipvs: pass parsed transport offset to state handlers
     - ipvs: use parsed transport offset in TCP state lookup
     - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors
     - ipvs: ensure inner headers in ICMP errors are in headroom
     - [s390x] zcrypt: Remove the empty file
     - cifs: validate DFS referral string offsets
     - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED
     - SUNRPC: pin upper rpc_clnt across the TLS connect_worker
     - dm era: fix NULL pointer dereference in metadata_open()
     - regulator: core: regulator_lock_two() should test for EDEADLK not
       EDEADLOCK
     - net/mlx5: Fix L3 tunnel entropy refcount leak
     - octeontx2-af: fix VF bringup affecting PF promiscuous state
     - drm/xe: remove duplicate <kunit/test-bug.h> include
     - smb: client: fix overflow in passthrough ioctl bounds check
     - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()
     - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()
     - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter
     - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put
     - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc
     - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get
     - ASoC: SOF: topology: validate vendor array size before parsing
     - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()
     - net: atm: reject out-of-range traffic classes in QoS validation
     - net: ife: require ETH_HLEN to be pullable in ife_decode()
     - [arm64] fpsimd: Fix type mismatch in sve_{save,load}_state()
     - [arm64] dts: qcom: sdm630: describe adsp_mem region properly
     - [arm64] dts: ti: k3-am62a7-sk: Add bootph-all tag to vqmmc
     - [arm64] dts: imx8ulp-evk: Correct Type-C int GPIO flags
     - [s390x] KVM: s390: pci: Fix GISC refcount leak on AIF enable failure
     - [arm64] KVM: arm64: vgic: Check the interrupt is still ours before
       migrating it
     - [s390x] KVM: s390: pci: Fix handling of AIF enable without AISB
     - [amd64] KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs
     - [amd64] KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV
       EOIs
     - [arm64] KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2
     - [arm64] KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops()
       (CVE-2026-64555)
     - fbdev: metronomefb: fix potential memory leak in metronomefb_probe()
     - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()
     - fbdev: hecubafb: fix potential memory leak in hecubafb_probe()
     - fbdev: sm712: Fix operator precedence in big_swap macro
     - fbdev: efifb: fix memory leak in efifb_probe()
     - fbdev: radeon: fix potential memory leak in radeonfb_pci_register()
     - fbdev: i740fb: fix potential memory leak in i740fb_probe()
     - fbdev: s3fb: fix potential memory leak in s3_pci_probe()
     - fbdev: uvesafb: fix potential memory leak in uvesafb_probe()
     - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()
     - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()
     - fbdev: vesafb: fix memory leak in vesafb_probe()
     - fbdev: nvidia: fix potential memory leak in nvidiafb_probe()
     - fbdev: tridentfb: fix potential memory leak in trident_pci_probe()
     - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
     - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control
     - ASoC: mediatek: mt8192: Release reserved memory on cleanup
     - ASoC: mediatek: mt8183: Release reserved memory on cleanup
     - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback
     - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
     - netfilter: nfnl_cthelper: apply per-class values when updating policies
     - netfilter: xt_cluster: reject template conntracks in hash match
     - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
     - netfilter: nft_set_pipapo: don't leak bad clone into future transaction
     - netfilter: nf_nat_sip: reload possible stale data pointer
     - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6
       defrag
     - netfilter: nf_conncount: fix zone comparison in tuple dedup
     - netfilter: ecache: fix inverted time_after() check
     - netfilter: xt_nat: reject unsupported target families
     - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
       (CVE-2026-64554)
     - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error
       path
     - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy
     - soc: fsl: qe: panic on ioremap() failure in qe_reset()
     - selinux: check connect-related permissions on TCP Fast Open
     - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
     - selinux: fix incorrect execmem checks on overlayfs
     - leds: uleds: Fix potential buffer overread
     - mfd: sm501: Fix reference leak on failed device registration
     - [amd64] tools/power/x86/intel-speed-select: Harden daemon pidfile open
     - [amd64] x86/boot: Validate console=uart8250 baud rate to fix early boot
       hang
     - [amd64] x86/boot: Reject too long acpi_rsdp= values
     - [amd64] perf/x86/amd/lbr: Fix kernel address leakage
     - cpufreq: intel_pstate: Set non-turbo capacity to HWP_GUARANTEED_PERF()
     - [s390x] perf_cpum_cf: Add missing array_index_nospec() to
       __hw_perf_event_init()
     - batman-adv: gw: acquire ethernet header only after skb realloc
     - batman-adv: access unicast_ttvn skb->data only after skb realloc
     - batman-adv: dat: acquire ARP hw source only after skb realloc
     - batman-adv: bla: reacquire gw address after skb realloc
     - batman-adv: dat: ensure accessible eth_hdr proto field
     - batman-adv: dat: fix tie-break for candidate selection
     - batman-adv: tt: avoid request storms during pending request
     - batman-adv: fix VLAN priority offset
     - batman-adv: frag: free unfragmentable packet
     - batman-adv: frag: fix primary_if leak on failed linearization
     - batman-adv: mcast: avoid OOB read of num_dests header
     - batman-adv: tt: prevent TVLV OOB check overflow
     - cifs: invalidate cfid on unlink/rename/rmdir
     - mfd: tps6586x: Fix OF node refcount
     - HID: playstation: validate num_touch_reports in DualShock 4 reports
     - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready
     - Bluetooth: SCO: hold sk properly in sco_conn_ready
     - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()
     - nvdimm/btt: Free arenas on btt_init() error paths
     - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path
     - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback
     - sunrpc: wait for in-flight TLS handshake callback when cancel loses race
     - lockd: Plug nlm_file leak when nlm_do_fopen() fails
     - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure
     - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
     - remoteproc: qcom: Fix leak when custom dump_segments addition fails
     - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing
       reference leak
     - mm/memory_hotplug: fix incorrect altmap passing in error path
     - mm/damon/core: make charge_addr_from aware of end-address exclusivity
     - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename
     - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length
     - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass
     - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off
     - fs/ntfs3: validate lcns_follow in log_replay conversion (CVE-2026-64533)
     - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow
     - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}
       (CVE-2026-64532)
     - ntfs3: cap RESTART_TABLE free-chain walker at rt->used
     - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head
     - ntfs3: validate split-point offset in indx_insert_into_buffer
     - ntfs3: fix out-of-bounds read in decompress_lznt
     - power: supply: charger-manager: fix refcount leak in is_full_charged()
     - [riscv64] cacheinfo: Fix node reference leak in populate_cache_leaves
     - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()
     - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error
     - fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole()
     - fs/proc/task_mmu: use huge_page_size() in pagemap_scan_hugetlb_entry()
     - proc: only bump parent nlink when registering directories
     - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE
     - kcov: use WRITE_ONCE() for selftest mode stores
     - mtd: slram: remove failed entries from the device list
     - 9p: skip nlink update in cacheless mode to fix WARN_ON
     - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished()
     - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint
     - ocfs2: use kzalloc for quota recovery bitmap allocation
     - mtd: rawnand: pl353: fix probe resource allocation
     - net/9p: fix infinite loop in p9_client_rpc on fatal signal
     - mtd: rawnand: fix condition in 'nand_select_target()'
     - ocfs2: avoid moving extents to occupied clusters
     - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits
     - ocfs2: add journal NULL check in ocfs2_checkpoint_inode()
     - ocfs2: reject dinodes with non-canonical i_mode type
     - ocfs2: reject dinodes whose i_rdev disagrees with the file type
     - ocfs2: reject non-inline dinodes with i_size and zero i_clusters
     - fpga: dfl: add bounds check in dfh_get_param_size()
     - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path
     - net: thunderbolt: Fix frags[] overflow by bounding frame_count
     - fpga: microchip-spi: fix zero header_size OOB read in
       mpf_ops_parse_header()
     - [s390x] pkey: Check length in PKEY_VERIFYPROTK ioctl
     - [s390x] pkey: Check length in pkey_pckmo handler implementation
     - mtd: spi-nor: swp: Improve locking user experience
     - mtd: spi-nor: spansion: use die erase for multi-die devices only
     - mtd: rawnand: Pause continuous reads at block boundaries
     - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization
     - taskstats: retain dead thread stats in TGID queries
     - irqchip/crossbar: Use correct index in crossbar_domain_free()
     - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()
     - tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt
     - dmaengine: tegra: Fix burst size calculation
     - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and
       ABORT_INT_MASK
     - [amd64] platform/x86: dell-laptop: fix missing cleanups in init error path
     - [amd64] platform/x86/amd/pmc: Check for intermediate wakeup in function
     - [amd64] platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops
     - [amd64] platform/x86/amd/pmc: Add delay_suspend module parameter
     - [amd64] platform/x86/amd/pmc: Don't log during intermediate wakeups
     - pkey: Move keytype check from pkey api to handler
     - smb: client: use kvzalloc() for megabyte buffer in simple fallocate
     - ksmbd: fix integer overflow in set_file_allocation_info()
     - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig
     - hwmon: (max6697) add missing 'select REGMAP_I2C' to Kconfig
     - i2c: mediatek: fix WRRD for SoCs without auto_restart option
     - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()
     - ice: fix ice_init_link() error return preventing probe
     - xen/gntdev: fix error handling in ioctl
     - xfrm: use compat translator only for u64 alignment mismatch
     - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for
       changelink
     - tpm: fix event_size output in tpm1_binary_bios_measurements_show
     - tpm: Make the TPM character devices non-seekable
     - time: Fix off-by-one in compat settimeofday() usec validation
     - spi: uniphier: Fix completion initialization order before
       devm_request_irq()
     - sctp: validate STALE_COOKIE cause length before reading staleness
       (CVE-2026-64551)
     - NFS: Charge unstable writes by request size, not folio size
     - nvmet-rdma: handle inline data with a nonzero offset
     - netdev-genl: report NAPI thread PID in the caller's pid namespace
     - can: esd_usb: kill anchored URBs before freeing netdevs
     - can: isotp: use unconditional synchronize_rcu() in isotp_release()
     - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
     - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
     - can: bcm: add missing rcu list annotations and operations
     - bpf,fork: wipe ->bpf_storage before bailouts that access it
     - bpf: Add missing access_ok call to copy_user_syms
     - block: fix race in blk_time_get_ns() returning 0
     - net: sparx5: unregister blocking notifier on init failure
     - dm thin metadata: fix superblock refcount leak on snapshot shadow failure
     - dm thin metadata: fix metadata snapshot consistency on commit failure
     - dm era: fix out-of-bounds memory access for non-zero start sector
     - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard
     - dm-ioctl: fix a possible overflow in list_version_get_info
     - dm-log: fix a bitset_size overflow on 32bit machines
     - dm-stats: fix dm_jiffies_to_msec64
     - dm-stats: fix merge accounting
     - dm_early_create: fix freeing used table on dm_resume failure
     - dm-integrity: fix a bug if the bio is out of limits
     - dm-integrity: don't increment hash_offset twice
     - dm-verity: avoid double increment of &use_bh_wq_enabled
     - dm-verity: fix a possible NULL pointer dereference
     - dm-verity: increase sprintf buffer size
     - dm-verity: make error counter atomic
     - [amd64] accel/ivpu: Reject firmware log with size smaller than header
     - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
     - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
     - scsi: sg: Report request-table problems when any status is set
     - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path
     - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it
     - scsi: target: Bound PR-OUT TransportID parsing to the received buffer
     - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
     - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()
     - scsi: elx: efct: Fix I/O leak on unsupported additional CDB
     - Input: ims-pcu - fix use-after-free and double-free in disconnect
     - Input: ims-pcu - only expose sysfs attributes on control interface
     - Input: ims-pcu - release data interface on disconnect
     - Input: ims-pcu - validate control endpoint type
     - Input: ims-pcu - add response length checks
     - Input: ims-pcu - fix DMA mapping violation in line setup
     - Input: ims-pcu - fix firmware leak in async update
     - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging
     - Input: ims-pcu - fix potential infinite loop in CDC union descriptor
       parsing
     - Input: ims-pcu - fix race condition in reset_device sysfs callback
     - Input: ims-pcu - fix type confusion in CDC union descriptor parsing
     - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete
     - tracing/user_events: Fix use-after-free in user_event_mm_dup()
     - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
     - cpu: hotplug: Preserve per instance callback errors
     - cpu: hotplug: Bound hotplug states sysfs output
     - gpio: tegra: do not call pinctrl for GPIO direction
     - gpio-f7188x: Add support for NCT6126D version B
     - gpios: palmas: add .get_direction() op
     - net: sit: require CAP_NET_ADMIN in the device netns for changelink
     - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure
     - net: ixp4xx_hss: fix duplicate HDLC netdev allocation
     - net/sched: act_ct: preserve tc_skb_cb across defragmentation
     - net: ena: clean up XDP TX queues when regular TX setup fails
     - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink
     - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink
     - net: ipip: require CAP_NET_ADMIN in the device netns for changelink
     - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
     - octeontx2-af: Free BPID bitmap on setup failure
     - ieee802154: admin-gate legacy LLSEC dump operations
     - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation
     - ieee802154: ca8210: fix cas_ctl leak on spi_async failure
     - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit
     - [amd64] platform/x86/amd/pmc: Avoid logging "(null)" for DMI values
     - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants
     - [s390x] Revert support for DCACHE_WORD_ACCESS (CVE-2026-64369)
     - batman-adv: retrieve ethhdr after potential skb realloc on RX
     - batman-adv: ensure minimal ethernet header on TX
     - batman-adv: clean untagged VLAN on netdev registration failure
     - espintcp: use sk_msg_free_partial to fix partial send
     - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()
     - rtc: mpfs: fix counter upload completion condition
     - hwmon: (w83627hf) remove VID sysfs files on error and remove
     - hwmon: (w83793) remove vrm sysfs file on probe failure
     - net: liquidio: fix BAR resource leak on PF number failure
     - hwmon: (occ) unregister sysfs devices outside occ lock
     - fsl/fman: Free init resources on KeyGen failure in fman_init()
     - net: lan743x: Initialize eth_syslock spinlock before use
     - net/sched: sch_multiq: Replace direct dequeue call with peek and
       qdisc_dequeue_peeked
     - net/sched: sch_taprio: Replace direct dequeue call with peek and
       qdisc_dequeue_peeked
     - fhandle: reject detached mounts in capable_wrt_mount()
     - hwmon: (max1619) add missing 'select REGMAP' to Kconfig
     - tracing/probes: Fix double addition of offset for @+FOFFSET
     - orangefs: keep the readdir entry size 64-bit in fill_from_part()
     - ata: pata_pxa: Fix DMA channel leak on probe error
     - net: wwan: iosm: bound device offsets in the MUX downlink decoder
     - hwmon: (asus_atk0110) Check package count before accessing element
     - [riscv64] probes: save original sp in rethook trampoline
     - mm/compaction: handle free_pages_prepare() properly in compaction_free()
     - irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure
     - [s390x] monwriter: Reject buffer reuse with different data length
     - mac802154: remove interfaces with RCU list deletion
     - llc: fix SAP refcount leak in llc_ui_autobind()
     - ipvs: use parsed transport offset in SCTP state lookup
     - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
     - macsec: don't read an unset MAC header in macsec_encrypt()
     - [arm64] smp: Fix hot-unplug tearing by forcing unregistration
     - ata: libata-core: Skip HPA resize for locked drives
     - drbd: reject data replies with an out-of-range payload size
     - [riscv64] Prevent NULL pointer dereference in machine_kexec_prepare()
     - tracing/osnoise: Call synchronize_rcu() when unregistering
     - [s390x] mm: Fix type mismatch in get_align_mask().
     - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
     - pmdomain: imx: Fix i.MX8MP power notifier
     - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence
     - [powerpc*] pseries: fix memory leak on krealloc failure in papr_init
     - wifi: rt2x00: avoid full teardown before work setup in probe
     - wifi: mwifiex: fix roaming to different channel in host_mlme mode
     - wifi: mac80211: fix memory leak in ieee80211_register_hw()
     - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
     - net: openvswitch: reject oversized nested action attrs (CVE-2026-64531)
     - Bluetooth: btrtl: validate firmware patch bounds
     - llc: fix SAP refcount leak when creating incoming sockets
     - macsec: fix promiscuity refcount leak in macsec_dev_open()
     - memstick: ms_block: reject a card that reports too many blocks
     - ipvs: fix more places with wrong ipv6 transport offsets
     - ipvs: reload ip header after head reallocation
     - reset: sunxi: fix memory region leak on ioremap failure
     - [powerpc*] spufs: fix out-of-bounds access in spufs_mem_mmap_access()
     - wifi: mac80211: free ack status frame on TX header build failure
     - wifi: mwifiex: fix permanently busy scans after multiple roam iterations
     - mtd: onenand: samsung: report DMA completion timeouts
     - mtd: mchp23k256: use SPI match data for chip caps
     - mmc: vub300: defer reset until cmd_mutex is unlocked
     - mtd: rawnand: fsl_ifc: return errors for failed page reads
     - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
     - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
     - mmc: block: fix RPMB device unregister ordering
     - mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method
     - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
     - ACPI: driver: Check ACPI_COMPANION() against NULL during probe
     - ACPI: bus: Introduce devm_acpi_install_notify_handler()
     - ACPI: NFIT: core: Use devm_acpi_install_notify_handler()
     - ACPI: NFIT: core: Fix possible deadlock and missing notifications
     - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values
     - iio: adc: ad7380: select REGMAP
     - iio: pressure: Remove redundant pm_runtime_mark_last_busy() calls
     - iio: pressure: mpl115: fix runtime PM leak on read error (CVE-2026-64493)
     - ALSA: aoa: check snd_ctl_new1() return value
     - ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)
     - ALSA: scarlett2: Allow selecting config_set by firmware version
     - ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417
     - vfio/mlx5: Fix racy bitfields and tighten struct layout (CVE-2026-64472)
     - PCI: altera: Fix resource leaks on probe failure (CVE-2026-64462)
     - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle()
     - PCI: mediatek: Switch to msi_create_parent_irq_domain()
     - PCI: mediatek: Convert bool to single quirks entry and bitmap
     - PCI: mediatek: Use generic MACRO for TPVPERL delay
     - PCI: mediatek: Fix IRQ domain leak when port fails to enable
       (CVE-2026-64461)
     - PCI: Use pbus_select_window() during BAR resize
     - PCI: Prevent resource tree corruption when BAR resize fails
     - PCI: Free saved list without holding pci_bus_sem
     - PCI: Fix restoring BARs on BAR resize rollback path
     - PCI: Move Resizable BAR code to rebar.c
     - PCI: Skip Resizable BAR restore on read error
     - staging: rtl8723bs: core: move constants to right side in comparison
     - staging: rtl8723bs: fix spaces around binary operators
     - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(),
       and rtw_get_wps_attr()
     - [amd64] crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
       (CVE-2026-64438)
     - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
       (CVE-2026-64434)
     - gpio: sch: use raw_spinlock_t in the irq startup path (CVE-2026-64428)
     - io_uring/rw: ensure reissue path is correctly handled for IOPOLL
     - io_uring/rw: preserve partial result for iopoll
     - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code
     - media: nxp: imx8-isi: Fix use-after-free on remove (CVE-2026-64421)
     - netfilter: ebtables: Use vmalloc_array() to improve code
     - netfilter: ebtables: zero chainstack array (CVE-2026-64413)
     - Bluetooth: L2CAP: Fix not tracking outstanding TX ident
     - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
       (CVE-2026-64206)
     - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO
     - Bluetooth: separate CIS_LINK and BIS_LINK link types
     - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
       (CVE-2026-64405)
     - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
     - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
     - mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host
       (CVE-2026-64416)
     - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg()
     - smb: client: resolve SWN tcon from live registrations (CVE-2026-64401)
     - ksmbd_vfs_rename(): vfs_path_parent_lookup() accepts ERR_PTR() as name
     - vfs: make LAST_XXX private to fs/namei.c
     - ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
     - ksmbd: use opener credentials for FSCTL mutations
     - ksmbd: centralize ksmbd_conn final release to plug transport leak
     - ksmbd: track the connection owning a byte-range lock (CVE-2026-64390)
     - proc: rename proc_setattr to proc_nochmod_setattr
     - proc: protect ptrace_may_access() with exec_update_lock (FD links)
     - [amd64] perf/x86/intel/uncore: Defer ADL global PMON enable to
       enable_box()
     - HID: add haptics page defines
     - HID: multitouch: fix out-of-bounds bit access on mt_io_flags
       (CVE-2026-64364)
     - seqlock: Introduce scoped_seqlock_read()
     - seqlock: Change do_task_stat() to use scoped_seqlock_read()
     - proc: protect ptrace_may_access() with exec_update_lock (part 1)
     - treewide: Switch/rename to timer_delete[_sync]()
     - HID: appleir: fix UAF on pending key_up_timer in remove() (CVE-2026-64363)
     - HID: pidff: Fix missing blank lines after declarations
     - HID: pidff: Add missing spaces
     - HID: pidff: Rework pidff_upload_effect
     - HID: pidff: Use correct effect type in effect update
     - hfs/hfsplus: prevent getting negative values of offset/length
     - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
       (CVE-2026-64361)
     - bpf: Convert lpm_trie.c to rqspinlock
     - bpf, arm64, powerpc: Add bpf_jit_bypass_spec_v1/v4()
     - bpf: Consistently use bpf_rcu_lock_held() everywhere
     - bpf: Allow LPM map access from sleepable BPF programs (CVE-2026-64352)
     - usb: iowarrior: remove inherent race with minor number
     - USB: iowarrior: fix use-after-free on disconnect race (CVE-2026-64341)
     - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
     - crypto: atmel - Drop explicit initialization of struct
       i2c_device_id::driver_data to 0
     - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
     - usb: gadget: f_fs: initialize reset_work at allocation time
     - crypto: atmel-sha204a - fail on hwrng registration error in probe path
     - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
     - btrfs: concentrate the error handling of submit_one_sector()
     - btrfs: replace for_each_set_bit() with for_each_set_bitmap()
     - btrfs: remove folio parameter from ordered io related functions
     - btrfs: remove the COW fixup mechanism
     - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC
     - [amd64] crypto: ccp - Move dev_info/err messages for SEV/SNP init and
       shutdown
     - [amd64] crypto: ccp - Reset TMR size at SNP Shutdown
     - [amd64] crypto: ccp - Register SNP panic notifier only if SNP is enabled
     - [amd64] crypto: ccp - Move SEV/SNP Platform initialization to KVM
     - [amd64] crypto: ccp - Fix a case where SNP_SHUTDOWN is missed
     - [amd64] crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)
     - [amd64] crypto: qat - fix restarting state leak on allocation failure
     - exfat: remove unnecessary read entry in __exfat_rename()
     - exfat: rename argument name for exfat_move_file and exfat_rename_file
     - exfat: add exfat_get_dentry_set_by_ei() helper
     - exfat: move exfat_chain_set() out of __exfat_resolve_path()
     - exfat: fix incorrect directory checksum after rename to shorter name
     - exfat: preserve benign secondary entries during rename and move
     - btrfs: fix false IO failure after falling back to buffered write
     - btrfs: fix incorrect buffered IO fallback for append direct writes
     - slab: Introduce kmalloc_obj() and family
     - slab: Introduce kmalloc_flex() and family
     - add default_gfp() helper macro and use it in the new *alloc_obj() helpers
     - default_gfp(): avoid using the "newfangled" __VA_OPT__ trick
     - slab: recognize @GFP parameter as optional in kernel-doc
     - fscrypt: Fix key setup in edge case with multiple data unit sizes
     - fscrypt: Replace mk_users keyring with simple list
     - mm/damon/core: always put unsuccessfully committed target pids
     - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
     - [arm64] KVM: arm64: Ensure level is always initialized when relaxing perms
     - [arm64] KVM: arm64: Fix propagation of TLBI level in
       kvm_pgtable_stage2_relax_perms()
     - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is
       uninitialized (CVE-2026-64192)
     - [amd64] perf/x86/amd/brs: Fix kernel address leakage
     - dibs: loopback: validate offset and size in move_data()
     - seqlock: fix scoped_seqlock_read kernel-doc
     - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
     - rtnetlink: Make per-netns RTNL dereference helpers to macro.
     - net: airoha: Fix channel configuration for ETS Qdisc
     - jiffies: Cast to unsigned long in secs_to_jiffies() conversion
     - afs: Fix afs_atcell_get_link() to check if ws_cell is unset first
     - afs: Fix afs_dynroot_readdir() to not use the RCU read lock
     - [amd64] crypto: ccp - Fix __sev_snp_shutdown_locked
     - [amd64] crypto: ccp - Fix dereferencing uninitialized error pointer
     - [amd64] crypto: ccp - Fix SNP panic notifier unregistration
     - udp_tunnel: fix deadlock in udp_tunnel_nic_set_port_priv()
     - Bluetooth: hci_core: Remove check of BDADDR_ANY in
       hci_conn_hash_lookup_big_state
     - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle
     - [amd64] crypto: ccp - Always pass in an error pointer to
       __sev_platform_shutdown_locked()
     - i40e: drop udp_tunnel_get_rx_info() call from i40e_open()
     - ice: drop udp_tunnel_get_rx_info() call from ndo_open()
     - [amd64] crypto: ccp - Fix leaking the same page twice
     - Bluetooth: L2CAP: Fix regressions caused by reusing ident
     - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
     - Bluetooth: L2CAP: fix tx ident leak for commands without a response
     - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
     - tools/testing: add linux/args.h header and fix radix, VMA tests
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.98
     - ext4: fix fd leak in EXT4_IOC_MOVE_EXT cross-sb validation
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.99
     - mm: refactor mm_access() to not return NULL
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.100
     - posix-cpu-timers: Prevent UAF caused by non-leader exec() race
       (CVE-2026-64560)
linux (6.12.96-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.96
     - [arm64] bpf, arm64: Reject out-of-range B.cond targets
     - nfsd: fix file change detection in CB_GETATTR
     - nfsd: release layout stid on setlease failure
     - userfaultfd: gate must_wait writability check on pte_present()
     - perf: Fix dangling cgroup pointer in cpuctx backport
     - bcachefs: avoid truncating fiemap extent length
     - drm/amd: Fix set but not used warnings
     - gpio: rockchip: change the GPIO version judgment logic
     - gpio: rockchip: teardown bugs and resource leaks
     - gpio: rockchip: fix generic IRQ chip leak on remove (CVE-2026-53226)
     - mm/vmalloc: take vmap_purge_lock in shrinker (CVE-2026-46093)
     - device property: initialize the remaining fields of fwnode_handle in
       fwnode_init()
     - f2fs: validate orphan inode entry count
     - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode
     - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
     - f2fs: fix potential deadlock in f2fs_balance_fs()
     - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
     - f2fs: fix listxattr handling of corrupted xattr entries
     - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
     - nfsd: add nfsd_file_{get,put} to 'nfs_to' nfsd_localio_operations
     - nfs_common: rename functions that invalidate LOCALIO nfs_clients
     - NFSv4/flexfiles: Remove cred local variable dependency
     - NFSv4/flexfiles: Add data structure support for striped layouts
     - NFSv4/flexfiles: reject zero filehandle version count
     - locking/rtmutex: Make sure we wake anything on the wake_q when we release
       the lock->wait_lock
     - apparmor: advertise the tcp fast open fix is applied
     - nfsd: move name lookup out of nfsd4_list_rec_dir()
     - nfsd: change nfs4_client_to_reclaim() to allocate data
     - bonding: fix xfrm offload feature setup on active-backup mode
     - block: add a store_limit operations for sysfs entries
     - block: fix queue freeze vs limits lock order in sysfs store methods
       (CVE-2025-21807)
     - mm/khugepaged: write all dirty file folios when collapsing
     - perf trace beauty fcntl: Fix build with older kernel headers
     - ACPI: CPPC: Suppress UBSAN warning caused by field misuse
     - ACPI: NFIT: core: Fix possible NULL pointer dereference
     - [amd64] platform/x86: intel-hid: Protect ACPI notify handler against
       recursion
     - perf/core: Detach event groups during remove_on_exec
     - [amd64] drm/i915: ensure segment offset never exceeds allowed max
     - usb: gadget: function: rndis: add length check to response query
     - usb: gadget: function: rndis: add length check for header
     - iio: accel: bmc150: clamp the device-reported FIFO frame count
     - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
     - iio: adc: lpc32xx: Initialize completion before requesting IRQ
     - iio: adc: spear: Initialize completion before requesting IRQ
     - iio: adc: ti-ads1119: fix PM reference leak in buffer preenable
     - iio: adc: ti-ads124s08: Return reset GPIO lookup errors
     - iio: backend: fix uninitialized data in debugfs
     - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
     - iio: common: st_sensors: honour channel endianness in read_axis_data
     - iio: event: Fix event FIFO reset race
     - iio: gyro: bmg160: bail out when bandwidth/filter is not in table
     - iio: gyro: bmg160: wait full startup time after mode change at probe
     - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
     - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
     - iio: imu: inv_icm42600: fix timestamp clock period by using lower value
     - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
     - iio: imu: st_lsm6dsx: deselect shub page before reading whoami
     - iio: light: al3010: fix incorrect scale for the highest gain range
     - iio: light: gp2ap002: fix runtime PM leak on read error
     - iio: light: opt3001: fix missing state reset on timeout
     - iio: light: tsl2591: return actual error from probe IRQ failure
     - iio: light: veml6030: fix channel type when pushing events
     - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
     - iio: resolver: ad2s1210: notify trigger and clear state on fault read
       error
     - iio: temperature: Build mlx90635 with CONFIG_MLX90635
     - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check
     - iio: temperature: ltc2983: Fix reinit_completion() called after conversion
       start
     - ALSA: virtio: Add missing 384 kHz PCM rate mapping
     - ALSA: virtio: Validate control metadata from the device
     - ALSA: ymfpci: check snd_ctl_new1() return value
     - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
     - ALSA: cmipci: check snd_ctl_new1() return value
     - ALSA: es1938: check snd_ctl_new1() return value
     - ALSA: firewire: isight: bound the sample count to the packet payload
     - ALSA: gus: check snd_ctl_new1() return value
     - ALSA: ice1712: check snd_ctl_new1() return value
     - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
     - ALSA: usb-audio: avoid kobject path lookup in DualSense match
     - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
     - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch
       put callbacks
     - ALSA: usb-audio: Roll back quirk control caches on write errors
     - ALSA: usb-audio: Update Babyface Pro control caches only after successful
       writes
     - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful
       writes
     - vfio/pci: Use a private flag to prevent power state change with VFs
     - vfio/pci: Latch disable_idle_d3 per device
     - vfio/pci: Release the VGA arbiter client on register_device() failure
     - vfio/pci: Fix racy bitfields and tighten struct layout
     - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
     - vfio: Remove device debugfs before releasing devres
     - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB
     - Bluetooth: btusb: fix use-after-free on registration failure
     - Bluetooth: btusb: fix use-after-free on marvell probe failure
     - Bluetooth: btusb: fix wakeup source leak on probe failure
     - [arm*] binder: fix UAF in binder_thread_release()
     - [arm*] binder: fix UAF in binder_free_transaction()
     - usb: xhci: Fix sleep in atomic context in xhci_free_streams()
     - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
     - PCI: host-common: Request bus reassignment when not probe-only
     - [arm*] PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
     - mm/damon/ops-common: handle extreme intervals in damon_hot_score()
     - netfilter: ipset: fix race between dump and ip_set_list resize
     - virtio_pci: fix vq info pointer lookup via wrong index
     - virtio-mmio: fix device release warning on module unload
     - hwrng: virtio: clamp device-reported used.len at copy_data()
     - USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
     - usb: dwc3: run gadget disconnect from sleepable suspend context
     - 6lowpan: fix NHC entry use-after-free on error path
     - tipc: fix out-of-bounds read in broadcast Gap ACK blocks
     - staging: vme_user: bound slave read/write to the kern_buf size
     - smb: client: restrict implied bcc[0] exemption to responses without data
       area
     - staging: vme_user: fix location monitor leak in fake bridge
     - staging: vme_user: fix location monitor leak in tsi148 bridge
     - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
     - staging: media: atomisp: reduce load_primary_binaries() stack usage
     - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
     - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
     - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
     - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
     - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and
       join_cmd_hdl()
     - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
     - staging: rtl8723bs: fix OOB write in HT_caps_handler()
     - crypto: amlogic - avoid double cleanup in meson_crypto_probe()
     - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then
       SMB2_CANCEL
     - net: af_key: initialize alg_key_len for IPComp states
     - audit: Fix data races of skb_queue_len() readers on audit_queue
     - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
     - coresight: etb10: restore atomic_t for shared reading state
     - debugobjects: Plug race against a concurrent OOM disable
     - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns
     - NTB: epf: Avoid calling pci_irq_vector() from hardirq context
     - gpio: eic-sprd: use raw_spinlock_t in the irq startup path
     - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
     - netpoll: fix a use-after-free on shutdown path
     - ipv4: igmp: remove multicast group from hash table on device destruction
     - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
     - mfd: cros_ec: Delay dev_set_drvdata() until probe success
     - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
     - mm: shrinker: fix shrinker_info teardown race with expansion
     - mm: shrinker: fix NULL pointer dereference in debugfs
     - mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent
       softlockup
     - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump
     - netfilter: handle unreadable frags
     - netfilter: ebtables: module names must be null-terminated
     - netfilter: ebtables: terminate table name before find_table_lock()
     - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
     - Bluetooth: bnep: pin L2CAP connection during netdev registration
     - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in
       nxp_recv_fw_req_v3()
     - Bluetooth: fix UAF in bt_accept_dequeue()
     - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
     - Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
     - Bluetooth: L2CAP: validate option length before reading conf opt value
     - fs/ntfs3: rename ni_readpage_cmpr into ni_read_folio_cmpr
     - fs/ntfs3: fsync files by syncing parent inodes
     - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio()
     - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
       (CVE-2026-53027)
     - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()
     - smb/client: Fix error code in smb2_aead_req_alloc()
     - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
     - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA
     - ksmbd: serialize QUERY_DIRECTORY requests per file
     - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation
     - ksmbd: require source read access for duplicate extents
     - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY
     - ksmbd: run set info with opener credentials
     - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION
     - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION
     - ksmbd: use opener credentials for delete-on-close
     - ksmbd: use opener credentials for ADS I/O
     - smb: client: fix query directory replay double-free
     - smb: client: fix query_info() replay double-free
     - smb: client: fix double-free in SMB2_ioctl() replay
     - smb: client: fix change notify replay double-free
     - smb: client: fix double-free in SMB2_flush() replay
     - smb: client: fix double-free in SMB2_open() replay
     - smb: client: fix double-free in SMB2_close() replay
     - smb: client: Fix next buffer leak in receive_encrypted_standard()
     - smb: client: use unaligned reads in parse_posix_ctxt()
     - smb: client: harden POSIX SID length parsing
     - smb: client: fix atime clamp check in read completion
     - smb: client: mask server-provided mode to 07777 in modefromsid
     - writeback: fix race between cgroup_writeback_umount() and
       inode_switch_wbs()
     - cpufreq: qcom-cpufreq-hw: Fix possible double free
     - firmware_loader: fix device reference leak in firmware_upload_register()
     - [amd64] cpufreq: intel_pstate: Sync policy->cur during CPU offline
     - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
     - cpufreq: Fix hotplug-suspend race during reboot
     - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
     - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
     - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog
       instances
     - X.509: Fix validation of ASN.1 certificate header
     - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
     - tools/mm/slabinfo: Fix trace disable logic inversion
     - tools/mm/slabinfo: fix total_objects attribute name
     - HID: hid-goodix-spi: validate report size to prevent stack buffer overflow
     - HID: wacom: stop hardware after post-start probe failures
     - HID: letsketch: fix UAF on inrange_timer at driver unbind
     - HID: lg-g15: cancel pending work on remove to fix a use-after-free
     - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte
       reads
     - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
     - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
     - media: mtk-jpeg: cancel workqueue on release for supported platforms only
     - serial: 8250_mid: Disable DMA for selected platforms
     - xfs: use null daddr for unset first bad log block
     - xfs: release dquot buffer after dqflush failure
     - xfs: fix unreachable BIGTIME check in dquot flush validation
     - xfs: fix pointer arithmetic error on 32-bit systems
     - xfs: fix exchmaps reservation limit check
     - bpf: Reject fragmented frames in devmap
     - bpf: Restore sysctl new-value from 1 to 0
     - bpf: Validate BTF repeated field counts before expansion
     - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
     - usb: cdc_acm: Add quirk for Uniden BC125AT scanner
     - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
     - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub
     - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()
     - usb: free iso schedules on failed submit
     - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
     - usb: gadget: udc: Fix use-after-free in gadget_match_driver
     - usb: gadget: f_printer: take kref only for successful open
     - USB: idmouse: fix use-after-free on disconnect race
     - USB: ldusb: fix use-after-free on disconnect race
     - USB: iowarrior: fix use-after-free on disconnect
     - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD
     - USB: legousbtower: fix use-after-free on disconnect race
     - usb: sl811-hcd: disable controller wakeup on remove
     - USB: storage: include US_FL_NO_SAME in quirks mask
     - USB: misc: uss720: unregister parport on probe failure
     - usb: mtu3: unmap request DMA on queue failure
     - USB: serial: keyspan_pda: fix information leak
     - USB: serial: option: add Telit Cinterion FE990D50 compositions
     - USB: serial: digi_acceleport: fix broken rx after throttle
     - USB: serial: digi_acceleport: fix hard lockup on disconnect
     - USB: serial: digi_acceleport: fix write buffer corruption
     - USB: ulpi: fix memory leak on registration failure
     - USB: usb-storage: ene_ub6250: restore media-ready check
     - usbip: tools: support SuperSpeedPlus devices
     - usbip: vudc: fix NULL deref in vep_dequeue()
     - usb: typec: anx7411: use devm_pm_runtime_enable()
     - usb: typec: class: drop PD lookup reference
     - usb: typec: tcpm: Fix VDM type for Enter Mode commands
     - usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
     - usb: typec: ucsi: Invert DisplayPort role assignment
     - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt
       mode
     - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
     - usb: typec: ucsi: cancel pending work on system suspend
     - usb: gadget: f_fs: Fix DMA fence leak
     - block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
     - [amd64] x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU
       when SNC enabled
     - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining
     - udf: validate free block extents against the partition length
     - udf: validate VAT header length against the VAT inode size
     - udf: validate sparing table length as an entry count, not a byte count
     - hwrng: jh7110 - fix refcount leak in starfive_trng_read()
     - nvme: target: rdma: fix ndev refcount leak on queue connect
     - dm-ioctl: report an error if a device has no table
     - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace
       disks
     - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
     - nvmet-auth: validate reply message payload bounds against transfer length
     - btrfs: do not trim a device which is not writeable
     - partitions: aix: bound the pp_count scan to the ppe array
     - isofs: bound Rock Ridge symlink components to the SL record
     - crypto: af_alg - Remove zero-copy support from skcipher and aead
     - [arm64] crypto: caam - use print_hex_dump_devel to guard key hex dumps
     - [arm64] crypto: caam - use print_hex_dump_devel to guard key hex dumps
       again
     - crypto: ecc - Fix carry overflow in vli multiplication
     - crypto: pcrypt - restore callback for non-parallel fallback
     - [amd64] crypto: ccp - Do not initialize SNP for SEV ioctls
     - [amd64] crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)
     - [amd64] crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)
     - crypto: drbg - Fix returning success on failure in CTR_DRBG
     - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
     - crypto: drbg - Fix the fips_enabled priority boost
     - [amd64] crypto: qat - keep VFs enabled during reset
     - [amd64] crypto: qat - notify fatal error before AER reset preparation
     - [amd64] crypto: qat - protect service table iterations with service_lock
     - [amd64] crypto: qat - validate RSA CRT component lengths
     - [arm64] fpsimd: Fix type mismatch in sme_{save,load}_state()
     - spi: fsl-lpspi: replace dmaengine_terminate_all() with
       dmaengine_terminate_sync()
     - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
     - EDAC/i10nm: Don't fail probing if ADXL is missing
     - watchdog: apple: Add "apple,t8103-wdt" compatible
     - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
     - i2c: core: fix hang on adapter registration failure
     - tracing: Prevent out-of-bounds read in glob matching
     - audit: fix potential integer overflow in audit_log_n_hex()
     - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
     - module: decompress: check return value of module_extend_max_pages()
     - exfat: bound uniname advance in exfat_find_dir_entry()
     - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()
     - riscv: mm: Unconditionally sfence.vma for spurious fault
     - mm: fix mmap errno value when MAP_DROPPABLE is not supported
     - mm: do file ownership checks with the proper mount idmap
     - [amd64] iommu/amd: Don't split flush for amd_iommu_domain_flush_all()
     - iommufd: Set upper bounds on cache invalidation entry_num and entry_len
     - [amd64] KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected
       #DBs
     - [amd64] KVM: x86: Ensure vendor's exit handler runs before fastpath
       userspace exits
     - [amd64] KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in
       guest mode
     - udmabuf: fix DMA direction mismatch in release_udmabuf()
     - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
     - i2c: core: fix irq domain leak on adapter registration failure
     - i2c: core: fix NULL-deref on adapter registration failure
     - i2c: core: fix adapter probe deferral loop
     - i2c: core: fix adapter debugfs creation
     - i2c: core: fix adapter deregistration race
     - i2c: mpc: Fix timeout calculations
     - i2c: stm32f7: truncate clock period instead of rounding it
     - Input: synaptics-rmi4 - unregister function handlers on physical driver
       registration failure
     - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
     - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
     - Input: elan_i2c - prevent division by zero and arithmetic underflow
     - Input: goodix - clamp the device-reported contact count
     - Input: iforce - bound the device-reported force-feedback effect index
     - Input: mms114 - fix touch indexing for MMS134S and MMS136
     - Input: touchwin - reset the packet index on every complete packet
     - Input: mms114 - reject an oversized device packet size
     - Input: maplemouse - fix NULL pointer dereference in open()
     - Input: mms114 - fix multi-touch slot corruption
     - Input: maple_keyb - set driver data before registering input device
     - Input: maplemouse - set driver data before registering input device
     - Input: maplecontrol - set driver data before registering input device
     - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
     - RDMA/siw: bound Read Response placement to the RREAD length
     - fuse: fix device node leak in cuse_process_init_reply()
     - fuse: re-lock request before returning from fuse_ref_folio()
     - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req
     - usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction
       checks
     - smb: client: reject overlapping data areas in SMB2 responses
     - xfs: fix null pointer dereference in tracepoint
     - xfs: fail recovery on a committed log item with no regions
     - xfs: resample the data fork mapping after cycling ILOCK
     - xfs: don't wrap around quota ids in dqiterate
     - xfs: set xfarray killable sort correctly
     - xfs: clamp timestamp nanoseconds correctly
     - xfs: fully check the parent handle when it points to the rootdir
     - xfs: don't zap bmbt forks if they are MAXLEVELS tall
 .
   [ Han Gao ]
   * [riscv64] set NR_CPUS to 128 (Closes: #1140651)
 .
   [ Salvatore Bonaccorso ]
   * [rt] Refresh "locking/rt: Annotate unlock followed by lock for sparse."
     (context changes)
linux (6.12.95-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.95
     - wifi: mt76: mt7921: avoid undesired changes of the preset regulatory
       domain
     - wifi: mt76: mt7921: fix a potential scan no APs
     - wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync
       (CVE-2026-53101)
     - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (CVE-2026-53167)
     - gpiolib: Extract gpiochip_choose_fwnode() for wider use
     - gpiolib: Remove redundant assignment of return variable
     - gpio: Fix resource leaks on errors in gpiochip_add_data_with_key()
       (CVE-2026-31732)
     - io_uring/net: Avoid msghdr on op_connect/op_bind async data
     - drm/xe/display: fix oops in suspend/shutdown without display
       (CVE-2026-53142)
     - [arm64] drm/v3d: Store the active job inside the queue's state
     - [arm64] drm/v3d: Skip CSD when it has zeroed workgroups (CVE-2026-53139)
     - eventpoll: use hlist_is_singular_node() in __ep_remove()
     - eventpoll: split __ep_remove()
     - eventpoll: kill __ep_remove()
     - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()
     - eventpoll: rename ep_remove_safe() back to ep_remove()
     - eventpoll: move epi_fget() up
     - eventpoll: fix ep_remove struct eventpoll / struct file UAF
       (CVE-2026-46242)
     - iio: light: bh1780: fix PM runtime leak on error path (CVE-2026-43355)
     - net: Drop the lock in skb_may_tx_timestamp() (CVE-2026-43216)
     - Reapply "selftest/ptp: update ptp selftest to exercise the gettimex
       options"
     - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING
     - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP
     - debugobjects: Do not fill_pool() if pi_blocked_on
     - debugobjects: Dont call fill_pool() in early boot hardirq context
     - RDMA/bnxt_re: zero shared page before exposing to userspace
     - i2c: stub: Reject I2C block transfers with invalid length
     - [amd64] agp/amd64: Fix broken error propagation in agp_amd64_probe()
       (CVE-2026-53325)
     - bpf: Reject sleepable kprobe_multi programs at attach time
       (CVE-2026-43010)
     - ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn()
     - regulator: core: fix locking in regulator_resolve_supply() error path
     - dlm: prevent NPD when writing a positive value to event_done
       (CVE-2025-23131)
     - xfs: remove the expr argument to XFS_TEST_ERROR
     - xfs: fix error returns in CoW fork repair
     - Revert "net: bonding: fix use-after-free in bond_xmit_broadcast()"
     - net: bonding: add broadcast_neighbor option for 802.3ad
     - bonding: add support for per-port LACP actor priority
     - bonding: print churn state via netlink
     - bonding: 3ad: implement proper RCU rules for port->aggregator
       (CVE-2026-52975)
     - net: bonding: fix use-after-free in bond_xmit_broadcast() (CVE-2026-31419)
     - bonding: fix NULL pointer dereference in actor_port_prio setting
     - staging: rtl8723bs: fix buffer over-read in rtw_update_protection
       (CVE-2026-53179)
     - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
       (CVE-2026-53341)
     - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs
     - hv: utils: handle and propagate errors in kvp_register
     - locking/mutex: Remove wakeups from under mutex::wait_lock
     - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
     - phonet: Pass ifindex to fill_addr().
     - phonet: Pass net and ifindex to phonet_address_notify().
     - net: phonet: free phonet_device after RCU grace period (CVE-2026-53157)
     - rxrpc: Fix the ACK parser to extract the SACK table for parsing
       (CVE-2026-53151)
     - fuse: re-lock request before replacing page cache folio
     - ftrace: Update the mcount_loc check of skipped entries
     - ftrace: Have ftrace pages output reflect freed pages
     - ftrace: Do not over-allocate ftrace memory
     - ftrace: Test mcount_loc addr before calling ftrace_call_addr()
     - ftrace: Check against is_kernel_text() instead of kaslr_offset()
     - net: ipv6: Make udp_tunnel6_xmit_skb() void
     - sctp: disable BH before calling udp_tunnel_xmit_skb() (CVE-2026-53070)
     - iio: light: veml6075: add bounds check to veml6075_it_ms index
     - iio: adc: ti-ads1298: add bounds check to pga_settings index
     - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent
       vcs_write
     - [arm64] serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
     - ksmbd: reject non-VALID session in compound request branch
     - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
     - virtiofs: fix UAF on submount umount
     - [amd64] KVM: x86: Fix shadow paging use-after-free due to unexpected role
       (CVE-2026-53359)
     - [amd64] KVM: x86/mmu: Ensure hugepage is in by slot before checking max
       mapping level
     - Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command
       Completion support"
     - [amd64] KVM: SEV: Ignore MMIO requests of length '0'
     - [amd64] KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+
     - [amd64] KVM: SEV: Ignore Port I/O requests of length '0'
     - batman-adv: tp_meter: keep unacked list in ascending ordered
     - batman-adv: tp_meter: initialize dup_acks explicitly
     - batman-adv: tp_meter: initialize dec_cwnd explicitly
     - batman-adv: tp_meter: avoid window underflow
     - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
     - batman-adv: tp_meter: fix fast recovery precondition
     - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection
     - batman-adv: tp_meter: add only finished tp_vars to lists
     - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE
     - batman-adv: prevent ELP transmission interval underflow
     - batman-adv: tp_meter: initialize last_recv_time during init
     - batman-adv: ensure bcast is writable before modifying TTL
     - batman-adv: fix (m|b)cast csum after decrementing TTL
     - batman-adv: frag: ensure fragment is writable before modifying TTL
     - batman-adv: frag: avoid underflow of TTL
     - batman-adv: v: prevent OGM aggregation on disabled hardif
     - batman-adv: tp_meter: restrict number of unacked list entries
     - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE
     - batman-adv: tp_meter: prevent parallel modifications of last_recv
     - batman-adv: tp_meter: handle overlapping packets
     - batman-adv: tt: don't merge change entries with different VIDs
     - batman-adv: tt: track roam count per VID
     - batman-adv: dat: prevent false sharing between VLANs
     - batman-adv: tvlv: enforce 2-byte alignment
     - batman-adv: tvlv: avoid race of cifsnotfound handler state
     - ipv6: account for fraggap on the paged allocation path (CVE-2026-53362)
     - fs: constify file ptr in backing_file accessor helpers
     - lsm: add backing_file LSM hooks
     - selinux: fix overlayfs mmap() and mprotect() access checks
     - inet: add indirect call wrapper for getfrag() calls
     - ipv4: account for fraggap on the paged allocation path
     - ntfs3: reject direct userspace writes to reserved $LX* xattrs
     - [amd64] KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb()
     - [amd64] KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free
     - af_unix: Set gc_in_progress to true in unix_gc(). (CVE-2026-53361)
     - mtd: spi-nor: macronix: Add post_sfdp fixups for Quad Input Page Program
     - mtd: spi-nor: macronix: add support for mx66{l2, u1}g45g
     - mac802154: llsec: add skb_cow_data() before in-place crypto
     - net: skmsg: preserve sg.copy across SG transforms
     - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
     - apparmor: mediate the implicit connect of TCP fast open sendmsg
     - apparmor: fix use-after-free in rawdata dedup loop
     - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share
       BAR
     - fbdev: fix use-after-free in store_modes()
     - kernel/fork: clear PF_BLOCK_TS in copy_process()
     - block: invalidate cached plug timestamp after task switch
     - err.h: use __always_inline on all error pointer helpers
     - KEYS: fix overflow in keyctl_pkey_params_get_2()
     - keys: Pin request_key_auth payload in instantiate paths
     - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S
     - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer
     - wifi: ath11k: fix warning when unbinding
     - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor
     - wifi: rtw88: increase TX report timeout to fix race condition
     - wifi: rtw88: usb: fix memory leaks on USB write failures
     - wifi: iwlwifi: mvm: fix race condition in PTP removal
     - f2fs: validate compress cache inode only when enabled
     - f2fs: fix to round down start offset of fallocate for pin file
     - f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
     - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
     - f2fs: keep atomic write retry from zeroing original data
     - block: Avoid mounting the bdev pseudo-filesystem in userspace
     - bpf: use kvfree() for replaced sysctl write buffer
     - exfat: fix potential use-after-free in exfat_find_dir_entry()
     - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with
       get_unaligned()
     - gfs2: fix use-after-free in gfs2_qd_dealloc
     - [arm64] pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
     - hdlc_ppp: sync per-proto timers before freeing hdlc state
     - blk-cgroup: fix UAF in __blkcg_rstat_flush()
     - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
     - pNFS: Fix use-after-free in pnfs_update_layout()
     - fpga: region: fix use-after-free in child_regions_with_firmware()
     - rpmsg: char: Fix use-after-free on probe error path
     - ocfs2: reject oversized group bitmap descriptors
     - 9p: avoid putting oldfid in p9_client_walk() error path
     - [amd64] KVM: x86: hyper-v: Bound the bank index when querying sparse banks
     - [amd64] KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
     - power: reset: linkstation-poweroff: fix use-after-free in the
       linkstation_poweroff_init()
     - [riscv64] mm: Extract helper mark_new_valid_map()
     - [riscv64] kfence: Call mark_new_valid_map() for kfence_unprotect()
     - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in
       fb_videomode_to_var
     - fbdev: modedb: fix a possible UAF in fb_find_mode()
     - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
     - i2c: core: fix adapter registration race
     - NFSD: Fix SECINFO_NO_NAME decode error cleanup
     - nfsd: fix posix_acl leak on SETACL decode failure
     - nfsd: check get_user() return when reading princhashlen
     - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
     - nfsd: reset write verifier on deferred writeback errors
     - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
     - NFS: Prevent resource leak in nfs_alloc_server()
     - ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
     - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
     - drivers/base/memory: set mem->altmap after successful device registration
     - Documentation: ioctl-number: Fix linuxppc-dev mailto link
     - Documentation: ioctl-number: Extend "Include File" column width
     - [amd64] crypto: qat - Replace kzalloc() + copy_from_user() with
       memdup_user()
     - [amd64] crypto: qat - Return pointer directly in adf_ctl_alloc_resources
     - [amd64] crypto: qat - remove unused character device and IOCTLs
     - net/tcp-ao: fix use-after-free of key in del_async path
     - locking: rtmutex: Fix wake_q logic in task_blocks_on_rt_mutex
     - net: bonding: update the slave array for broadcast mode
     - bonding: annotate data-races arcound churn variables
     - bonding: do not set usable_slaves for broadcast mode
 .
   [ Salvatore Bonaccorso ]
   * net/netfilter: Enable NETFILTER_NETLINK_HOOK as module (Closes: #1139686)
   * [rt] Refresh "locking/rt: Annotate unlock followed by lock for sparse."
 .
   [ Uwe Kleine-König ]
   * [amd64] Enable CONFIG_PINCTRL_CS42L43 and CONFIG_SPI_CS42L43 explicitly
     (Closes: #1136179)
linux (6.12.95-1~bpo12+1) bookworm-backports; urgency=medium
 .
   * Rebuild for bookworm-backports
 .
 linux (6.12.95-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.95
     - wifi: mt76: mt7921: avoid undesired changes of the preset regulatory
       domain
     - wifi: mt76: mt7921: fix a potential scan no APs
     - wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync
       (CVE-2026-53101)
     - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (CVE-2026-53167)
     - gpiolib: Extract gpiochip_choose_fwnode() for wider use
     - gpiolib: Remove redundant assignment of return variable
     - gpio: Fix resource leaks on errors in gpiochip_add_data_with_key()
       (CVE-2026-31732)
     - io_uring/net: Avoid msghdr on op_connect/op_bind async data
     - drm/xe/display: fix oops in suspend/shutdown without display
       (CVE-2026-53142)
     - [arm64] drm/v3d: Store the active job inside the queue's state
     - [arm64] drm/v3d: Skip CSD when it has zeroed workgroups (CVE-2026-53139)
     - eventpoll: use hlist_is_singular_node() in __ep_remove()
     - eventpoll: split __ep_remove()
     - eventpoll: kill __ep_remove()
     - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()
     - eventpoll: rename ep_remove_safe() back to ep_remove()
     - eventpoll: move epi_fget() up
     - eventpoll: fix ep_remove struct eventpoll / struct file UAF
       (CVE-2026-46242)
     - iio: light: bh1780: fix PM runtime leak on error path (CVE-2026-43355)
     - net: Drop the lock in skb_may_tx_timestamp() (CVE-2026-43216)
     - Reapply "selftest/ptp: update ptp selftest to exercise the gettimex
       options"
     - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING
     - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP
     - debugobjects: Do not fill_pool() if pi_blocked_on
     - debugobjects: Dont call fill_pool() in early boot hardirq context
     - RDMA/bnxt_re: zero shared page before exposing to userspace
     - i2c: stub: Reject I2C block transfers with invalid length
     - [amd64] agp/amd64: Fix broken error propagation in agp_amd64_probe()
       (CVE-2026-53325)
     - bpf: Reject sleepable kprobe_multi programs at attach time
       (CVE-2026-43010)
     - ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn()
     - regulator: core: fix locking in regulator_resolve_supply() error path
     - dlm: prevent NPD when writing a positive value to event_done
       (CVE-2025-23131)
     - xfs: remove the expr argument to XFS_TEST_ERROR
     - xfs: fix error returns in CoW fork repair
     - Revert "net: bonding: fix use-after-free in bond_xmit_broadcast()"
     - net: bonding: add broadcast_neighbor option for 802.3ad
     - bonding: add support for per-port LACP actor priority
     - bonding: print churn state via netlink
     - bonding: 3ad: implement proper RCU rules for port->aggregator
       (CVE-2026-52975)
     - net: bonding: fix use-after-free in bond_xmit_broadcast() (CVE-2026-31419)
     - bonding: fix NULL pointer dereference in actor_port_prio setting
     - staging: rtl8723bs: fix buffer over-read in rtw_update_protection
       (CVE-2026-53179)
     - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
       (CVE-2026-53341)
     - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs
     - hv: utils: handle and propagate errors in kvp_register
     - locking/mutex: Remove wakeups from under mutex::wait_lock
     - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
     - phonet: Pass ifindex to fill_addr().
     - phonet: Pass net and ifindex to phonet_address_notify().
     - net: phonet: free phonet_device after RCU grace period (CVE-2026-53157)
     - rxrpc: Fix the ACK parser to extract the SACK table for parsing
       (CVE-2026-53151)
     - fuse: re-lock request before replacing page cache folio
     - ftrace: Update the mcount_loc check of skipped entries
     - ftrace: Have ftrace pages output reflect freed pages
     - ftrace: Do not over-allocate ftrace memory
     - ftrace: Test mcount_loc addr before calling ftrace_call_addr()
     - ftrace: Check against is_kernel_text() instead of kaslr_offset()
     - net: ipv6: Make udp_tunnel6_xmit_skb() void
     - sctp: disable BH before calling udp_tunnel_xmit_skb() (CVE-2026-53070)
     - iio: light: veml6075: add bounds check to veml6075_it_ms index
     - iio: adc: ti-ads1298: add bounds check to pga_settings index
     - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent
       vcs_write
     - [arm64] serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
     - ksmbd: reject non-VALID session in compound request branch
     - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
     - virtiofs: fix UAF on submount umount
     - [amd64] KVM: x86: Fix shadow paging use-after-free due to unexpected role
       (CVE-2026-53359)
     - [amd64] KVM: x86/mmu: Ensure hugepage is in by slot before checking max
       mapping level
     - Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command
       Completion support"
     - [amd64] KVM: SEV: Ignore MMIO requests of length '0'
     - [amd64] KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+
     - [amd64] KVM: SEV: Ignore Port I/O requests of length '0'
     - batman-adv: tp_meter: keep unacked list in ascending ordered
     - batman-adv: tp_meter: initialize dup_acks explicitly
     - batman-adv: tp_meter: initialize dec_cwnd explicitly
     - batman-adv: tp_meter: avoid window underflow
     - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
     - batman-adv: tp_meter: fix fast recovery precondition
     - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection
     - batman-adv: tp_meter: add only finished tp_vars to lists
     - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE
     - batman-adv: prevent ELP transmission interval underflow
     - batman-adv: tp_meter: initialize last_recv_time during init
     - batman-adv: ensure bcast is writable before modifying TTL
     - batman-adv: fix (m|b)cast csum after decrementing TTL
     - batman-adv: frag: ensure fragment is writable before modifying TTL
     - batman-adv: frag: avoid underflow of TTL
     - batman-adv: v: prevent OGM aggregation on disabled hardif
     - batman-adv: tp_meter: restrict number of unacked list entries
     - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE
     - batman-adv: tp_meter: prevent parallel modifications of last_recv
     - batman-adv: tp_meter: handle overlapping packets
     - batman-adv: tt: don't merge change entries with different VIDs
     - batman-adv: tt: track roam count per VID
     - batman-adv: dat: prevent false sharing between VLANs
     - batman-adv: tvlv: enforce 2-byte alignment
     - batman-adv: tvlv: avoid race of cifsnotfound handler state
     - ipv6: account for fraggap on the paged allocation path (CVE-2026-53362)
     - fs: constify file ptr in backing_file accessor helpers
     - lsm: add backing_file LSM hooks
     - selinux: fix overlayfs mmap() and mprotect() access checks
     - inet: add indirect call wrapper for getfrag() calls
     - ipv4: account for fraggap on the paged allocation path
     - ntfs3: reject direct userspace writes to reserved $LX* xattrs
     - [amd64] KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb()
     - [amd64] KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free
     - af_unix: Set gc_in_progress to true in unix_gc(). (CVE-2026-53361)
     - mtd: spi-nor: macronix: Add post_sfdp fixups for Quad Input Page Program
     - mtd: spi-nor: macronix: add support for mx66{l2, u1}g45g
     - mac802154: llsec: add skb_cow_data() before in-place crypto
     - net: skmsg: preserve sg.copy across SG transforms
     - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
     - apparmor: mediate the implicit connect of TCP fast open sendmsg
     - apparmor: fix use-after-free in rawdata dedup loop
     - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share
       BAR
     - fbdev: fix use-after-free in store_modes()
     - kernel/fork: clear PF_BLOCK_TS in copy_process()
     - block: invalidate cached plug timestamp after task switch
     - err.h: use __always_inline on all error pointer helpers
     - KEYS: fix overflow in keyctl_pkey_params_get_2()
     - keys: Pin request_key_auth payload in instantiate paths
     - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S
     - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer
     - wifi: ath11k: fix warning when unbinding
     - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor
     - wifi: rtw88: increase TX report timeout to fix race condition
     - wifi: rtw88: usb: fix memory leaks on USB write failures
     - wifi: iwlwifi: mvm: fix race condition in PTP removal
     - f2fs: validate compress cache inode only when enabled
     - f2fs: fix to round down start offset of fallocate for pin file
     - f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
     - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
     - f2fs: keep atomic write retry from zeroing original data
     - block: Avoid mounting the bdev pseudo-filesystem in userspace
     - bpf: use kvfree() for replaced sysctl write buffer
     - exfat: fix potential use-after-free in exfat_find_dir_entry()
     - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with
       get_unaligned()
     - gfs2: fix use-after-free in gfs2_qd_dealloc
     - [arm64] pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
     - hdlc_ppp: sync per-proto timers before freeing hdlc state
     - blk-cgroup: fix UAF in __blkcg_rstat_flush()
     - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
     - pNFS: Fix use-after-free in pnfs_update_layout()
     - fpga: region: fix use-after-free in child_regions_with_firmware()
     - rpmsg: char: Fix use-after-free on probe error path
     - ocfs2: reject oversized group bitmap descriptors
     - 9p: avoid putting oldfid in p9_client_walk() error path
     - [amd64] KVM: x86: hyper-v: Bound the bank index when querying sparse banks
     - [amd64] KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
     - power: reset: linkstation-poweroff: fix use-after-free in the
       linkstation_poweroff_init()
     - [riscv64] mm: Extract helper mark_new_valid_map()
     - [riscv64] kfence: Call mark_new_valid_map() for kfence_unprotect()
     - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in
       fb_videomode_to_var
     - fbdev: modedb: fix a possible UAF in fb_find_mode()
     - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
     - i2c: core: fix adapter registration race
     - NFSD: Fix SECINFO_NO_NAME decode error cleanup
     - nfsd: fix posix_acl leak on SETACL decode failure
     - nfsd: check get_user() return when reading princhashlen
     - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
     - nfsd: reset write verifier on deferred writeback errors
     - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
     - NFS: Prevent resource leak in nfs_alloc_server()
     - ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
     - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
     - drivers/base/memory: set mem->altmap after successful device registration
     - Documentation: ioctl-number: Fix linuxppc-dev mailto link
     - Documentation: ioctl-number: Extend "Include File" column width
     - [amd64] crypto: qat - Replace kzalloc() + copy_from_user() with
       memdup_user()
     - [amd64] crypto: qat - Return pointer directly in adf_ctl_alloc_resources
     - [amd64] crypto: qat - remove unused character device and IOCTLs
     - net/tcp-ao: fix use-after-free of key in del_async path
     - locking: rtmutex: Fix wake_q logic in task_blocks_on_rt_mutex
     - net: bonding: update the slave array for broadcast mode
     - bonding: annotate data-races arcound churn variables
     - bonding: do not set usable_slaves for broadcast mode
 .
   [ Salvatore Bonaccorso ]
   * net/netfilter: Enable NETFILTER_NETLINK_HOOK as module (Closes: #1139686)
   * [rt] Refresh "locking/rt: Annotate unlock followed by lock for sparse."
 .
   [ Uwe Kleine-König ]
   * [amd64] Enable CONFIG_PINCTRL_CS42L43 and CONFIG_SPI_CS42L43 explicitly
     (Closes: #1136179)

linux-signed-amd64 (6.12.107+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.107-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.106
     - PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
     - Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
     - ALSA: scarlett2: Use a private URB for the notification endpoint
     - rndis_host: add overflow check in rndis_rx_fixup()
     - gpio: ml-ioh: use raw_spinlock_t for the register lock (CVE-2026-80562)
     - gve: fix zero-length skb frag with header-split
     - hwmon: (ltc4286) Fix symbol namespace of MODULE_IMPORT_NS()
     - netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
       (CVE-2026-64216)
     - inet: frags: add inet_frag_putn() helper
     - ipv4: frags: remove ipq_put()
     - inet: frags: change inet_frag_kill() to defer refcount updates
     - inet: frags: save a pair of atomic operations in reassembly
     - inet: frags: publish queues before arming timer (CVE-2026-74662)
     - serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
       (CVE-2026-74653)
     - NTB: ntb_netdev: Preserve RX queue depth on allocation failure
       (CVE-2026-74626)
     - serial: amba-pl011: synchronize DMA teardown
     - serial: sc16is7xx: rename EFR mutex with generic name
     - serial: sc16is7xx: use guards for simple mutex locks
     - serial: sc16is7xx: enable THRI before filling TX FIFO
     - xfs: namespace the maximum length/refcount symbols
     - xfs: don't use a xfs_log_iovec for ri_buf in log recovery
     - xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)
     - xfs: hoist per-bucket unlinked list check to helper
     - xfs: don't livelock in scrub on a circular unlinked list
     - ALSA: dummy: Check card index validity at probe
     - ocfs2: fix missing metadata reservation for large xattrs
     - null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows
     - kcov: fix data corruption and race conditions on PREEMPT_RT
     - ext4: stop retrying saturated xattr cache entries
     - ext4: clear error before retrying inode xattr space fallback
     - ext4: propagate errors from fast commit range replay
     - xfs: validate attr entry pointer before field access
     - libceph: fix OOB read in decode_watchers() via missing bounds check
       (CVE-2026-80557)
     - nfc: digital: clamp SENSF_RES length to the destination buffer
     - nfc: fdp: bound the device-reported read length and fix an skb leak
     - nfc: microread: validate target discovery payload lengths
     - nfc: llcp: bound the connect_sn TLV walk to the skb
     - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
     - nfc: llcp: reject PDUs shorter than the LLCP header
     - nfc: pn533: purge fragmented skbs during cleanup
     - nfc: st21nfca: validate ATR_REQ length against the received frame
     - nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
     - nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
     - nfc: nci: free destination parameters when closing a connection
     - ndisc: ndisc_send_redirect() cleanup
     - Input: byd - synchronize timer deletion before freeing private data
       (CVE-2026-80572)
     - ipv4: reject undersized MTUs in ip_do_fragment()
     - ipv6: fix use-after-free in ip6_finish_output2()
     - nvmet-auth: zero the AUTH_RECEIVE response buffer
     - nvmet-fc: fix invalid free in LS IOD error path
     - nvmet-tcp: bound SGL data length before allocating command buffers
     - nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
     - mptcp: pm: fix data race in add_addr timer callback
     - [arm64] ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
       (CVE-2026-80583)
     - drm/xe: Fix DPT allocation paths.
     - HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
     - HID: magicmouse: re-enable multitouch after reset-resume
     - HID: magicmouse: do not keep a stale msc->input if no input is claimed
     - HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID
     - HID: core: fix OOB read of field->usage in hid_set_field()
     - net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
     - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (CVE-2026-64581)
     - ipv4: start using dst_dev_rcu() (CVE-2025-40074)
     - mptcp: pm: fix memory leak from alloc-during-teardown race
     - Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard
     - Input: atkbd - skip deactivate for HONOR ZQC-P
     - HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
     - HID: nintendo: register input device after capabilities are set
     - HID: nintendo: stop device IO before hid_hw_stop on probe failure
     - HID: core: fix number/pointer type confusion on long items
     - HID: sensor: custom: Fix use-after-free in enable_sensor
     - HID: hyperv: validate initial device info bounds
     - Bluetooth: hci_event: fix LE list UAF on reset
     - Bluetooth: hci_event: validate LE Set CIG Parameters response
     - Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync
     - Bluetooth: hci_aml: validate firmware segment lengths
     - net: gro: properly validate BIG TCP aggregation criteria
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.107
     - inet: frags: strip GSO state from fragments before reassembly
       (CVE-2026-80590)
linux-signed-amd64 (6.12.105+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.105-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.102
     - [amd64] x86/bugs: Make Safe-RET robust against interrupt injection
       (CVE-2026-68480)
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.103
     - netfilter: nf_conntrack_expect: restore helper propagation via expectation
     - netfilter: br_netfilter: Reallocate headroom if necessary in
       neigh_hh_bridge()
     - net: mpls: initialize rtm_tos in mpls_getroute()
     - HID: logitech-dj: Standardise hid_report_enum variable nomenclature
     - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB
       write
     - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report
     - bpf: Reset register bounds before narrowing retval range in
       check_mem_access()
     - netconsole: avoid OOB reads, msg is not nul-terminated (CVE-2026-43197)
     - [amd64] thunderbolt: Prevent XDomain delayed work use-after-free on
       disconnect
     - [arm64] pinctrl: qcom: Unconditionally mark gpio as wakeup enable
     - [arm64] pinctrl: qcom: sc8280xp: Add missing wakeup entries for
       GPIO143/151
     - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
     - [amd64] dmaengine: idxd: fix fdev setup failure cleanup in
       idxd_cdev_open()
     - gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe()
     - ata: sata_mv: accept 1 or 2 resources in platform probe
     - ata: libahci_platform: support non-consecutive port numbers
     - ahci: Introduce ahci_ignore_port() helper
     - ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
     - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup
     - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup
     - of: reserved_mem: Add code to dynamically allocate reserved_mem array
     - of: reserved_mem: prevent OOB when too many dynamic regions are defined
     - btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag
     - btrfs: zoned: fix deadlock between metadata writeback and transaction
       commit
     - [arm64] phy-zynqmp: Postpone getting clock rate until actually needed
     - [arm64] phy: zynqmp: fix clock error handling in xpsgtr_phy_init()
     - [arm64] phy: zynqmp: fix runtime PM leak on probe allocation failure
     - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in
       sip_help_tcp()
     - [arm64] drm/mediatek: Check CRTC state before freeing
     - Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep
       annotation
     - KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type
     - keys: fix out-of-bounds read in keyring_get_key_chunk()
     - keys: make keyring key-chunk byte order agree with keyring_diff_objects()
     - assoc_array: trim the final shortcut word using the current chunk end
     - netfilter: nf_tables: make nft_object rhltable per table
     - netfilter: xt_hashlimit: validate hashtable supports
       XT_HASHLIMIT_RATE_MATCH
     - ipvs: fix the checksum validations
     - ipvs: fix places with wrong packet offsets
     - ipvs: do not mangle ICMP replies for non-first fragments
     - netfilter: nft_payload: fix mask build for partial field offload
     - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled
       (CVE-2026-68322)
     - rds: tcp: hold the RCU lock across ipv6_chk_addr() in
       rds_tcp_laddr_check()
     - [amd64,arm64] pinctrl-amd: Don't clear S4 wake bits at probe
     - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
     - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection
       buffer
     - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
     - smb: client: fix buffer leaks in SMB1 read and write
     - spi: spi-cadence: supports transmission with bits_per_word of 16 and 32
     - spi: spi-cadence: Move TX FIFO full busy-wait into FIFO
     - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
     - hwmon: (ina2xx) Add support for has_alerts configuration flag
     - hwmon: (ina2xx) Add support for INA260
     - hwmon: (ina226) Add support for SY24655
     - hwmon: (ina2xx) Make it easier to add more devices
     - hwmon: (ina2xx) Add support for INA234
     - hwmon: (ina2xx) Shift INA234 shunt and current registers
     - hwmon: (ina2xx) Fix various overflow issues
     - hwmon: (ltc4282) Fix reading the minimum alarm voltage
     - hwmon: (sht3x) Fix unaligned accesses
     - hwmon: (lm90) Only report alarms if driver is ready
     - hwmon: (nzxt-smart2) DMA-align output buffer
     - net: do not send ICMP/NDISC Redirects when peer allocation fails
     - hwmon: (nct6775-core) Prevent access to unsupported weight registers
     - net: bridge: mrp: fix Option TLV length in MRP_Test frames
     - forcedeth: fix UAF of txrx_stats in nv_remove
     - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
     - hwmon: (adt7470) Fix cache updated before hardware write on I2C error
     - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
     - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()
     - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks
     - hwmon: (adt7470) Use cached PWM frequency value
     - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
     - hwmon: (adt7470) Fix PWM auto temp state array and bounds check
     - rtase: fix double free of multi-frag skb on DMA map failure
     - [powerpc*] boot: Fix simpleboot CPU node lookup check
     - [powerpc*] boot: Fix treeboot-currituck CPU node lookup check
     - [powerpc*] boot: Fix treeboot-akebono CPU node lookup check
     - net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
     - wifi: mac80211: validate individual TWT params before driver setup
     - net: ethernet: mtk_eth_soc: support named IRQs
     - net: ethernet: mtk_eth_soc: add consts for irq index
     - net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in
       poll_controller
     - hwmon: (pmbus) Fix return value from pmbus_update_byte_data()
     - [amd64,arm64] idpf: adjust TxQ ring count minimum
     - [amd64,arm64] idpf: Fix mailbox IRQ name leak on request failure
     - Bluetooth: ISO: clear iso_data always when detaching conn from hcon
     - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
     - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos
     - Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis()
     - Bluetooth: ISO: fix leaking sk after socket release
     - Bluetooth: ISO: avoid deadlocks in iso_sock_timeout
     - Bluetooth: btintel: Validate length before parsing diagnostics TLV
     - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists
     - Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
     - Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync
     - net: phylink: put link_gpio if phylink_create fails
     - scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
     - scsi: ufs: core: Cancel RTC work in active-active suspend
     - scsi: zfcp: Fix memory leak during adapter release by destroying
       gid_pn_req
     - scsi: target: Clear cmd_cnt when initial counter enrollment fails
     - net: sxgbe: free TX rings on RX allocation failure
     - net: sxgbe: check descriptor ring allocation failures
     - can: isotp: check register_netdevice_notifier() error in module init
     - tracing/mmiotrace: Reset dropped_count in mmio_reset_data()
     - tracing: Remove TRACE_EVENT_FL_FILTERED logic
     - tracing/mmiotrace: Remove reference to unused per CPU data pointer
     - tracing/mmiotrace: Add NULL check for mmio_trace_array in logging
       functions
     - [riscv64] mm: Fix out-of-bounds page-table walk during memory hot-remove
     - [arm64] net: dsa: mt7530: check bus->read() errors in the MDIO regmap
       backend
     - [arm64] net: dsa: mt7530: error out on failed reads in MT7531 PHY polling
     - net: libwx: fix FDIR ATR queue mismatch for software VLAN packets
     - [arm64] octeontx2-pf: Set correct sequence for carrier off and tx queue
       stop
     - sched/deadline: Use revised wakeup rule only for running dl_server
     - qede: sync udp_tunnel ports outside qede_lock in the recovery path
     - ksmbd: return success for deferred final close
     - ksmbd: fix use-after-free in __close_file_table_ids()
     - pinctrl: devicetree: don't free uninitialized dev_name on error path
     - erofs: cap LZMA stream pool size
     - pinctrl: bm1880: add missing select GENERIC_PINCONF
     - fortify: Disable -Wstringop-overread in tests
     - mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
     - fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes
     - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
     - mm/hugetlb: fix list corruption in allocate_file_region_entries()
     - mm/vmstat: fold stranded per-cpu node stats when a node comes online
     - tracing/probes: Reject $arg0 in meta argument expansion
     - [amd64] KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while
       L2 is active
     - [s390x] KVM: s390: pci: Reject adapter interrupt forwarding if already
       enabled
     - [s390x] KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
     - [s390x] KVM: s390: pci: Validate AIBV and AISB before pinning guest pages
     - sctp: validate Adaptation Indication parameter length
     - audit: fix potential integer overflow in audit_log_n_string()
     - audit: fix potential use-after-free in audit_del_rule()
     - Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()
     - Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()
     - Bluetooth: mgmt: fix pending command UAF in EIR updates
     - Bluetooth: mgmt: fix UAF in pair command cancellation
     - Bluetooth: hci_sync: Fix advertising data UAFs
     - Bluetooth: HIDP: reject frames without a transaction header
     - Bluetooth: HIDP: validate numbered report payloads
     - bpf: lwt: Fix dst reference leak on reroute failure
     - ALSA: 6fire: Fix UAF at error handling during probe
     - ALSA: lx6464es: fix period byte count for 16-bit streams
     - ALSA: pcm: wake linked drain waiters on unlink
     - ALSA: seq: Fix division by zero in initialize_timer()
     - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes
     - ALSA: ump: fix double free of out_cvts on rawmidi error
     - ASoC: tas2562: fix DVC coefficient write order
     - ASoC: tas2562: fix broken entries in the volume lookup table
     - ata: libata-eh: Increase STANDBY IMMEDIATE timeout
     - ata: libata-sata: fix ata_scsi_lpm_supported() iteration
     - ALSA: usb-audio: fix use-after-free in ump_to_endpoint()
     - ALSA: usb-audio: fix stack info leak in RME Digiface status
     - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
     - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
     - ALSA: usb-audio: Clamp frame size in implicit-feedback mode
     - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
     - e1000: fix memory leak in e1000_probe()
     - igbvf: Fix leak in TX DMA error cleanup
     - ipvs: do not propagate one-packet flag to synced conns
     - net/smc: fix socket use-after-free during link group termination
     - netfilter: ipset: do not update comments from kernel-side hash adds
     - tipc: avoid use-after-free in poll trace queue dumps
     - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames
     - binfmt_misc: reject a flag character as the field delimiter
     - binfmt_misc: don't let an 'F' entry pin its own instance
     - mm/page_reporting: use system_freezable_wq to fix UAF during suspend
     - mm: memcg: initialize *locked in memcg1_oom_prepare() stub
     - net: bridge: stop fast-leave after deleting a port group
     - net: ipv6: clear suppressed fib6 rule result
     - [powerpc*] ps3: Fix map failure path in dma_ioc0_map_pages()
     - veth: convert frag_list skbs before running XDP
     - vxlan: re-fetch eth header after route_shortcircuit()
     - vxlan: unclone skb head before modifying eth header in
       route_shortcircuit()
     - vxlan: use neigh_ha_snapshot() in route_shortcircuit()
     - vxlan: use pskb_network_may_pull() in route_shortcircuit()
     - ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()
     - tracing: Check return value of __register_event() in
       trace_module_add_events()
     - tracing/filters: Fix false positive match in regex_match_full()
     - spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure
     - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
     - sctp: reject stale cookies with mismatched verification tags
     - sctp: prevent peer transport count overflow
     - hwmon: (npcm750-pwm-fan): stop fan timer on device detach
     - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client
     - i2c: amd-mp2: Unregister callback on adapter add failure
     - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure
     - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
     - cpufreq: schedutil: Publish util hooks only after all sg_cpu are
       initialized
     - power: supply: bq25890: fix the -10 C NTC lookup entry
     - power: supply: max17040: handle missing status supplier
     - [s390x] pci: Fix s390_pci_mmio_write syscall error return without MIO
     - [s390x] qeth: Check CAP_NET_ADMIN for private ioctls
     - [s390x] dasd: Fix potential NULL pointer dereference
     - [s390x] dasd: Fix undersized format-check buffer
     - [s390x] zcrypt: Fix wrong domain value verification with EP11 CPRBs
     - [s390x] zcrypt: Validate length for CCA AES cipher key requests
     - [s390x] zcrypt: Validate length for CCA ECC private key requests
     - [arm64] phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
     - [arm64] phy: zynqmp: use read-modify-write for SERDES scrambler bypass
     - [arm64] phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
     - net: openvswitch: fix potential UAF on meter attach failure
     - net: openvswitch: fix skb leak on flow key update failure during
       recirculation
     - net: openvswitch: fix skb leak on flow key update failure during ct
     - ice: wait for reset completion in ice_resume()
     - ice: fix memory leak in ice_lbtest_prepare_rings()
     - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock
       deadlock
     - i2c: iproc: reset bus after timeout if START_BUSY is stuck
     - i2c: imx: Fix slave registration race and error handling
     - i2c: imx: Cancel hrtimer before clearing slave pointer
     - can: c_can: c_can_chip_config(): keep controller in init mode until
       bittiming is configured
     - can: ems_usb: validate CPC message lengths
     - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB
       resubmit failure
     - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb
       allocation failure
     - can: j1939: transport: j1939_session_fresh_new(): initialize receive
       buffer
     - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking
     - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in
       kvaser_usb_hydra_get_busparams()
     - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received
       command extents
     - can: softing: fw_parse(): validate firmware record spans
     - can: peak_usb: add bounds check for USB channel index
     - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB
       submit error
     - can: peak_usb: validate uCAN receive record lengths
     - can: ctucanfd: add missing MODULE_DEVICE_TABLE()
     - can: ctucanfd: use self-test mode for PRESUME_ACK
     - can: ctucanfd: unmap BAR0 using base address
     - can: ctucanfd: handle bus error interrupts
     - can: ctucanfd: mark error-active controller status valid
     - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs
     - [arm*] drm/vc4: Supply the overflow slot size in BPOS, not the whole bin
       BO size
     - [arm*] drm/vc4: Zero the tile state data array before each BIN job
     - [arm64] drm/panthor: reject firmware sections with oversized data
     - [arm64] drm/panthor: validate firmware interface structure sizes
     - [arm64] drm/mediatek: ovl_adaptor: balance component registrations
     - drm/amdgpu: restore UMD profile pstate after runtime resume
     - drm/amdgpu: cap GTT size to physical RAM on APUs
     - drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
     - drm/amd/display: use proper context for logging
     - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
     - drm/amdkfd: fix QID bit leak in pqm_create_queue()
     - drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
     - drm/amdkfd: Handle invalid event type in CRIU event restore
     - drm/amdkfd: hold event_mutex while checkpointing CRIU events
     - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
     - drm/vmwgfx: reject DX_BIND_QUERY without a DX context
     - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
     - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
     - drm/vmwgfx: bound DMA command body size against suffix pointer
     - drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
     - drm/vmwgfx: use check_add_overflow for shader size+offset bound
     - drm/vmwgfx: validate external BO copy bounds for both stride paths
     - spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX
     - HID: logitech-dj: Fix maxfield check in DJ short report validation
     - ata: libahci_platform: Do not set mask_port_map when not needed
     - ata: ahci: Make ahci_ignore_port() handle empty mask_port_map
     - of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array()
       fails
     - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release
     - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting
     - drm/xe: Introduce xe_gt_dbg_printer()
     - drm/xe: Apply whitelist to engine save-restore
     - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists
       (CVE-2026-68267)
     - drm/xe/rtp: Maintain OA whitelists separately
     - drm/xe/rtp: Keep track of non-OA nonpriv slots
     - drm/xe/rtp: Generalize whitelist_apply_to_hwe
     - drm/xe/rtp: Save OA nonpriv registers to register save/restore lists
     - drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs
     - drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt
     - drm/xe/oa: (De-)whitelist OA registers on OA stream open/release
     - drm/xe/rtp: Ensure locking/ref counting for OA whitelists
     - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
     - fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes
     - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
     - lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled()
     - mm/slab: prevent unbounded recursion in free path with new kmalloc type
     - gpio: pch: use raw_spinlock_t for the register lock
     - usb: gadget: f_tcm: synchronize delayed set_alt with teardown
       (CVE-2026-68367)
     - usb: typec: ucsi: split connector lock classes
     - usb: typec: ucsi: Fix race condition and ordering in port unregistration
     - media: i2c: imx219: Rename VTS to FRM_LENGTH
     - media: imx219: Fix maximum frame length in lines
     - media: chips-media: wave5: Support CBP profile
     - media: uapi: rkisp: Correct name version enum
     - wifi: brcmfmac: drain bus_reset work on device removal (CVE-2026-64586)
     - wifi: ath6kl: fix use-after-free in aggr_reset_state() (CVE-2026-68198)
     - wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW)
     - wifi: brcmfmac: set F2 blocksize to 256 for BCM43752
     - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change
     - mptcp: pm: avoid code duplication to lookup endp
     - mptcp: add mptcp_userspace_pm_lookup_addr helper
     - mptcp: pm: use addr entry for get_local_id
     - mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)
     - drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions
     - drm/amdgpu: Fix context pstate override handling (CVE-2026-68273)
     - drm/sched: Store the drm client_id in drm_sched_fence
     - drm/amdgpu: give each kernel job a unique id
     - drm/amdgpu/gfx: fix cleaner shader IB buffer overflow (CVE-2026-68276)
     - drm/fb-helper: Allocate and release fb_info in single place
     - drm/tegra: fbdev: Remove offset into framebuffer memory
     - drm/exec: Remove the index parameter from
       drm_exec_for_each_locked_obj[_reverse]
     - drm/xe: Wait on external BO kernel fences in exec IOCTL
     - [arm64] drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable()
     - [arm64] drm/i915/vrr: require valid min/max vfreq for VRR (CVE-2026-68254)
     - drm/xe: Rename ___xe_bo_create_locked()
     - drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266)
     - [arm64] drm/i915/hdcp: Move to using intel_display in intel_hdcp
     - [arm64] drm/i915/hdcp: require monotonically increasing seq_num_v
     - [arm64] drm/i915/hdcp: Skip inactive MST connectors when building stream
       list
     - [arm64] drm/i915/hdcp: check streams[] bounds before overflow
       (CVE-2026-68253)
     - drm/xe: Stub out new pagefault layer
     - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)
     - rxrpc: Generate rtt_min
     - rxrpc: Adjust the rxrpc_rtt_rx tracepoint
     - rxrpc: Fix the calculation and use of RTO
     - rxrpc: Manage RTT per-call rather than per-peer
     - rxrpc: Fix irq-disabled in local_bh_enable() (CVE-2025-38525)
     - can: use skb hash instead of private variable in headroom
     - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
     - usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
     - drm/fb-helper: Fix a locking bug in an error path
     - [arm64,armhf] drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.104
     - mount: honour SB_NOUSER in the new mount API
     - drm/amd/display: Add AV mute wait frames to dce110_set_avmute
     - drm/amd/display: Check for tg ops in dce110_set_avmute
     - [s390x] zcrypt: Fix missing mem scrub at clear key import in
       cca_clr2cipherkey()
     - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
     - [arm64] dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer
     - drm/bridge: ps8640: propagate AUX transfer register errors
     - [arm64] net: hns3: fix speed configuration residue after driver reload
     - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit"
     - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
     - enic: fix tx_hang_reset use-after-free on device removal
     - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock
     - pds_core: keep the health thread stopped during reset
     - pds_core: cancel pending PCI reset work on AER recovery
     - netfilter: ipset: switch ext_size to atomic64_t
     - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
     - ipvs: return the csum validation for forward hook
     - watchdog: bd96801_wdt: Fix timeout for enabled WDG
     - btrfs: fix memory leak in btrfs_do_encoded_write()
     - bpf: Preserve pointer state for commuted arithmetic
     - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in
       smc_llc_event_handler()
     - net/sched: cls_route: fix fastmap use-after-free on filter
     - [arm64] net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
     - devlink: fix net namespace reference leak in reload
     - net/mlx5: fw_tracer, return NULL on create error
     - counter: microchip-tcb-capture: Fix DT channel validation
     - bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch
     - bpf: tcp: Make sure iter->batch always contains a full bucket snapshot
     - bpf: tcp: Get rid of st_bucket_done
     - bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items
     - bpf: tcp: Avoid socket skips and repeats during iteration
     - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
     - vhost/vdpa: reject overflowing PA map page counts on 32-bit
     - vdpa/mlx5: Fix buffer length in create_direct_keys()
     - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss()
     - xsk: require at least 16 bytes of TX metadata
     - udp: fix potential use-after-free in tunnel segmentation
     - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
     - net/openvswitch: check Ethernet header length in key_extract()
     - net/sched: cls_api: Always acquire rtnl_lock when destroying locked
       classifiers
     - hwmon: (nzxt-smart2) Check return value of init_device() in probe
     - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations
     - bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss()
     - bnxt_en: Determine and store default RX ring in vnic structure
     - bnxt_en: Refresh VNIC default ring on queue restart if needed
     - bnxt_en: Fix PTP PPS setting bug
     - sctp: fix addip_serial increment on ASCONF_ACK allocation failure
     - tcp: fix TFO max_qlen accounting across reuseport migration
     - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
     - net: prestera: validate firmware header length
     - net: remove WARN_ON_ONCE() from sk_mc_loop()
     - net/smc: fix TOCTOU race between smc_listen_out() and listener close
     - [amd64] net: thunderbolt: Tear down DMA paths before stopping the rings
     - ata: pata_sl82c105: fix bridge revision use-after-free
     - net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
     - sctp: clear control chunk transport if it is being removed
     - tls: don't abort the connection on signal-interrupted sends
     - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string
       termination
     - hwmon: (ads7828) Fix external VREF regulator handling
     - hwmon: (ltc4282) Avoid overflow in maximum power calculation
     - hwmon: (ltc4282) Clamp negative current limits
     - hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt
     - mm/vmscan: wake up flushers conditionally to avoid cgroup OOM
       (Closes: #1143545)
     - net: fec: do not release NULL pages when RX buffer allocation fails
     - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
     - mtd: spinand: fix direct mapping creation sizes
     - mtd: spinand: try a regular dirmap if creating a dirmap for continuous
       reading fails
     - mtd: spinand: repeat reading in regular mode if continuous reading fails
     - swapfile: call cond_resched() before locking si->lock
     - Input: evdev - sanitize event type index when fetching event masks
     - ALSA: usb-audio: fix OOB write on Type II inbound URBs
     - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
     - [amd64] thunderbolt: icm: Preserve USB4 proxy data-valid bit
     - usb: cdnsp: fix incorrect endian conversions for APB timeout register
     - usb: gadget: f_ncm: Use unsigned int for ndp_index
     - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
     - net: usb: ipheth: fix carrier_work UAF on disconnect
     - vt: add permission check for KDSKBMETA ioctl
     - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
     - Input: evdev - fix information leak in evdev_pass_values()
     - ima: fix out-of-bounds read in xattr_verify()
     - ipvs: stop estimator after disabled calc phase
     - ipvs: add totalconns for dest
     - ipvs: properly update the overload flag on dest edit
     - ipvs: clear IPv4 options after rebasing tunnel ICMP errors
     - packet: use consistent hard_header_len in non-ring send paths
     - packet: use consistent hard_header_len in TX_RING send path
     - net/packet: reset the MAC header on the packet-socket transmit path
     - packet: synchronize pressure clearing with ring reconfiguration
     - net: fix skb length accounting after generic XDP frag adjustment
     - net: openvswitch: reallocate update replies for mismatched IDs
     - net/sched: reject overly deep qdisc hierarchies
     - net: octeontx2-pf: Fix UB in shift operation
     - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
     - mac802154: fix netdev use-after-free in beacon worker
     - netfilter: ebt_nflog: pin the NFLOG backend
     - net: bridge: mrp: fix uninitialised bytes on the wire
     - [s390x] KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
       (CVE-2026-74514)
     - [s390x] KVM: s390: pci: Fix missing error codes and memory unaccounting
     - [s390x] KVM: s390: pci: Fix resource leak on IRQ registration failure
     - [s390x] KVM: s390: pci: Fix aisb calculation
     - block: Reorder the request allocation code in blk_mq_submit_bio()
     - blk-mq: pop cached request if it is usable (CVE-2026-64017)
     - blk-mq: reinsert cached request to the list
     - dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk
     - [amd64] crypto: ccp - Add new SEV/SNP platform shutdown API
     - [amd64] KVM: SVM: Add support to initialize SEV/SNP functionality in KVM
     - [amd64] crypto: ccp - Fix checks for SNP_VLEK_LOAD input buffer length
     - [amd64] crypto: ccp - Abort doing SEV INIT if SNP INIT fails
     - futex: Prevent robust futex exit race some more
     - kunit/fortify: Replace "volatile" with OPTIMIZER_HIDE_VAR()
     - kunit/fortify: Add back "volatile" for sizeof() constants
     - pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
     - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
     - ipv4: fix use-after-free in fib_nhc_update_mtu()
     - mei: pull kvfree out of spinlock
     - nvmem: layouts: Add fixed-layout driver
     - serial: qcom-geni: fix TX DMA buffer flush
     - serial: 8250_dma: Clear stale RX state on shutdown
     - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
     - staging: rtl8723bs: fix OOB read in WMM_param_handler()
     - staging: rtl8723bs: fix missing shared-key auth challenge length check
     - staging: rtl8723bs: validate monitor transmit frame lengths
     - misc: fastrpc: fix channel ctx ref leak when session alloc fails
     - misc: fastrpc: Remove buffer from list prior to unmap operation
     - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
     - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
     - ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
     - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
     - ALSA: usx2y: bound the hwdep mmap fault offset
     - tracing: Fix race between update_event_fields and, event_define_fields
     - fbdev: bitblit: bound-check glyph index in bit_cursor()
     - ring-buffer: Prevent subbuf order change when resizing is disabled
     - mm/huge_memory: fix huge_zero_pfn race
     - net: smc: fix splice entry lifetime imbalance in smc_rx_splice
     - ipv6: prevent in6_dev_get() from resurrecting inet6_dev
     - netfilter: bridge: release template ct on non-IP path
     - netfilter: nf_conntrack: defer invalid log until after unlock
     - net: atlantic: free stranded TX buffers on ring deinit
     - net: atlantic: free RX pages of consumed but not refilled buffers
     - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
     - net/sched: act_gact, act_police: range check the fallback control action
     - ovl: don't warn when the mount is completed from another user namespace
     - binfmt_misc: don't warn when the mount is completed from another user
       namespace
     - Revert "drm/amdgpu: fix aperture mapping leak"
     - xdp: reject clones that overrun skb_shared_info tailroom
     - vxlan: do not arm the ageing timer on a device that is down
     - vsock/virtio: read virtqueues under worker locks
     - vsock/virtio: avoid refilling the RX queue after teardown
     - veth: fix skb length accounting after XDP frag adjustment
     - vhost: reset the vring metadata cache on vring reconfiguration
     - tls: don't leave a full plaintext sk_msg ring unpushed
     - tipc: read le->link under the node lock in tipc_node_link_down()
     - smb: client: Fix use-after-free in cifs_try_adding_channels()
     - [amd64] KVM: x86/mmu: WARN and clear role.invalid when creating a child
       shadow page
     - eventfs: Fix use-after-free in eventfs_remove_rec()
     - Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
     - ptp: ocp: Fix board ID over-read
     - ipv6: fix Route Information option length validation
     - ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
     - fscrypt: use the mount idmap for the owner check in
       fscrypt_ioctl_set_policy()
     - sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
     - ima: Instantiate file_truncate and path_truncate hooks
     - fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
     - fsverity: Fix silent truncation in bpf_get_fsverity_digest()
     - bpf, sockmap: Fix sk_redir use-after-free in send verdict
     - scsi: scsi_debug: Negate wrapped memcmp() result
     - sctp: keep chunk->transport in step with the list it is queued on
     - sctp: fix use-after-free of cached ASCONF chunk
     - sctp: clear new_transport when removing a peer
     - [amd64] thunderbolt: Bound the DROM dual link port number before indexing
       sw->ports
     - [amd64] thunderbolt: Fix bandwidth group reservation indexing
     - bpf: tcp: fix double sock release on batch realloc
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.105
     - block: stop the timeout timer when releasing a never added disk
     - bpf: Fix linked reg delta tracking when src_reg == dst_reg
       (CVE-2026-53092)
     - bpf: Clear delta when clearing reg id for non-{add,sub} ops
     - f2fs: fix UAF issue in f2fs_merge_page_bio() (CVE-2025-40054)
     - mtd: ubi: skip programming unused bits in ubi headers
     - ubi: fastmap: fix ubi->fm memory leak
     - mm/damon/ops-common: putback folios on invalid migrate nid
       (CVE-2026-74644)
     - mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD}
     - igc: fix netdev not re-attached after resume if interface is down
     - ipvs: separate destination availability state
     - net: mana: Fix EQ leak in mana_remove on NULL port
     - [amd64] crypto: ccp: Add external API interface for PSP module
       initialization
     - [amd64] KVM: SVM: Ensure PSP module is initialized if KVM module is
       built-in
     - selinux: require every boolean value to be defined
     - selinux: reject a class permission count below its inherited common
     - selinux: do not cancel a policy conversion that never started
     - selinux: reject an unclaimed class value in security_get_classes()
     - mptcp: avoid combining some incoming suboptions
     - mptcp: options: reset DSS fields in case of unexpected size
     - mptcp: fastopen: only mark MPTFO subflows with SYN data
     - [s390x] qeth: validate user buffer length in SNMP and ARP query ioctls
     - [amd64] ASoC: SOF: sof-audio: Fix error path in
       sof_widget_setup_unlocked()
     - fbdev: core: Fix pointer desynchronization in fb_io_read()
     - drm/panthor: skip zero-sized firmware sections
     - drm/amdgpu: reject oversized IBs with per-ring packet limits
     - drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12
     - drm/amdgpu: fix aperture iounmap skipped on device removal
     - [amd64] ASoC: SOF: topology: Use acpi mach from the machine driver
     - Input: xpad - add support for ZENAIM LEVERLESS
     - Input: cs40l50-vibra - validate custom data from user space
     - [powerpc*] pseries: pci - logic bug
     - Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
     - Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
     - Input: psxpad-spi - set driver data before use
     - Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
     - Input: iforce - validate input packet lengths
     - [powerpc*] pseries: lparcfg - fix kbuf[] underflow
     - Input: synaptics-rmi4 - zero report size on F54 work error
     - Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
     - Input: synaptics-rmi4 - block s_input when F54 queue is busy
     - Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
     - Input: hynitron_cstxxx - validate touch count and finger IDs
     - [arm64] crypto: qce - fix error path in devm_qce_register_algs
     - gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on
       unbind
     - [arm64] pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state
       0
     - libceph: fix multiple unsafe decodes in decode_locker()
     - ftrace: Protect direct_functions in ftrace_find_rec_direct
     - ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
     - Input: sur40 - fix input device registration ordering
     - Input: sur40 - fix V4L error path cleanup
     - libceph: Avoid using invalid osd indices from primary_temp
     - ceph: fix MDS random selection readiness predicate
     - libceph: tolerate addrvecs with multiple entries of the same type
     - [armhf] mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on
       32-bit
     - mmc: sdhci: unmap the bounce buffer before device release
     - mmc: sdhci: make tuning_err a signed int
     - drm/connector/hdmi: Fix out of bounds memory read
     - drm/xe: Order ring writes before ring tail updates
     - drm/radeon: fix autosuspend cleanup during teardown
     - [s390x] vfio_ccw: Free all memory if cp_init() fails
     - [s390x] vfio_ccw: Limit the number of channel program segments
     - [s390x] vfio_ccw: Cancel existing workqueues
     - [s390x] vfio_ccw: Ensure index for read/write regions are within range
     - [s390x] vfio_ccw: Ensure first IDAW remains constant
     - [s390x] vfio_ccw: Fix out of bounds check on CCW array
     - [s390x] vfio_ccw: Move cp cleanup out of not operational
     - [s390x] vfio_ccw: Selectively expand io_mutex
     - [s390x] vfio_ccw: Calculate idal length based on idaw type
     - [s390x] vfio_ccw: Implement a crw lock
     - drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix
     - drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE
     - drm/amdgpu: Reject UVD message with invalid number of h265 refs
     - drm/amdgpu: fix nbif 6.3.1 l1 low power not functional
     - drm/amdgpu: check ASPM on the dGPU host link
     - drm/amdgpu: validate GEM_CREATE domain combinations
     - drm/amdgpu: Reject UVD message with dimensions above 4096
     - drm/amdgpu: Implement insert_end for VCE 3
     - drm/amdgpu: Fix UVD min buffer sizes
     - drm/amdgpu: Fix UVD dpb min size calculation for H264
     - drm/amdgpu: Fix UVD decode image min size calculation
     - drm/amdgpu: disallow multiple FENCE chunks in one submit
     - xfs: clear zapped attr fork state when bmap repair finds no attr fork
     - xfs: zero i_nlink before repair puts inode on unlinked list
     - xfs: only check mergeability of bnobt records
     - xfs: don't double-lock when deleting a self-referential directory
     - xfs: set the prev pointer when reinserting an inode on the unlinked list
     - xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers
     - xfs: nlink scrub must take IOLOCK before determining ILOCK state
     - xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev
     - xfs: fix ilock leak on error in xfs_dq_get_next_id
     - xfs: don't zap the attr fork on repair when there are queued pptr updates
     - xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair
     - xfs: fix allocated inodes that show up in the unlinked list
     - xfs: fix another iunlink infinite loop bug in online fsck
     - xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers
     - xfs: avoid UAF on sc->tempip in xrep_tempfile_create
     - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN
     - xfs: don't swallow dquot recovery verification errors
     - xfs: check xfarray iteration errors when committing unlinked inode lists
     - xfs: check v5 superblock features early
     - ceph: Remove ceph_writepage()
     - ceph: Use a folio in ceph_page_mkwrite()
     - ceph: Convert ceph_find_incompatible() to take a folio
     - ceph: Convert writepage_nounlock() to write_folio_nounlock()
     - ceph: fix writeback_count leak in write_folio_nounlock()
     - ceph: avoid fs reclaim while using current->journal_info
     - ceph: fix hanging __ceph_get_caps() with stale mds_wanted
     - libceph: Amend checking to fix `make W=1` build breakage
     - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
       (CVE-2026-68159)
     - mm/khugepaged: guard is_zero_pfn() calls with pte_present()
     - userfaultfd: prevent registration of special VMAs (CVE-2026-68166)
     - libceph: fix two unsafe bare decodes in decode_lockers() (CVE-2026-68082)
     - net/sched: serialize qdisc_rtab_list against concurrent get/put
       (CVE-2026-68138)
     - super: remove pointless s_root checks
     - super: skip dying superblocks early
     - super: use a common iterator (Part 1)
     - super: use common iterator (Part 2)
     - fs/super: fix emergency thaw double-unlock of s_umount
     - super: fix emergency thaw deadlock on frozen block devices
       (CVE-2026-68132)
     - smb: move smb_version_values to common/smbglob.h
     - smb: move get_rfc1002_len() to common/smbglob.h
     - smb/server: rename include guard in smb_common.h
     - ksmbd: rename smb2_get_msg to smb_get_msg
     - smb/server: fix minimum SMB1 PDU size
     - smb/server: fix minimum SMB2 PDU size
     - ksmbd: validate minimum PDU size for transform requests (CVE-2026-68431)
     - eventpoll: pin files while checking reverse paths
     - tcp: Pass flags to __tcp_send_ack
     - tcp: fast path functions later
     - tcp: reorganize tcp_sock_write_txrx group for variables later
     - tcp: challenge ACK for non-exact RST in SYN-RECEIVED (CVE-2026-68118)
     - iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
     - btrfs: add debug build only WARN
     - btrfs: add space_info argument to btrfs_chunk_alloc()
     - btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg()
     - btrfs: zoned: fix missing chunk metadata reservation
     - [amd64] KVM: x86: Cancel delayed I/O APIC EOI handling before destroying
       vCPUs (CVE-2026-74517)
     - [arm64] ASoC: tas2562: Validate values for volume writes
     - ata: libata-scsi: terminate deferred commands on time out
     - igc: remove napi_synchronize() in igc_down()
     - ksmbd: conn lock to serialize smb2 negotiate
     - ksmbd: reject repeated SMB2 NEGOTIATE requests (CVE-2026-74494)
     - net: pktgen: fix code style (WARNING: Block comments)
     - net: pktgen: fix proc entry use-after-free (CVE-2026-74479)
     - binfmt_misc: don't leak the user namespace when the mount fails
       (CVE-2026-74483)
     - fsnotify, lsm: Decouple fsnotify from lsm
     - fsnotify: opt-in for permission events at file open time
     - fs: don't block write during exec on pre-content watched files
     - binfmt_misc: restore write access when removing an entry (CVE-2026-74487)
     - vrf: Make pcpu_dstats update functions available to other modules.
     - vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS.
     - vxlan: use pskb_network_may_pull() for transmit path header pulls
       (CVE-2026-74474)
     - ice: fix VF interrupts cleanup
     - include/linux/fs.h: add inode_lock_killable()
     - smb: client: fix race with fallocate(2) and AIO+DIO
     - cifs: add fscache_resize_cookie() to cifs_setsize()
     - can: rcar_canfd: change the initializing flow for clocks and resets
     - drm/amd/pm: Use same metric table for APU
     - drm/amd/pm: Use macro to initialize metrics table
     - drm/amd/pm: fix torn gpu metrics reads
     - drm/amdgpu: remove unused function parameter
     - drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
     - drm/amd/pm: adjust the visibility of pp_table sysfs node
     - drm/amd/pm: fix pptable use-after-free (CVE-2026-74450)
     - net: tap: set skb->dev before parsing virtio net header in
       tap_get_user_xdp() (CVE-2026-74684)
     - drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
     - ring-buffer: Simplify functions with __free(kfree) to free allocations
     - ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
       (CVE-2026-74602)
     - mm/pagewalk: split walk_page_range_novma() into kernel/user parts
     - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
       (CVE-2026-74672)
     - mm/ptdump: always stabilise against page table freeing using init_mm
       (CVE-2026-74599)
     - KVM: SVM: Serialize accesses to the owner and mirror list with separate
       lock (CVE-2026-74607)
     - ring-buffer: Simplify ring_buffer_read_page() with guard()
     - ring-buffer: Make ring_buffer_{un}map() simpler with guard(mutex)
     - ring-buffer: Prevent resizing of persistent ring buffer
     - [amd64] x86/mce: Remove __mcheck_cpu_init_early()
     - [amd64] x86/mce: Set CR4.MCE last during init
     - [amd64] x86/mce: Set up the polling timer before CMCI discovery
     - [amd64] ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget
       setup
     - net/x25: fix use-after-free of the socket by its timers (CVE-2026-74628)
     - [arm64] tegra: Add EL2 virtual timer interrupt for Tegra194
     - crypto: ccm - Set rfc4309 maxauthsize from child
     - netfilter: ipset: fix refcount race between list:set GC and swap
     - netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort
       path
     - netfilter: flowtable: publish GC-visible tuple last
     - netfilter: ipset: fix list type element drift bug
     - netfilter: ipset: let destroy callbacks adjust ext mem size
     - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
     - macvlan: inherit needed_headroom and needed_tailroom from lowerdev
     - veth: fix queue index used to wake the peer txq in veth_poll
     - tcp: fix icsk_ack.ato bitfield overflow
     - net: packet: fix wrong transport_header when sending VLAN-tagged frame
     - net/tls: Fail tls_sw_splice_read() after a failed async decrypt
     - af_packet: Don't send zero-byte data in tpacket_snd().
     - net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
     - net/sched: cls_u32: skip hash tables in u32_bind_class()
     - net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
     - net/sched: cls_bpf: reject dev-bound programs bound to a different device
     - drm/xe/oa: Fix sync entry leak on OA config emit failure
     - erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
     - perf: Unify perf_event_free_task() / perf_event_exit_task_context()
     - perf/core: Fix group leader use-after-free after sibling detach
       (CVE-2026-74637)
     - fs: unlock the superblock during iterate_supers_type
     - binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
     - net: harmonize tstats and dstats
     - ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS
     - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu()
     - ring-buffer: Use current_context for safe per-CPU buffer swap
       (CVE-2026-74601)
     - ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r
     - net: ethernet: mtk_eth_soc: only use legacy mode on missing IRQ name
     - net: ethernet: mtk_eth_soc: improve support for named interrupts
 .
   [ Salvatore Bonaccorso ]
   * drivers/mmc/host: Enable MMC_ALCOR as module (Closes: #1142912)
   * drivers/misc/cardreader: Enable MISC_ALCOR_PCI as module (Closes: #1142912)
linux-signed-amd64 (6.12.101+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.101-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.101
     - [amd64] platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU
       hotplug
     - net: airoha: Move airoha_eth driver in a dedicated folder
     - net: airoha: Fix skb->priority underflow in airoha_dev_select_queue()
     - bpf: Fix ld_{abs,ind} failure path analysis in subprogs (CVE-2026-53090)
     - netfilter: nft_counter: serialize reset with spinlock (CVE-2026-45897)
     - netfilter: nft_quota: use atomic64_xchg for reset
     - netfilter: nf_tables: revert commit_mutex usage in reset path
       (CVE-2026-45901)
     - drm/virtio: fix deadlock in display_info_cb by removing hotplug from
       dequeue worker
     - fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race
     - seqlock: Cure some more scoped_seqlock() optimization fails
     - seqlock: Allow KASAN to fail optimizing
     - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing
     - [amd64] KVM: x86: Check for invalid/obsolete root *after* making MMU pages
       available (CVE-2026-64561)
     - [amd64] KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on
       KVM_RUN
     - [amd64] KVM: nVMX: Hide shadow VMCS right after VMCLEAR (CVE-2026-64562)
     - [amd64] KVM: x86/mmu: Fix use-after-free on vendor module reload
     - can: bcm: add locking when updating filter and timer values
     - can: bcm: fix CAN frame rx/tx statistics
     - can: bcm: extend bcm_tx_lock usage for data and timer updates
     - can: bcm: validate frame length in bcm_rx_setup() for RTR replies
     - can: bcm: add missing device refcount for CAN filter removal
     - can: bcm: fix stale rx/tx ops after device removal
     - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
     - can: bcm: track a single source interface for ANYDEV timeout/throttle ops
     - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
     - can: isotp: serialize TX state transitions under so->rx_lock
     - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up
     - Revert "arm64: dts: ti: k3-am62a7-sk: Add bootph-all tag to vqmmc"
     - [arm64,armhf] gpu: host1x: Fix use-after-free in
       host1x_bo_clear_cached_mappings
     - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin
     - xprtrdma: Clear receive-side ownership pointers on release
     - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
       (CVE-2026-64565)
     - Input: ims-pcu - fix logic error in packet reset
     - [arm64] tegra: Fix CPU compatible string to cortex-a78ae on Tegra234
     - IB/mad: Drop unmatched RMPP responses before reassembly
     - mtd: mtdswap: remove debugfs stats file on teardown
     - mtd: nand: mtk-ecc: stop on ECC idle timeouts
     - btrfs: reject free space cache with more entries than pages
     - btrfs: fix root leak if its reloc root is unexpected in
       merge_reloc_roots()
     - RDMA/cma: Fix hardware address comparison length in netevent callback
     - RDMA/umem: Add pinned revocable dmabuf import interface
     - RDMA/irdma: Prevent rereg_mr for non-mem regions
     - RDMA/erdma: initialize ret for empty receive WR lists
     - [arm64] RDMA/hns: Fix potential integer overflow in mhop hem cleanup
     - RDMA/siw: publish QP after initialization
     - mtd: fix double free and WARN_ON in add_mtd_device() error paths
     - RDMA/irdma: Prevent overflows in memory contiguity checks
     - xfrm6: clear dst.dev on error to avoid double netdev_put in
       xfrm6_fill_dst()
     - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
     - wifi: cfg80211: cancel sched scan results work on unregister
     - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
     - wifi: mac80211_hwsim: clamp virtio RX length before skb_put
     - wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure
     - wifi: mac80211: fix fils_discovery double free on alloc failure
     - wifi: libertas: fix memory leak in helper_firmware_cb()
     - wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
     - wifi: cfg80211: pass net_device to .set_monitor_channel
     - wifi: cfg80211: define and use wiphy guard
     - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock
     - wifi: nl80211: free RNR data on MBSSID mismatch
     - wifi: cfg80211: derive S1G beacon TSF from S1G fields
     - wifi: nl80211: validate nested MBSSID IE blobs
     - wifi: cfg80211: validate PMSR measurement type data
     - wifi: cfg80211: validate PMSR FTM preamble range
     - wifi: cfg80211: reject unsupported PMSR FTM location requests
     - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
     - wifi: brcmfmac: initialize SDIO data work before cleanup
     - wifi: cfg80211: bound element ID read when checking non-inheritance
     - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop
     - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions()
     - ASoC: cs42l43: Correct report for forced microphone jack
     - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup
     - [arm64] firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context
     - cpufreq: Make cpufreq_update_pressure() fall back to cpuinfo.max_freq
     - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
     - ipv4: fib: free fib_alias with kfree_rcu() on insert error path
     - net/iucv: take a reference on the socket found in afiucv_hs_rcv()
     - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
     - scsi: core: wake eh reliably when using scsi_schedule_eh
     - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is
       registered
     - ata: sata_dwc_460ex: use platform_get_irq()
     - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending
       interrupts
     - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
     - [amd64] accel/ivpu: Fix wrong register read in LNL failure diagnostics
     - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC
     - Bluetooth: qca: fix NVM tag length underflow in TLV parser
     - Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update
     - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync
     - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds
     - Bluetooth: hci_qca: Clear memdump state on invalid dump size
     - smb/client: handle overlapping allocated ranges in fallocate
     - [amd64] drm/i915/gt: use correct selftest config symbol
     - [powerpc*] 85xx: Add fsl,ifc to common device ids
     - [powerpc*] time: Prepare to stop elapsing in dynticks-idle
     - [powerpc*] vtime: Initialize starttime at boot for native accounting
     - bpf, sockmap: Reject unhashed UDP sockets on sockmap update
     - [s390x] checksum: Fix csum_partial() without vector facility
     - [riscv64] hwprobe: Avoid uninitialized read in hwprobe_get_cpus()
     - can: j1939: fix lockless local-destination check
     - drm/xe/wopcm: fix WOPCM size for LNL+
     - smb: move some duplicate definitions to common/cifsglob.h
     - ksmbd: pin conn during async oplock break notification
     - ksmbd: validate compound request size before reading StructureSize2
     - net/sched: act_tunnel_key: Defer dst_release to RCU callback
     - sctp: fix auth_hmacs array size in struct sctp_cookie
     - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
     - usb: core: sysfs: add lock to bos_descriptors_read()
     - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()
     - usb: core: port: Deattach Type-C connector on component unbind
     - USB: storage: add NO_ATA_1X quirk for Longmai USB Key
     - usb: chipidea: fix usage_count leak when autosuspend_delay is negative
     - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback
     - usb: gadget: f_midi: cancel pending IN work before freeing the midi object
     - usb: gadget: printer: fix infinite loop in printer_read()
     - USB: gadget: snps-udc: fix device name leak on probe failure
     - USB: gadget: fsl-udc: fix device name leak on probe failure
     - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
     - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
     - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer
     - USB: serial: ftdi_sio: add support for E+H FXA291
     - USB: serial: io_edgeport: cap received transmit credits
     - USB: serial: keyspan_pda: fix data loss on receive throttling
     - USB: serial: option: add TDTECH MT5710-CN
     - crypto: rsa-pkcs1pad: Don't WARN on an empty digest
     - Revert "drm/amd/display: Add missing kdoc for ALLM parameters"
     - [riscv64] KVM: Serialize virtual interrupt pending state updates
     - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits
     - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware
       request
     - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin
     - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop
     - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop
     - hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop
     - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop
     - hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop
     - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
     - wifi: ath11k: fix potential buffer underflow in
       ath11k_hal_rx_msdu_list_get()
     - wifi: ath11k: Flush the posted write after writing to
       PCIE_SOC_GLOBAL_RESET
     - wifi: ath12k: Flush the posted write after writing to
       PCIE_SOC_GLOBAL_RESET
     - firewire: net: Fix fragmented datagram reassembly
     - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
     - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
     - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
     - wifi: carl9170: fix OOB read from off-by-two in TX status handler
     - wifi: carl9170: fix buffer overflow in rx_stream failover path
     - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8
     - btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps
     - btrfs: free mapping node on duplicate reloc root insert
     - ASoC: tas2781: bound firmware description string parsing
     - ALSA: hda: cs35l41: Fix NULL pointer dereference in
       cs35l41_get_acpi_mute_state() (CVE-2025-40098)
     - ALSA: hda: cs35l41: validate and free ACPI mute object
     - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI
     - ASoC: cs35l56: Don't use devres to unregister component
     - ASoC: cs35l56: Fix potential probe() deadlock
     - ASoC: cs35l56: Use complete_all() to signal init_completion
     - wifi: iwlwifi: mvm: validate SAR GEO response payload size
     - wifi: iwlwifi: mvm: fix read in wake packet notification handler
     - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
     - drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook()
     - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC
     - hwmon: (asus-ec-sensors) fix EC read intervals
     - hwmon: (asus-ec-sensors) add missed handle for ENOMEM
     - smb: client: validate DFS referral PathConsumed
     - hwmon: occ: validate poll response sensor blocks
     - regulator: mt6358: use regmap helper to read fixed LDO calibration
     - Bluetooth: btusb: validate Realtek vendor event length
     - netlink: specs: rt-link: convert bridge port flag attributes to u8
     - net/packet: avoid fanout hook re-registration after unregister
     - bonding: fix devconf_all NULL dereference when IPv6 is disabled
     - rds: drop incoming messages that cross network namespace boundaries
     - gtp: parse extension headers before reading inner protocol
     - [arm64] dpaa2-eth: put MAC endpoint device on disconnect
     - [amd64] iommu/amd: Wait for completion instead of returning early in
       iommu_completion_wait()
     - wifi: mac80211: tear down new links on vif update error path
     - nfp: Check resource mutex allocation
     - wan: wanxl: Only reset hardware after BAR mapping
     - wifi: mwifiex: bound uAP association event IEs to the event buffer
     - [amd64] iommu/amd: Bound the early ACPI HID map
     - [amd64] iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()
     - wifi: mac80211: recalculate TIM when a station enters power save
     - pds_core: reject component parameter in legacy firmware update
     - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN
     - net: txgbe: fix FDIR filter leak on remove
     - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
     - pds_core: fix deadlock between reset thread and remove
     - pds_core: fix use-after-free on workqueue during remove
     - pds_core: yield the CPU while waiting for the adminq to drain
     - pds_core: order completion reads after the ownership check
     - pds_core: fix auxiliary device add/del races
     - pds_core: check for workqueue allocation failure
     - sctp: validate stream count in sctp_process_strreset_inreq()
     - net: mctp i3c: clean up notifier and buses if driver register fails
     - tls: device: push pending open record on splice EOF
     - gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
     - nexthop: initialize extack in nh_res_bucket_migrate()
     - tipc: fix infinite loop in __tipc_nl_compat_dumpit
     - wifi: mt76: mt7925: guard link STA in decap offload
     - wifi: mt76: mt7915: guard HE capability lookups
     - wifi: mt76: connac: fix possible NULL-pointer deref in
       mt76_connac_mcu_uni_bss_he_tlv()
     - wifi: mt76: mt7925: fix possible NULL-pointer deref in
       mt7925_mcu_bss_he_tlv()
     - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()
     - wifi: mt76: mt7925: fix crash in reset link replay
     - wifi: mt76: mt7996: fix possible NULL-pointer deref in
       mt7996_mcu_sta_bfer_eht()
     - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning
     - ovl: fix trusted xattr escape prefix matching
     - amt: re-read skb header pointers after every pull
     - amt: make the head writable before rewriting the L2 header
     - net: bridge: vlan: fix vlan range dumps starting with pvid
     - net: hsr: fix memory leak on slave unregistration by removing synced VLANs
     - net: dpaa: fix mode setting
     - sctp: auth: verify auth requirement when auth_chunk is NULL
     - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
     - iomap: correct the range of a partial dirty clear
     - tipc: fix u16 MTU truncation in media and bearer MTU validation
     - net: stmmac: fix l3l4 filter rejecting unsupported offload requests
     - net: stmmac: reset residual action in L3L4 filters on delete
     - net: stmmac: enable the MAC on link up for all supported speeds
     - net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM
     - octeontx2-vf: set TC flower flag on MCAM entry allocation
     - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup
     - ppp: use IFF_NO_QUEUE in virtual interfaces
     - ppp: convert to percpu netstats
     - ppp: enable TX scatter-gather
     - ppp: annotate data races in ppp_generic
     - [amd64,arm64] hinic: remove unused ethtool RSS user configuration buffers
     - net: qrtr: restrict socket creation to the initial network namespace
     - dpll: add clock quality level attribute and op
     - net/mlx5: DPLL, Add clock quality level op implementation
     - net/mlx5: Remove newline at the end of a netlink error message
     - net/mlx5: Refactor EEPROM query error handling to return status separately
     - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads
     - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule
     - net/mlx5e: Report zero bandwidth for non-ETS traffic classes
     - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation
     - octeontx2-pf: tc: fix egress ratelimiting
     - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error
     - ice: allow creating VFs when !CONFIG_ICE_SWITCHDEV
     - ice: fix LAG recipe to profile association
     - rds: tcp: unregister sysctl before tearing down listen socket
     - net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets()
     - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
     - drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay
     - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()
     - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()
     - [arm64] drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply
       parsers
     - [arm64] drm/dp/mst: fix buffer overflows in sideband chunk accumulation
     - [arm64] drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply
       parsers
     - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at
       0 (v2)
     - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older
     - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT
     - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1
     - drm/nouveau: fix reversed error cleanup order in ucopy functions
     - drm/displayid: fix Tiled Display Topology ID size
     - [amd64] drm/i915/gem: Add missing nospec on parallel submit slot
     - drm/nouveau/acr: fix missing nvkm_done() in error path of
       nvkm_acr_oneinit()
     - drm/radeon: fix r100_copy_blit for large BOs
     - drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds
     - drm/amdkfd: Use kvcalloc to allocate arrays
     - drm/amdkfd: Check bounds in allocate_event_notification_slot
     - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation
     - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips
     - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path
       leaks prev_sink reference
     - drm/virtio: bound EDID block reads to the response buffer
     - drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()
     - [amd64] drm/i915: Return NULL on error in active_instance
     - [amd64] drm/i915/bios: range check LFP Data Block panel_type2
     - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()
     - [amd64] drm/i915/gem: Do not leak siblings[] on proto context error
     - [amd64] drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
     - drm/amd/pm: fix smu14 power limit range calculation
     - drm/gfx10: Program DB_RING_CONTROL
     - [arm64] drm/panthor: return error on truncated firmware
     - drm/amdgpu: Fix VFCT bus number matching with soft filter
     - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)
     - drm/amd/display: set new_stream to NULL after release
     - drm/amd/display: dce100: skip non-DP stream encoders for DP MST
     - drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge
     - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved
     - drm/vmwgfx: Validate vmw_surface_metadata::array_size
     - drm/vc4: Prevent shader BO mappings from becoming writable
     - media: airspy: Return queued buffers on start_streaming() failure
     - media: aspeed: fix missing of_reserved_mem_device_release() on probe
       failure
     - media: cec: seco: unregister adapter on IR probe failure
     - media: cedrus: clean up media device on probe failure
     - media: cedrus: Fix missing cleanup in error path
     - media: cedrus: skip invalid H.264 reference list entries
     - media: chips-media: wave5: Move src_buf Removal to finish_encode
     - media: cx231xx: fix devres lifetime
     - media: cx23885: add ioremap return check and cleanup
     - media: i2c: alvium: fix critical pointer access in alvium_ctrl_init
     - media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for
       overlapping ranges
     - media: marvell-cam: fix missing pci_disable_device() on remove
     - media: meson: vdec: Fix memory leak in error path of vdec_open
     - media: msi2500: Return queued buffers on start_streaming() failure
     - media: nuvoton: npcm-video: fix error handling in npcm_video_init()
     - media: nuvoton: npcm-video: fix memory leaks in probe and remove
     - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and
       pipe
     - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure
     - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error
       path
     - media: nxp: imx8-isi: Fix potential out-of-bounds issues
     - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding
     - media: pci: dm1105: Free allocated workqueue
     - media: pwc: Drain fill_buf on start_streaming() failure
     - media: pwc: Return queued buffers on start_streaming() failure
     - media: qcom: camss: Fix RDI streaming for CSID GEN2
     - media: radio-si476x: Unregister v4l2_device on probe failure
     - media: rtl2832: fix use-after-free in rtl2832_remove()
     - media: rtl2832_sdr: Return queued buffers on start_streaming() failure
     - media: saa7134: Fix a possible memory leak in saa7134_video_init1
     - media: stm32: dcmi: unregister notifier on probe failure
     - media: sun4i-csi: Return queued buffers on start_streaming() failure
     - media: tegra-video: vi: fix invalid u32 return value in format lookup
     - media: ti: vpe: unwind v4l2 device registration on probe error
     - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete()
     - media: v4l2-ctrls: validate HEVC active reference counts
     - media: v4l2-fwnode: Fix subdev owner overwritten in
       v4l2_async_register_subdev_sensor()
     - media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely
     - media: vb2: use ssize_t for vb2_read/vb2_write
     - media: vidtv: fix reference leak on failed device registration
     - media: vimc: fix reference leak on failed device registration
     - media: vivid: add vivid_update_reduced_fps()
     - media: vivid: check for vb2_is_busy() when toggling caps
     - media: vivid: fix cleanup bugs in vivid_init()
     - media: vpif_capture: fix OF node reference imbalance
     - ALSA: seq: close a re-opened queue timer in the destructor
     - ALSA: timer: drain a slave's callback before its master detaches it
     - ALSA: timer: don't re-enter an instance callback that is still running
     - wifi: ath6kl: fix OOB access from firmware ADDBA window size
     - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper
     - wifi: wilc1000: validate assoc response length before subtracting header
     - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses
     - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses
     - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses
     - wifi: brcmfmac: make release_scratchbuffers idempotent
     - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()
     - staging: rtl8723bs: fix inverted HT40 secondary channel offset
     - Bluetooth: hci_sync: Protect UUID list traversal
     - Bluetooth: RFCOMM: Fix session UAF in set_termios
     - exec: fix unsigned loop counter wrap in transfer_args_to_stack()
     - binfmt_misc: set have_execfd only once the interpreter is opened
     - objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0
     - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
     - firmware: stratix10-svc: fix memory leaks and list corruption bugs
     - [amd64] x86/boot/compressed: Disable jump tables
     - [amd64] comedi: comedi_parport: deal with premature interrupt
     - uio_hv_generic: Bind to FCopy device by default
     - serial: sc16is7xx: implement gpio get_direction() callback
     - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR
       platforms (Closes: #1143721)
     - mei: bus: access mei_device under device_lock on cleanup
     - [amd64] intel_th: fix MSC output device reference leak
     - misc: nsm: only unlock nsm_dev on post-lock error paths
     - misc: nsm: pin the module while the device is open
     - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev
     - tracing: Fix resource leak on mmiotrace trace_pipe close
     - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match()
     - tracing/probes: Avoid temporary buffer truncation in
       trace_probe_match_command_args()
     - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro
     - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()
     - [arm64] syscall: Ensure saved x0 is kept in-sync with tracer updates
     - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer
       updates"
     - mptcp: decrement subflows counter on failed passive join
     - mptcp: only set DATA_FIN when a mapping is present
     - sctp: don't free the ASCONF's own transport in DEL-IP processing
       (CVE-2026-64564)
     - sctp: avoid auth_enable sysctl UAF during netns teardown
     - sctp: close UDP tunnel sockets during netns teardown
     - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
     - ceph: fix refcount leak in ceph_readdir()
     - libceph: bound get_version reply decode to front len
     - libceph: Fix multiplication overflow in decode_new_up_state_weight()
     - libceph: guard missing CRUSH type name lookup
     - libceph: refresh auth->authorizer_buf{,_len} after authorizer update
     - libceph: Reject monmaps advertising zero monitors
     - libceph: reject zero bucket types in crush_decode
     - libceph: remove debugfs files before client teardown
     - amt: fix use-after-free in AMT delayed works
     - ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP
     - binfmt_elf_fdpic: only honour the first PT_INTERP
     - fs: preserve ACL_DONT_CACHE state in forget_cached_acl()
     - fscrypt: Add missing superblock check in find_or_insert_direct_key()
     - ftrace: Add global mutex to serialize trace_parser access
     - iomap: fix out-of-bounds bitmap_set() with zero-length range
     - [amd64] iommu/vt-d: Disallow SVA if page walk is not coherent
     - phonet: pep: fix use-after-free in pep_get_sb()
     - vxlan: require CAP_NET_ADMIN in the device netns for changelink
     - net: slip: serialize receive against buffer reallocation
     - geneve: require CAP_NET_ADMIN in the device netns for changelink
     - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
     - net/iucv: fix use-after-free of a severed iucv_path
     - net/mlx5e: Use sender devcom for MPV master-up
     - net/x25: fix use-after-free in x25_kill_by_neigh()
     - net: gro: fix double aggregation of flush-marked skbs
     - net: hip04: fix RX buffer leak on build_skb failure
     - proc: Fix broken error paths for namespace links
     - ice: fix PTP Call Trace during PTP release
     - rbd: Reset positive result codes to zero in object map update path
     - ksmbd: defer destroy_previous_session() until after NTLM authentication
     - ice: reject out-of-range ptype in ice_parser_profile_init
     - ice: use READ_ONCE() to access cached PHC time
     - ila: reload IPv6 header after pskb_may_pull in checksum adjust
     - mac802154: hold an interface reference across the scan worker
     - mac802154: llsec: reject frames shorter than the authentication tag
     - mctp: serial: handle zero-length frames to prevent rx buffer overflow
     - openvswitch: fix GSO userspace truncation underflow
     - pppoe: reload header pointer after dev_hard_header()
     - rtase: Workaround for TX hang caused by hardware packet parsing
     - tcp: initialize standalone TCP-AO response padding
     - tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
     - vsock/virtio: collapse receive queue under memory pressure
     - vxlan: mdb: Fix source list corruption on a failed replace
     - drm/amd/pm: fix amdgpu_pm_info power display units
     - drm/amd/pm: make pp_features read-only when scpm is enabled
     - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/gfx8: drop unecessary BUG_ON()
     - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/vce: fix integer overflow in image size
     - drm/amdgpu/vcn4: avoid rereading IB param length
     - drm/dp_mst: Handle torn-down topology gracefully in
       drm_dp_mst_topology_queue_probe()
     - drm/amdgpu: fix division by zero with invalid uvd dimensions
     - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
     - drm/amdgpu: fix aperture mapping leak
     - drm/amd/pm: fix smu13 power limit range calculation
     - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops
       (CVE-2026-53078)
     - net: qrtr: ns: Raise node count limit to 512
     - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
     - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
     - ksmbd: bound DACL dedup walk to copied ACEs
     - ksmbd: validate ACE size against SID sub-authorities
     - fscrypt: Avoid dynamic allocation in fscrypt_get_devices()
     - drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources
     - io_uring/rw: fix missing ERESTARTSYS conversion in read paths
     - net: pcs: xpcs: fix SGMII state reading
     - gve: fix Rx queue stall on alloc failure
     - mm/damon/core: validate ranges in damon_set_regions()
     - mm/damon/core: disallow overlapping input ranges for damon_set_regions()
     - iommufd: Reject invalid read count in iommufd_fault_fops_read()
     - iommufd: Break the loop on failure in iommufd_fault_fops_read()
       (CVE-2026-64290)
     - iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()
     - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
       (CVE-2026-64280)
     - i2c: davinci: Unregister cpufreq notifier on probe failure
     - VFS/audit: introduce kern_path_parent() for audit
     - audit: widen ino fields to u64
     - audit: use 'unsigned int' instead of 'unsigned'
     - audit: fix recursive locking deadlock in audit_dupe_exe()
     - i2c: i801: fix hardware state machine corruption in error path
       (CVE-2026-64205)
     - ALSA: hda: conexant: Remove mic bias threshold override
     - ALSA: hda: Fix cached processing coefficient verbs
     - rxrpc: Pull out certain app callback funcs into an ops table
     - rxrpc: serialize kernel accept preallocation with socket teardown
     - xfs: factor out xfs_attr3_leaf_init
     - xfs: don't replace the wrong part of the cow fork
     - fbcon: Rename struct fbcon_ops to struct fbcon_par
     - fbcon: Use correct type for vc_resize() return value
     - rxrpc: Fix CPU time starvation in I/O thread
     - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack
     - rxrpc: Use irq-disabling spinlocks between app and I/O thread
     - rxrpc: Fix notification vs call-release vs recvmsg
     - rxrpc: Fix socket notification race
     - tipc: restrict socket queue dumps in enqueue tracepoints
     - vduse: Use fixed 4KB bounce pages for non-4KB page size
     - vduse: remove unused vaddr parameter of vduse_domain_free_coherent
     - vduse: take out allocations from vduse_dev_alloc_coherent
     - VDUSE: avoid leaking information to userspace
     - octeontx2: Annotate mmio regions as __iomem
     - octeontx2-vf: clear stale mailbox IRQ state before request_irq()
     - octeontx2-pf: clear stale mailbox IRQ state before request_irq()
     - [arm64] dts: qcom: correct RBR opp entry
     - [arm64] dts: qcom: hamoa: Fix OPP tables for all DisplayPort controllers
     - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable
     - ASoC: mediatek: mt8192: Check runtime resume during probe
     - ASoC: mediatek: mt8183-afe-pcm: Shorten memif_data table using macros
     - ASoC: mediatek: mt8183-afe-pcm: Support >32 bit DMA addresses
     - ASoC: mediatek: mt8183-afe-pcm: use local `dev` pointer in driver
       callbacks
     - ASoC: mediatek: mt8183: Check runtime resume during probe
     - netfilter: nf_conntrack_sip: remove net variable shadowing
     - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
     - netfilter: bitwise: rename some boolean operation functions
     - netfilter: nf_tables: Remove unused nft_reduce_is_readonly()
     - netfilter: nf_tables: remove register tracking infrastructure
     - netfilter: nft_fib: reject fib expression on the netdev egress hook
     - gpu: Move DRM buddy allocator one level up (part two)
     - gpu/buddy: bail out of try_harder when alignment cannot be honoured
     - NFSD: pass nfsd_file to nfsd_iter_read()
     - sunrpc: allocate a separate bvec array for socket sends
     - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists
     - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow
     - remoteproc: xlnx: Check remote core state
     - mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch
     - mm/sparse-vmemmap: fix vmemmap accounting underflow
     - landlock: Prepare to use credential instead of domain for fowner
     - landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path
     - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages
     - mtd: maps: vmu-flash: fix fault in unaligned fixup
     - mm: prepare to move subsection_map_init() to mm/sparse-vmemmap.c
     - mm/sparse-vmemmap: fix DAX vmemmap accounting with optimization
     - dma: dw-edma: Fix build warning in dw_edma_pcie_probe()
     - dmaengine: dw-edma: Fix confusing cleanup.h syntax
     - dmaengine: dw-edma-pcie: Reject devices without driver data
     - i2c: imx: separate atomic, dma and non-dma use case
     - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
     - xfrm: Use nested-BH locking for nat_keepalive_sk_ipv[46]
     - xfrm: nat_keepalive: avoid double free on send error
     - tcp: defer md5sig_info kfree past RCU grace period in tcp_connect
     - tcp: Decrement tcp_md5_needed static branch
     - nvmet: Introduce nvmet_req_transfer_len()
     - nvmet-auth: reject short AUTH_RECEIVE buffers
     - ovl: use linked upper dentry in copy-up tmpfile
     - block: add helper add_disk_final()
     - block: remove redundant GD_NEED_PART_SCAN in add_disk_final()
     - dm-integrity: fix leaking uninitialized kernel memory
     - cleanup: add a scoped version of CLASS()
     - cleanup: fix scoped_class()
     - cred: add kernel_cred() helper
     - cred: add scoped_with_kernel_creds()
     - dm: avoid leaking the caller's thread keyring via the table device file
     - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
     - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()
     - net: mana: Validate the packet length reported by the NIC
     - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink
     - gve: fix header buffer corruption with header-split and HW-GRO
     - gpio: mt7621: avoid corruption of shared interrupt trigger state
     - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
     - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
     - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
     - ipmi: fix refcount leak in i_ipmi_request()
     - net/mlx5: HWS, Rearrange to prevent forward declaration
     - net/mlx5: HWS, fix matcher leak on resize target setup failure
     - octeontx2-pf: fix SQB pointer leak on init failure
     - ata: libata-core: Reject an invalid concurrent positioning ranges count
     - fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
     - net: macb: drop in-flight Tx SKBs on close
     - net: ipa: fix SMEM state handle leaks in SMP2P init
     - Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections
     - Bluetooth: hci_core: Fix not accounting for BIS/CIS/PA links separately
     - afs: Improve server refcount/active count tracing
     - afs: Make afs_lookup_cell() take a trace note
     - afs: Drop the net parameter from afs_unuse_cell()
     - rxrpc: Allow the app to store private data on peer structs
     - afs: Use the per-peer app data provided by rxrpc
     - afs: Fix afs_server ref accounting
     - afs: Simplify cell record handling
     - afs: Fix dynamic lookup to fail on cell lookup failure
     - afs: Fix lack of locking around modifications of net->cells_dyn_ino
     - USB: gadget: Use str_enable_disable-like helpers
     - USB: gadget: fsl-udc: fix dev_printk() device
     - usb: musb: omap2430: clean up probe error handling
     - usb: musb: omap2430: Do not put borrowed of_node in probe
     - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query
     - gpu: Fix uninitialized buddy for built-in drivers
     - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link
     - rxrpc: Fix locking issues with the peer record hash
     - wifi: nl80211: fix nl80211_start_radar_detection return value
     - net: ethernet: Remove accidental duplication in Kconfig file
     - afs: Set vllist to NULL if addr parsing fails
     - dpll: fix clock quality level reporting
     - afs: Fix delayed allocation of a cell's anonymous key
     - afs: handle CB.InitCallBackState3 requests without a server record
     - Bluetooth: hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK
     - Bluetooth: hci_conn: Fix not cleaning up Broadcaster/Broadcast Source
     - Bluetooth: hci_conn: Fix not cleaning up PA_LINK connections
     - Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
     - afs: Fix uninit var in afs_alloc_anon_key()
     - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after
       hotplug
 .
   [ Salvatore Bonaccorso ]
   * [rt] Refresh "locking/rt: Add sparse annotation for RCU." (context
     changes)
   * rhashtable: clear stale iter->p on table restart (CVE-2026-64563)
linux-signed-amd64 (6.12.100+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.100-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.97
     - smb/server: do not require delete access for non-replacing links
     - [amd64] iommu/vt-d: Clear Present bit before tearing down context entry
       (CVE-2026-45944)
     - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().
     - bpf: Support for hardening against JIT spraying (CVE-2026-64508)
     - [amd64] x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)
     - bpf: Restrict JIT predictor flush to cBPF
     - bpf: Skip redundant IBPB in pack allocator
     - bpf: Prefer packs that won't trigger an IBPB flush on allocation
     - bpf: Prefer dirty packs for eBPF allocations
     - sched/fair: Only update stats for allowed CPUs when looking for dst group
     - crypto: algif_skcipher - force synchronous processing
     - [arm64] KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU
       (CVE-2026-64287)
     - [arm64] KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp
       vCPU (CVE-2026-64286)
     - iommu: Pass old domain to set_dev_pasid op
     - [amd64] iommu/vt-d: Cleanup intel_context_flush_present()
     - [amd64] iommu/vt-d: Clear Present bit before tearing down scalable-mode
       context entry
     - timekeeping: Register default clocksource before taking tk_core.lock
     - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
       (CVE-2026-64534)
     - nvmet-tcp: Fix potential UAF when ddgst mismatch (CVE-2026-64535)
     - vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365)
     - vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970)
     - [armhf] crypto: sun4i-ss - Remove insecure and unused rng_alg
     - [amd64] iommu/amd: Use maximum Event log buffer size when SNP is enabled
       on Family 0x19
     - [amd64] iommu/amd: Use maximum PPR log buffer size when SNP is enabled on
       Family 0x19
     - [amd64] x86/mm: Fix check/use ordering in switch_mm_irqs_off()
     - net: dropreason: Gather SOCKET_ drop reasons.
     - af_unix: Set drop reason in unix_release_sock().
     - af_unix: Set drop reason in manage_oob().
     - af_unix: Set drop reason in unix_stream_read_skb().
     - af_unix/scm: fix whitespace errors
     - af_unix: Don't hold unix_state_lock() in __unix_dgram_recvmsg().
     - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb().
     - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb().
     - af_unix: Drop all SCM attributes for SOCKMAP. (CVE-2026-53005)
     - crypto: crypto4xx - Remove ahash-related code
     - crypto: crypto4xx - Remove insecure and unused rng_alg
     - crypto: hisi-trng - Remove crypto_rng interface
     - time/jiffies: Register jiffies clocksource before usage
     - time/jiffies: Change register_refined_jiffies() to void __init
     - media: uvcvideo: Use hw timestaming if the clock buffer is full
     - media: uvcvideo: Avoid partial metadata buffers
     - media: uvcvideo: Fix buffer sequence in frame gaps
     - media: uvcvideo: Fix dev_sof filtering in hw timestamp
     - media: uvcvideo: Do not add clock samples with small sof delta
     - media: uvcvideo: Relax the constrains for interpolating the hw clock
     - media: uvcvideo: Fix sequence number when no EOF
     - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties
     - dt-bindings: power: imx93: Add MIPI PHY power domain
     - serial: msm: Disable DMA for kernel console UART
     - serial: max310x: implement gpio_chip::get_direction()
     - serial: 8250_omap: clear rx_running on zero-length DMA completes
     - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc
     - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK)
     - afs: Fix netns teardown to cancel the preallocation charger
     - afs: fix NULL pointer dereference in afs_get_tree()
     - afs: Fix further netns teardown to cancel the preallocation charger
     - fbcon: fix NULL pointer dereference for a console without vc_data
     - clocksource/drivers/sun5i: Handle error returns from
       devm_reset_control_get_optional_exclusive()
     - drm/rockchip: Test for imported buffers with drm_gem_is_imported()
     - drm/tidss: Drop extra drm_mode_config_reset() call
     - drm/gpuvm: Do not prepare NULL objects
     - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch()
     - drm/radeon: fix integer overflow in radeon_align_pitch()
     - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure
     - libbpf: Report error when a negative kprobe offset is specified
     - drm/amd/pm: remove trailing semicolon from AMDGPU_PM_POLICY_ATTR macro
     - Documentation: proc: fix section numbering in table of contents
     - [arm64] dts: rockchip: Fix gmac0 reset pin for NanoPi R5S
     - [arm64] dts: qcom: sc8180x: Fix phy simple_bus_reg warning
     - [arm64] dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg
       warning
     - wifi: cfg80211: fix grammar in MLO group key error message
     - [arm64] tegra: Fix Tegra234 MGBE PTP clock
     - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block
     - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc
     - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()
     - wifi: rtw89: Correct data type for scan index to avoid infinite loop
     - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer
     - kconfig: fix potential NULL pointer dereference in conf_askvalue
     - soc: xilinx: Shutdown and free rx mailbox channel
     - wifi: ath9k: fix OOB access from firmware tx status queue ID
     - [armhf] dts: am335x-sl50: Fix audio bitclock and frame master endpoint
     - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH
     - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5
     - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register
       failure
     - media: cedrus: Fix failure to clean up hardware on probe failure
     - media: v4l2-common: Add YUV24 format info
     - memory: tegra: Wire up system sleep PM ops
     - [amd64] crypto: qat - fix heartbeat error injection
     - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path
     - drm/gpuvm: take refcount on DRM device
     - [arm64] dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc
     - [arm64] dts: imx8x-colibri: Correct SODIMM PAD settings
     - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
     - [amd64] crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one
     - crypto: atmel-sha204a - fix blocking and non-blocking rng logic
     - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve
     - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents
       (CVE-2026-64544)
     - dlm: fix add msg handle in send_queue ordered
     - nilfs2: fix backing_dev_info reference leak
     - media: qcom: camss: vfe: fix PIX subdev naming on VFE lite
     - [amd64] iommu/amd: Fix a stale comment about which legacy mode is user
       visible
     - [arm64] dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host
     - clk: scmi: Fix clock rate rounding
     - [arm64] dts: qcom: kodiak: Fix ICE reg size
     - [arm64] dts: qcom: sm8450: Fix ICE reg size
     - [arm64] drm/hisilicon/hibmc: move display contrl config to hibmc_probe()
     - [arm64] drm/hisilicon/hibmc: use clock to look up the PLL value
     - evm: terminate and bound the evm_xattrs read buffer
     - thermal: hwmon: Fix critical temperature attribute removal
     - clk: scpi: Unregister child clock providers on remove
     - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats()
     - crypto: ccp - Treat zero-length cert chain as query for blob lengths
     - spi: hisi-kunpeng: Use dev_err_probe() for host registration failure
     - net/sched: sch_htb: do not change sch->flags in htb_dump()
     - net/sched: sch_htb: annotate data-races (I)
     - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD
     - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier
     - RDMA/hns: Fix arithmetic overflow in calc_hem_config()
     - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference
     - RDMA/srpt: fix integer overflow in immediate data length check
     - [arm64] RDMA/hns: Initialize seqfile before creating file
     - drm/syncobj: Fix memory leak in drm_syncobj_find_fence()
     - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table()
     - media: atomisp: gc2235: fix UAF and memory leak
     - staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy()
     - firmware: arm_scmi: Read sensor config as 32-bit value
     - sysfs: clamp show() return value in sysfs_kf_read()
     - bitops: use common function parameter names
     - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions
     - net/sched: sch_drr: annotate data-races around cl->deficit
     - media: rockchip: rga: fix too small buffer size
     - [arm64] firmware: arm_scmi: Fix OOB in scmi_power_name_get()
     - [arm64] dts: qcom: sc7180: Add power-domain and iface clk for ice node
     - [arm64] dts: qcom: kodiak: Add power-domain and iface clk for ice node
     - [arm64] dts: qcom: sm8450: Add power-domain and iface clk for ice node
     - [arm64] dts: qcom: sm8650: Add power-domain and iface clk for ice node
     - tracing: Bound synthetic-field strings with seq_buf
     - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount()
     - device property: fix fwnode reference leak in
       fwnode_graph_get_endpoint_by_id()
     - driver core: Use mod_delayed_work to prevent lost deferred probe work
     - Revert "treewide: Fix probing of devices in DT overlays"
     - cpufreq: Documentation: fix sampling_down_factor range
     - cpufreq: conservative: Simplify frequency limit handling
     - pwm: imx27: Fix variable truncation in .apply()
     - RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed
     - bus: sunxi-rsb: Always check register address validity
     - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs
     - RDMA/rxe: Fix a use-after-free problem in rxe_mmap
     - IB/mlx4: Fix refcount leak in add_port() error path
     - [arm64] RDMA/hns: Fix warning in poll cq direct mode
     - [arm64] RDMA/hns: Fix log flood after cmd_mbox failure
     - RDMA/counter: Fix incorrect port index in rdma_counter_init() error
       cleanup
     - PM: sleep: Use complete() in device_pm_sleep_init()
     - jiffies: Define secs_to_jiffies()
     - driver core: Fix missing jiffies conversion in
       deferred_probe_extend_timeout()
     - driver core: Guard deferred probe timeout extension with
       delayed_work_pending()
     - mtd: spi-nor: Drop duplicate Kconfig dependency
     - ALSA: seq: midi: Serialize output teardown with event_input
     - pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table
     - pinctrl: cs42l43: Fix polarity on debounce
     - nvmet-tcp: fix page fragment cache leak in error path
     - nvme-multipath: fix flex array size in struct nvme_ns_head
     - workqueue: drop spurious '*' from print_worker_info() fn declaration
     - ipv6: guard against possible NULL deref in __in6_dev_stats_get()
     - net/sched: cls_bpf: prevent unbounded recursion in offload rollback
     - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client
       is registered
     - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove
     - gpu: host1x: Allow entries in BO caches to be freed
     - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output()
     - gpu: host1x: Fix iommu_map_sgtable() return value check
     - drm/tegra: Fix iommu_map_sgtable() return value check
     - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada
     - libbpf: Harden parse_vma_segs() path parsing
     - bpftool: Fix typo in struct_ops map FD generation for light skeleton
     - libbpf: Fix UAF in strset__add_str()
     - dax/kmem: account for partial discontiguous resource upon removal
     - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()
     - ocfs2: don't BUG_ON an invalid journal dinode
     - ocfs2: kill osb->system_file_mutex lock
     - crypto: hisilicon/qm - disable error report before flr
     - crypto: tegra - Fix dma_free_coherent size error
     - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm
     - sched/deadline: Always stop dl-server before changing parameters
     - sched/deadline: Reject debugfs dl_server writes for offline CPUs
     - [arm64] drm/msm/dp: fix HPD state status bit shift value
     - [arm64] drm/msm/dp: Fix the ISR_* enum values
     - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info
     - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe
     - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path
     - media: qcom: venus: drop extra padding in NV12 raw size calculation
     - media: qcom: venus: relax encoder frame/blur dimension steps on v4
     - media: qcom: venus: relax encoder frame/blur step size on v6
     - amba: use generic driver_override infrastructure
     - cdx: use generic driver_override infrastructure
     - Drivers: hv: vmbus: use generic driver_override infrastructure
     - rpmsg: use generic driver_override infrastructure
     - md/raid10: reset read_slot when reusing r10bio for discard
     - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback
     - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble
     - NFSD: Fix delegation reference leak in nfsd4_revoke_states
     - HID: wiimote: Fix table layout and whitespace errors
     - ata: libata: Fix ata_exec_internal()
     - nvdimm/btt: Handle preemption in BTT lane acquisition
     - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and
       multi-channel scans"
     - scsi: pm8001: Fix error code in non_fatal_log_show()
     - scsi: ufs: Fix wrong value printed in unexpected UPIU response case
     - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs
     - mm/fake-numa: fix under-allocation detection in uniform split
     - ext2: fix ignored return value of generic_write_sync()
     - sched: restore timer_slack_ns when resetting RT policy on fork
     - driver core: Use system_percpu_wq instead of system_wq
     - tick/sched: Fix TOCTOU in nohz idle time fetch
     - configfs_lookup(): don't leave ->s_dentry dangling on failure
     - drm/amdgpu: set sub_block_index for mca ras sub-blocks
     - bpftool: Use libbpf error code for flow dissector query
     - vhost: fix vhost_get_avail_idx for a non empty ring
     - [amd64] perf/x86/amd/core: Always use the NMI latency mitigation
     - [amd64] perf/x86/intel/uncore: Fix discovery unit lookup for multi-die
       systems
     - [amd64] perf/x86/amd/uncore: Use Node ID to identify DF and UMC domains
     - xfrm: fix NAT-related field inheritance in SA migration
     - drm/amdkfd: always resume_all after suspend_all
     - ocfs2: rebase copied fsdlm LVB pointers in locking_state
     - ocfs2: fix buffer head management in ocfs2_read_blocks()
     - ocfs2: reject FITRIM ranges shorter than a cluster
     - ocfs2/dlm: require a ref for locking_state debugfs open
     - ocfs2: fix race between ocfs2_control_install_private() and
       ocfs2_control_release()
     - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures
     - netfilter: nfnetlink_cthelper: use {READ,WRITE}_ONCE for accessing helper
       flags
     - netfilter: synproxy: drop packets if timestamp adjustment fails
     - netfilter: synproxy: adjust duplicate timestamp options
     - netfilter: synproxy: fix unaligned memory access in timestamp adjustment
     - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock
     - netfilter: conntrack: revert ct extension genid infrastructure
     - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is
       pptp
     - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path()
     - RDMA/irdma: Fix OOB read during CQ MR registration
     - RDMA/irdma: Initialize iwmr->access during MR registration
     - [arm64] dts: imx95: Correct PCIe outbound address space configuration
     - [arm64] dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as
       well
     - RDMA/siw: Fix endpoint/socket association handling
     - bpf: Check tail zero of bpf_prog_info
     - bpf: Update transport_header when encapsulating UDP tunnel in lwt
     - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response
     - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO
       indication
     - wifi: wcn36xx: fix OOB read from short trigger BA firmware response
     - ALSA: seq: Fix partial userptr event expansion
     - [riscv64] cpu_ops: Change return value type of cpu_is_stopped() to bool
     - [riscv64] stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe
     - ALSA: seq: Clear variable event pointer on read
     - ACPI: IPMI: Fix message kref handling on dead device
     - cpufreq: Documentation: fix conservative governor freq_step description
     - thermal: testing: reject missing command arguments
     - IB/mlx5: Don't take the rereg_mr fallback without a new translation
     - IB/mlx5: Properly support implicit ODP rereg_mr
     - spi: ep93xx: fix double-free of zeropage on DMA setup failure
     - [amd64] ASoC: amd: acp-sdw-sof: Bound DAI link iteration
     - firmware_loader: Fix recursive lock in device_cache_fw_images()
     - configfs: fix lockless traversals of ->s_children
     - watchdog: unregister PM notifier on watchdog unregister
     - scsi: target: Fix hexadecimal CHAP_I handling
     - scsi: target: Remove tcm_loop target reset handling
     - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins
       34-39
     - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins
       34-39
     - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()
     - hwspinlock: qcom: avoid uninitialized struct members
     - sched/fair: Fix cpu_util runnable_avg arithmetic
     - wifi: mt76: mt7925: clean up DMA on probe failure
     - wifi: mt76: mt7925: fix stale pointer comparisons in change_vif_links
     - wifi: mt76: mt7925: keep TX BA state in the primary WCID
     - wifi: mt76: mt792x: skip MLD header rewrite for 802.3 encap TX
     - wifi: mt76: fix argument to ieee80211_is_first_frag()
     - wifi: mt76: mt7915: fix potential tx_retries underflow
     - wifi: mt76: mt7921: fix potential tx_retries underflow
     - wifi: mt76: mt7925: fix potential tx_retries underflow
     - wifi: mt76: mt7996: fix potential tx_retries underflow
     - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()
     - fbdev: sm501fb: Fix buffer errors in OF binding code
     - hwmon: (it87) Clamp negative values to zero in set_fan()
     - btrfs: zoned: don't account data relocation space-info in statfs free
       space
     - btrfs: fix deadlock cloning inline extent when using flushoncommit
     - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified
     - NFSD: Handle layout stid in nfsd4_drop_revoked_stid()
     - spi: meson-spifc: fix runtime PM leak on remove
     - ASoC: codecs: aw88261: fix incorrect masks for boost regs
     - vduse: hold vduse_lock across IDR lookup in open path
     - vhost/vdpa: validate virtqueue index in mmap and fault paths
     - virtio_console: read size from config space during device init
     - vduse: Requeue failed read to send_list head
     - vhost/net: complete zerocopy ubufs only once
     - tools/virtio: check mmap return value in vringh_test
     - vdpa/octeon_ep: Fix PF->VF mailbox data address calculation
     - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove()
     - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails
     - bonding: 3ad: fix mux port state on oper down
     - ext4: fix kernel BUG in ext4_write_inline_data_end
     - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT
     - of: cpu: add check in __of_find_n_match_cpu_property()
     - vfio/qat: fix f_pos race in qat_vf_resume_write()
     - bpf: Tighten cgroup storage cookie checks for prog arrays
     - ASoC: cs35l56: Fix possible uninitialized value in
       cs35l56_spi_system_reset()
     - [s390x] process: Fix kernel thread function pointer type
     - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for
       non-serdev device
     - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD
       (CVE-2026-64539)
     - Bluetooth: hci_core: Fix UAF in hci_unregister_dev()
     - Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path
     - Bluetooth: hci: validate codec capability element length
     - Bluetooth: vhci: validate devcoredump state before side effects
     - fs: efs: remove unneeded debug prints
     - RDMA/mlx5: Remove DCT restrack tracking
     - RDMA/mlx5: Remove raw RSS QP restrack tracking
     - RDMA/mlx5: Fix undefined shift of user RQ WQE size
     - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one
     - ASoC: codecs: hdac_hdmi: Validate written enum value
     - ASoC: fsl: fsl_audmix: Validate written enum values
     - ASoC: tegra: tegra210_ahub: Validate written enum value
     - net: dsa: qca8k: fix led devicename when using external mdio bus
     - net/sched: cls_flow: Dont expose folded kernel pointers
     - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().
     - bridge: cfm: reject invalid CCM interval at configuration time
       (CVE-2026-64537)
     - sctp: validate embedded address parameter length
     - net: pfcp: allocate per-cpu tstats for PFCP netdevs
     - net/sched: sch_hfsc: Don't make class passive twice
     - tipc: require net admin for TIPCv2 netlink mutators
     - tipc: prevent snt_unacked underflow on CONN_ACK
     - tipc: reject inverted service ranges from peer bindings
     - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
     - crypto: cavium/cpt - fix DMA cleanup using wrong loop index
     - crypto: rng - Free default RNG on module exit
     - ALSA: seq: Fix kernel heap address leak in bounce_error_event()
     - spi: xilinx: use FIFO occupancy register to determine buffer size
     - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO
     - power: supply: core: fix supplied_from allocations
     - handshake: Require admin permission for DONE command
     - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek
       before restoring qlen
     - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek
       before restoring qlen
     - net: mana: initialize gdma queue id to INVALID_QUEUE_ID
     - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check
     - net: ethernet: mtk_wed: fix loading WO firmware for MT7986
     - bpf: Run generic devmap egress prog on private skb
     - net/mlx5: Check max_macs devlink param value against max capability
     - octeontx2-af: npc: Fix size of entry2cntr_map
     - net: ethernet: mtk_wed: debugfs: correct index in wed_amsdu_show()
     - net: wwan: t7xx: check skb_clone in control TX
     - dpll: add reference-sync netlink attribute
     - dpll: add reference sync get/set
     - dpll: Allow associating dpll pin with a firmware node
     - dpll: Add notifier chain for dpll events
     - dpll: Support dynamic pin index allocation
     - dpll: Enhance and consolidate reference counting logic
     - dpll: fix stale iteration in dpll_pin_on_pin_unregister()
     - dpll: send delete notification before unregister in on-pin rollback
     - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister()
     - dpll: guard sync-pair removal on full pin unregister
     - dpll: balance create/delete notifications in __dpll_pin_(un)register
     - landlock: Fix unmarked concurrent access to socket family
     - net: bcmgenet: Use weighted round-robin TX DMA arbitration
     - kcm: use WRITE_ONCE() when changing lower socket callbacks
     - netfilter: nf_conncount: callers must hold rcu read lock
     - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait()
     - cifs: remove all cifs files before kill super
     - smb/client: always return a value for FS_IOC_GETFLAGS
     - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket
     - udf: fix nls leak on udf_fill_super() failure
     - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
     - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check
     - [powerpc*] perf: fix preempt count underflow in fsl_emb_pmu_del
     - [powerpc*] powernv: fix preempt count leak in
       pnv_kexec_wait_secondaries_down
     - [powerpc*] kexec: fix double get_cpu() imbalance in kexec_prepare_cpus
     - KEYS: Use acquire when reading state in keyring search
     - tipc: fix UAF in tipc_l2_send_msg()
     - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
     - net: airoha: Introduce ndo_select_queue callback
     - net: airoha: Add sched ETS offload support
     - net: airoha: Fix always-true condition in PPE1 queue reservation loop
     - net: ethernet: oa_tc6: Remove FCS size in RX frame
     - ionic: Fix check in ionic_get_link_ext_stats
     - ksmbd: fix use-after-free in same_client_has_lease()
     - mfd: rsmu: Fix page register setup
     - mfd: cs42l43: Sanity check firmware size
     - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write
     - net/9p: fix race condition on rdma->state in trans_rdma.c
     - eventpoll: expand top-of-file overview / locking doc
     - eventpoll: rename attach_epitem() to ep_attach_file()
     - eventpoll: split ep_insert() into alloc + register stages
     - eventpoll: extract ep_deliver_event() from ep_send_events()
     - eventpoll: wrap EP_UNACTIVE_PTR in typed sentinel helpers
     - eventpoll: rename epi->next and txlist for clarity
     - eventpoll: Fix epoll_wait() report false negative
     - gpiolib: acpi: Only trigger ActiveBoth interrupts on boot
     - staging: nvec: fix use-after-free in nvec_rx_completed()
     - coresight: cti: Fix DT filter signals silently ignored
     - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore
     - PCI/ASPM: Don't reconfigure ASPM entering low-power state
     - PCI: Introduce named defines for PCI ROM
     - PCI: Check ROM header and data structure addr before accessing
     - [amd64] x86/platform/olpc: xo15: Drop wakeup source on driver removal
     - [amd64] platform/x86: xo15-ebook: Fix wakeup source and GPE handling
     - PCI: loongson: Do not ignore downstream devices on external bridges
     - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker()
     - PCI: qcom: Set max OPP before DBI access during resume
     - phy: phy-can-transceiver: Check driver match and driver data against NULL
     - clk: at91: sam9x7: Fix gmac_gclk clock definition
     - coresight: Fix source not disabled on idr_alloc_u32 failure
     - mailbox: mtk-adsp: fix UAF during device teardown
     - staging: most: video: avoid double free on video register failure
     - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()
     - usb: host: max3421: Reject hub port requests for non-existent ports
     - char: tlclk: fix use-after-free in tlclk_cleanup()
     - PCI: qcom: Disable ASPM L0s for SA8775P
     - iio: light: si1133: reset counter to prevent race condition
     - iio: light: si1133: prevent race condition on timeout
     - iio: magnetometer: ak8975: fix potential kernel stack memory leak
     - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling
     - iio: accel: mma8452: handle I2C read error(s) in mma8452_read()
     - iio: tcs3472: power down chip on probe failure
     - clk: at91: keep securam node alive while mapping it
     - HID: logitech-hidpp: remove excess kernel-doc member in
       hidpp_scroll_counter
     - fs/ntfs3: add bounds check to run_get_highest_vcn()
     - fs/ntfs3: fix mount failure on 64K page-size kernels
     - drm/amd/display: Add missing kdoc for ALLM parameters
     - [amd64] thunderbolt: debugfs: Fix margining error counter buffer leak
     - dmaengine: imx-sdma: Refine spba bus searching in probe
     - perf: Fix off-by-one stack buffer overflow in kallsyms__parse()
     - dmaengine: qcom: gpi: set DMA_PRIVATE capability
     - dmaengine: Fix possible use after free
     - dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc
     - dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor
     - clk: qcom: a53: Corrected frequency multiplier for 1152MHz
     - pNFS/filelayout: fix cheking if a layout is striped
     - xprtrdma: Avoid 250 ms delay on backlog wakeup
     - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot
     - xprtrdma: Post receive buffers after RPC completion
     - xprtrdma: Use sendctx DMA state for Send signaling
     - xprtrdma: Decouple req recycling from RPC completion
     - NFSv4/pnfs: defer return_range callbacks until after inode unlock
     - nfs: keep PG_UPTODATE clear after read errors in page groups
     - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors
     - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in
       pg_get_mirror_count_write
     - nfs: use nfsi->rwsem to protect traversal of the file lock list
     - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro
     - PCI: meson: Propagate devm_add_action_or_reset() failure
     - PCI: meson: Add missing remove callback
     - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size
     - PCI: rcar-host: Remove unused LIST_HEAD(res)
     - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE
     - xprtrdma: Initialize re_id before removal registration
     - xprtrdma: Check frwr_wp_create() during connect
     - xprtrdma: Document and assert reply-handler invariants
     - xprtrdma: Resize reply buffers before reposting receives
     - xprtrdma: Fix bcall rep leak and unbounded peek
     - xprtrdma: Sanitize the reply credit grant after parsing
     - xprtrdma: Repost Receive buffers for malformed replies
     - xprtrdma: Return sendctx slot after Send preparation failure
     - tools lib api: Fix missing null termination in filename__read_int/ull()
     - tools lib api: Fix filename__write_int() writing uninitialized stack data
     - tools lib api: Fix mount_overload() snprintf truncation and toupper range
     - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port()
     - PCI: mediatek: Use actual physical address instead of virt_to_phys()
     - Revert "PCI/MSI: Unmap MSI-X region on error"
     - security/apparmor/apparmorfs.c: conditionally compile
       get_loaddata_common_ref()
     - apparmor: check label build before no_new_privs test
     - apparmor: aa_label_alloc use aa_label_free on alloc failure
     - apparmor: fix rawdata_f_data implicit flex array
     - apparmor: grab ns lock and refresh when looking up changehat child
       profiles
     - apparmor: fix potential UAF in aa_replace_profiles
     - apparmor: remove or add symlinks to rawdata according to export_binary
     - apparmor: aa_getprocattr free procattr leak on format failure
     - apparmor: put secmark label after secid lookup
     - workqueue: Add new WQ_PERCPU flag
     - i3c: master: add WQ_PERCPU to alloc_workqueue users
     - i3c: master: Make hot-join workqueue freezable to block hot-join during
       suspend
     - i3c: master: Prevent reuse of dynamic address on device add failure
     - apparmor: fix label can not be immediately before a declaration
     - gpio: mlxbf3: fail probe if gpiochip registration fails
     - [amd64] drm/i915: clear CRTC color blob pointers after dropping refs
     - spi: dw: fix wrong BAUDR setting after resume
     - xfrm: Fix xfrm state cache insertion race
     - xfrm: annotate data-races around xfrm_policy_count[] and
       xfrm_policy_default[]
     - xfrm: validate selector family and prefixlen during match
     - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode
     - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free
     - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm
     - drm/amdgpu: initialize irq.lock spinlock earlier
     - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown
     - net: psample: fix info leak in PSAMPLE_ATTR_DATA (CVE-2026-64553)
     - sctp: hold socket lock when dumping endpoints in sctp_diag
     - PCI: iproc: Restore .map_irq() for the platform bus driver
     - spi: rpc-if: Use correct device for hardware reinitialization on resume
     - virtio-net: fix len check in receive_big() (CVE-2026-64552)
     - dpaa2-switch: fix VLAN upper check not rejecting bridge join
     - devlink: Fix parent ref leak in devl_rate_node_create()
     - flow_dissector: check device type before reading ETH_ADDRS
     - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints
     - [arm64] hw_breakpoint: reject unaligned watchpoints that would truncate
       BAS
     - thermal: intel: Fix dangling resources on thermal_throttle_online()
       failure
     - ACPI: resource: Amend kernel-doc style
     - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone()
     - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit()
     - ieee802154: fix kernel-infoleak in dgram_recvmsg()
     - mac802154: Prevent overwrite return code in
       mac802154_perform_association()
     - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry
     - netfilter: ipset: Fix data race between add and dump in all hash types
     - netfilter: ipset: annotate "pos" for concurrent readers/writers
     - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash
       types
     - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()
     - netfilter: ipset: make sure gc is properly stopped
     - netfilter: nf_reject: skip iphdr options when looking for icmp header
     - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak
     - mailbox: imx: Forward the timeout/ error in imx_mu_generic_tx()
     - irqchip/crossbar: Fix parent domain resource leak
     - net: marvell: prestera: initialize err in prestera_port_sfp_bind
     - tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
       (CVE-2026-64543)
     - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths
     - octeontx2-af: mcs: Fix unsupported secy stats read
     - octeontx2-pf: Clear stats of all resources when freeing resources
     - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown
     - net/sched: act_ct: fix nf_connlabels leak on two error paths
     - ipv6: ndisc: fix NULL deref in accept_untracked_na() (CVE-2026-64542)
     - dpaa2-switch: do not accept VLAN uppers while bridged
     - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags
     - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231
     - bpf: Fix stack slot index in nospec checks
     - bpftool: Fix vmlinux BTF leak in cgroup commands
     - bpf: zero-initialize the fib lookup flow struct
     - bpf: Fix effective prog array index with BPF_F_PREORDER
     - power: sequencing: fix ABBA deadlock in pwrseq_device_unregister()
     - drm/edid: fix OOB read in drm_parse_tiled_block() (CVE-2026-64546)
     - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0
     - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0
     - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()
     - ice: fix AQ error code comparison in ice_set_pauseparam()
     - ice: call netif_keep_dst() once when entering switchdev mode
     - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info
     - ice: dpll: fix memory leak in ice_dpll_init_info error paths
     - i40e: Fix i40e_debug() to use struct i40e_hw argument
     - rtc: msc313: fix NULL deref in shared IRQ handler at probe
     - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2
       NEGOTIATE
     - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). (CVE-2026-64538)
     - net: bnxt: use ethtool string helpers
     - eth: bnxt: gather and report HW-GRO stats
     - eth: bnxt: rename ring_err_stats -> ring_drv_stats
     - eth: bnxt: improve the timing of stats
     - ipv4: fib: Don't ignore error route in local/main tables.
     - md/raid5: use stripe state snapshot in break_stripe_batch_list()
     - md/raid5: avoid R5_Overlap races while breaking stripe batches
     - bpf: Disable xfrm_decode_session hook attachment
     - netfilter: nf_nat: avoid invalid nat_net pointer use on failed
       nf_nat_init()
     - netfilter: nf_conncount: prevent connlimit drops for early confirmed ct
       (Closes: #1130336)
     - netfilter: nft_synproxy: stop bypassing the priv->info snapshot
     - netfilter: nft_compat: ebtables emulation must reject non-bridge targets
     - gpio: davinci: fix IRQ domain leak on devm_kzalloc failure
     - NTB: epf: Make db_valid_mask cover only real doorbell bits
     - NTB: epf: Report 0-based doorbell vector via ntb_db_event()
     - NTB: epf: Fix doorbell bitmask and IRQ vector handling
     - net, bpf: check master for NULL in xdp_master_redirect() (CVE-2026-64545)
     - net: dsa: sja1105: round up PTP perout pin duration
     - veth: fix NAPI leak in XDP enable error path
     - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle
       (CVE-2026-64530)
     - ipv6: fix error handling in disable_ipv6 sysctl
     - ipv6: fix error handling in ignore_routes_with_linkdown sysctl
     - ipv6: fix error handling in forwarding sysctl
     - ipv6: fix error handling in disable_policy sysctl
     - rtnetlink: Add per-netns RTNL.
     - rtnetlink: Add assertion helpers for per-netns RTNL.
     - rtnetlink: Define rtnl_net_trylock().
     - ipv6: Add __in6_dev_get_rtnl_net().
     - ipv6: Convert net.ipv6.conf.${DEV}.XXX sysctl to per-netns RTNL.
     - ipv6: fix missing notification for ignore_routes_with_linkdown
     - thermal: testing: zone: Flush work items during cleanup
     - ACPI: processor_idle: Mark LPI enter functions as __cpuidle
     - smb/client: preserve errors from smb2_set_sparse()
     - rtc: ds1307: Fix off-by-one issue with wday for rx8130
     - rtc: cmos: unregister HPET IRQ handler on probe failure
     - net: dsa: realtek: fix memory leak in rtl8366rb_setup_led()
     - octeontx2-af: Validate NIX maximum LFs correctly
     - net: mvneta: re-enable percpu interrupt on resume
     - net: sungem: fix probe error cleanup
     - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove
     - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count
     - udp_tunnel: remove rtnl_lock dependency
     - net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync
     - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22"
       fallback
     - [arm64] net: hisilicon: hns3: use ethtool string helpers
     - [arm64] net: hns3: use string choices helper
     - [arm64] net: hns3: use hns3_get_ae_dev() helper to reduce the unnecessary
       middle layer conversion
     - [arm64] net: hns3: use hns3_get_ops() helper to reduce the unnecessary
       middle layer conversion
     - [arm64] net: hns3: clear hns alarm: comparison of integer expressions of
       different signedness
     - [arm64] net: hns3: unify copper port ksettings configuration path
     - [arm64] net: hns3: refactor MAC autoneg and speed configuration
     - [arm64] net: hns3: fix permanent link down deadlock after reset
     - [arm64] net: hns3: differentiate autoneg default values between copper and
       fiber
     - tracing: probes: fix typo in a log message
     - spi: sh-msiof: abort transfers when reset times out
     - gpio: mvebu: fail probe if gpiochip registration fails
     - gpio: htc-egpio: use managed gpiochip registration
     - seg6: validate SRH length before reading fixed fields
     - qede: fix out-of-bounds check for cqe->len_list[]
     - net: enetc: check the number of BDs needed for xdp_frame
     - sctp: fix SCTP_RESET_STREAMS stream list length limit
     - MIPS: DEC: Ensure RTC platform device deregistration upon failure
     - ASoC: codecs: lpass-va-macro: add SM6115 compatible
     - ASoC: codecs: lpass-va-macro: Fix LPASS Codec Version for SC7280
     - hwmon: adm1275: Prevent reading uninitialized stack
     - hwmon: (pmbus) Fix passing events to regulator core
     - hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against
       divide-by-zero
     - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump
     - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()
       (CVE-2026-64540)
     - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy
     - net: gianfar: dispose irq mappings on probe failure and device removal
     - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF
     - bridge: stp: Fix a potential use-after-free when deleting a bridge
     - [arm64] drm/panthor: Fix potential invalid pointer deref in
       group_process_tiler_oom()
     - [arm64] drm/panthor: Don't overrule pending immediate ticks in
       sched_resume_tick()
     - [arm64] drm/panthor: Fix a leak when a group is evicted before the tiler
       OOM is serviced
     - [arm64] drm/panthor: Interrupt group start/resumption if
       group_bind_locked() fails
     - tracing/events: Fix to check the simple_tsk_fn creation
     - tracing: eprobe: read the complete FILTER_PTR_STRING pointer
     - irqchip/gic-v3-its: Fix OF node reference leak
     - irqchip/ts4800: Fix missing chained handler cleanup on remove
     - virtio_net: disable cb when NAPI is busy-polled
     - cxgb4: Fix decode strings dump for T6 adapters
     - net/sched: act_bpf: use rcu_dereference_bh() to read the filter
     - ksmbd: reject undersized DACLs before parsing ACEs
     - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check
     - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe
     - pinctrl: meson: restore non-sleeping GPIO access
     - net/sched: hhf: clear heavy-hitter state on reset
     - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid
     - afs: Fix error code in afs_extract_vl_addrs()
     - afs: Fix double netfs initialisation in afs_root_iget()
     - afs: use kvfree() to free memory allocated by kvcalloc()
     - afs: Remove erroneous seq |= 1 in volume lookup loop
     - afs: Make /afs/.<cell> as well as /afs/<cell> mountpoints
     - afs: Add rootcell checks
     - afs: Make /afs/@cell and /afs/.@cell symlinks
     - afs: Fix afs_atcell_get_link() to handle RCU pathwalk
     - afs: Remove the "autocell" mount option
     - afs: Change dynroot to create contents on demand
     - afs: Fix misplaced inc of net->cells_outstanding
     - afs: Fix callback service message parsers to pass through -EAGAIN
     - afs: Fix missing NULL pointer check in afs_break_some_callbacks()
     - afs: Fix vllist leak
     - afs: Fix the volume AFS_VOLUME_RM_TREE is set on
     - afs: Fix unchecked-length string display in debug statement
     - minix: avoid overflow in bitmap block count calculation
     - ovl: fix comment about locking order
     - netfs: Fix writeback error handling
     - drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()
     - drm/xe/hw_engine: Fix double-free of managed BO in error path
     - drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays
     - netfs: Drop the error arg from netfs_read_subreq_terminated()
     - cifs: Fix missing credit release on failure in cifs_issue_read()
     - ata: sata_gemini: unwind clocks on IDE pinctrl errors
     - ata: libata-scsi: limit simulated SCSI command copy to response length
     - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()
     - HID: core: Fix OOB read in hid_get_report for numbered reports
     - [arm64] mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()
     - HID: bpf: Fix hid_bpf_get_data() range check
     - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
       (CVE-2026-64547)
     - gue: validate REMCSUM private option length
     - netfilter: xt_u32: reject invalid shift counts
     - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()
     - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop
     - netfilter: xt_connmark: reject invalid shift parameters
     - net/mlx5: LAG, MPESW, Fix missing complete() on devcom error
     - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation
     - net/mlx5e: Fix HV VHCA stats agent registration race
     - net: microchip: vcap: fix races on the shared Super VCAP block
     - qede: fix off-by-one in BD ring consumption on build_skb failure
     - net: qualcomm: rmnet: validate MAP frame length before ingress parsing
       (CVE-2026-64550)
     - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload
     - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
     - amt: fix size calculation in amt_get_size()
     - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control
     - Bluetooth: MGMT: Fix adv monitor add failure cleanup
     - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length
     - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
       (CVE-2026-64549)
     - ring-buffer: Fix event length with forced 8-byte alignment
     - net/tls: Consume empty data records in tls_sw_read_sock()
     - net: usb: lan78xx: move functions to avoid forward definitions
     - net: usb: lan78xx: disable VLAN filter in promiscuous mode
     - [arm64] drm/v3d: Reject invalid indirect BO handle in indirect CSD setup
     - net/sched: cake: reject overhead values that underflow length
     - octeontx2-pf: check DMAC extraction support before filtering
     - [amd64] perf/x86/amd/core: Avoid enabling BRS from the SVM reload path
     - gpio: mvebu: free generic chips on unbind
     - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
     - ipv6: mcast: Replace locking comments with lockdep annotations.
     - ipv6: mcast: Fix potential UAF in MLD delayed work
     - netfilter: nft_lookup: fix catchall element handling with inverted lookups
     - ipvs: pass parsed transport offset to state handlers
     - ipvs: use parsed transport offset in TCP state lookup
     - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors
     - ipvs: ensure inner headers in ICMP errors are in headroom
     - [s390x] zcrypt: Remove the empty file
     - cifs: validate DFS referral string offsets
     - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED
     - SUNRPC: pin upper rpc_clnt across the TLS connect_worker
     - dm era: fix NULL pointer dereference in metadata_open()
     - regulator: core: regulator_lock_two() should test for EDEADLK not
       EDEADLOCK
     - net/mlx5: Fix L3 tunnel entropy refcount leak
     - octeontx2-af: fix VF bringup affecting PF promiscuous state
     - drm/xe: remove duplicate <kunit/test-bug.h> include
     - smb: client: fix overflow in passthrough ioctl bounds check
     - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()
     - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()
     - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter
     - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put
     - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc
     - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get
     - ASoC: SOF: topology: validate vendor array size before parsing
     - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()
     - net: atm: reject out-of-range traffic classes in QoS validation
     - net: ife: require ETH_HLEN to be pullable in ife_decode()
     - [arm64] fpsimd: Fix type mismatch in sve_{save,load}_state()
     - [arm64] dts: qcom: sdm630: describe adsp_mem region properly
     - [arm64] dts: ti: k3-am62a7-sk: Add bootph-all tag to vqmmc
     - [arm64] dts: imx8ulp-evk: Correct Type-C int GPIO flags
     - [s390x] KVM: s390: pci: Fix GISC refcount leak on AIF enable failure
     - [arm64] KVM: arm64: vgic: Check the interrupt is still ours before
       migrating it
     - [s390x] KVM: s390: pci: Fix handling of AIF enable without AISB
     - [amd64] KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs
     - [amd64] KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV
       EOIs
     - [arm64] KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2
     - [arm64] KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops()
       (CVE-2026-64555)
     - fbdev: metronomefb: fix potential memory leak in metronomefb_probe()
     - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()
     - fbdev: hecubafb: fix potential memory leak in hecubafb_probe()
     - fbdev: sm712: Fix operator precedence in big_swap macro
     - fbdev: efifb: fix memory leak in efifb_probe()
     - fbdev: radeon: fix potential memory leak in radeonfb_pci_register()
     - fbdev: i740fb: fix potential memory leak in i740fb_probe()
     - fbdev: s3fb: fix potential memory leak in s3_pci_probe()
     - fbdev: uvesafb: fix potential memory leak in uvesafb_probe()
     - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()
     - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()
     - fbdev: vesafb: fix memory leak in vesafb_probe()
     - fbdev: nvidia: fix potential memory leak in nvidiafb_probe()
     - fbdev: tridentfb: fix potential memory leak in trident_pci_probe()
     - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
     - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control
     - ASoC: mediatek: mt8192: Release reserved memory on cleanup
     - ASoC: mediatek: mt8183: Release reserved memory on cleanup
     - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback
     - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
     - netfilter: nfnl_cthelper: apply per-class values when updating policies
     - netfilter: xt_cluster: reject template conntracks in hash match
     - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
     - netfilter: nft_set_pipapo: don't leak bad clone into future transaction
     - netfilter: nf_nat_sip: reload possible stale data pointer
     - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6
       defrag
     - netfilter: nf_conncount: fix zone comparison in tuple dedup
     - netfilter: ecache: fix inverted time_after() check
     - netfilter: xt_nat: reject unsupported target families
     - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
       (CVE-2026-64554)
     - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error
       path
     - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy
     - soc: fsl: qe: panic on ioremap() failure in qe_reset()
     - selinux: check connect-related permissions on TCP Fast Open
     - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
     - selinux: fix incorrect execmem checks on overlayfs
     - leds: uleds: Fix potential buffer overread
     - mfd: sm501: Fix reference leak on failed device registration
     - [amd64] tools/power/x86/intel-speed-select: Harden daemon pidfile open
     - [amd64] x86/boot: Validate console=uart8250 baud rate to fix early boot
       hang
     - [amd64] x86/boot: Reject too long acpi_rsdp= values
     - [amd64] perf/x86/amd/lbr: Fix kernel address leakage
     - cpufreq: intel_pstate: Set non-turbo capacity to HWP_GUARANTEED_PERF()
     - [s390x] perf_cpum_cf: Add missing array_index_nospec() to
       __hw_perf_event_init()
     - batman-adv: gw: acquire ethernet header only after skb realloc
     - batman-adv: access unicast_ttvn skb->data only after skb realloc
     - batman-adv: dat: acquire ARP hw source only after skb realloc
     - batman-adv: bla: reacquire gw address after skb realloc
     - batman-adv: dat: ensure accessible eth_hdr proto field
     - batman-adv: dat: fix tie-break for candidate selection
     - batman-adv: tt: avoid request storms during pending request
     - batman-adv: fix VLAN priority offset
     - batman-adv: frag: free unfragmentable packet
     - batman-adv: frag: fix primary_if leak on failed linearization
     - batman-adv: mcast: avoid OOB read of num_dests header
     - batman-adv: tt: prevent TVLV OOB check overflow
     - cifs: invalidate cfid on unlink/rename/rmdir
     - mfd: tps6586x: Fix OF node refcount
     - HID: playstation: validate num_touch_reports in DualShock 4 reports
     - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready
     - Bluetooth: SCO: hold sk properly in sco_conn_ready
     - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()
     - nvdimm/btt: Free arenas on btt_init() error paths
     - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path
     - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback
     - sunrpc: wait for in-flight TLS handshake callback when cancel loses race
     - lockd: Plug nlm_file leak when nlm_do_fopen() fails
     - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure
     - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
     - remoteproc: qcom: Fix leak when custom dump_segments addition fails
     - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing
       reference leak
     - mm/memory_hotplug: fix incorrect altmap passing in error path
     - mm/damon/core: make charge_addr_from aware of end-address exclusivity
     - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename
     - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length
     - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass
     - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off
     - fs/ntfs3: validate lcns_follow in log_replay conversion (CVE-2026-64533)
     - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow
     - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}
       (CVE-2026-64532)
     - ntfs3: cap RESTART_TABLE free-chain walker at rt->used
     - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head
     - ntfs3: validate split-point offset in indx_insert_into_buffer
     - ntfs3: fix out-of-bounds read in decompress_lznt
     - power: supply: charger-manager: fix refcount leak in is_full_charged()
     - [riscv64] cacheinfo: Fix node reference leak in populate_cache_leaves
     - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()
     - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error
     - fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole()
     - fs/proc/task_mmu: use huge_page_size() in pagemap_scan_hugetlb_entry()
     - proc: only bump parent nlink when registering directories
     - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE
     - kcov: use WRITE_ONCE() for selftest mode stores
     - mtd: slram: remove failed entries from the device list
     - 9p: skip nlink update in cacheless mode to fix WARN_ON
     - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished()
     - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint
     - ocfs2: use kzalloc for quota recovery bitmap allocation
     - mtd: rawnand: pl353: fix probe resource allocation
     - net/9p: fix infinite loop in p9_client_rpc on fatal signal
     - mtd: rawnand: fix condition in 'nand_select_target()'
     - ocfs2: avoid moving extents to occupied clusters
     - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits
     - ocfs2: add journal NULL check in ocfs2_checkpoint_inode()
     - ocfs2: reject dinodes with non-canonical i_mode type
     - ocfs2: reject dinodes whose i_rdev disagrees with the file type
     - ocfs2: reject non-inline dinodes with i_size and zero i_clusters
     - fpga: dfl: add bounds check in dfh_get_param_size()
     - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path
     - net: thunderbolt: Fix frags[] overflow by bounding frame_count
     - fpga: microchip-spi: fix zero header_size OOB read in
       mpf_ops_parse_header()
     - [s390x] pkey: Check length in PKEY_VERIFYPROTK ioctl
     - [s390x] pkey: Check length in pkey_pckmo handler implementation
     - mtd: spi-nor: swp: Improve locking user experience
     - mtd: spi-nor: spansion: use die erase for multi-die devices only
     - mtd: rawnand: Pause continuous reads at block boundaries
     - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization
     - taskstats: retain dead thread stats in TGID queries
     - irqchip/crossbar: Use correct index in crossbar_domain_free()
     - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()
     - tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt
     - dmaengine: tegra: Fix burst size calculation
     - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and
       ABORT_INT_MASK
     - [amd64] platform/x86: dell-laptop: fix missing cleanups in init error path
     - [amd64] platform/x86/amd/pmc: Check for intermediate wakeup in function
     - [amd64] platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops
     - [amd64] platform/x86/amd/pmc: Add delay_suspend module parameter
     - [amd64] platform/x86/amd/pmc: Don't log during intermediate wakeups
     - pkey: Move keytype check from pkey api to handler
     - smb: client: use kvzalloc() for megabyte buffer in simple fallocate
     - ksmbd: fix integer overflow in set_file_allocation_info()
     - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig
     - hwmon: (max6697) add missing 'select REGMAP_I2C' to Kconfig
     - i2c: mediatek: fix WRRD for SoCs without auto_restart option
     - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()
     - ice: fix ice_init_link() error return preventing probe
     - xen/gntdev: fix error handling in ioctl
     - xfrm: use compat translator only for u64 alignment mismatch
     - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for
       changelink
     - tpm: fix event_size output in tpm1_binary_bios_measurements_show
     - tpm: Make the TPM character devices non-seekable
     - time: Fix off-by-one in compat settimeofday() usec validation
     - spi: uniphier: Fix completion initialization order before
       devm_request_irq()
     - sctp: validate STALE_COOKIE cause length before reading staleness
       (CVE-2026-64551)
     - NFS: Charge unstable writes by request size, not folio size
     - nvmet-rdma: handle inline data with a nonzero offset
     - netdev-genl: report NAPI thread PID in the caller's pid namespace
     - can: esd_usb: kill anchored URBs before freeing netdevs
     - can: isotp: use unconditional synchronize_rcu() in isotp_release()
     - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
     - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
     - can: bcm: add missing rcu list annotations and operations
     - bpf,fork: wipe ->bpf_storage before bailouts that access it
     - bpf: Add missing access_ok call to copy_user_syms
     - block: fix race in blk_time_get_ns() returning 0
     - net: sparx5: unregister blocking notifier on init failure
     - dm thin metadata: fix superblock refcount leak on snapshot shadow failure
     - dm thin metadata: fix metadata snapshot consistency on commit failure
     - dm era: fix out-of-bounds memory access for non-zero start sector
     - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard
     - dm-ioctl: fix a possible overflow in list_version_get_info
     - dm-log: fix a bitset_size overflow on 32bit machines
     - dm-stats: fix dm_jiffies_to_msec64
     - dm-stats: fix merge accounting
     - dm_early_create: fix freeing used table on dm_resume failure
     - dm-integrity: fix a bug if the bio is out of limits
     - dm-integrity: don't increment hash_offset twice
     - dm-verity: avoid double increment of &use_bh_wq_enabled
     - dm-verity: fix a possible NULL pointer dereference
     - dm-verity: increase sprintf buffer size
     - dm-verity: make error counter atomic
     - [amd64] accel/ivpu: Reject firmware log with size smaller than header
     - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
     - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
     - scsi: sg: Report request-table problems when any status is set
     - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path
     - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it
     - scsi: target: Bound PR-OUT TransportID parsing to the received buffer
     - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
     - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()
     - scsi: elx: efct: Fix I/O leak on unsupported additional CDB
     - Input: ims-pcu - fix use-after-free and double-free in disconnect
     - Input: ims-pcu - only expose sysfs attributes on control interface
     - Input: ims-pcu - release data interface on disconnect
     - Input: ims-pcu - validate control endpoint type
     - Input: ims-pcu - add response length checks
     - Input: ims-pcu - fix DMA mapping violation in line setup
     - Input: ims-pcu - fix firmware leak in async update
     - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging
     - Input: ims-pcu - fix potential infinite loop in CDC union descriptor
       parsing
     - Input: ims-pcu - fix race condition in reset_device sysfs callback
     - Input: ims-pcu - fix type confusion in CDC union descriptor parsing
     - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete
     - tracing/user_events: Fix use-after-free in user_event_mm_dup()
     - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
     - cpu: hotplug: Preserve per instance callback errors
     - cpu: hotplug: Bound hotplug states sysfs output
     - gpio: tegra: do not call pinctrl for GPIO direction
     - gpio-f7188x: Add support for NCT6126D version B
     - gpios: palmas: add .get_direction() op
     - net: sit: require CAP_NET_ADMIN in the device netns for changelink
     - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure
     - net: ixp4xx_hss: fix duplicate HDLC netdev allocation
     - net/sched: act_ct: preserve tc_skb_cb across defragmentation
     - net: ena: clean up XDP TX queues when regular TX setup fails
     - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink
     - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink
     - net: ipip: require CAP_NET_ADMIN in the device netns for changelink
     - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
     - octeontx2-af: Free BPID bitmap on setup failure
     - ieee802154: admin-gate legacy LLSEC dump operations
     - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation
     - ieee802154: ca8210: fix cas_ctl leak on spi_async failure
     - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit
     - [amd64] platform/x86/amd/pmc: Avoid logging "(null)" for DMI values
     - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants
     - [s390x] Revert support for DCACHE_WORD_ACCESS (CVE-2026-64369)
     - batman-adv: retrieve ethhdr after potential skb realloc on RX
     - batman-adv: ensure minimal ethernet header on TX
     - batman-adv: clean untagged VLAN on netdev registration failure
     - espintcp: use sk_msg_free_partial to fix partial send
     - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()
     - rtc: mpfs: fix counter upload completion condition
     - hwmon: (w83627hf) remove VID sysfs files on error and remove
     - hwmon: (w83793) remove vrm sysfs file on probe failure
     - net: liquidio: fix BAR resource leak on PF number failure
     - hwmon: (occ) unregister sysfs devices outside occ lock
     - fsl/fman: Free init resources on KeyGen failure in fman_init()
     - net: lan743x: Initialize eth_syslock spinlock before use
     - net/sched: sch_multiq: Replace direct dequeue call with peek and
       qdisc_dequeue_peeked
     - net/sched: sch_taprio: Replace direct dequeue call with peek and
       qdisc_dequeue_peeked
     - fhandle: reject detached mounts in capable_wrt_mount()
     - hwmon: (max1619) add missing 'select REGMAP' to Kconfig
     - tracing/probes: Fix double addition of offset for @+FOFFSET
     - orangefs: keep the readdir entry size 64-bit in fill_from_part()
     - ata: pata_pxa: Fix DMA channel leak on probe error
     - net: wwan: iosm: bound device offsets in the MUX downlink decoder
     - hwmon: (asus_atk0110) Check package count before accessing element
     - [riscv64] probes: save original sp in rethook trampoline
     - mm/compaction: handle free_pages_prepare() properly in compaction_free()
     - irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure
     - [s390x] monwriter: Reject buffer reuse with different data length
     - mac802154: remove interfaces with RCU list deletion
     - llc: fix SAP refcount leak in llc_ui_autobind()
     - ipvs: use parsed transport offset in SCTP state lookup
     - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
     - macsec: don't read an unset MAC header in macsec_encrypt()
     - [arm64] smp: Fix hot-unplug tearing by forcing unregistration
     - ata: libata-core: Skip HPA resize for locked drives
     - drbd: reject data replies with an out-of-range payload size
     - [riscv64] Prevent NULL pointer dereference in machine_kexec_prepare()
     - tracing/osnoise: Call synchronize_rcu() when unregistering
     - [s390x] mm: Fix type mismatch in get_align_mask().
     - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
     - pmdomain: imx: Fix i.MX8MP power notifier
     - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence
     - [powerpc*] pseries: fix memory leak on krealloc failure in papr_init
     - wifi: rt2x00: avoid full teardown before work setup in probe
     - wifi: mwifiex: fix roaming to different channel in host_mlme mode
     - wifi: mac80211: fix memory leak in ieee80211_register_hw()
     - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
     - net: openvswitch: reject oversized nested action attrs (CVE-2026-64531)
     - Bluetooth: btrtl: validate firmware patch bounds
     - llc: fix SAP refcount leak when creating incoming sockets
     - macsec: fix promiscuity refcount leak in macsec_dev_open()
     - memstick: ms_block: reject a card that reports too many blocks
     - ipvs: fix more places with wrong ipv6 transport offsets
     - ipvs: reload ip header after head reallocation
     - reset: sunxi: fix memory region leak on ioremap failure
     - [powerpc*] spufs: fix out-of-bounds access in spufs_mem_mmap_access()
     - wifi: mac80211: free ack status frame on TX header build failure
     - wifi: mwifiex: fix permanently busy scans after multiple roam iterations
     - mtd: onenand: samsung: report DMA completion timeouts
     - mtd: mchp23k256: use SPI match data for chip caps
     - mmc: vub300: defer reset until cmd_mutex is unlocked
     - mtd: rawnand: fsl_ifc: return errors for failed page reads
     - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
     - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
     - mmc: block: fix RPMB device unregister ordering
     - mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method
     - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
     - ACPI: driver: Check ACPI_COMPANION() against NULL during probe
     - ACPI: bus: Introduce devm_acpi_install_notify_handler()
     - ACPI: NFIT: core: Use devm_acpi_install_notify_handler()
     - ACPI: NFIT: core: Fix possible deadlock and missing notifications
     - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values
     - iio: adc: ad7380: select REGMAP
     - iio: pressure: Remove redundant pm_runtime_mark_last_busy() calls
     - iio: pressure: mpl115: fix runtime PM leak on read error (CVE-2026-64493)
     - ALSA: aoa: check snd_ctl_new1() return value
     - ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)
     - ALSA: scarlett2: Allow selecting config_set by firmware version
     - ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417
     - vfio/mlx5: Fix racy bitfields and tighten struct layout (CVE-2026-64472)
     - PCI: altera: Fix resource leaks on probe failure (CVE-2026-64462)
     - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle()
     - PCI: mediatek: Switch to msi_create_parent_irq_domain()
     - PCI: mediatek: Convert bool to single quirks entry and bitmap
     - PCI: mediatek: Use generic MACRO for TPVPERL delay
     - PCI: mediatek: Fix IRQ domain leak when port fails to enable
       (CVE-2026-64461)
     - PCI: Use pbus_select_window() during BAR resize
     - PCI: Prevent resource tree corruption when BAR resize fails
     - PCI: Free saved list without holding pci_bus_sem
     - PCI: Fix restoring BARs on BAR resize rollback path
     - PCI: Move Resizable BAR code to rebar.c
     - PCI: Skip Resizable BAR restore on read error
     - staging: rtl8723bs: core: move constants to right side in comparison
     - staging: rtl8723bs: fix spaces around binary operators
     - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(),
       and rtw_get_wps_attr()
     - [amd64] crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
       (CVE-2026-64438)
     - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
       (CVE-2026-64434)
     - gpio: sch: use raw_spinlock_t in the irq startup path (CVE-2026-64428)
     - io_uring/rw: ensure reissue path is correctly handled for IOPOLL
     - io_uring/rw: preserve partial result for iopoll
     - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code
     - media: nxp: imx8-isi: Fix use-after-free on remove (CVE-2026-64421)
     - netfilter: ebtables: Use vmalloc_array() to improve code
     - netfilter: ebtables: zero chainstack array (CVE-2026-64413)
     - Bluetooth: L2CAP: Fix not tracking outstanding TX ident
     - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
       (CVE-2026-64206)
     - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO
     - Bluetooth: separate CIS_LINK and BIS_LINK link types
     - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
       (CVE-2026-64405)
     - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
     - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
     - mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host
       (CVE-2026-64416)
     - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg()
     - smb: client: resolve SWN tcon from live registrations (CVE-2026-64401)
     - ksmbd_vfs_rename(): vfs_path_parent_lookup() accepts ERR_PTR() as name
     - vfs: make LAST_XXX private to fs/namei.c
     - ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
     - ksmbd: use opener credentials for FSCTL mutations
     - ksmbd: centralize ksmbd_conn final release to plug transport leak
     - ksmbd: track the connection owning a byte-range lock (CVE-2026-64390)
     - proc: rename proc_setattr to proc_nochmod_setattr
     - proc: protect ptrace_may_access() with exec_update_lock (FD links)
     - [amd64] perf/x86/intel/uncore: Defer ADL global PMON enable to
       enable_box()
     - HID: add haptics page defines
     - HID: multitouch: fix out-of-bounds bit access on mt_io_flags
       (CVE-2026-64364)
     - seqlock: Introduce scoped_seqlock_read()
     - seqlock: Change do_task_stat() to use scoped_seqlock_read()
     - proc: protect ptrace_may_access() with exec_update_lock (part 1)
     - treewide: Switch/rename to timer_delete[_sync]()
     - HID: appleir: fix UAF on pending key_up_timer in remove() (CVE-2026-64363)
     - HID: pidff: Fix missing blank lines after declarations
     - HID: pidff: Add missing spaces
     - HID: pidff: Rework pidff_upload_effect
     - HID: pidff: Use correct effect type in effect update
     - hfs/hfsplus: prevent getting negative values of offset/length
     - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
       (CVE-2026-64361)
     - bpf: Convert lpm_trie.c to rqspinlock
     - bpf, arm64, powerpc: Add bpf_jit_bypass_spec_v1/v4()
     - bpf: Consistently use bpf_rcu_lock_held() everywhere
     - bpf: Allow LPM map access from sleepable BPF programs (CVE-2026-64352)
     - usb: iowarrior: remove inherent race with minor number
     - USB: iowarrior: fix use-after-free on disconnect race (CVE-2026-64341)
     - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
     - crypto: atmel - Drop explicit initialization of struct
       i2c_device_id::driver_data to 0
     - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
     - usb: gadget: f_fs: initialize reset_work at allocation time
     - crypto: atmel-sha204a - fail on hwrng registration error in probe path
     - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
     - btrfs: concentrate the error handling of submit_one_sector()
     - btrfs: replace for_each_set_bit() with for_each_set_bitmap()
     - btrfs: remove folio parameter from ordered io related functions
     - btrfs: remove the COW fixup mechanism
     - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC
     - [amd64] crypto: ccp - Move dev_info/err messages for SEV/SNP init and
       shutdown
     - [amd64] crypto: ccp - Reset TMR size at SNP Shutdown
     - [amd64] crypto: ccp - Register SNP panic notifier only if SNP is enabled
     - [amd64] crypto: ccp - Move SEV/SNP Platform initialization to KVM
     - [amd64] crypto: ccp - Fix a case where SNP_SHUTDOWN is missed
     - [amd64] crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)
     - [amd64] crypto: qat - fix restarting state leak on allocation failure
     - exfat: remove unnecessary read entry in __exfat_rename()
     - exfat: rename argument name for exfat_move_file and exfat_rename_file
     - exfat: add exfat_get_dentry_set_by_ei() helper
     - exfat: move exfat_chain_set() out of __exfat_resolve_path()
     - exfat: fix incorrect directory checksum after rename to shorter name
     - exfat: preserve benign secondary entries during rename and move
     - btrfs: fix false IO failure after falling back to buffered write
     - btrfs: fix incorrect buffered IO fallback for append direct writes
     - slab: Introduce kmalloc_obj() and family
     - slab: Introduce kmalloc_flex() and family
     - add default_gfp() helper macro and use it in the new *alloc_obj() helpers
     - default_gfp(): avoid using the "newfangled" __VA_OPT__ trick
     - slab: recognize @GFP parameter as optional in kernel-doc
     - fscrypt: Fix key setup in edge case with multiple data unit sizes
     - fscrypt: Replace mk_users keyring with simple list
     - mm/damon/core: always put unsuccessfully committed target pids
     - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
     - [arm64] KVM: arm64: Ensure level is always initialized when relaxing perms
     - [arm64] KVM: arm64: Fix propagation of TLBI level in
       kvm_pgtable_stage2_relax_perms()
     - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is
       uninitialized (CVE-2026-64192)
     - [amd64] perf/x86/amd/brs: Fix kernel address leakage
     - dibs: loopback: validate offset and size in move_data()
     - seqlock: fix scoped_seqlock_read kernel-doc
     - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
     - rtnetlink: Make per-netns RTNL dereference helpers to macro.
     - net: airoha: Fix channel configuration for ETS Qdisc
     - jiffies: Cast to unsigned long in secs_to_jiffies() conversion
     - afs: Fix afs_atcell_get_link() to check if ws_cell is unset first
     - afs: Fix afs_dynroot_readdir() to not use the RCU read lock
     - [amd64] crypto: ccp - Fix __sev_snp_shutdown_locked
     - [amd64] crypto: ccp - Fix dereferencing uninitialized error pointer
     - [amd64] crypto: ccp - Fix SNP panic notifier unregistration
     - udp_tunnel: fix deadlock in udp_tunnel_nic_set_port_priv()
     - Bluetooth: hci_core: Remove check of BDADDR_ANY in
       hci_conn_hash_lookup_big_state
     - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle
     - [amd64] crypto: ccp - Always pass in an error pointer to
       __sev_platform_shutdown_locked()
     - i40e: drop udp_tunnel_get_rx_info() call from i40e_open()
     - ice: drop udp_tunnel_get_rx_info() call from ndo_open()
     - [amd64] crypto: ccp - Fix leaking the same page twice
     - Bluetooth: L2CAP: Fix regressions caused by reusing ident
     - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
     - Bluetooth: L2CAP: fix tx ident leak for commands without a response
     - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
     - tools/testing: add linux/args.h header and fix radix, VMA tests
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.98
     - ext4: fix fd leak in EXT4_IOC_MOVE_EXT cross-sb validation
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.99
     - mm: refactor mm_access() to not return NULL
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.100
     - posix-cpu-timers: Prevent UAF caused by non-leader exec() race
       (CVE-2026-64560)
linux-signed-amd64 (6.12.96+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.96-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.96
     - [arm64] bpf, arm64: Reject out-of-range B.cond targets
     - nfsd: fix file change detection in CB_GETATTR
     - nfsd: release layout stid on setlease failure
     - userfaultfd: gate must_wait writability check on pte_present()
     - perf: Fix dangling cgroup pointer in cpuctx backport
     - bcachefs: avoid truncating fiemap extent length
     - drm/amd: Fix set but not used warnings
     - gpio: rockchip: change the GPIO version judgment logic
     - gpio: rockchip: teardown bugs and resource leaks
     - gpio: rockchip: fix generic IRQ chip leak on remove (CVE-2026-53226)
     - mm/vmalloc: take vmap_purge_lock in shrinker (CVE-2026-46093)
     - device property: initialize the remaining fields of fwnode_handle in
       fwnode_init()
     - f2fs: validate orphan inode entry count
     - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode
     - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
     - f2fs: fix potential deadlock in f2fs_balance_fs()
     - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
     - f2fs: fix listxattr handling of corrupted xattr entries
     - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
     - nfsd: add nfsd_file_{get,put} to 'nfs_to' nfsd_localio_operations
     - nfs_common: rename functions that invalidate LOCALIO nfs_clients
     - NFSv4/flexfiles: Remove cred local variable dependency
     - NFSv4/flexfiles: Add data structure support for striped layouts
     - NFSv4/flexfiles: reject zero filehandle version count
     - locking/rtmutex: Make sure we wake anything on the wake_q when we release
       the lock->wait_lock
     - apparmor: advertise the tcp fast open fix is applied
     - nfsd: move name lookup out of nfsd4_list_rec_dir()
     - nfsd: change nfs4_client_to_reclaim() to allocate data
     - bonding: fix xfrm offload feature setup on active-backup mode
     - block: add a store_limit operations for sysfs entries
     - block: fix queue freeze vs limits lock order in sysfs store methods
       (CVE-2025-21807)
     - mm/khugepaged: write all dirty file folios when collapsing
     - perf trace beauty fcntl: Fix build with older kernel headers
     - ACPI: CPPC: Suppress UBSAN warning caused by field misuse
     - ACPI: NFIT: core: Fix possible NULL pointer dereference
     - [amd64] platform/x86: intel-hid: Protect ACPI notify handler against
       recursion
     - perf/core: Detach event groups during remove_on_exec
     - [amd64] drm/i915: ensure segment offset never exceeds allowed max
     - usb: gadget: function: rndis: add length check to response query
     - usb: gadget: function: rndis: add length check for header
     - iio: accel: bmc150: clamp the device-reported FIFO frame count
     - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
     - iio: adc: lpc32xx: Initialize completion before requesting IRQ
     - iio: adc: spear: Initialize completion before requesting IRQ
     - iio: adc: ti-ads1119: fix PM reference leak in buffer preenable
     - iio: adc: ti-ads124s08: Return reset GPIO lookup errors
     - iio: backend: fix uninitialized data in debugfs
     - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
     - iio: common: st_sensors: honour channel endianness in read_axis_data
     - iio: event: Fix event FIFO reset race
     - iio: gyro: bmg160: bail out when bandwidth/filter is not in table
     - iio: gyro: bmg160: wait full startup time after mode change at probe
     - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
     - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
     - iio: imu: inv_icm42600: fix timestamp clock period by using lower value
     - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
     - iio: imu: st_lsm6dsx: deselect shub page before reading whoami
     - iio: light: al3010: fix incorrect scale for the highest gain range
     - iio: light: gp2ap002: fix runtime PM leak on read error
     - iio: light: opt3001: fix missing state reset on timeout
     - iio: light: tsl2591: return actual error from probe IRQ failure
     - iio: light: veml6030: fix channel type when pushing events
     - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
     - iio: resolver: ad2s1210: notify trigger and clear state on fault read
       error
     - iio: temperature: Build mlx90635 with CONFIG_MLX90635
     - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check
     - iio: temperature: ltc2983: Fix reinit_completion() called after conversion
       start
     - ALSA: virtio: Add missing 384 kHz PCM rate mapping
     - ALSA: virtio: Validate control metadata from the device
     - ALSA: ymfpci: check snd_ctl_new1() return value
     - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
     - ALSA: cmipci: check snd_ctl_new1() return value
     - ALSA: es1938: check snd_ctl_new1() return value
     - ALSA: firewire: isight: bound the sample count to the packet payload
     - ALSA: gus: check snd_ctl_new1() return value
     - ALSA: ice1712: check snd_ctl_new1() return value
     - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
     - ALSA: usb-audio: avoid kobject path lookup in DualSense match
     - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
     - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch
       put callbacks
     - ALSA: usb-audio: Roll back quirk control caches on write errors
     - ALSA: usb-audio: Update Babyface Pro control caches only after successful
       writes
     - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful
       writes
     - vfio/pci: Use a private flag to prevent power state change with VFs
     - vfio/pci: Latch disable_idle_d3 per device
     - vfio/pci: Release the VGA arbiter client on register_device() failure
     - vfio/pci: Fix racy bitfields and tighten struct layout
     - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
     - vfio: Remove device debugfs before releasing devres
     - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB
     - Bluetooth: btusb: fix use-after-free on registration failure
     - Bluetooth: btusb: fix use-after-free on marvell probe failure
     - Bluetooth: btusb: fix wakeup source leak on probe failure
     - [arm*] binder: fix UAF in binder_thread_release()
     - [arm*] binder: fix UAF in binder_free_transaction()
     - usb: xhci: Fix sleep in atomic context in xhci_free_streams()
     - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
     - PCI: host-common: Request bus reassignment when not probe-only
     - [arm*] PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
     - mm/damon/ops-common: handle extreme intervals in damon_hot_score()
     - netfilter: ipset: fix race between dump and ip_set_list resize
     - virtio_pci: fix vq info pointer lookup via wrong index
     - virtio-mmio: fix device release warning on module unload
     - hwrng: virtio: clamp device-reported used.len at copy_data()
     - USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
     - usb: dwc3: run gadget disconnect from sleepable suspend context
     - 6lowpan: fix NHC entry use-after-free on error path
     - tipc: fix out-of-bounds read in broadcast Gap ACK blocks
     - staging: vme_user: bound slave read/write to the kern_buf size
     - smb: client: restrict implied bcc[0] exemption to responses without data
       area
     - staging: vme_user: fix location monitor leak in fake bridge
     - staging: vme_user: fix location monitor leak in tsi148 bridge
     - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
     - staging: media: atomisp: reduce load_primary_binaries() stack usage
     - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
     - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
     - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
     - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
     - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and
       join_cmd_hdl()
     - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
     - staging: rtl8723bs: fix OOB write in HT_caps_handler()
     - crypto: amlogic - avoid double cleanup in meson_crypto_probe()
     - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then
       SMB2_CANCEL
     - net: af_key: initialize alg_key_len for IPComp states
     - audit: Fix data races of skb_queue_len() readers on audit_queue
     - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
     - coresight: etb10: restore atomic_t for shared reading state
     - debugobjects: Plug race against a concurrent OOM disable
     - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns
     - NTB: epf: Avoid calling pci_irq_vector() from hardirq context
     - gpio: eic-sprd: use raw_spinlock_t in the irq startup path
     - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
     - netpoll: fix a use-after-free on shutdown path
     - ipv4: igmp: remove multicast group from hash table on device destruction
     - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
     - mfd: cros_ec: Delay dev_set_drvdata() until probe success
     - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
     - mm: shrinker: fix shrinker_info teardown race with expansion
     - mm: shrinker: fix NULL pointer dereference in debugfs
     - mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent
       softlockup
     - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump
     - netfilter: handle unreadable frags
     - netfilter: ebtables: module names must be null-terminated
     - netfilter: ebtables: terminate table name before find_table_lock()
     - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
     - Bluetooth: bnep: pin L2CAP connection during netdev registration
     - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in
       nxp_recv_fw_req_v3()
     - Bluetooth: fix UAF in bt_accept_dequeue()
     - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
     - Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
     - Bluetooth: L2CAP: validate option length before reading conf opt value
     - fs/ntfs3: rename ni_readpage_cmpr into ni_read_folio_cmpr
     - fs/ntfs3: fsync files by syncing parent inodes
     - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio()
     - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
       (CVE-2026-53027)
     - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()
     - smb/client: Fix error code in smb2_aead_req_alloc()
     - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
     - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA
     - ksmbd: serialize QUERY_DIRECTORY requests per file
     - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation
     - ksmbd: require source read access for duplicate extents
     - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY
     - ksmbd: run set info with opener credentials
     - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION
     - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION
     - ksmbd: use opener credentials for delete-on-close
     - ksmbd: use opener credentials for ADS I/O
     - smb: client: fix query directory replay double-free
     - smb: client: fix query_info() replay double-free
     - smb: client: fix double-free in SMB2_ioctl() replay
     - smb: client: fix change notify replay double-free
     - smb: client: fix double-free in SMB2_flush() replay
     - smb: client: fix double-free in SMB2_open() replay
     - smb: client: fix double-free in SMB2_close() replay
     - smb: client: Fix next buffer leak in receive_encrypted_standard()
     - smb: client: use unaligned reads in parse_posix_ctxt()
     - smb: client: harden POSIX SID length parsing
     - smb: client: fix atime clamp check in read completion
     - smb: client: mask server-provided mode to 07777 in modefromsid
     - writeback: fix race between cgroup_writeback_umount() and
       inode_switch_wbs()
     - cpufreq: qcom-cpufreq-hw: Fix possible double free
     - firmware_loader: fix device reference leak in firmware_upload_register()
     - [amd64] cpufreq: intel_pstate: Sync policy->cur during CPU offline
     - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
     - cpufreq: Fix hotplug-suspend race during reboot
     - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
     - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
     - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog
       instances
     - X.509: Fix validation of ASN.1 certificate header
     - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
     - tools/mm/slabinfo: Fix trace disable logic inversion
     - tools/mm/slabinfo: fix total_objects attribute name
     - HID: hid-goodix-spi: validate report size to prevent stack buffer overflow
     - HID: wacom: stop hardware after post-start probe failures
     - HID: letsketch: fix UAF on inrange_timer at driver unbind
     - HID: lg-g15: cancel pending work on remove to fix a use-after-free
     - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte
       reads
     - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
     - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
     - media: mtk-jpeg: cancel workqueue on release for supported platforms only
     - serial: 8250_mid: Disable DMA for selected platforms
     - xfs: use null daddr for unset first bad log block
     - xfs: release dquot buffer after dqflush failure
     - xfs: fix unreachable BIGTIME check in dquot flush validation
     - xfs: fix pointer arithmetic error on 32-bit systems
     - xfs: fix exchmaps reservation limit check
     - bpf: Reject fragmented frames in devmap
     - bpf: Restore sysctl new-value from 1 to 0
     - bpf: Validate BTF repeated field counts before expansion
     - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
     - usb: cdc_acm: Add quirk for Uniden BC125AT scanner
     - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
     - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub
     - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()
     - usb: free iso schedules on failed submit
     - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
     - usb: gadget: udc: Fix use-after-free in gadget_match_driver
     - usb: gadget: f_printer: take kref only for successful open
     - USB: idmouse: fix use-after-free on disconnect race
     - USB: ldusb: fix use-after-free on disconnect race
     - USB: iowarrior: fix use-after-free on disconnect
     - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD
     - USB: legousbtower: fix use-after-free on disconnect race
     - usb: sl811-hcd: disable controller wakeup on remove
     - USB: storage: include US_FL_NO_SAME in quirks mask
     - USB: misc: uss720: unregister parport on probe failure
     - usb: mtu3: unmap request DMA on queue failure
     - USB: serial: keyspan_pda: fix information leak
     - USB: serial: option: add Telit Cinterion FE990D50 compositions
     - USB: serial: digi_acceleport: fix broken rx after throttle
     - USB: serial: digi_acceleport: fix hard lockup on disconnect
     - USB: serial: digi_acceleport: fix write buffer corruption
     - USB: ulpi: fix memory leak on registration failure
     - USB: usb-storage: ene_ub6250: restore media-ready check
     - usbip: tools: support SuperSpeedPlus devices
     - usbip: vudc: fix NULL deref in vep_dequeue()
     - usb: typec: anx7411: use devm_pm_runtime_enable()
     - usb: typec: class: drop PD lookup reference
     - usb: typec: tcpm: Fix VDM type for Enter Mode commands
     - usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
     - usb: typec: ucsi: Invert DisplayPort role assignment
     - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt
       mode
     - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
     - usb: typec: ucsi: cancel pending work on system suspend
     - usb: gadget: f_fs: Fix DMA fence leak
     - block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
     - [amd64] x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU
       when SNC enabled
     - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining
     - udf: validate free block extents against the partition length
     - udf: validate VAT header length against the VAT inode size
     - udf: validate sparing table length as an entry count, not a byte count
     - hwrng: jh7110 - fix refcount leak in starfive_trng_read()
     - nvme: target: rdma: fix ndev refcount leak on queue connect
     - dm-ioctl: report an error if a device has no table
     - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace
       disks
     - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
     - nvmet-auth: validate reply message payload bounds against transfer length
     - btrfs: do not trim a device which is not writeable
     - partitions: aix: bound the pp_count scan to the ppe array
     - isofs: bound Rock Ridge symlink components to the SL record
     - crypto: af_alg - Remove zero-copy support from skcipher and aead
     - [arm64] crypto: caam - use print_hex_dump_devel to guard key hex dumps
     - [arm64] crypto: caam - use print_hex_dump_devel to guard key hex dumps
       again
     - crypto: ecc - Fix carry overflow in vli multiplication
     - crypto: pcrypt - restore callback for non-parallel fallback
     - [amd64] crypto: ccp - Do not initialize SNP for SEV ioctls
     - [amd64] crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)
     - [amd64] crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)
     - crypto: drbg - Fix returning success on failure in CTR_DRBG
     - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
     - crypto: drbg - Fix the fips_enabled priority boost
     - [amd64] crypto: qat - keep VFs enabled during reset
     - [amd64] crypto: qat - notify fatal error before AER reset preparation
     - [amd64] crypto: qat - protect service table iterations with service_lock
     - [amd64] crypto: qat - validate RSA CRT component lengths
     - [arm64] fpsimd: Fix type mismatch in sme_{save,load}_state()
     - spi: fsl-lpspi: replace dmaengine_terminate_all() with
       dmaengine_terminate_sync()
     - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
     - EDAC/i10nm: Don't fail probing if ADXL is missing
     - watchdog: apple: Add "apple,t8103-wdt" compatible
     - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
     - i2c: core: fix hang on adapter registration failure
     - tracing: Prevent out-of-bounds read in glob matching
     - audit: fix potential integer overflow in audit_log_n_hex()
     - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
     - module: decompress: check return value of module_extend_max_pages()
     - exfat: bound uniname advance in exfat_find_dir_entry()
     - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()
     - riscv: mm: Unconditionally sfence.vma for spurious fault
     - mm: fix mmap errno value when MAP_DROPPABLE is not supported
     - mm: do file ownership checks with the proper mount idmap
     - [amd64] iommu/amd: Don't split flush for amd_iommu_domain_flush_all()
     - iommufd: Set upper bounds on cache invalidation entry_num and entry_len
     - [amd64] KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected
       #DBs
     - [amd64] KVM: x86: Ensure vendor's exit handler runs before fastpath
       userspace exits
     - [amd64] KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in
       guest mode
     - udmabuf: fix DMA direction mismatch in release_udmabuf()
     - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
     - i2c: core: fix irq domain leak on adapter registration failure
     - i2c: core: fix NULL-deref on adapter registration failure
     - i2c: core: fix adapter probe deferral loop
     - i2c: core: fix adapter debugfs creation
     - i2c: core: fix adapter deregistration race
     - i2c: mpc: Fix timeout calculations
     - i2c: stm32f7: truncate clock period instead of rounding it
     - Input: synaptics-rmi4 - unregister function handlers on physical driver
       registration failure
     - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
     - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
     - Input: elan_i2c - prevent division by zero and arithmetic underflow
     - Input: goodix - clamp the device-reported contact count
     - Input: iforce - bound the device-reported force-feedback effect index
     - Input: mms114 - fix touch indexing for MMS134S and MMS136
     - Input: touchwin - reset the packet index on every complete packet
     - Input: mms114 - reject an oversized device packet size
     - Input: maplemouse - fix NULL pointer dereference in open()
     - Input: mms114 - fix multi-touch slot corruption
     - Input: maple_keyb - set driver data before registering input device
     - Input: maplemouse - set driver data before registering input device
     - Input: maplecontrol - set driver data before registering input device
     - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
     - RDMA/siw: bound Read Response placement to the RREAD length
     - fuse: fix device node leak in cuse_process_init_reply()
     - fuse: re-lock request before returning from fuse_ref_folio()
     - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req
     - usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction
       checks
     - smb: client: reject overlapping data areas in SMB2 responses
     - xfs: fix null pointer dereference in tracepoint
     - xfs: fail recovery on a committed log item with no regions
     - xfs: resample the data fork mapping after cycling ILOCK
     - xfs: don't wrap around quota ids in dqiterate
     - xfs: set xfarray killable sort correctly
     - xfs: clamp timestamp nanoseconds correctly
     - xfs: fully check the parent handle when it points to the rootdir
     - xfs: don't zap bmbt forks if they are MAXLEVELS tall
 .
   [ Han Gao ]
   * [riscv64] set NR_CPUS to 128 (Closes: #1140651)
 .
   [ Salvatore Bonaccorso ]
   * [rt] Refresh "locking/rt: Annotate unlock followed by lock for sparse."
     (context changes)
linux-signed-amd64 (6.12.95+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.95-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.95
     - wifi: mt76: mt7921: avoid undesired changes of the preset regulatory
       domain
     - wifi: mt76: mt7921: fix a potential scan no APs
     - wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync
       (CVE-2026-53101)
     - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (CVE-2026-53167)
     - gpiolib: Extract gpiochip_choose_fwnode() for wider use
     - gpiolib: Remove redundant assignment of return variable
     - gpio: Fix resource leaks on errors in gpiochip_add_data_with_key()
       (CVE-2026-31732)
     - io_uring/net: Avoid msghdr on op_connect/op_bind async data
     - drm/xe/display: fix oops in suspend/shutdown without display
       (CVE-2026-53142)
     - [arm64] drm/v3d: Store the active job inside the queue's state
     - [arm64] drm/v3d: Skip CSD when it has zeroed workgroups (CVE-2026-53139)
     - eventpoll: use hlist_is_singular_node() in __ep_remove()
     - eventpoll: split __ep_remove()
     - eventpoll: kill __ep_remove()
     - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()
     - eventpoll: rename ep_remove_safe() back to ep_remove()
     - eventpoll: move epi_fget() up
     - eventpoll: fix ep_remove struct eventpoll / struct file UAF
       (CVE-2026-46242)
     - iio: light: bh1780: fix PM runtime leak on error path (CVE-2026-43355)
     - net: Drop the lock in skb_may_tx_timestamp() (CVE-2026-43216)
     - Reapply "selftest/ptp: update ptp selftest to exercise the gettimex
       options"
     - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING
     - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP
     - debugobjects: Do not fill_pool() if pi_blocked_on
     - debugobjects: Dont call fill_pool() in early boot hardirq context
     - RDMA/bnxt_re: zero shared page before exposing to userspace
     - i2c: stub: Reject I2C block transfers with invalid length
     - [amd64] agp/amd64: Fix broken error propagation in agp_amd64_probe()
       (CVE-2026-53325)
     - bpf: Reject sleepable kprobe_multi programs at attach time
       (CVE-2026-43010)
     - ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn()
     - regulator: core: fix locking in regulator_resolve_supply() error path
     - dlm: prevent NPD when writing a positive value to event_done
       (CVE-2025-23131)
     - xfs: remove the expr argument to XFS_TEST_ERROR
     - xfs: fix error returns in CoW fork repair
     - Revert "net: bonding: fix use-after-free in bond_xmit_broadcast()"
     - net: bonding: add broadcast_neighbor option for 802.3ad
     - bonding: add support for per-port LACP actor priority
     - bonding: print churn state via netlink
     - bonding: 3ad: implement proper RCU rules for port->aggregator
       (CVE-2026-52975)
     - net: bonding: fix use-after-free in bond_xmit_broadcast() (CVE-2026-31419)
     - bonding: fix NULL pointer dereference in actor_port_prio setting
     - staging: rtl8723bs: fix buffer over-read in rtw_update_protection
       (CVE-2026-53179)
     - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
       (CVE-2026-53341)
     - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs
     - hv: utils: handle and propagate errors in kvp_register
     - locking/mutex: Remove wakeups from under mutex::wait_lock
     - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
     - phonet: Pass ifindex to fill_addr().
     - phonet: Pass net and ifindex to phonet_address_notify().
     - net: phonet: free phonet_device after RCU grace period (CVE-2026-53157)
     - rxrpc: Fix the ACK parser to extract the SACK table for parsing
       (CVE-2026-53151)
     - fuse: re-lock request before replacing page cache folio
     - ftrace: Update the mcount_loc check of skipped entries
     - ftrace: Have ftrace pages output reflect freed pages
     - ftrace: Do not over-allocate ftrace memory
     - ftrace: Test mcount_loc addr before calling ftrace_call_addr()
     - ftrace: Check against is_kernel_text() instead of kaslr_offset()
     - net: ipv6: Make udp_tunnel6_xmit_skb() void
     - sctp: disable BH before calling udp_tunnel_xmit_skb() (CVE-2026-53070)
     - iio: light: veml6075: add bounds check to veml6075_it_ms index
     - iio: adc: ti-ads1298: add bounds check to pga_settings index
     - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent
       vcs_write
     - [arm64] serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
     - ksmbd: reject non-VALID session in compound request branch
     - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
     - virtiofs: fix UAF on submount umount
     - [amd64] KVM: x86: Fix shadow paging use-after-free due to unexpected role
       (CVE-2026-53359)
     - [amd64] KVM: x86/mmu: Ensure hugepage is in by slot before checking max
       mapping level
     - Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command
       Completion support"
     - [amd64] KVM: SEV: Ignore MMIO requests of length '0'
     - [amd64] KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+
     - [amd64] KVM: SEV: Ignore Port I/O requests of length '0'
     - batman-adv: tp_meter: keep unacked list in ascending ordered
     - batman-adv: tp_meter: initialize dup_acks explicitly
     - batman-adv: tp_meter: initialize dec_cwnd explicitly
     - batman-adv: tp_meter: avoid window underflow
     - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
     - batman-adv: tp_meter: fix fast recovery precondition
     - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection
     - batman-adv: tp_meter: add only finished tp_vars to lists
     - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE
     - batman-adv: prevent ELP transmission interval underflow
     - batman-adv: tp_meter: initialize last_recv_time during init
     - batman-adv: ensure bcast is writable before modifying TTL
     - batman-adv: fix (m|b)cast csum after decrementing TTL
     - batman-adv: frag: ensure fragment is writable before modifying TTL
     - batman-adv: frag: avoid underflow of TTL
     - batman-adv: v: prevent OGM aggregation on disabled hardif
     - batman-adv: tp_meter: restrict number of unacked list entries
     - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE
     - batman-adv: tp_meter: prevent parallel modifications of last_recv
     - batman-adv: tp_meter: handle overlapping packets
     - batman-adv: tt: don't merge change entries with different VIDs
     - batman-adv: tt: track roam count per VID
     - batman-adv: dat: prevent false sharing between VLANs
     - batman-adv: tvlv: enforce 2-byte alignment
     - batman-adv: tvlv: avoid race of cifsnotfound handler state
     - ipv6: account for fraggap on the paged allocation path (CVE-2026-53362)
     - fs: constify file ptr in backing_file accessor helpers
     - lsm: add backing_file LSM hooks
     - selinux: fix overlayfs mmap() and mprotect() access checks
     - inet: add indirect call wrapper for getfrag() calls
     - ipv4: account for fraggap on the paged allocation path
     - ntfs3: reject direct userspace writes to reserved $LX* xattrs
     - [amd64] KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb()
     - [amd64] KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free
     - af_unix: Set gc_in_progress to true in unix_gc(). (CVE-2026-53361)
     - mtd: spi-nor: macronix: Add post_sfdp fixups for Quad Input Page Program
     - mtd: spi-nor: macronix: add support for mx66{l2, u1}g45g
     - mac802154: llsec: add skb_cow_data() before in-place crypto
     - net: skmsg: preserve sg.copy across SG transforms
     - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
     - apparmor: mediate the implicit connect of TCP fast open sendmsg
     - apparmor: fix use-after-free in rawdata dedup loop
     - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share
       BAR
     - fbdev: fix use-after-free in store_modes()
     - kernel/fork: clear PF_BLOCK_TS in copy_process()
     - block: invalidate cached plug timestamp after task switch
     - err.h: use __always_inline on all error pointer helpers
     - KEYS: fix overflow in keyctl_pkey_params_get_2()
     - keys: Pin request_key_auth payload in instantiate paths
     - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S
     - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer
     - wifi: ath11k: fix warning when unbinding
     - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor
     - wifi: rtw88: increase TX report timeout to fix race condition
     - wifi: rtw88: usb: fix memory leaks on USB write failures
     - wifi: iwlwifi: mvm: fix race condition in PTP removal
     - f2fs: validate compress cache inode only when enabled
     - f2fs: fix to round down start offset of fallocate for pin file
     - f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
     - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
     - f2fs: keep atomic write retry from zeroing original data
     - block: Avoid mounting the bdev pseudo-filesystem in userspace
     - bpf: use kvfree() for replaced sysctl write buffer
     - exfat: fix potential use-after-free in exfat_find_dir_entry()
     - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with
       get_unaligned()
     - gfs2: fix use-after-free in gfs2_qd_dealloc
     - [arm64] pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
     - hdlc_ppp: sync per-proto timers before freeing hdlc state
     - blk-cgroup: fix UAF in __blkcg_rstat_flush()
     - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
     - pNFS: Fix use-after-free in pnfs_update_layout()
     - fpga: region: fix use-after-free in child_regions_with_firmware()
     - rpmsg: char: Fix use-after-free on probe error path
     - ocfs2: reject oversized group bitmap descriptors
     - 9p: avoid putting oldfid in p9_client_walk() error path
     - [amd64] KVM: x86: hyper-v: Bound the bank index when querying sparse banks
     - [amd64] KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
     - power: reset: linkstation-poweroff: fix use-after-free in the
       linkstation_poweroff_init()
     - [riscv64] mm: Extract helper mark_new_valid_map()
     - [riscv64] kfence: Call mark_new_valid_map() for kfence_unprotect()
     - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in
       fb_videomode_to_var
     - fbdev: modedb: fix a possible UAF in fb_find_mode()
     - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
     - i2c: core: fix adapter registration race
     - NFSD: Fix SECINFO_NO_NAME decode error cleanup
     - nfsd: fix posix_acl leak on SETACL decode failure
     - nfsd: check get_user() return when reading princhashlen
     - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
     - nfsd: reset write verifier on deferred writeback errors
     - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
     - NFS: Prevent resource leak in nfs_alloc_server()
     - ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
     - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
     - drivers/base/memory: set mem->altmap after successful device registration
     - Documentation: ioctl-number: Fix linuxppc-dev mailto link
     - Documentation: ioctl-number: Extend "Include File" column width
     - [amd64] crypto: qat - Replace kzalloc() + copy_from_user() with
       memdup_user()
     - [amd64] crypto: qat - Return pointer directly in adf_ctl_alloc_resources
     - [amd64] crypto: qat - remove unused character device and IOCTLs
     - net/tcp-ao: fix use-after-free of key in del_async path
     - locking: rtmutex: Fix wake_q logic in task_blocks_on_rt_mutex
     - net: bonding: update the slave array for broadcast mode
     - bonding: annotate data-races arcound churn variables
     - bonding: do not set usable_slaves for broadcast mode
 .
   [ Salvatore Bonaccorso ]
   * net/netfilter: Enable NETFILTER_NETLINK_HOOK as module (Closes: #1139686)
   * [rt] Refresh "locking/rt: Annotate unlock followed by lock for sparse."
 .
   [ Uwe Kleine-König ]
   * [amd64] Enable CONFIG_PINCTRL_CS42L43 and CONFIG_SPI_CS42L43 explicitly
     (Closes: #1136179)
linux-signed-amd64 (6.12.95+1~bpo12+1) bookworm-backports; urgency=medium
 .
   * Sign kernel from linux 6.12.95-1~bpo12+1
 .
   * Rebuild for bookworm-backports

linux-signed-arm64 (6.12.107+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.107-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.106
     - PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
     - Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
     - ALSA: scarlett2: Use a private URB for the notification endpoint
     - rndis_host: add overflow check in rndis_rx_fixup()
     - gpio: ml-ioh: use raw_spinlock_t for the register lock (CVE-2026-80562)
     - gve: fix zero-length skb frag with header-split
     - hwmon: (ltc4286) Fix symbol namespace of MODULE_IMPORT_NS()
     - netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
       (CVE-2026-64216)
     - inet: frags: add inet_frag_putn() helper
     - ipv4: frags: remove ipq_put()
     - inet: frags: change inet_frag_kill() to defer refcount updates
     - inet: frags: save a pair of atomic operations in reassembly
     - inet: frags: publish queues before arming timer (CVE-2026-74662)
     - serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
       (CVE-2026-74653)
     - NTB: ntb_netdev: Preserve RX queue depth on allocation failure
       (CVE-2026-74626)
     - serial: amba-pl011: synchronize DMA teardown
     - serial: sc16is7xx: rename EFR mutex with generic name
     - serial: sc16is7xx: use guards for simple mutex locks
     - serial: sc16is7xx: enable THRI before filling TX FIFO
     - xfs: namespace the maximum length/refcount symbols
     - xfs: don't use a xfs_log_iovec for ri_buf in log recovery
     - xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)
     - xfs: hoist per-bucket unlinked list check to helper
     - xfs: don't livelock in scrub on a circular unlinked list
     - ALSA: dummy: Check card index validity at probe
     - ocfs2: fix missing metadata reservation for large xattrs
     - null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows
     - kcov: fix data corruption and race conditions on PREEMPT_RT
     - ext4: stop retrying saturated xattr cache entries
     - ext4: clear error before retrying inode xattr space fallback
     - ext4: propagate errors from fast commit range replay
     - xfs: validate attr entry pointer before field access
     - libceph: fix OOB read in decode_watchers() via missing bounds check
       (CVE-2026-80557)
     - nfc: digital: clamp SENSF_RES length to the destination buffer
     - nfc: fdp: bound the device-reported read length and fix an skb leak
     - nfc: microread: validate target discovery payload lengths
     - nfc: llcp: bound the connect_sn TLV walk to the skb
     - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
     - nfc: llcp: reject PDUs shorter than the LLCP header
     - nfc: pn533: purge fragmented skbs during cleanup
     - nfc: st21nfca: validate ATR_REQ length against the received frame
     - nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
     - nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
     - nfc: nci: free destination parameters when closing a connection
     - ndisc: ndisc_send_redirect() cleanup
     - Input: byd - synchronize timer deletion before freeing private data
       (CVE-2026-80572)
     - ipv4: reject undersized MTUs in ip_do_fragment()
     - ipv6: fix use-after-free in ip6_finish_output2()
     - nvmet-auth: zero the AUTH_RECEIVE response buffer
     - nvmet-fc: fix invalid free in LS IOD error path
     - nvmet-tcp: bound SGL data length before allocating command buffers
     - nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
     - mptcp: pm: fix data race in add_addr timer callback
     - [arm64] ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
       (CVE-2026-80583)
     - drm/xe: Fix DPT allocation paths.
     - HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
     - HID: magicmouse: re-enable multitouch after reset-resume
     - HID: magicmouse: do not keep a stale msc->input if no input is claimed
     - HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID
     - HID: core: fix OOB read of field->usage in hid_set_field()
     - net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
     - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (CVE-2026-64581)
     - ipv4: start using dst_dev_rcu() (CVE-2025-40074)
     - mptcp: pm: fix memory leak from alloc-during-teardown race
     - Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard
     - Input: atkbd - skip deactivate for HONOR ZQC-P
     - HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
     - HID: nintendo: register input device after capabilities are set
     - HID: nintendo: stop device IO before hid_hw_stop on probe failure
     - HID: core: fix number/pointer type confusion on long items
     - HID: sensor: custom: Fix use-after-free in enable_sensor
     - HID: hyperv: validate initial device info bounds
     - Bluetooth: hci_event: fix LE list UAF on reset
     - Bluetooth: hci_event: validate LE Set CIG Parameters response
     - Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync
     - Bluetooth: hci_aml: validate firmware segment lengths
     - net: gro: properly validate BIG TCP aggregation criteria
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.107
     - inet: frags: strip GSO state from fragments before reassembly
       (CVE-2026-80590)
linux-signed-arm64 (6.12.105+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.105-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.102
     - [amd64] x86/bugs: Make Safe-RET robust against interrupt injection
       (CVE-2026-68480)
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.103
     - netfilter: nf_conntrack_expect: restore helper propagation via expectation
     - netfilter: br_netfilter: Reallocate headroom if necessary in
       neigh_hh_bridge()
     - net: mpls: initialize rtm_tos in mpls_getroute()
     - HID: logitech-dj: Standardise hid_report_enum variable nomenclature
     - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB
       write
     - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report
     - bpf: Reset register bounds before narrowing retval range in
       check_mem_access()
     - netconsole: avoid OOB reads, msg is not nul-terminated (CVE-2026-43197)
     - [amd64] thunderbolt: Prevent XDomain delayed work use-after-free on
       disconnect
     - [arm64] pinctrl: qcom: Unconditionally mark gpio as wakeup enable
     - [arm64] pinctrl: qcom: sc8280xp: Add missing wakeup entries for
       GPIO143/151
     - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
     - [amd64] dmaengine: idxd: fix fdev setup failure cleanup in
       idxd_cdev_open()
     - gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe()
     - ata: sata_mv: accept 1 or 2 resources in platform probe
     - ata: libahci_platform: support non-consecutive port numbers
     - ahci: Introduce ahci_ignore_port() helper
     - ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
     - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup
     - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup
     - of: reserved_mem: Add code to dynamically allocate reserved_mem array
     - of: reserved_mem: prevent OOB when too many dynamic regions are defined
     - btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag
     - btrfs: zoned: fix deadlock between metadata writeback and transaction
       commit
     - [arm64] phy-zynqmp: Postpone getting clock rate until actually needed
     - [arm64] phy: zynqmp: fix clock error handling in xpsgtr_phy_init()
     - [arm64] phy: zynqmp: fix runtime PM leak on probe allocation failure
     - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in
       sip_help_tcp()
     - [arm64] drm/mediatek: Check CRTC state before freeing
     - Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep
       annotation
     - KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type
     - keys: fix out-of-bounds read in keyring_get_key_chunk()
     - keys: make keyring key-chunk byte order agree with keyring_diff_objects()
     - assoc_array: trim the final shortcut word using the current chunk end
     - netfilter: nf_tables: make nft_object rhltable per table
     - netfilter: xt_hashlimit: validate hashtable supports
       XT_HASHLIMIT_RATE_MATCH
     - ipvs: fix the checksum validations
     - ipvs: fix places with wrong packet offsets
     - ipvs: do not mangle ICMP replies for non-first fragments
     - netfilter: nft_payload: fix mask build for partial field offload
     - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled
       (CVE-2026-68322)
     - rds: tcp: hold the RCU lock across ipv6_chk_addr() in
       rds_tcp_laddr_check()
     - [amd64,arm64] pinctrl-amd: Don't clear S4 wake bits at probe
     - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
     - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection
       buffer
     - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
     - smb: client: fix buffer leaks in SMB1 read and write
     - spi: spi-cadence: supports transmission with bits_per_word of 16 and 32
     - spi: spi-cadence: Move TX FIFO full busy-wait into FIFO
     - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
     - hwmon: (ina2xx) Add support for has_alerts configuration flag
     - hwmon: (ina2xx) Add support for INA260
     - hwmon: (ina226) Add support for SY24655
     - hwmon: (ina2xx) Make it easier to add more devices
     - hwmon: (ina2xx) Add support for INA234
     - hwmon: (ina2xx) Shift INA234 shunt and current registers
     - hwmon: (ina2xx) Fix various overflow issues
     - hwmon: (ltc4282) Fix reading the minimum alarm voltage
     - hwmon: (sht3x) Fix unaligned accesses
     - hwmon: (lm90) Only report alarms if driver is ready
     - hwmon: (nzxt-smart2) DMA-align output buffer
     - net: do not send ICMP/NDISC Redirects when peer allocation fails
     - hwmon: (nct6775-core) Prevent access to unsupported weight registers
     - net: bridge: mrp: fix Option TLV length in MRP_Test frames
     - forcedeth: fix UAF of txrx_stats in nv_remove
     - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
     - hwmon: (adt7470) Fix cache updated before hardware write on I2C error
     - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
     - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()
     - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks
     - hwmon: (adt7470) Use cached PWM frequency value
     - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
     - hwmon: (adt7470) Fix PWM auto temp state array and bounds check
     - rtase: fix double free of multi-frag skb on DMA map failure
     - [powerpc*] boot: Fix simpleboot CPU node lookup check
     - [powerpc*] boot: Fix treeboot-currituck CPU node lookup check
     - [powerpc*] boot: Fix treeboot-akebono CPU node lookup check
     - net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
     - wifi: mac80211: validate individual TWT params before driver setup
     - net: ethernet: mtk_eth_soc: support named IRQs
     - net: ethernet: mtk_eth_soc: add consts for irq index
     - net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in
       poll_controller
     - hwmon: (pmbus) Fix return value from pmbus_update_byte_data()
     - [amd64,arm64] idpf: adjust TxQ ring count minimum
     - [amd64,arm64] idpf: Fix mailbox IRQ name leak on request failure
     - Bluetooth: ISO: clear iso_data always when detaching conn from hcon
     - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
     - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos
     - Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis()
     - Bluetooth: ISO: fix leaking sk after socket release
     - Bluetooth: ISO: avoid deadlocks in iso_sock_timeout
     - Bluetooth: btintel: Validate length before parsing diagnostics TLV
     - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists
     - Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
     - Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync
     - net: phylink: put link_gpio if phylink_create fails
     - scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
     - scsi: ufs: core: Cancel RTC work in active-active suspend
     - scsi: zfcp: Fix memory leak during adapter release by destroying
       gid_pn_req
     - scsi: target: Clear cmd_cnt when initial counter enrollment fails
     - net: sxgbe: free TX rings on RX allocation failure
     - net: sxgbe: check descriptor ring allocation failures
     - can: isotp: check register_netdevice_notifier() error in module init
     - tracing/mmiotrace: Reset dropped_count in mmio_reset_data()
     - tracing: Remove TRACE_EVENT_FL_FILTERED logic
     - tracing/mmiotrace: Remove reference to unused per CPU data pointer
     - tracing/mmiotrace: Add NULL check for mmio_trace_array in logging
       functions
     - [riscv64] mm: Fix out-of-bounds page-table walk during memory hot-remove
     - [arm64] net: dsa: mt7530: check bus->read() errors in the MDIO regmap
       backend
     - [arm64] net: dsa: mt7530: error out on failed reads in MT7531 PHY polling
     - net: libwx: fix FDIR ATR queue mismatch for software VLAN packets
     - [arm64] octeontx2-pf: Set correct sequence for carrier off and tx queue
       stop
     - sched/deadline: Use revised wakeup rule only for running dl_server
     - qede: sync udp_tunnel ports outside qede_lock in the recovery path
     - ksmbd: return success for deferred final close
     - ksmbd: fix use-after-free in __close_file_table_ids()
     - pinctrl: devicetree: don't free uninitialized dev_name on error path
     - erofs: cap LZMA stream pool size
     - pinctrl: bm1880: add missing select GENERIC_PINCONF
     - fortify: Disable -Wstringop-overread in tests
     - mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
     - fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes
     - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
     - mm/hugetlb: fix list corruption in allocate_file_region_entries()
     - mm/vmstat: fold stranded per-cpu node stats when a node comes online
     - tracing/probes: Reject $arg0 in meta argument expansion
     - [amd64] KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while
       L2 is active
     - [s390x] KVM: s390: pci: Reject adapter interrupt forwarding if already
       enabled
     - [s390x] KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
     - [s390x] KVM: s390: pci: Validate AIBV and AISB before pinning guest pages
     - sctp: validate Adaptation Indication parameter length
     - audit: fix potential integer overflow in audit_log_n_string()
     - audit: fix potential use-after-free in audit_del_rule()
     - Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()
     - Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()
     - Bluetooth: mgmt: fix pending command UAF in EIR updates
     - Bluetooth: mgmt: fix UAF in pair command cancellation
     - Bluetooth: hci_sync: Fix advertising data UAFs
     - Bluetooth: HIDP: reject frames without a transaction header
     - Bluetooth: HIDP: validate numbered report payloads
     - bpf: lwt: Fix dst reference leak on reroute failure
     - ALSA: 6fire: Fix UAF at error handling during probe
     - ALSA: lx6464es: fix period byte count for 16-bit streams
     - ALSA: pcm: wake linked drain waiters on unlink
     - ALSA: seq: Fix division by zero in initialize_timer()
     - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes
     - ALSA: ump: fix double free of out_cvts on rawmidi error
     - ASoC: tas2562: fix DVC coefficient write order
     - ASoC: tas2562: fix broken entries in the volume lookup table
     - ata: libata-eh: Increase STANDBY IMMEDIATE timeout
     - ata: libata-sata: fix ata_scsi_lpm_supported() iteration
     - ALSA: usb-audio: fix use-after-free in ump_to_endpoint()
     - ALSA: usb-audio: fix stack info leak in RME Digiface status
     - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
     - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
     - ALSA: usb-audio: Clamp frame size in implicit-feedback mode
     - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
     - e1000: fix memory leak in e1000_probe()
     - igbvf: Fix leak in TX DMA error cleanup
     - ipvs: do not propagate one-packet flag to synced conns
     - net/smc: fix socket use-after-free during link group termination
     - netfilter: ipset: do not update comments from kernel-side hash adds
     - tipc: avoid use-after-free in poll trace queue dumps
     - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames
     - binfmt_misc: reject a flag character as the field delimiter
     - binfmt_misc: don't let an 'F' entry pin its own instance
     - mm/page_reporting: use system_freezable_wq to fix UAF during suspend
     - mm: memcg: initialize *locked in memcg1_oom_prepare() stub
     - net: bridge: stop fast-leave after deleting a port group
     - net: ipv6: clear suppressed fib6 rule result
     - [powerpc*] ps3: Fix map failure path in dma_ioc0_map_pages()
     - veth: convert frag_list skbs before running XDP
     - vxlan: re-fetch eth header after route_shortcircuit()
     - vxlan: unclone skb head before modifying eth header in
       route_shortcircuit()
     - vxlan: use neigh_ha_snapshot() in route_shortcircuit()
     - vxlan: use pskb_network_may_pull() in route_shortcircuit()
     - ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()
     - tracing: Check return value of __register_event() in
       trace_module_add_events()
     - tracing/filters: Fix false positive match in regex_match_full()
     - spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure
     - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
     - sctp: reject stale cookies with mismatched verification tags
     - sctp: prevent peer transport count overflow
     - hwmon: (npcm750-pwm-fan): stop fan timer on device detach
     - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client
     - i2c: amd-mp2: Unregister callback on adapter add failure
     - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure
     - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
     - cpufreq: schedutil: Publish util hooks only after all sg_cpu are
       initialized
     - power: supply: bq25890: fix the -10 C NTC lookup entry
     - power: supply: max17040: handle missing status supplier
     - [s390x] pci: Fix s390_pci_mmio_write syscall error return without MIO
     - [s390x] qeth: Check CAP_NET_ADMIN for private ioctls
     - [s390x] dasd: Fix potential NULL pointer dereference
     - [s390x] dasd: Fix undersized format-check buffer
     - [s390x] zcrypt: Fix wrong domain value verification with EP11 CPRBs
     - [s390x] zcrypt: Validate length for CCA AES cipher key requests
     - [s390x] zcrypt: Validate length for CCA ECC private key requests
     - [arm64] phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
     - [arm64] phy: zynqmp: use read-modify-write for SERDES scrambler bypass
     - [arm64] phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
     - net: openvswitch: fix potential UAF on meter attach failure
     - net: openvswitch: fix skb leak on flow key update failure during
       recirculation
     - net: openvswitch: fix skb leak on flow key update failure during ct
     - ice: wait for reset completion in ice_resume()
     - ice: fix memory leak in ice_lbtest_prepare_rings()
     - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock
       deadlock
     - i2c: iproc: reset bus after timeout if START_BUSY is stuck
     - i2c: imx: Fix slave registration race and error handling
     - i2c: imx: Cancel hrtimer before clearing slave pointer
     - can: c_can: c_can_chip_config(): keep controller in init mode until
       bittiming is configured
     - can: ems_usb: validate CPC message lengths
     - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB
       resubmit failure
     - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb
       allocation failure
     - can: j1939: transport: j1939_session_fresh_new(): initialize receive
       buffer
     - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking
     - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in
       kvaser_usb_hydra_get_busparams()
     - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received
       command extents
     - can: softing: fw_parse(): validate firmware record spans
     - can: peak_usb: add bounds check for USB channel index
     - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB
       submit error
     - can: peak_usb: validate uCAN receive record lengths
     - can: ctucanfd: add missing MODULE_DEVICE_TABLE()
     - can: ctucanfd: use self-test mode for PRESUME_ACK
     - can: ctucanfd: unmap BAR0 using base address
     - can: ctucanfd: handle bus error interrupts
     - can: ctucanfd: mark error-active controller status valid
     - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs
     - [arm*] drm/vc4: Supply the overflow slot size in BPOS, not the whole bin
       BO size
     - [arm*] drm/vc4: Zero the tile state data array before each BIN job
     - [arm64] drm/panthor: reject firmware sections with oversized data
     - [arm64] drm/panthor: validate firmware interface structure sizes
     - [arm64] drm/mediatek: ovl_adaptor: balance component registrations
     - drm/amdgpu: restore UMD profile pstate after runtime resume
     - drm/amdgpu: cap GTT size to physical RAM on APUs
     - drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
     - drm/amd/display: use proper context for logging
     - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
     - drm/amdkfd: fix QID bit leak in pqm_create_queue()
     - drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
     - drm/amdkfd: Handle invalid event type in CRIU event restore
     - drm/amdkfd: hold event_mutex while checkpointing CRIU events
     - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
     - drm/vmwgfx: reject DX_BIND_QUERY without a DX context
     - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
     - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
     - drm/vmwgfx: bound DMA command body size against suffix pointer
     - drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
     - drm/vmwgfx: use check_add_overflow for shader size+offset bound
     - drm/vmwgfx: validate external BO copy bounds for both stride paths
     - spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX
     - HID: logitech-dj: Fix maxfield check in DJ short report validation
     - ata: libahci_platform: Do not set mask_port_map when not needed
     - ata: ahci: Make ahci_ignore_port() handle empty mask_port_map
     - of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array()
       fails
     - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release
     - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting
     - drm/xe: Introduce xe_gt_dbg_printer()
     - drm/xe: Apply whitelist to engine save-restore
     - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists
       (CVE-2026-68267)
     - drm/xe/rtp: Maintain OA whitelists separately
     - drm/xe/rtp: Keep track of non-OA nonpriv slots
     - drm/xe/rtp: Generalize whitelist_apply_to_hwe
     - drm/xe/rtp: Save OA nonpriv registers to register save/restore lists
     - drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs
     - drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt
     - drm/xe/oa: (De-)whitelist OA registers on OA stream open/release
     - drm/xe/rtp: Ensure locking/ref counting for OA whitelists
     - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
     - fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes
     - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
     - lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled()
     - mm/slab: prevent unbounded recursion in free path with new kmalloc type
     - gpio: pch: use raw_spinlock_t for the register lock
     - usb: gadget: f_tcm: synchronize delayed set_alt with teardown
       (CVE-2026-68367)
     - usb: typec: ucsi: split connector lock classes
     - usb: typec: ucsi: Fix race condition and ordering in port unregistration
     - media: i2c: imx219: Rename VTS to FRM_LENGTH
     - media: imx219: Fix maximum frame length in lines
     - media: chips-media: wave5: Support CBP profile
     - media: uapi: rkisp: Correct name version enum
     - wifi: brcmfmac: drain bus_reset work on device removal (CVE-2026-64586)
     - wifi: ath6kl: fix use-after-free in aggr_reset_state() (CVE-2026-68198)
     - wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW)
     - wifi: brcmfmac: set F2 blocksize to 256 for BCM43752
     - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change
     - mptcp: pm: avoid code duplication to lookup endp
     - mptcp: add mptcp_userspace_pm_lookup_addr helper
     - mptcp: pm: use addr entry for get_local_id
     - mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)
     - drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions
     - drm/amdgpu: Fix context pstate override handling (CVE-2026-68273)
     - drm/sched: Store the drm client_id in drm_sched_fence
     - drm/amdgpu: give each kernel job a unique id
     - drm/amdgpu/gfx: fix cleaner shader IB buffer overflow (CVE-2026-68276)
     - drm/fb-helper: Allocate and release fb_info in single place
     - drm/tegra: fbdev: Remove offset into framebuffer memory
     - drm/exec: Remove the index parameter from
       drm_exec_for_each_locked_obj[_reverse]
     - drm/xe: Wait on external BO kernel fences in exec IOCTL
     - [arm64] drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable()
     - [arm64] drm/i915/vrr: require valid min/max vfreq for VRR (CVE-2026-68254)
     - drm/xe: Rename ___xe_bo_create_locked()
     - drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266)
     - [arm64] drm/i915/hdcp: Move to using intel_display in intel_hdcp
     - [arm64] drm/i915/hdcp: require monotonically increasing seq_num_v
     - [arm64] drm/i915/hdcp: Skip inactive MST connectors when building stream
       list
     - [arm64] drm/i915/hdcp: check streams[] bounds before overflow
       (CVE-2026-68253)
     - drm/xe: Stub out new pagefault layer
     - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)
     - rxrpc: Generate rtt_min
     - rxrpc: Adjust the rxrpc_rtt_rx tracepoint
     - rxrpc: Fix the calculation and use of RTO
     - rxrpc: Manage RTT per-call rather than per-peer
     - rxrpc: Fix irq-disabled in local_bh_enable() (CVE-2025-38525)
     - can: use skb hash instead of private variable in headroom
     - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
     - usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
     - drm/fb-helper: Fix a locking bug in an error path
     - [arm64,armhf] drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.104
     - mount: honour SB_NOUSER in the new mount API
     - drm/amd/display: Add AV mute wait frames to dce110_set_avmute
     - drm/amd/display: Check for tg ops in dce110_set_avmute
     - [s390x] zcrypt: Fix missing mem scrub at clear key import in
       cca_clr2cipherkey()
     - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
     - [arm64] dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer
     - drm/bridge: ps8640: propagate AUX transfer register errors
     - [arm64] net: hns3: fix speed configuration residue after driver reload
     - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit"
     - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
     - enic: fix tx_hang_reset use-after-free on device removal
     - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock
     - pds_core: keep the health thread stopped during reset
     - pds_core: cancel pending PCI reset work on AER recovery
     - netfilter: ipset: switch ext_size to atomic64_t
     - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
     - ipvs: return the csum validation for forward hook
     - watchdog: bd96801_wdt: Fix timeout for enabled WDG
     - btrfs: fix memory leak in btrfs_do_encoded_write()
     - bpf: Preserve pointer state for commuted arithmetic
     - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in
       smc_llc_event_handler()
     - net/sched: cls_route: fix fastmap use-after-free on filter
     - [arm64] net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
     - devlink: fix net namespace reference leak in reload
     - net/mlx5: fw_tracer, return NULL on create error
     - counter: microchip-tcb-capture: Fix DT channel validation
     - bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch
     - bpf: tcp: Make sure iter->batch always contains a full bucket snapshot
     - bpf: tcp: Get rid of st_bucket_done
     - bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items
     - bpf: tcp: Avoid socket skips and repeats during iteration
     - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
     - vhost/vdpa: reject overflowing PA map page counts on 32-bit
     - vdpa/mlx5: Fix buffer length in create_direct_keys()
     - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss()
     - xsk: require at least 16 bytes of TX metadata
     - udp: fix potential use-after-free in tunnel segmentation
     - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
     - net/openvswitch: check Ethernet header length in key_extract()
     - net/sched: cls_api: Always acquire rtnl_lock when destroying locked
       classifiers
     - hwmon: (nzxt-smart2) Check return value of init_device() in probe
     - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations
     - bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss()
     - bnxt_en: Determine and store default RX ring in vnic structure
     - bnxt_en: Refresh VNIC default ring on queue restart if needed
     - bnxt_en: Fix PTP PPS setting bug
     - sctp: fix addip_serial increment on ASCONF_ACK allocation failure
     - tcp: fix TFO max_qlen accounting across reuseport migration
     - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
     - net: prestera: validate firmware header length
     - net: remove WARN_ON_ONCE() from sk_mc_loop()
     - net/smc: fix TOCTOU race between smc_listen_out() and listener close
     - [amd64] net: thunderbolt: Tear down DMA paths before stopping the rings
     - ata: pata_sl82c105: fix bridge revision use-after-free
     - net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
     - sctp: clear control chunk transport if it is being removed
     - tls: don't abort the connection on signal-interrupted sends
     - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string
       termination
     - hwmon: (ads7828) Fix external VREF regulator handling
     - hwmon: (ltc4282) Avoid overflow in maximum power calculation
     - hwmon: (ltc4282) Clamp negative current limits
     - hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt
     - mm/vmscan: wake up flushers conditionally to avoid cgroup OOM
       (Closes: #1143545)
     - net: fec: do not release NULL pages when RX buffer allocation fails
     - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
     - mtd: spinand: fix direct mapping creation sizes
     - mtd: spinand: try a regular dirmap if creating a dirmap for continuous
       reading fails
     - mtd: spinand: repeat reading in regular mode if continuous reading fails
     - swapfile: call cond_resched() before locking si->lock
     - Input: evdev - sanitize event type index when fetching event masks
     - ALSA: usb-audio: fix OOB write on Type II inbound URBs
     - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
     - [amd64] thunderbolt: icm: Preserve USB4 proxy data-valid bit
     - usb: cdnsp: fix incorrect endian conversions for APB timeout register
     - usb: gadget: f_ncm: Use unsigned int for ndp_index
     - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
     - net: usb: ipheth: fix carrier_work UAF on disconnect
     - vt: add permission check for KDSKBMETA ioctl
     - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
     - Input: evdev - fix information leak in evdev_pass_values()
     - ima: fix out-of-bounds read in xattr_verify()
     - ipvs: stop estimator after disabled calc phase
     - ipvs: add totalconns for dest
     - ipvs: properly update the overload flag on dest edit
     - ipvs: clear IPv4 options after rebasing tunnel ICMP errors
     - packet: use consistent hard_header_len in non-ring send paths
     - packet: use consistent hard_header_len in TX_RING send path
     - net/packet: reset the MAC header on the packet-socket transmit path
     - packet: synchronize pressure clearing with ring reconfiguration
     - net: fix skb length accounting after generic XDP frag adjustment
     - net: openvswitch: reallocate update replies for mismatched IDs
     - net/sched: reject overly deep qdisc hierarchies
     - net: octeontx2-pf: Fix UB in shift operation
     - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
     - mac802154: fix netdev use-after-free in beacon worker
     - netfilter: ebt_nflog: pin the NFLOG backend
     - net: bridge: mrp: fix uninitialised bytes on the wire
     - [s390x] KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
       (CVE-2026-74514)
     - [s390x] KVM: s390: pci: Fix missing error codes and memory unaccounting
     - [s390x] KVM: s390: pci: Fix resource leak on IRQ registration failure
     - [s390x] KVM: s390: pci: Fix aisb calculation
     - block: Reorder the request allocation code in blk_mq_submit_bio()
     - blk-mq: pop cached request if it is usable (CVE-2026-64017)
     - blk-mq: reinsert cached request to the list
     - dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk
     - [amd64] crypto: ccp - Add new SEV/SNP platform shutdown API
     - [amd64] KVM: SVM: Add support to initialize SEV/SNP functionality in KVM
     - [amd64] crypto: ccp - Fix checks for SNP_VLEK_LOAD input buffer length
     - [amd64] crypto: ccp - Abort doing SEV INIT if SNP INIT fails
     - futex: Prevent robust futex exit race some more
     - kunit/fortify: Replace "volatile" with OPTIMIZER_HIDE_VAR()
     - kunit/fortify: Add back "volatile" for sizeof() constants
     - pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
     - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
     - ipv4: fix use-after-free in fib_nhc_update_mtu()
     - mei: pull kvfree out of spinlock
     - nvmem: layouts: Add fixed-layout driver
     - serial: qcom-geni: fix TX DMA buffer flush
     - serial: 8250_dma: Clear stale RX state on shutdown
     - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
     - staging: rtl8723bs: fix OOB read in WMM_param_handler()
     - staging: rtl8723bs: fix missing shared-key auth challenge length check
     - staging: rtl8723bs: validate monitor transmit frame lengths
     - misc: fastrpc: fix channel ctx ref leak when session alloc fails
     - misc: fastrpc: Remove buffer from list prior to unmap operation
     - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
     - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
     - ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
     - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
     - ALSA: usx2y: bound the hwdep mmap fault offset
     - tracing: Fix race between update_event_fields and, event_define_fields
     - fbdev: bitblit: bound-check glyph index in bit_cursor()
     - ring-buffer: Prevent subbuf order change when resizing is disabled
     - mm/huge_memory: fix huge_zero_pfn race
     - net: smc: fix splice entry lifetime imbalance in smc_rx_splice
     - ipv6: prevent in6_dev_get() from resurrecting inet6_dev
     - netfilter: bridge: release template ct on non-IP path
     - netfilter: nf_conntrack: defer invalid log until after unlock
     - net: atlantic: free stranded TX buffers on ring deinit
     - net: atlantic: free RX pages of consumed but not refilled buffers
     - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
     - net/sched: act_gact, act_police: range check the fallback control action
     - ovl: don't warn when the mount is completed from another user namespace
     - binfmt_misc: don't warn when the mount is completed from another user
       namespace
     - Revert "drm/amdgpu: fix aperture mapping leak"
     - xdp: reject clones that overrun skb_shared_info tailroom
     - vxlan: do not arm the ageing timer on a device that is down
     - vsock/virtio: read virtqueues under worker locks
     - vsock/virtio: avoid refilling the RX queue after teardown
     - veth: fix skb length accounting after XDP frag adjustment
     - vhost: reset the vring metadata cache on vring reconfiguration
     - tls: don't leave a full plaintext sk_msg ring unpushed
     - tipc: read le->link under the node lock in tipc_node_link_down()
     - smb: client: Fix use-after-free in cifs_try_adding_channels()
     - [amd64] KVM: x86/mmu: WARN and clear role.invalid when creating a child
       shadow page
     - eventfs: Fix use-after-free in eventfs_remove_rec()
     - Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
     - ptp: ocp: Fix board ID over-read
     - ipv6: fix Route Information option length validation
     - ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
     - fscrypt: use the mount idmap for the owner check in
       fscrypt_ioctl_set_policy()
     - sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
     - ima: Instantiate file_truncate and path_truncate hooks
     - fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
     - fsverity: Fix silent truncation in bpf_get_fsverity_digest()
     - bpf, sockmap: Fix sk_redir use-after-free in send verdict
     - scsi: scsi_debug: Negate wrapped memcmp() result
     - sctp: keep chunk->transport in step with the list it is queued on
     - sctp: fix use-after-free of cached ASCONF chunk
     - sctp: clear new_transport when removing a peer
     - [amd64] thunderbolt: Bound the DROM dual link port number before indexing
       sw->ports
     - [amd64] thunderbolt: Fix bandwidth group reservation indexing
     - bpf: tcp: fix double sock release on batch realloc
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.105
     - block: stop the timeout timer when releasing a never added disk
     - bpf: Fix linked reg delta tracking when src_reg == dst_reg
       (CVE-2026-53092)
     - bpf: Clear delta when clearing reg id for non-{add,sub} ops
     - f2fs: fix UAF issue in f2fs_merge_page_bio() (CVE-2025-40054)
     - mtd: ubi: skip programming unused bits in ubi headers
     - ubi: fastmap: fix ubi->fm memory leak
     - mm/damon/ops-common: putback folios on invalid migrate nid
       (CVE-2026-74644)
     - mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD}
     - igc: fix netdev not re-attached after resume if interface is down
     - ipvs: separate destination availability state
     - net: mana: Fix EQ leak in mana_remove on NULL port
     - [amd64] crypto: ccp: Add external API interface for PSP module
       initialization
     - [amd64] KVM: SVM: Ensure PSP module is initialized if KVM module is
       built-in
     - selinux: require every boolean value to be defined
     - selinux: reject a class permission count below its inherited common
     - selinux: do not cancel a policy conversion that never started
     - selinux: reject an unclaimed class value in security_get_classes()
     - mptcp: avoid combining some incoming suboptions
     - mptcp: options: reset DSS fields in case of unexpected size
     - mptcp: fastopen: only mark MPTFO subflows with SYN data
     - [s390x] qeth: validate user buffer length in SNMP and ARP query ioctls
     - [amd64] ASoC: SOF: sof-audio: Fix error path in
       sof_widget_setup_unlocked()
     - fbdev: core: Fix pointer desynchronization in fb_io_read()
     - drm/panthor: skip zero-sized firmware sections
     - drm/amdgpu: reject oversized IBs with per-ring packet limits
     - drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12
     - drm/amdgpu: fix aperture iounmap skipped on device removal
     - [amd64] ASoC: SOF: topology: Use acpi mach from the machine driver
     - Input: xpad - add support for ZENAIM LEVERLESS
     - Input: cs40l50-vibra - validate custom data from user space
     - [powerpc*] pseries: pci - logic bug
     - Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
     - Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
     - Input: psxpad-spi - set driver data before use
     - Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
     - Input: iforce - validate input packet lengths
     - [powerpc*] pseries: lparcfg - fix kbuf[] underflow
     - Input: synaptics-rmi4 - zero report size on F54 work error
     - Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
     - Input: synaptics-rmi4 - block s_input when F54 queue is busy
     - Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
     - Input: hynitron_cstxxx - validate touch count and finger IDs
     - [arm64] crypto: qce - fix error path in devm_qce_register_algs
     - gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on
       unbind
     - [arm64] pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state
       0
     - libceph: fix multiple unsafe decodes in decode_locker()
     - ftrace: Protect direct_functions in ftrace_find_rec_direct
     - ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
     - Input: sur40 - fix input device registration ordering
     - Input: sur40 - fix V4L error path cleanup
     - libceph: Avoid using invalid osd indices from primary_temp
     - ceph: fix MDS random selection readiness predicate
     - libceph: tolerate addrvecs with multiple entries of the same type
     - [armhf] mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on
       32-bit
     - mmc: sdhci: unmap the bounce buffer before device release
     - mmc: sdhci: make tuning_err a signed int
     - drm/connector/hdmi: Fix out of bounds memory read
     - drm/xe: Order ring writes before ring tail updates
     - drm/radeon: fix autosuspend cleanup during teardown
     - [s390x] vfio_ccw: Free all memory if cp_init() fails
     - [s390x] vfio_ccw: Limit the number of channel program segments
     - [s390x] vfio_ccw: Cancel existing workqueues
     - [s390x] vfio_ccw: Ensure index for read/write regions are within range
     - [s390x] vfio_ccw: Ensure first IDAW remains constant
     - [s390x] vfio_ccw: Fix out of bounds check on CCW array
     - [s390x] vfio_ccw: Move cp cleanup out of not operational
     - [s390x] vfio_ccw: Selectively expand io_mutex
     - [s390x] vfio_ccw: Calculate idal length based on idaw type
     - [s390x] vfio_ccw: Implement a crw lock
     - drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix
     - drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE
     - drm/amdgpu: Reject UVD message with invalid number of h265 refs
     - drm/amdgpu: fix nbif 6.3.1 l1 low power not functional
     - drm/amdgpu: check ASPM on the dGPU host link
     - drm/amdgpu: validate GEM_CREATE domain combinations
     - drm/amdgpu: Reject UVD message with dimensions above 4096
     - drm/amdgpu: Implement insert_end for VCE 3
     - drm/amdgpu: Fix UVD min buffer sizes
     - drm/amdgpu: Fix UVD dpb min size calculation for H264
     - drm/amdgpu: Fix UVD decode image min size calculation
     - drm/amdgpu: disallow multiple FENCE chunks in one submit
     - xfs: clear zapped attr fork state when bmap repair finds no attr fork
     - xfs: zero i_nlink before repair puts inode on unlinked list
     - xfs: only check mergeability of bnobt records
     - xfs: don't double-lock when deleting a self-referential directory
     - xfs: set the prev pointer when reinserting an inode on the unlinked list
     - xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers
     - xfs: nlink scrub must take IOLOCK before determining ILOCK state
     - xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev
     - xfs: fix ilock leak on error in xfs_dq_get_next_id
     - xfs: don't zap the attr fork on repair when there are queued pptr updates
     - xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair
     - xfs: fix allocated inodes that show up in the unlinked list
     - xfs: fix another iunlink infinite loop bug in online fsck
     - xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers
     - xfs: avoid UAF on sc->tempip in xrep_tempfile_create
     - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN
     - xfs: don't swallow dquot recovery verification errors
     - xfs: check xfarray iteration errors when committing unlinked inode lists
     - xfs: check v5 superblock features early
     - ceph: Remove ceph_writepage()
     - ceph: Use a folio in ceph_page_mkwrite()
     - ceph: Convert ceph_find_incompatible() to take a folio
     - ceph: Convert writepage_nounlock() to write_folio_nounlock()
     - ceph: fix writeback_count leak in write_folio_nounlock()
     - ceph: avoid fs reclaim while using current->journal_info
     - ceph: fix hanging __ceph_get_caps() with stale mds_wanted
     - libceph: Amend checking to fix `make W=1` build breakage
     - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
       (CVE-2026-68159)
     - mm/khugepaged: guard is_zero_pfn() calls with pte_present()
     - userfaultfd: prevent registration of special VMAs (CVE-2026-68166)
     - libceph: fix two unsafe bare decodes in decode_lockers() (CVE-2026-68082)
     - net/sched: serialize qdisc_rtab_list against concurrent get/put
       (CVE-2026-68138)
     - super: remove pointless s_root checks
     - super: skip dying superblocks early
     - super: use a common iterator (Part 1)
     - super: use common iterator (Part 2)
     - fs/super: fix emergency thaw double-unlock of s_umount
     - super: fix emergency thaw deadlock on frozen block devices
       (CVE-2026-68132)
     - smb: move smb_version_values to common/smbglob.h
     - smb: move get_rfc1002_len() to common/smbglob.h
     - smb/server: rename include guard in smb_common.h
     - ksmbd: rename smb2_get_msg to smb_get_msg
     - smb/server: fix minimum SMB1 PDU size
     - smb/server: fix minimum SMB2 PDU size
     - ksmbd: validate minimum PDU size for transform requests (CVE-2026-68431)
     - eventpoll: pin files while checking reverse paths
     - tcp: Pass flags to __tcp_send_ack
     - tcp: fast path functions later
     - tcp: reorganize tcp_sock_write_txrx group for variables later
     - tcp: challenge ACK for non-exact RST in SYN-RECEIVED (CVE-2026-68118)
     - iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
     - btrfs: add debug build only WARN
     - btrfs: add space_info argument to btrfs_chunk_alloc()
     - btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg()
     - btrfs: zoned: fix missing chunk metadata reservation
     - [amd64] KVM: x86: Cancel delayed I/O APIC EOI handling before destroying
       vCPUs (CVE-2026-74517)
     - [arm64] ASoC: tas2562: Validate values for volume writes
     - ata: libata-scsi: terminate deferred commands on time out
     - igc: remove napi_synchronize() in igc_down()
     - ksmbd: conn lock to serialize smb2 negotiate
     - ksmbd: reject repeated SMB2 NEGOTIATE requests (CVE-2026-74494)
     - net: pktgen: fix code style (WARNING: Block comments)
     - net: pktgen: fix proc entry use-after-free (CVE-2026-74479)
     - binfmt_misc: don't leak the user namespace when the mount fails
       (CVE-2026-74483)
     - fsnotify, lsm: Decouple fsnotify from lsm
     - fsnotify: opt-in for permission events at file open time
     - fs: don't block write during exec on pre-content watched files
     - binfmt_misc: restore write access when removing an entry (CVE-2026-74487)
     - vrf: Make pcpu_dstats update functions available to other modules.
     - vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS.
     - vxlan: use pskb_network_may_pull() for transmit path header pulls
       (CVE-2026-74474)
     - ice: fix VF interrupts cleanup
     - include/linux/fs.h: add inode_lock_killable()
     - smb: client: fix race with fallocate(2) and AIO+DIO
     - cifs: add fscache_resize_cookie() to cifs_setsize()
     - can: rcar_canfd: change the initializing flow for clocks and resets
     - drm/amd/pm: Use same metric table for APU
     - drm/amd/pm: Use macro to initialize metrics table
     - drm/amd/pm: fix torn gpu metrics reads
     - drm/amdgpu: remove unused function parameter
     - drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
     - drm/amd/pm: adjust the visibility of pp_table sysfs node
     - drm/amd/pm: fix pptable use-after-free (CVE-2026-74450)
     - net: tap: set skb->dev before parsing virtio net header in
       tap_get_user_xdp() (CVE-2026-74684)
     - drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
     - ring-buffer: Simplify functions with __free(kfree) to free allocations
     - ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
       (CVE-2026-74602)
     - mm/pagewalk: split walk_page_range_novma() into kernel/user parts
     - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
       (CVE-2026-74672)
     - mm/ptdump: always stabilise against page table freeing using init_mm
       (CVE-2026-74599)
     - KVM: SVM: Serialize accesses to the owner and mirror list with separate
       lock (CVE-2026-74607)
     - ring-buffer: Simplify ring_buffer_read_page() with guard()
     - ring-buffer: Make ring_buffer_{un}map() simpler with guard(mutex)
     - ring-buffer: Prevent resizing of persistent ring buffer
     - [amd64] x86/mce: Remove __mcheck_cpu_init_early()
     - [amd64] x86/mce: Set CR4.MCE last during init
     - [amd64] x86/mce: Set up the polling timer before CMCI discovery
     - [amd64] ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget
       setup
     - net/x25: fix use-after-free of the socket by its timers (CVE-2026-74628)
     - [arm64] tegra: Add EL2 virtual timer interrupt for Tegra194
     - crypto: ccm - Set rfc4309 maxauthsize from child
     - netfilter: ipset: fix refcount race between list:set GC and swap
     - netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort
       path
     - netfilter: flowtable: publish GC-visible tuple last
     - netfilter: ipset: fix list type element drift bug
     - netfilter: ipset: let destroy callbacks adjust ext mem size
     - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
     - macvlan: inherit needed_headroom and needed_tailroom from lowerdev
     - veth: fix queue index used to wake the peer txq in veth_poll
     - tcp: fix icsk_ack.ato bitfield overflow
     - net: packet: fix wrong transport_header when sending VLAN-tagged frame
     - net/tls: Fail tls_sw_splice_read() after a failed async decrypt
     - af_packet: Don't send zero-byte data in tpacket_snd().
     - net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
     - net/sched: cls_u32: skip hash tables in u32_bind_class()
     - net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
     - net/sched: cls_bpf: reject dev-bound programs bound to a different device
     - drm/xe/oa: Fix sync entry leak on OA config emit failure
     - erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
     - perf: Unify perf_event_free_task() / perf_event_exit_task_context()
     - perf/core: Fix group leader use-after-free after sibling detach
       (CVE-2026-74637)
     - fs: unlock the superblock during iterate_supers_type
     - binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
     - net: harmonize tstats and dstats
     - ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS
     - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu()
     - ring-buffer: Use current_context for safe per-CPU buffer swap
       (CVE-2026-74601)
     - ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r
     - net: ethernet: mtk_eth_soc: only use legacy mode on missing IRQ name
     - net: ethernet: mtk_eth_soc: improve support for named interrupts
 .
   [ Salvatore Bonaccorso ]
   * drivers/mmc/host: Enable MMC_ALCOR as module (Closes: #1142912)
   * drivers/misc/cardreader: Enable MISC_ALCOR_PCI as module (Closes: #1142912)
linux-signed-arm64 (6.12.101+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.101-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.101
     - [amd64] platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU
       hotplug
     - net: airoha: Move airoha_eth driver in a dedicated folder
     - net: airoha: Fix skb->priority underflow in airoha_dev_select_queue()
     - bpf: Fix ld_{abs,ind} failure path analysis in subprogs (CVE-2026-53090)
     - netfilter: nft_counter: serialize reset with spinlock (CVE-2026-45897)
     - netfilter: nft_quota: use atomic64_xchg for reset
     - netfilter: nf_tables: revert commit_mutex usage in reset path
       (CVE-2026-45901)
     - drm/virtio: fix deadlock in display_info_cb by removing hotplug from
       dequeue worker
     - fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race
     - seqlock: Cure some more scoped_seqlock() optimization fails
     - seqlock: Allow KASAN to fail optimizing
     - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing
     - [amd64] KVM: x86: Check for invalid/obsolete root *after* making MMU pages
       available (CVE-2026-64561)
     - [amd64] KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on
       KVM_RUN
     - [amd64] KVM: nVMX: Hide shadow VMCS right after VMCLEAR (CVE-2026-64562)
     - [amd64] KVM: x86/mmu: Fix use-after-free on vendor module reload
     - can: bcm: add locking when updating filter and timer values
     - can: bcm: fix CAN frame rx/tx statistics
     - can: bcm: extend bcm_tx_lock usage for data and timer updates
     - can: bcm: validate frame length in bcm_rx_setup() for RTR replies
     - can: bcm: add missing device refcount for CAN filter removal
     - can: bcm: fix stale rx/tx ops after device removal
     - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
     - can: bcm: track a single source interface for ANYDEV timeout/throttle ops
     - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
     - can: isotp: serialize TX state transitions under so->rx_lock
     - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up
     - Revert "arm64: dts: ti: k3-am62a7-sk: Add bootph-all tag to vqmmc"
     - [arm64,armhf] gpu: host1x: Fix use-after-free in
       host1x_bo_clear_cached_mappings
     - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin
     - xprtrdma: Clear receive-side ownership pointers on release
     - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
       (CVE-2026-64565)
     - Input: ims-pcu - fix logic error in packet reset
     - [arm64] tegra: Fix CPU compatible string to cortex-a78ae on Tegra234
     - IB/mad: Drop unmatched RMPP responses before reassembly
     - mtd: mtdswap: remove debugfs stats file on teardown
     - mtd: nand: mtk-ecc: stop on ECC idle timeouts
     - btrfs: reject free space cache with more entries than pages
     - btrfs: fix root leak if its reloc root is unexpected in
       merge_reloc_roots()
     - RDMA/cma: Fix hardware address comparison length in netevent callback
     - RDMA/umem: Add pinned revocable dmabuf import interface
     - RDMA/irdma: Prevent rereg_mr for non-mem regions
     - RDMA/erdma: initialize ret for empty receive WR lists
     - [arm64] RDMA/hns: Fix potential integer overflow in mhop hem cleanup
     - RDMA/siw: publish QP after initialization
     - mtd: fix double free and WARN_ON in add_mtd_device() error paths
     - RDMA/irdma: Prevent overflows in memory contiguity checks
     - xfrm6: clear dst.dev on error to avoid double netdev_put in
       xfrm6_fill_dst()
     - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
     - wifi: cfg80211: cancel sched scan results work on unregister
     - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
     - wifi: mac80211_hwsim: clamp virtio RX length before skb_put
     - wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure
     - wifi: mac80211: fix fils_discovery double free on alloc failure
     - wifi: libertas: fix memory leak in helper_firmware_cb()
     - wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
     - wifi: cfg80211: pass net_device to .set_monitor_channel
     - wifi: cfg80211: define and use wiphy guard
     - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock
     - wifi: nl80211: free RNR data on MBSSID mismatch
     - wifi: cfg80211: derive S1G beacon TSF from S1G fields
     - wifi: nl80211: validate nested MBSSID IE blobs
     - wifi: cfg80211: validate PMSR measurement type data
     - wifi: cfg80211: validate PMSR FTM preamble range
     - wifi: cfg80211: reject unsupported PMSR FTM location requests
     - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
     - wifi: brcmfmac: initialize SDIO data work before cleanup
     - wifi: cfg80211: bound element ID read when checking non-inheritance
     - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop
     - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions()
     - ASoC: cs42l43: Correct report for forced microphone jack
     - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup
     - [arm64] firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context
     - cpufreq: Make cpufreq_update_pressure() fall back to cpuinfo.max_freq
     - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
     - ipv4: fib: free fib_alias with kfree_rcu() on insert error path
     - net/iucv: take a reference on the socket found in afiucv_hs_rcv()
     - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
     - scsi: core: wake eh reliably when using scsi_schedule_eh
     - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is
       registered
     - ata: sata_dwc_460ex: use platform_get_irq()
     - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending
       interrupts
     - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
     - [amd64] accel/ivpu: Fix wrong register read in LNL failure diagnostics
     - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC
     - Bluetooth: qca: fix NVM tag length underflow in TLV parser
     - Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update
     - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync
     - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds
     - Bluetooth: hci_qca: Clear memdump state on invalid dump size
     - smb/client: handle overlapping allocated ranges in fallocate
     - [amd64] drm/i915/gt: use correct selftest config symbol
     - [powerpc*] 85xx: Add fsl,ifc to common device ids
     - [powerpc*] time: Prepare to stop elapsing in dynticks-idle
     - [powerpc*] vtime: Initialize starttime at boot for native accounting
     - bpf, sockmap: Reject unhashed UDP sockets on sockmap update
     - [s390x] checksum: Fix csum_partial() without vector facility
     - [riscv64] hwprobe: Avoid uninitialized read in hwprobe_get_cpus()
     - can: j1939: fix lockless local-destination check
     - drm/xe/wopcm: fix WOPCM size for LNL+
     - smb: move some duplicate definitions to common/cifsglob.h
     - ksmbd: pin conn during async oplock break notification
     - ksmbd: validate compound request size before reading StructureSize2
     - net/sched: act_tunnel_key: Defer dst_release to RCU callback
     - sctp: fix auth_hmacs array size in struct sctp_cookie
     - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
     - usb: core: sysfs: add lock to bos_descriptors_read()
     - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()
     - usb: core: port: Deattach Type-C connector on component unbind
     - USB: storage: add NO_ATA_1X quirk for Longmai USB Key
     - usb: chipidea: fix usage_count leak when autosuspend_delay is negative
     - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback
     - usb: gadget: f_midi: cancel pending IN work before freeing the midi object
     - usb: gadget: printer: fix infinite loop in printer_read()
     - USB: gadget: snps-udc: fix device name leak on probe failure
     - USB: gadget: fsl-udc: fix device name leak on probe failure
     - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
     - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
     - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer
     - USB: serial: ftdi_sio: add support for E+H FXA291
     - USB: serial: io_edgeport: cap received transmit credits
     - USB: serial: keyspan_pda: fix data loss on receive throttling
     - USB: serial: option: add TDTECH MT5710-CN
     - crypto: rsa-pkcs1pad: Don't WARN on an empty digest
     - Revert "drm/amd/display: Add missing kdoc for ALLM parameters"
     - [riscv64] KVM: Serialize virtual interrupt pending state updates
     - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits
     - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware
       request
     - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin
     - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop
     - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop
     - hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop
     - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop
     - hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop
     - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
     - wifi: ath11k: fix potential buffer underflow in
       ath11k_hal_rx_msdu_list_get()
     - wifi: ath11k: Flush the posted write after writing to
       PCIE_SOC_GLOBAL_RESET
     - wifi: ath12k: Flush the posted write after writing to
       PCIE_SOC_GLOBAL_RESET
     - firewire: net: Fix fragmented datagram reassembly
     - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
     - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
     - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
     - wifi: carl9170: fix OOB read from off-by-two in TX status handler
     - wifi: carl9170: fix buffer overflow in rx_stream failover path
     - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8
     - btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps
     - btrfs: free mapping node on duplicate reloc root insert
     - ASoC: tas2781: bound firmware description string parsing
     - ALSA: hda: cs35l41: Fix NULL pointer dereference in
       cs35l41_get_acpi_mute_state() (CVE-2025-40098)
     - ALSA: hda: cs35l41: validate and free ACPI mute object
     - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI
     - ASoC: cs35l56: Don't use devres to unregister component
     - ASoC: cs35l56: Fix potential probe() deadlock
     - ASoC: cs35l56: Use complete_all() to signal init_completion
     - wifi: iwlwifi: mvm: validate SAR GEO response payload size
     - wifi: iwlwifi: mvm: fix read in wake packet notification handler
     - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
     - drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook()
     - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC
     - hwmon: (asus-ec-sensors) fix EC read intervals
     - hwmon: (asus-ec-sensors) add missed handle for ENOMEM
     - smb: client: validate DFS referral PathConsumed
     - hwmon: occ: validate poll response sensor blocks
     - regulator: mt6358: use regmap helper to read fixed LDO calibration
     - Bluetooth: btusb: validate Realtek vendor event length
     - netlink: specs: rt-link: convert bridge port flag attributes to u8
     - net/packet: avoid fanout hook re-registration after unregister
     - bonding: fix devconf_all NULL dereference when IPv6 is disabled
     - rds: drop incoming messages that cross network namespace boundaries
     - gtp: parse extension headers before reading inner protocol
     - [arm64] dpaa2-eth: put MAC endpoint device on disconnect
     - [amd64] iommu/amd: Wait for completion instead of returning early in
       iommu_completion_wait()
     - wifi: mac80211: tear down new links on vif update error path
     - nfp: Check resource mutex allocation
     - wan: wanxl: Only reset hardware after BAR mapping
     - wifi: mwifiex: bound uAP association event IEs to the event buffer
     - [amd64] iommu/amd: Bound the early ACPI HID map
     - [amd64] iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()
     - wifi: mac80211: recalculate TIM when a station enters power save
     - pds_core: reject component parameter in legacy firmware update
     - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN
     - net: txgbe: fix FDIR filter leak on remove
     - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
     - pds_core: fix deadlock between reset thread and remove
     - pds_core: fix use-after-free on workqueue during remove
     - pds_core: yield the CPU while waiting for the adminq to drain
     - pds_core: order completion reads after the ownership check
     - pds_core: fix auxiliary device add/del races
     - pds_core: check for workqueue allocation failure
     - sctp: validate stream count in sctp_process_strreset_inreq()
     - net: mctp i3c: clean up notifier and buses if driver register fails
     - tls: device: push pending open record on splice EOF
     - gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
     - nexthop: initialize extack in nh_res_bucket_migrate()
     - tipc: fix infinite loop in __tipc_nl_compat_dumpit
     - wifi: mt76: mt7925: guard link STA in decap offload
     - wifi: mt76: mt7915: guard HE capability lookups
     - wifi: mt76: connac: fix possible NULL-pointer deref in
       mt76_connac_mcu_uni_bss_he_tlv()
     - wifi: mt76: mt7925: fix possible NULL-pointer deref in
       mt7925_mcu_bss_he_tlv()
     - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()
     - wifi: mt76: mt7925: fix crash in reset link replay
     - wifi: mt76: mt7996: fix possible NULL-pointer deref in
       mt7996_mcu_sta_bfer_eht()
     - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning
     - ovl: fix trusted xattr escape prefix matching
     - amt: re-read skb header pointers after every pull
     - amt: make the head writable before rewriting the L2 header
     - net: bridge: vlan: fix vlan range dumps starting with pvid
     - net: hsr: fix memory leak on slave unregistration by removing synced VLANs
     - net: dpaa: fix mode setting
     - sctp: auth: verify auth requirement when auth_chunk is NULL
     - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
     - iomap: correct the range of a partial dirty clear
     - tipc: fix u16 MTU truncation in media and bearer MTU validation
     - net: stmmac: fix l3l4 filter rejecting unsupported offload requests
     - net: stmmac: reset residual action in L3L4 filters on delete
     - net: stmmac: enable the MAC on link up for all supported speeds
     - net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM
     - octeontx2-vf: set TC flower flag on MCAM entry allocation
     - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup
     - ppp: use IFF_NO_QUEUE in virtual interfaces
     - ppp: convert to percpu netstats
     - ppp: enable TX scatter-gather
     - ppp: annotate data races in ppp_generic
     - [amd64,arm64] hinic: remove unused ethtool RSS user configuration buffers
     - net: qrtr: restrict socket creation to the initial network namespace
     - dpll: add clock quality level attribute and op
     - net/mlx5: DPLL, Add clock quality level op implementation
     - net/mlx5: Remove newline at the end of a netlink error message
     - net/mlx5: Refactor EEPROM query error handling to return status separately
     - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads
     - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule
     - net/mlx5e: Report zero bandwidth for non-ETS traffic classes
     - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation
     - octeontx2-pf: tc: fix egress ratelimiting
     - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error
     - ice: allow creating VFs when !CONFIG_ICE_SWITCHDEV
     - ice: fix LAG recipe to profile association
     - rds: tcp: unregister sysctl before tearing down listen socket
     - net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets()
     - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
     - drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay
     - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()
     - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()
     - [arm64] drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply
       parsers
     - [arm64] drm/dp/mst: fix buffer overflows in sideband chunk accumulation
     - [arm64] drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply
       parsers
     - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at
       0 (v2)
     - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older
     - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT
     - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1
     - drm/nouveau: fix reversed error cleanup order in ucopy functions
     - drm/displayid: fix Tiled Display Topology ID size
     - [amd64] drm/i915/gem: Add missing nospec on parallel submit slot
     - drm/nouveau/acr: fix missing nvkm_done() in error path of
       nvkm_acr_oneinit()
     - drm/radeon: fix r100_copy_blit for large BOs
     - drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds
     - drm/amdkfd: Use kvcalloc to allocate arrays
     - drm/amdkfd: Check bounds in allocate_event_notification_slot
     - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation
     - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips
     - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path
       leaks prev_sink reference
     - drm/virtio: bound EDID block reads to the response buffer
     - drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()
     - [amd64] drm/i915: Return NULL on error in active_instance
     - [amd64] drm/i915/bios: range check LFP Data Block panel_type2
     - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()
     - [amd64] drm/i915/gem: Do not leak siblings[] on proto context error
     - [amd64] drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
     - drm/amd/pm: fix smu14 power limit range calculation
     - drm/gfx10: Program DB_RING_CONTROL
     - [arm64] drm/panthor: return error on truncated firmware
     - drm/amdgpu: Fix VFCT bus number matching with soft filter
     - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)
     - drm/amd/display: set new_stream to NULL after release
     - drm/amd/display: dce100: skip non-DP stream encoders for DP MST
     - drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge
     - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved
     - drm/vmwgfx: Validate vmw_surface_metadata::array_size
     - drm/vc4: Prevent shader BO mappings from becoming writable
     - media: airspy: Return queued buffers on start_streaming() failure
     - media: aspeed: fix missing of_reserved_mem_device_release() on probe
       failure
     - media: cec: seco: unregister adapter on IR probe failure
     - media: cedrus: clean up media device on probe failure
     - media: cedrus: Fix missing cleanup in error path
     - media: cedrus: skip invalid H.264 reference list entries
     - media: chips-media: wave5: Move src_buf Removal to finish_encode
     - media: cx231xx: fix devres lifetime
     - media: cx23885: add ioremap return check and cleanup
     - media: i2c: alvium: fix critical pointer access in alvium_ctrl_init
     - media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for
       overlapping ranges
     - media: marvell-cam: fix missing pci_disable_device() on remove
     - media: meson: vdec: Fix memory leak in error path of vdec_open
     - media: msi2500: Return queued buffers on start_streaming() failure
     - media: nuvoton: npcm-video: fix error handling in npcm_video_init()
     - media: nuvoton: npcm-video: fix memory leaks in probe and remove
     - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and
       pipe
     - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure
     - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error
       path
     - media: nxp: imx8-isi: Fix potential out-of-bounds issues
     - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding
     - media: pci: dm1105: Free allocated workqueue
     - media: pwc: Drain fill_buf on start_streaming() failure
     - media: pwc: Return queued buffers on start_streaming() failure
     - media: qcom: camss: Fix RDI streaming for CSID GEN2
     - media: radio-si476x: Unregister v4l2_device on probe failure
     - media: rtl2832: fix use-after-free in rtl2832_remove()
     - media: rtl2832_sdr: Return queued buffers on start_streaming() failure
     - media: saa7134: Fix a possible memory leak in saa7134_video_init1
     - media: stm32: dcmi: unregister notifier on probe failure
     - media: sun4i-csi: Return queued buffers on start_streaming() failure
     - media: tegra-video: vi: fix invalid u32 return value in format lookup
     - media: ti: vpe: unwind v4l2 device registration on probe error
     - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete()
     - media: v4l2-ctrls: validate HEVC active reference counts
     - media: v4l2-fwnode: Fix subdev owner overwritten in
       v4l2_async_register_subdev_sensor()
     - media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely
     - media: vb2: use ssize_t for vb2_read/vb2_write
     - media: vidtv: fix reference leak on failed device registration
     - media: vimc: fix reference leak on failed device registration
     - media: vivid: add vivid_update_reduced_fps()
     - media: vivid: check for vb2_is_busy() when toggling caps
     - media: vivid: fix cleanup bugs in vivid_init()
     - media: vpif_capture: fix OF node reference imbalance
     - ALSA: seq: close a re-opened queue timer in the destructor
     - ALSA: timer: drain a slave's callback before its master detaches it
     - ALSA: timer: don't re-enter an instance callback that is still running
     - wifi: ath6kl: fix OOB access from firmware ADDBA window size
     - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper
     - wifi: wilc1000: validate assoc response length before subtracting header
     - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses
     - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses
     - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses
     - wifi: brcmfmac: make release_scratchbuffers idempotent
     - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()
     - staging: rtl8723bs: fix inverted HT40 secondary channel offset
     - Bluetooth: hci_sync: Protect UUID list traversal
     - Bluetooth: RFCOMM: Fix session UAF in set_termios
     - exec: fix unsigned loop counter wrap in transfer_args_to_stack()
     - binfmt_misc: set have_execfd only once the interpreter is opened
     - objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0
     - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
     - firmware: stratix10-svc: fix memory leaks and list corruption bugs
     - [amd64] x86/boot/compressed: Disable jump tables
     - [amd64] comedi: comedi_parport: deal with premature interrupt
     - uio_hv_generic: Bind to FCopy device by default
     - serial: sc16is7xx: implement gpio get_direction() callback
     - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR
       platforms (Closes: #1143721)
     - mei: bus: access mei_device under device_lock on cleanup
     - [amd64] intel_th: fix MSC output device reference leak
     - misc: nsm: only unlock nsm_dev on post-lock error paths
     - misc: nsm: pin the module while the device is open
     - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev
     - tracing: Fix resource leak on mmiotrace trace_pipe close
     - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match()
     - tracing/probes: Avoid temporary buffer truncation in
       trace_probe_match_command_args()
     - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro
     - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()
     - [arm64] syscall: Ensure saved x0 is kept in-sync with tracer updates
     - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer
       updates"
     - mptcp: decrement subflows counter on failed passive join
     - mptcp: only set DATA_FIN when a mapping is present
     - sctp: don't free the ASCONF's own transport in DEL-IP processing
       (CVE-2026-64564)
     - sctp: avoid auth_enable sysctl UAF during netns teardown
     - sctp: close UDP tunnel sockets during netns teardown
     - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
     - ceph: fix refcount leak in ceph_readdir()
     - libceph: bound get_version reply decode to front len
     - libceph: Fix multiplication overflow in decode_new_up_state_weight()
     - libceph: guard missing CRUSH type name lookup
     - libceph: refresh auth->authorizer_buf{,_len} after authorizer update
     - libceph: Reject monmaps advertising zero monitors
     - libceph: reject zero bucket types in crush_decode
     - libceph: remove debugfs files before client teardown
     - amt: fix use-after-free in AMT delayed works
     - ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP
     - binfmt_elf_fdpic: only honour the first PT_INTERP
     - fs: preserve ACL_DONT_CACHE state in forget_cached_acl()
     - fscrypt: Add missing superblock check in find_or_insert_direct_key()
     - ftrace: Add global mutex to serialize trace_parser access
     - iomap: fix out-of-bounds bitmap_set() with zero-length range
     - [amd64] iommu/vt-d: Disallow SVA if page walk is not coherent
     - phonet: pep: fix use-after-free in pep_get_sb()
     - vxlan: require CAP_NET_ADMIN in the device netns for changelink
     - net: slip: serialize receive against buffer reallocation
     - geneve: require CAP_NET_ADMIN in the device netns for changelink
     - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
     - net/iucv: fix use-after-free of a severed iucv_path
     - net/mlx5e: Use sender devcom for MPV master-up
     - net/x25: fix use-after-free in x25_kill_by_neigh()
     - net: gro: fix double aggregation of flush-marked skbs
     - net: hip04: fix RX buffer leak on build_skb failure
     - proc: Fix broken error paths for namespace links
     - ice: fix PTP Call Trace during PTP release
     - rbd: Reset positive result codes to zero in object map update path
     - ksmbd: defer destroy_previous_session() until after NTLM authentication
     - ice: reject out-of-range ptype in ice_parser_profile_init
     - ice: use READ_ONCE() to access cached PHC time
     - ila: reload IPv6 header after pskb_may_pull in checksum adjust
     - mac802154: hold an interface reference across the scan worker
     - mac802154: llsec: reject frames shorter than the authentication tag
     - mctp: serial: handle zero-length frames to prevent rx buffer overflow
     - openvswitch: fix GSO userspace truncation underflow
     - pppoe: reload header pointer after dev_hard_header()
     - rtase: Workaround for TX hang caused by hardware packet parsing
     - tcp: initialize standalone TCP-AO response padding
     - tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
     - vsock/virtio: collapse receive queue under memory pressure
     - vxlan: mdb: Fix source list corruption on a failed replace
     - drm/amd/pm: fix amdgpu_pm_info power display units
     - drm/amd/pm: make pp_features read-only when scpm is enabled
     - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/gfx8: drop unecessary BUG_ON()
     - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()
     - drm/amdgpu/vce: fix integer overflow in image size
     - drm/amdgpu/vcn4: avoid rereading IB param length
     - drm/dp_mst: Handle torn-down topology gracefully in
       drm_dp_mst_topology_queue_probe()
     - drm/amdgpu: fix division by zero with invalid uvd dimensions
     - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
     - drm/amdgpu: fix aperture mapping leak
     - drm/amd/pm: fix smu13 power limit range calculation
     - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops
       (CVE-2026-53078)
     - net: qrtr: ns: Raise node count limit to 512
     - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
     - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
     - ksmbd: bound DACL dedup walk to copied ACEs
     - ksmbd: validate ACE size against SID sub-authorities
     - fscrypt: Avoid dynamic allocation in fscrypt_get_devices()
     - drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources
     - io_uring/rw: fix missing ERESTARTSYS conversion in read paths
     - net: pcs: xpcs: fix SGMII state reading
     - gve: fix Rx queue stall on alloc failure
     - mm/damon/core: validate ranges in damon_set_regions()
     - mm/damon/core: disallow overlapping input ranges for damon_set_regions()
     - iommufd: Reject invalid read count in iommufd_fault_fops_read()
     - iommufd: Break the loop on failure in iommufd_fault_fops_read()
       (CVE-2026-64290)
     - iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()
     - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
       (CVE-2026-64280)
     - i2c: davinci: Unregister cpufreq notifier on probe failure
     - VFS/audit: introduce kern_path_parent() for audit
     - audit: widen ino fields to u64
     - audit: use 'unsigned int' instead of 'unsigned'
     - audit: fix recursive locking deadlock in audit_dupe_exe()
     - i2c: i801: fix hardware state machine corruption in error path
       (CVE-2026-64205)
     - ALSA: hda: conexant: Remove mic bias threshold override
     - ALSA: hda: Fix cached processing coefficient verbs
     - rxrpc: Pull out certain app callback funcs into an ops table
     - rxrpc: serialize kernel accept preallocation with socket teardown
     - xfs: factor out xfs_attr3_leaf_init
     - xfs: don't replace the wrong part of the cow fork
     - fbcon: Rename struct fbcon_ops to struct fbcon_par
     - fbcon: Use correct type for vc_resize() return value
     - rxrpc: Fix CPU time starvation in I/O thread
     - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack
     - rxrpc: Use irq-disabling spinlocks between app and I/O thread
     - rxrpc: Fix notification vs call-release vs recvmsg
     - rxrpc: Fix socket notification race
     - tipc: restrict socket queue dumps in enqueue tracepoints
     - vduse: Use fixed 4KB bounce pages for non-4KB page size
     - vduse: remove unused vaddr parameter of vduse_domain_free_coherent
     - vduse: take out allocations from vduse_dev_alloc_coherent
     - VDUSE: avoid leaking information to userspace
     - octeontx2: Annotate mmio regions as __iomem
     - octeontx2-vf: clear stale mailbox IRQ state before request_irq()
     - octeontx2-pf: clear stale mailbox IRQ state before request_irq()
     - [arm64] dts: qcom: correct RBR opp entry
     - [arm64] dts: qcom: hamoa: Fix OPP tables for all DisplayPort controllers
     - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable
     - ASoC: mediatek: mt8192: Check runtime resume during probe
     - ASoC: mediatek: mt8183-afe-pcm: Shorten memif_data table using macros
     - ASoC: mediatek: mt8183-afe-pcm: Support >32 bit DMA addresses
     - ASoC: mediatek: mt8183-afe-pcm: use local `dev` pointer in driver
       callbacks
     - ASoC: mediatek: mt8183: Check runtime resume during probe
     - netfilter: nf_conntrack_sip: remove net variable shadowing
     - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
     - netfilter: bitwise: rename some boolean operation functions
     - netfilter: nf_tables: Remove unused nft_reduce_is_readonly()
     - netfilter: nf_tables: remove register tracking infrastructure
     - netfilter: nft_fib: reject fib expression on the netdev egress hook
     - gpu: Move DRM buddy allocator one level up (part two)
     - gpu/buddy: bail out of try_harder when alignment cannot be honoured
     - NFSD: pass nfsd_file to nfsd_iter_read()
     - sunrpc: allocate a separate bvec array for socket sends
     - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists
     - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow
     - remoteproc: xlnx: Check remote core state
     - mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch
     - mm/sparse-vmemmap: fix vmemmap accounting underflow
     - landlock: Prepare to use credential instead of domain for fowner
     - landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path
     - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages
     - mtd: maps: vmu-flash: fix fault in unaligned fixup
     - mm: prepare to move subsection_map_init() to mm/sparse-vmemmap.c
     - mm/sparse-vmemmap: fix DAX vmemmap accounting with optimization
     - dma: dw-edma: Fix build warning in dw_edma_pcie_probe()
     - dmaengine: dw-edma: Fix confusing cleanup.h syntax
     - dmaengine: dw-edma-pcie: Reject devices without driver data
     - i2c: imx: separate atomic, dma and non-dma use case
     - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
     - xfrm: Use nested-BH locking for nat_keepalive_sk_ipv[46]
     - xfrm: nat_keepalive: avoid double free on send error
     - tcp: defer md5sig_info kfree past RCU grace period in tcp_connect
     - tcp: Decrement tcp_md5_needed static branch
     - nvmet: Introduce nvmet_req_transfer_len()
     - nvmet-auth: reject short AUTH_RECEIVE buffers
     - ovl: use linked upper dentry in copy-up tmpfile
     - block: add helper add_disk_final()
     - block: remove redundant GD_NEED_PART_SCAN in add_disk_final()
     - dm-integrity: fix leaking uninitialized kernel memory
     - cleanup: add a scoped version of CLASS()
     - cleanup: fix scoped_class()
     - cred: add kernel_cred() helper
     - cred: add scoped_with_kernel_creds()
     - dm: avoid leaking the caller's thread keyring via the table device file
     - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
     - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()
     - net: mana: Validate the packet length reported by the NIC
     - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink
     - gve: fix header buffer corruption with header-split and HW-GRO
     - gpio: mt7621: avoid corruption of shared interrupt trigger state
     - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
     - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
     - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
     - ipmi: fix refcount leak in i_ipmi_request()
     - net/mlx5: HWS, Rearrange to prevent forward declaration
     - net/mlx5: HWS, fix matcher leak on resize target setup failure
     - octeontx2-pf: fix SQB pointer leak on init failure
     - ata: libata-core: Reject an invalid concurrent positioning ranges count
     - fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
     - net: macb: drop in-flight Tx SKBs on close
     - net: ipa: fix SMEM state handle leaks in SMP2P init
     - Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections
     - Bluetooth: hci_core: Fix not accounting for BIS/CIS/PA links separately
     - afs: Improve server refcount/active count tracing
     - afs: Make afs_lookup_cell() take a trace note
     - afs: Drop the net parameter from afs_unuse_cell()
     - rxrpc: Allow the app to store private data on peer structs
     - afs: Use the per-peer app data provided by rxrpc
     - afs: Fix afs_server ref accounting
     - afs: Simplify cell record handling
     - afs: Fix dynamic lookup to fail on cell lookup failure
     - afs: Fix lack of locking around modifications of net->cells_dyn_ino
     - USB: gadget: Use str_enable_disable-like helpers
     - USB: gadget: fsl-udc: fix dev_printk() device
     - usb: musb: omap2430: clean up probe error handling
     - usb: musb: omap2430: Do not put borrowed of_node in probe
     - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query
     - gpu: Fix uninitialized buddy for built-in drivers
     - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link
     - rxrpc: Fix locking issues with the peer record hash
     - wifi: nl80211: fix nl80211_start_radar_detection return value
     - net: ethernet: Remove accidental duplication in Kconfig file
     - afs: Set vllist to NULL if addr parsing fails
     - dpll: fix clock quality level reporting
     - afs: Fix delayed allocation of a cell's anonymous key
     - afs: handle CB.InitCallBackState3 requests without a server record
     - Bluetooth: hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK
     - Bluetooth: hci_conn: Fix not cleaning up Broadcaster/Broadcast Source
     - Bluetooth: hci_conn: Fix not cleaning up PA_LINK connections
     - Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
     - afs: Fix uninit var in afs_alloc_anon_key()
     - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after
       hotplug
 .
   [ Salvatore Bonaccorso ]
   * [rt] Refresh "locking/rt: Add sparse annotation for RCU." (context
     changes)
   * rhashtable: clear stale iter->p on table restart (CVE-2026-64563)
linux-signed-arm64 (6.12.100+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.100-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.97
     - smb/server: do not require delete access for non-replacing links
     - [amd64] iommu/vt-d: Clear Present bit before tearing down context entry
       (CVE-2026-45944)
     - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().
     - bpf: Support for hardening against JIT spraying (CVE-2026-64508)
     - [amd64] x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)
     - bpf: Restrict JIT predictor flush to cBPF
     - bpf: Skip redundant IBPB in pack allocator
     - bpf: Prefer packs that won't trigger an IBPB flush on allocation
     - bpf: Prefer dirty packs for eBPF allocations
     - sched/fair: Only update stats for allowed CPUs when looking for dst group
     - crypto: algif_skcipher - force synchronous processing
     - [arm64] KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU
       (CVE-2026-64287)
     - [arm64] KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp
       vCPU (CVE-2026-64286)
     - iommu: Pass old domain to set_dev_pasid op
     - [amd64] iommu/vt-d: Cleanup intel_context_flush_present()
     - [amd64] iommu/vt-d: Clear Present bit before tearing down scalable-mode
       context entry
     - timekeeping: Register default clocksource before taking tk_core.lock
     - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
       (CVE-2026-64534)
     - nvmet-tcp: Fix potential UAF when ddgst mismatch (CVE-2026-64535)
     - vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365)
     - vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970)
     - [armhf] crypto: sun4i-ss - Remove insecure and unused rng_alg
     - [amd64] iommu/amd: Use maximum Event log buffer size when SNP is enabled
       on Family 0x19
     - [amd64] iommu/amd: Use maximum PPR log buffer size when SNP is enabled on
       Family 0x19
     - [amd64] x86/mm: Fix check/use ordering in switch_mm_irqs_off()
     - net: dropreason: Gather SOCKET_ drop reasons.
     - af_unix: Set drop reason in unix_release_sock().
     - af_unix: Set drop reason in manage_oob().
     - af_unix: Set drop reason in unix_stream_read_skb().
     - af_unix/scm: fix whitespace errors
     - af_unix: Don't hold unix_state_lock() in __unix_dgram_recvmsg().
     - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb().
     - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb().
     - af_unix: Drop all SCM attributes for SOCKMAP. (CVE-2026-53005)
     - crypto: crypto4xx - Remove ahash-related code
     - crypto: crypto4xx - Remove insecure and unused rng_alg
     - crypto: hisi-trng - Remove crypto_rng interface
     - time/jiffies: Register jiffies clocksource before usage
     - time/jiffies: Change register_refined_jiffies() to void __init
     - media: uvcvideo: Use hw timestaming if the clock buffer is full
     - media: uvcvideo: Avoid partial metadata buffers
     - media: uvcvideo: Fix buffer sequence in frame gaps
     - media: uvcvideo: Fix dev_sof filtering in hw timestamp
     - media: uvcvideo: Do not add clock samples with small sof delta
     - media: uvcvideo: Relax the constrains for interpolating the hw clock
     - media: uvcvideo: Fix sequence number when no EOF
     - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties
     - dt-bindings: power: imx93: Add MIPI PHY power domain
     - serial: msm: Disable DMA for kernel console UART
     - serial: max310x: implement gpio_chip::get_direction()
     - serial: 8250_omap: clear rx_running on zero-length DMA completes
     - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc
     - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK)
     - afs: Fix netns teardown to cancel the preallocation charger
     - afs: fix NULL pointer dereference in afs_get_tree()
     - afs: Fix further netns teardown to cancel the preallocation charger
     - fbcon: fix NULL pointer dereference for a console without vc_data
     - clocksource/drivers/sun5i: Handle error returns from
       devm_reset_control_get_optional_exclusive()
     - drm/rockchip: Test for imported buffers with drm_gem_is_imported()
     - drm/tidss: Drop extra drm_mode_config_reset() call
     - drm/gpuvm: Do not prepare NULL objects
     - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch()
     - drm/radeon: fix integer overflow in radeon_align_pitch()
     - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure
     - libbpf: Report error when a negative kprobe offset is specified
     - drm/amd/pm: remove trailing semicolon from AMDGPU_PM_POLICY_ATTR macro
     - Documentation: proc: fix section numbering in table of contents
     - [arm64] dts: rockchip: Fix gmac0 reset pin for NanoPi R5S
     - [arm64] dts: qcom: sc8180x: Fix phy simple_bus_reg warning
     - [arm64] dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg
       warning
     - wifi: cfg80211: fix grammar in MLO group key error message
     - [arm64] tegra: Fix Tegra234 MGBE PTP clock
     - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block
     - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc
     - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()
     - wifi: rtw89: Correct data type for scan index to avoid infinite loop
     - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer
     - kconfig: fix potential NULL pointer dereference in conf_askvalue
     - soc: xilinx: Shutdown and free rx mailbox channel
     - wifi: ath9k: fix OOB access from firmware tx status queue ID
     - [armhf] dts: am335x-sl50: Fix audio bitclock and frame master endpoint
     - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH
     - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5
     - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register
       failure
     - media: cedrus: Fix failure to clean up hardware on probe failure
     - media: v4l2-common: Add YUV24 format info
     - memory: tegra: Wire up system sleep PM ops
     - [amd64] crypto: qat - fix heartbeat error injection
     - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path
     - drm/gpuvm: take refcount on DRM device
     - [arm64] dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc
     - [arm64] dts: imx8x-colibri: Correct SODIMM PAD settings
     - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
     - [amd64] crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one
     - crypto: atmel-sha204a - fix blocking and non-blocking rng logic
     - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve
     - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents
       (CVE-2026-64544)
     - dlm: fix add msg handle in send_queue ordered
     - nilfs2: fix backing_dev_info reference leak
     - media: qcom: camss: vfe: fix PIX subdev naming on VFE lite
     - [amd64] iommu/amd: Fix a stale comment about which legacy mode is user
       visible
     - [arm64] dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host
     - clk: scmi: Fix clock rate rounding
     - [arm64] dts: qcom: kodiak: Fix ICE reg size
     - [arm64] dts: qcom: sm8450: Fix ICE reg size
     - [arm64] drm/hisilicon/hibmc: move display contrl config to hibmc_probe()
     - [arm64] drm/hisilicon/hibmc: use clock to look up the PLL value
     - evm: terminate and bound the evm_xattrs read buffer
     - thermal: hwmon: Fix critical temperature attribute removal
     - clk: scpi: Unregister child clock providers on remove
     - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats()
     - crypto: ccp - Treat zero-length cert chain as query for blob lengths
     - spi: hisi-kunpeng: Use dev_err_probe() for host registration failure
     - net/sched: sch_htb: do not change sch->flags in htb_dump()
     - net/sched: sch_htb: annotate data-races (I)
     - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD
     - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier
     - RDMA/hns: Fix arithmetic overflow in calc_hem_config()
     - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference
     - RDMA/srpt: fix integer overflow in immediate data length check
     - [arm64] RDMA/hns: Initialize seqfile before creating file
     - drm/syncobj: Fix memory leak in drm_syncobj_find_fence()
     - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table()
     - media: atomisp: gc2235: fix UAF and memory leak
     - staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy()
     - firmware: arm_scmi: Read sensor config as 32-bit value
     - sysfs: clamp show() return value in sysfs_kf_read()
     - bitops: use common function parameter names
     - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions
     - net/sched: sch_drr: annotate data-races around cl->deficit
     - media: rockchip: rga: fix too small buffer size
     - [arm64] firmware: arm_scmi: Fix OOB in scmi_power_name_get()
     - [arm64] dts: qcom: sc7180: Add power-domain and iface clk for ice node
     - [arm64] dts: qcom: kodiak: Add power-domain and iface clk for ice node
     - [arm64] dts: qcom: sm8450: Add power-domain and iface clk for ice node
     - [arm64] dts: qcom: sm8650: Add power-domain and iface clk for ice node
     - tracing: Bound synthetic-field strings with seq_buf
     - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount()
     - device property: fix fwnode reference leak in
       fwnode_graph_get_endpoint_by_id()
     - driver core: Use mod_delayed_work to prevent lost deferred probe work
     - Revert "treewide: Fix probing of devices in DT overlays"
     - cpufreq: Documentation: fix sampling_down_factor range
     - cpufreq: conservative: Simplify frequency limit handling
     - pwm: imx27: Fix variable truncation in .apply()
     - RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed
     - bus: sunxi-rsb: Always check register address validity
     - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs
     - RDMA/rxe: Fix a use-after-free problem in rxe_mmap
     - IB/mlx4: Fix refcount leak in add_port() error path
     - [arm64] RDMA/hns: Fix warning in poll cq direct mode
     - [arm64] RDMA/hns: Fix log flood after cmd_mbox failure
     - RDMA/counter: Fix incorrect port index in rdma_counter_init() error
       cleanup
     - PM: sleep: Use complete() in device_pm_sleep_init()
     - jiffies: Define secs_to_jiffies()
     - driver core: Fix missing jiffies conversion in
       deferred_probe_extend_timeout()
     - driver core: Guard deferred probe timeout extension with
       delayed_work_pending()
     - mtd: spi-nor: Drop duplicate Kconfig dependency
     - ALSA: seq: midi: Serialize output teardown with event_input
     - pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table
     - pinctrl: cs42l43: Fix polarity on debounce
     - nvmet-tcp: fix page fragment cache leak in error path
     - nvme-multipath: fix flex array size in struct nvme_ns_head
     - workqueue: drop spurious '*' from print_worker_info() fn declaration
     - ipv6: guard against possible NULL deref in __in6_dev_stats_get()
     - net/sched: cls_bpf: prevent unbounded recursion in offload rollback
     - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client
       is registered
     - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove
     - gpu: host1x: Allow entries in BO caches to be freed
     - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output()
     - gpu: host1x: Fix iommu_map_sgtable() return value check
     - drm/tegra: Fix iommu_map_sgtable() return value check
     - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada
     - libbpf: Harden parse_vma_segs() path parsing
     - bpftool: Fix typo in struct_ops map FD generation for light skeleton
     - libbpf: Fix UAF in strset__add_str()
     - dax/kmem: account for partial discontiguous resource upon removal
     - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()
     - ocfs2: don't BUG_ON an invalid journal dinode
     - ocfs2: kill osb->system_file_mutex lock
     - crypto: hisilicon/qm - disable error report before flr
     - crypto: tegra - Fix dma_free_coherent size error
     - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm
     - sched/deadline: Always stop dl-server before changing parameters
     - sched/deadline: Reject debugfs dl_server writes for offline CPUs
     - [arm64] drm/msm/dp: fix HPD state status bit shift value
     - [arm64] drm/msm/dp: Fix the ISR_* enum values
     - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info
     - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe
     - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path
     - media: qcom: venus: drop extra padding in NV12 raw size calculation
     - media: qcom: venus: relax encoder frame/blur dimension steps on v4
     - media: qcom: venus: relax encoder frame/blur step size on v6
     - amba: use generic driver_override infrastructure
     - cdx: use generic driver_override infrastructure
     - Drivers: hv: vmbus: use generic driver_override infrastructure
     - rpmsg: use generic driver_override infrastructure
     - md/raid10: reset read_slot when reusing r10bio for discard
     - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback
     - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble
     - NFSD: Fix delegation reference leak in nfsd4_revoke_states
     - HID: wiimote: Fix table layout and whitespace errors
     - ata: libata: Fix ata_exec_internal()
     - nvdimm/btt: Handle preemption in BTT lane acquisition
     - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and
       multi-channel scans"
     - scsi: pm8001: Fix error code in non_fatal_log_show()
     - scsi: ufs: Fix wrong value printed in unexpected UPIU response case
     - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs
     - mm/fake-numa: fix under-allocation detection in uniform split
     - ext2: fix ignored return value of generic_write_sync()
     - sched: restore timer_slack_ns when resetting RT policy on fork
     - driver core: Use system_percpu_wq instead of system_wq
     - tick/sched: Fix TOCTOU in nohz idle time fetch
     - configfs_lookup(): don't leave ->s_dentry dangling on failure
     - drm/amdgpu: set sub_block_index for mca ras sub-blocks
     - bpftool: Use libbpf error code for flow dissector query
     - vhost: fix vhost_get_avail_idx for a non empty ring
     - [amd64] perf/x86/amd/core: Always use the NMI latency mitigation
     - [amd64] perf/x86/intel/uncore: Fix discovery unit lookup for multi-die
       systems
     - [amd64] perf/x86/amd/uncore: Use Node ID to identify DF and UMC domains
     - xfrm: fix NAT-related field inheritance in SA migration
     - drm/amdkfd: always resume_all after suspend_all
     - ocfs2: rebase copied fsdlm LVB pointers in locking_state
     - ocfs2: fix buffer head management in ocfs2_read_blocks()
     - ocfs2: reject FITRIM ranges shorter than a cluster
     - ocfs2/dlm: require a ref for locking_state debugfs open
     - ocfs2: fix race between ocfs2_control_install_private() and
       ocfs2_control_release()
     - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures
     - netfilter: nfnetlink_cthelper: use {READ,WRITE}_ONCE for accessing helper
       flags
     - netfilter: synproxy: drop packets if timestamp adjustment fails
     - netfilter: synproxy: adjust duplicate timestamp options
     - netfilter: synproxy: fix unaligned memory access in timestamp adjustment
     - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock
     - netfilter: conntrack: revert ct extension genid infrastructure
     - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is
       pptp
     - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path()
     - RDMA/irdma: Fix OOB read during CQ MR registration
     - RDMA/irdma: Initialize iwmr->access during MR registration
     - [arm64] dts: imx95: Correct PCIe outbound address space configuration
     - [arm64] dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as
       well
     - RDMA/siw: Fix endpoint/socket association handling
     - bpf: Check tail zero of bpf_prog_info
     - bpf: Update transport_header when encapsulating UDP tunnel in lwt
     - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response
     - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO
       indication
     - wifi: wcn36xx: fix OOB read from short trigger BA firmware response
     - ALSA: seq: Fix partial userptr event expansion
     - [riscv64] cpu_ops: Change return value type of cpu_is_stopped() to bool
     - [riscv64] stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe
     - ALSA: seq: Clear variable event pointer on read
     - ACPI: IPMI: Fix message kref handling on dead device
     - cpufreq: Documentation: fix conservative governor freq_step description
     - thermal: testing: reject missing command arguments
     - IB/mlx5: Don't take the rereg_mr fallback without a new translation
     - IB/mlx5: Properly support implicit ODP rereg_mr
     - spi: ep93xx: fix double-free of zeropage on DMA setup failure
     - [amd64] ASoC: amd: acp-sdw-sof: Bound DAI link iteration
     - firmware_loader: Fix recursive lock in device_cache_fw_images()
     - configfs: fix lockless traversals of ->s_children
     - watchdog: unregister PM notifier on watchdog unregister
     - scsi: target: Fix hexadecimal CHAP_I handling
     - scsi: target: Remove tcm_loop target reset handling
     - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins
       34-39
     - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins
       34-39
     - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()
     - hwspinlock: qcom: avoid uninitialized struct members
     - sched/fair: Fix cpu_util runnable_avg arithmetic
     - wifi: mt76: mt7925: clean up DMA on probe failure
     - wifi: mt76: mt7925: fix stale pointer comparisons in change_vif_links
     - wifi: mt76: mt7925: keep TX BA state in the primary WCID
     - wifi: mt76: mt792x: skip MLD header rewrite for 802.3 encap TX
     - wifi: mt76: fix argument to ieee80211_is_first_frag()
     - wifi: mt76: mt7915: fix potential tx_retries underflow
     - wifi: mt76: mt7921: fix potential tx_retries underflow
     - wifi: mt76: mt7925: fix potential tx_retries underflow
     - wifi: mt76: mt7996: fix potential tx_retries underflow
     - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()
     - fbdev: sm501fb: Fix buffer errors in OF binding code
     - hwmon: (it87) Clamp negative values to zero in set_fan()
     - btrfs: zoned: don't account data relocation space-info in statfs free
       space
     - btrfs: fix deadlock cloning inline extent when using flushoncommit
     - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified
     - NFSD: Handle layout stid in nfsd4_drop_revoked_stid()
     - spi: meson-spifc: fix runtime PM leak on remove
     - ASoC: codecs: aw88261: fix incorrect masks for boost regs
     - vduse: hold vduse_lock across IDR lookup in open path
     - vhost/vdpa: validate virtqueue index in mmap and fault paths
     - virtio_console: read size from config space during device init
     - vduse: Requeue failed read to send_list head
     - vhost/net: complete zerocopy ubufs only once
     - tools/virtio: check mmap return value in vringh_test
     - vdpa/octeon_ep: Fix PF->VF mailbox data address calculation
     - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove()
     - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails
     - bonding: 3ad: fix mux port state on oper down
     - ext4: fix kernel BUG in ext4_write_inline_data_end
     - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT
     - of: cpu: add check in __of_find_n_match_cpu_property()
     - vfio/qat: fix f_pos race in qat_vf_resume_write()
     - bpf: Tighten cgroup storage cookie checks for prog arrays
     - ASoC: cs35l56: Fix possible uninitialized value in
       cs35l56_spi_system_reset()
     - [s390x] process: Fix kernel thread function pointer type
     - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for
       non-serdev device
     - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD
       (CVE-2026-64539)
     - Bluetooth: hci_core: Fix UAF in hci_unregister_dev()
     - Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path
     - Bluetooth: hci: validate codec capability element length
     - Bluetooth: vhci: validate devcoredump state before side effects
     - fs: efs: remove unneeded debug prints
     - RDMA/mlx5: Remove DCT restrack tracking
     - RDMA/mlx5: Remove raw RSS QP restrack tracking
     - RDMA/mlx5: Fix undefined shift of user RQ WQE size
     - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one
     - ASoC: codecs: hdac_hdmi: Validate written enum value
     - ASoC: fsl: fsl_audmix: Validate written enum values
     - ASoC: tegra: tegra210_ahub: Validate written enum value
     - net: dsa: qca8k: fix led devicename when using external mdio bus
     - net/sched: cls_flow: Dont expose folded kernel pointers
     - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().
     - bridge: cfm: reject invalid CCM interval at configuration time
       (CVE-2026-64537)
     - sctp: validate embedded address parameter length
     - net: pfcp: allocate per-cpu tstats for PFCP netdevs
     - net/sched: sch_hfsc: Don't make class passive twice
     - tipc: require net admin for TIPCv2 netlink mutators
     - tipc: prevent snt_unacked underflow on CONN_ACK
     - tipc: reject inverted service ranges from peer bindings
     - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
     - crypto: cavium/cpt - fix DMA cleanup using wrong loop index
     - crypto: rng - Free default RNG on module exit
     - ALSA: seq: Fix kernel heap address leak in bounce_error_event()
     - spi: xilinx: use FIFO occupancy register to determine buffer size
     - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO
     - power: supply: core: fix supplied_from allocations
     - handshake: Require admin permission for DONE command
     - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek
       before restoring qlen
     - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek
       before restoring qlen
     - net: mana: initialize gdma queue id to INVALID_QUEUE_ID
     - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check
     - net: ethernet: mtk_wed: fix loading WO firmware for MT7986
     - bpf: Run generic devmap egress prog on private skb
     - net/mlx5: Check max_macs devlink param value against max capability
     - octeontx2-af: npc: Fix size of entry2cntr_map
     - net: ethernet: mtk_wed: debugfs: correct index in wed_amsdu_show()
     - net: wwan: t7xx: check skb_clone in control TX
     - dpll: add reference-sync netlink attribute
     - dpll: add reference sync get/set
     - dpll: Allow associating dpll pin with a firmware node
     - dpll: Add notifier chain for dpll events
     - dpll: Support dynamic pin index allocation
     - dpll: Enhance and consolidate reference counting logic
     - dpll: fix stale iteration in dpll_pin_on_pin_unregister()
     - dpll: send delete notification before unregister in on-pin rollback
     - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister()
     - dpll: guard sync-pair removal on full pin unregister
     - dpll: balance create/delete notifications in __dpll_pin_(un)register
     - landlock: Fix unmarked concurrent access to socket family
     - net: bcmgenet: Use weighted round-robin TX DMA arbitration
     - kcm: use WRITE_ONCE() when changing lower socket callbacks
     - netfilter: nf_conncount: callers must hold rcu read lock
     - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait()
     - cifs: remove all cifs files before kill super
     - smb/client: always return a value for FS_IOC_GETFLAGS
     - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket
     - udf: fix nls leak on udf_fill_super() failure
     - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
     - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check
     - [powerpc*] perf: fix preempt count underflow in fsl_emb_pmu_del
     - [powerpc*] powernv: fix preempt count leak in
       pnv_kexec_wait_secondaries_down
     - [powerpc*] kexec: fix double get_cpu() imbalance in kexec_prepare_cpus
     - KEYS: Use acquire when reading state in keyring search
     - tipc: fix UAF in tipc_l2_send_msg()
     - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
     - net: airoha: Introduce ndo_select_queue callback
     - net: airoha: Add sched ETS offload support
     - net: airoha: Fix always-true condition in PPE1 queue reservation loop
     - net: ethernet: oa_tc6: Remove FCS size in RX frame
     - ionic: Fix check in ionic_get_link_ext_stats
     - ksmbd: fix use-after-free in same_client_has_lease()
     - mfd: rsmu: Fix page register setup
     - mfd: cs42l43: Sanity check firmware size
     - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write
     - net/9p: fix race condition on rdma->state in trans_rdma.c
     - eventpoll: expand top-of-file overview / locking doc
     - eventpoll: rename attach_epitem() to ep_attach_file()
     - eventpoll: split ep_insert() into alloc + register stages
     - eventpoll: extract ep_deliver_event() from ep_send_events()
     - eventpoll: wrap EP_UNACTIVE_PTR in typed sentinel helpers
     - eventpoll: rename epi->next and txlist for clarity
     - eventpoll: Fix epoll_wait() report false negative
     - gpiolib: acpi: Only trigger ActiveBoth interrupts on boot
     - staging: nvec: fix use-after-free in nvec_rx_completed()
     - coresight: cti: Fix DT filter signals silently ignored
     - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore
     - PCI/ASPM: Don't reconfigure ASPM entering low-power state
     - PCI: Introduce named defines for PCI ROM
     - PCI: Check ROM header and data structure addr before accessing
     - [amd64] x86/platform/olpc: xo15: Drop wakeup source on driver removal
     - [amd64] platform/x86: xo15-ebook: Fix wakeup source and GPE handling
     - PCI: loongson: Do not ignore downstream devices on external bridges
     - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker()
     - PCI: qcom: Set max OPP before DBI access during resume
     - phy: phy-can-transceiver: Check driver match and driver data against NULL
     - clk: at91: sam9x7: Fix gmac_gclk clock definition
     - coresight: Fix source not disabled on idr_alloc_u32 failure
     - mailbox: mtk-adsp: fix UAF during device teardown
     - staging: most: video: avoid double free on video register failure
     - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()
     - usb: host: max3421: Reject hub port requests for non-existent ports
     - char: tlclk: fix use-after-free in tlclk_cleanup()
     - PCI: qcom: Disable ASPM L0s for SA8775P
     - iio: light: si1133: reset counter to prevent race condition
     - iio: light: si1133: prevent race condition on timeout
     - iio: magnetometer: ak8975: fix potential kernel stack memory leak
     - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling
     - iio: accel: mma8452: handle I2C read error(s) in mma8452_read()
     - iio: tcs3472: power down chip on probe failure
     - clk: at91: keep securam node alive while mapping it
     - HID: logitech-hidpp: remove excess kernel-doc member in
       hidpp_scroll_counter
     - fs/ntfs3: add bounds check to run_get_highest_vcn()
     - fs/ntfs3: fix mount failure on 64K page-size kernels
     - drm/amd/display: Add missing kdoc for ALLM parameters
     - [amd64] thunderbolt: debugfs: Fix margining error counter buffer leak
     - dmaengine: imx-sdma: Refine spba bus searching in probe
     - perf: Fix off-by-one stack buffer overflow in kallsyms__parse()
     - dmaengine: qcom: gpi: set DMA_PRIVATE capability
     - dmaengine: Fix possible use after free
     - dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc
     - dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor
     - clk: qcom: a53: Corrected frequency multiplier for 1152MHz
     - pNFS/filelayout: fix cheking if a layout is striped
     - xprtrdma: Avoid 250 ms delay on backlog wakeup
     - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot
     - xprtrdma: Post receive buffers after RPC completion
     - xprtrdma: Use sendctx DMA state for Send signaling
     - xprtrdma: Decouple req recycling from RPC completion
     - NFSv4/pnfs: defer return_range callbacks until after inode unlock
     - nfs: keep PG_UPTODATE clear after read errors in page groups
     - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors
     - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in
       pg_get_mirror_count_write
     - nfs: use nfsi->rwsem to protect traversal of the file lock list
     - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro
     - PCI: meson: Propagate devm_add_action_or_reset() failure
     - PCI: meson: Add missing remove callback
     - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size
     - PCI: rcar-host: Remove unused LIST_HEAD(res)
     - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE
     - xprtrdma: Initialize re_id before removal registration
     - xprtrdma: Check frwr_wp_create() during connect
     - xprtrdma: Document and assert reply-handler invariants
     - xprtrdma: Resize reply buffers before reposting receives
     - xprtrdma: Fix bcall rep leak and unbounded peek
     - xprtrdma: Sanitize the reply credit grant after parsing
     - xprtrdma: Repost Receive buffers for malformed replies
     - xprtrdma: Return sendctx slot after Send preparation failure
     - tools lib api: Fix missing null termination in filename__read_int/ull()
     - tools lib api: Fix filename__write_int() writing uninitialized stack data
     - tools lib api: Fix mount_overload() snprintf truncation and toupper range
     - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port()
     - PCI: mediatek: Use actual physical address instead of virt_to_phys()
     - Revert "PCI/MSI: Unmap MSI-X region on error"
     - security/apparmor/apparmorfs.c: conditionally compile
       get_loaddata_common_ref()
     - apparmor: check label build before no_new_privs test
     - apparmor: aa_label_alloc use aa_label_free on alloc failure
     - apparmor: fix rawdata_f_data implicit flex array
     - apparmor: grab ns lock and refresh when looking up changehat child
       profiles
     - apparmor: fix potential UAF in aa_replace_profiles
     - apparmor: remove or add symlinks to rawdata according to export_binary
     - apparmor: aa_getprocattr free procattr leak on format failure
     - apparmor: put secmark label after secid lookup
     - workqueue: Add new WQ_PERCPU flag
     - i3c: master: add WQ_PERCPU to alloc_workqueue users
     - i3c: master: Make hot-join workqueue freezable to block hot-join during
       suspend
     - i3c: master: Prevent reuse of dynamic address on device add failure
     - apparmor: fix label can not be immediately before a declaration
     - gpio: mlxbf3: fail probe if gpiochip registration fails
     - [amd64] drm/i915: clear CRTC color blob pointers after dropping refs
     - spi: dw: fix wrong BAUDR setting after resume
     - xfrm: Fix xfrm state cache insertion race
     - xfrm: annotate data-races around xfrm_policy_count[] and
       xfrm_policy_default[]
     - xfrm: validate selector family and prefixlen during match
     - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode
     - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free
     - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm
     - drm/amdgpu: initialize irq.lock spinlock earlier
     - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown
     - net: psample: fix info leak in PSAMPLE_ATTR_DATA (CVE-2026-64553)
     - sctp: hold socket lock when dumping endpoints in sctp_diag
     - PCI: iproc: Restore .map_irq() for the platform bus driver
     - spi: rpc-if: Use correct device for hardware reinitialization on resume
     - virtio-net: fix len check in receive_big() (CVE-2026-64552)
     - dpaa2-switch: fix VLAN upper check not rejecting bridge join
     - devlink: Fix parent ref leak in devl_rate_node_create()
     - flow_dissector: check device type before reading ETH_ADDRS
     - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints
     - [arm64] hw_breakpoint: reject unaligned watchpoints that would truncate
       BAS
     - thermal: intel: Fix dangling resources on thermal_throttle_online()
       failure
     - ACPI: resource: Amend kernel-doc style
     - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone()
     - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit()
     - ieee802154: fix kernel-infoleak in dgram_recvmsg()
     - mac802154: Prevent overwrite return code in
       mac802154_perform_association()
     - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry
     - netfilter: ipset: Fix data race between add and dump in all hash types
     - netfilter: ipset: annotate "pos" for concurrent readers/writers
     - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash
       types
     - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()
     - netfilter: ipset: make sure gc is properly stopped
     - netfilter: nf_reject: skip iphdr options when looking for icmp header
     - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak
     - mailbox: imx: Forward the timeout/ error in imx_mu_generic_tx()
     - irqchip/crossbar: Fix parent domain resource leak
     - net: marvell: prestera: initialize err in prestera_port_sfp_bind
     - tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
       (CVE-2026-64543)
     - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths
     - octeontx2-af: mcs: Fix unsupported secy stats read
     - octeontx2-pf: Clear stats of all resources when freeing resources
     - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown
     - net/sched: act_ct: fix nf_connlabels leak on two error paths
     - ipv6: ndisc: fix NULL deref in accept_untracked_na() (CVE-2026-64542)
     - dpaa2-switch: do not accept VLAN uppers while bridged
     - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags
     - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231
     - bpf: Fix stack slot index in nospec checks
     - bpftool: Fix vmlinux BTF leak in cgroup commands
     - bpf: zero-initialize the fib lookup flow struct
     - bpf: Fix effective prog array index with BPF_F_PREORDER
     - power: sequencing: fix ABBA deadlock in pwrseq_device_unregister()
     - drm/edid: fix OOB read in drm_parse_tiled_block() (CVE-2026-64546)
     - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0
     - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0
     - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()
     - ice: fix AQ error code comparison in ice_set_pauseparam()
     - ice: call netif_keep_dst() once when entering switchdev mode
     - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info
     - ice: dpll: fix memory leak in ice_dpll_init_info error paths
     - i40e: Fix i40e_debug() to use struct i40e_hw argument
     - rtc: msc313: fix NULL deref in shared IRQ handler at probe
     - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2
       NEGOTIATE
     - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). (CVE-2026-64538)
     - net: bnxt: use ethtool string helpers
     - eth: bnxt: gather and report HW-GRO stats
     - eth: bnxt: rename ring_err_stats -> ring_drv_stats
     - eth: bnxt: improve the timing of stats
     - ipv4: fib: Don't ignore error route in local/main tables.
     - md/raid5: use stripe state snapshot in break_stripe_batch_list()
     - md/raid5: avoid R5_Overlap races while breaking stripe batches
     - bpf: Disable xfrm_decode_session hook attachment
     - netfilter: nf_nat: avoid invalid nat_net pointer use on failed
       nf_nat_init()
     - netfilter: nf_conncount: prevent connlimit drops for early confirmed ct
       (Closes: #1130336)
     - netfilter: nft_synproxy: stop bypassing the priv->info snapshot
     - netfilter: nft_compat: ebtables emulation must reject non-bridge targets
     - gpio: davinci: fix IRQ domain leak on devm_kzalloc failure
     - NTB: epf: Make db_valid_mask cover only real doorbell bits
     - NTB: epf: Report 0-based doorbell vector via ntb_db_event()
     - NTB: epf: Fix doorbell bitmask and IRQ vector handling
     - net, bpf: check master for NULL in xdp_master_redirect() (CVE-2026-64545)
     - net: dsa: sja1105: round up PTP perout pin duration
     - veth: fix NAPI leak in XDP enable error path
     - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle
       (CVE-2026-64530)
     - ipv6: fix error handling in disable_ipv6 sysctl
     - ipv6: fix error handling in ignore_routes_with_linkdown sysctl
     - ipv6: fix error handling in forwarding sysctl
     - ipv6: fix error handling in disable_policy sysctl
     - rtnetlink: Add per-netns RTNL.
     - rtnetlink: Add assertion helpers for per-netns RTNL.
     - rtnetlink: Define rtnl_net_trylock().
     - ipv6: Add __in6_dev_get_rtnl_net().
     - ipv6: Convert net.ipv6.conf.${DEV}.XXX sysctl to per-netns RTNL.
     - ipv6: fix missing notification for ignore_routes_with_linkdown
     - thermal: testing: zone: Flush work items during cleanup
     - ACPI: processor_idle: Mark LPI enter functions as __cpuidle
     - smb/client: preserve errors from smb2_set_sparse()
     - rtc: ds1307: Fix off-by-one issue with wday for rx8130
     - rtc: cmos: unregister HPET IRQ handler on probe failure
     - net: dsa: realtek: fix memory leak in rtl8366rb_setup_led()
     - octeontx2-af: Validate NIX maximum LFs correctly
     - net: mvneta: re-enable percpu interrupt on resume
     - net: sungem: fix probe error cleanup
     - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove
     - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count
     - udp_tunnel: remove rtnl_lock dependency
     - net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync
     - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22"
       fallback
     - [arm64] net: hisilicon: hns3: use ethtool string helpers
     - [arm64] net: hns3: use string choices helper
     - [arm64] net: hns3: use hns3_get_ae_dev() helper to reduce the unnecessary
       middle layer conversion
     - [arm64] net: hns3: use hns3_get_ops() helper to reduce the unnecessary
       middle layer conversion
     - [arm64] net: hns3: clear hns alarm: comparison of integer expressions of
       different signedness
     - [arm64] net: hns3: unify copper port ksettings configuration path
     - [arm64] net: hns3: refactor MAC autoneg and speed configuration
     - [arm64] net: hns3: fix permanent link down deadlock after reset
     - [arm64] net: hns3: differentiate autoneg default values between copper and
       fiber
     - tracing: probes: fix typo in a log message
     - spi: sh-msiof: abort transfers when reset times out
     - gpio: mvebu: fail probe if gpiochip registration fails
     - gpio: htc-egpio: use managed gpiochip registration
     - seg6: validate SRH length before reading fixed fields
     - qede: fix out-of-bounds check for cqe->len_list[]
     - net: enetc: check the number of BDs needed for xdp_frame
     - sctp: fix SCTP_RESET_STREAMS stream list length limit
     - MIPS: DEC: Ensure RTC platform device deregistration upon failure
     - ASoC: codecs: lpass-va-macro: add SM6115 compatible
     - ASoC: codecs: lpass-va-macro: Fix LPASS Codec Version for SC7280
     - hwmon: adm1275: Prevent reading uninitialized stack
     - hwmon: (pmbus) Fix passing events to regulator core
     - hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against
       divide-by-zero
     - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump
     - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()
       (CVE-2026-64540)
     - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy
     - net: gianfar: dispose irq mappings on probe failure and device removal
     - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF
     - bridge: stp: Fix a potential use-after-free when deleting a bridge
     - [arm64] drm/panthor: Fix potential invalid pointer deref in
       group_process_tiler_oom()
     - [arm64] drm/panthor: Don't overrule pending immediate ticks in
       sched_resume_tick()
     - [arm64] drm/panthor: Fix a leak when a group is evicted before the tiler
       OOM is serviced
     - [arm64] drm/panthor: Interrupt group start/resumption if
       group_bind_locked() fails
     - tracing/events: Fix to check the simple_tsk_fn creation
     - tracing: eprobe: read the complete FILTER_PTR_STRING pointer
     - irqchip/gic-v3-its: Fix OF node reference leak
     - irqchip/ts4800: Fix missing chained handler cleanup on remove
     - virtio_net: disable cb when NAPI is busy-polled
     - cxgb4: Fix decode strings dump for T6 adapters
     - net/sched: act_bpf: use rcu_dereference_bh() to read the filter
     - ksmbd: reject undersized DACLs before parsing ACEs
     - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check
     - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe
     - pinctrl: meson: restore non-sleeping GPIO access
     - net/sched: hhf: clear heavy-hitter state on reset
     - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid
     - afs: Fix error code in afs_extract_vl_addrs()
     - afs: Fix double netfs initialisation in afs_root_iget()
     - afs: use kvfree() to free memory allocated by kvcalloc()
     - afs: Remove erroneous seq |= 1 in volume lookup loop
     - afs: Make /afs/.<cell> as well as /afs/<cell> mountpoints
     - afs: Add rootcell checks
     - afs: Make /afs/@cell and /afs/.@cell symlinks
     - afs: Fix afs_atcell_get_link() to handle RCU pathwalk
     - afs: Remove the "autocell" mount option
     - afs: Change dynroot to create contents on demand
     - afs: Fix misplaced inc of net->cells_outstanding
     - afs: Fix callback service message parsers to pass through -EAGAIN
     - afs: Fix missing NULL pointer check in afs_break_some_callbacks()
     - afs: Fix vllist leak
     - afs: Fix the volume AFS_VOLUME_RM_TREE is set on
     - afs: Fix unchecked-length string display in debug statement
     - minix: avoid overflow in bitmap block count calculation
     - ovl: fix comment about locking order
     - netfs: Fix writeback error handling
     - drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()
     - drm/xe/hw_engine: Fix double-free of managed BO in error path
     - drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays
     - netfs: Drop the error arg from netfs_read_subreq_terminated()
     - cifs: Fix missing credit release on failure in cifs_issue_read()
     - ata: sata_gemini: unwind clocks on IDE pinctrl errors
     - ata: libata-scsi: limit simulated SCSI command copy to response length
     - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()
     - HID: core: Fix OOB read in hid_get_report for numbered reports
     - [arm64] mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()
     - HID: bpf: Fix hid_bpf_get_data() range check
     - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
       (CVE-2026-64547)
     - gue: validate REMCSUM private option length
     - netfilter: xt_u32: reject invalid shift counts
     - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()
     - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop
     - netfilter: xt_connmark: reject invalid shift parameters
     - net/mlx5: LAG, MPESW, Fix missing complete() on devcom error
     - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation
     - net/mlx5e: Fix HV VHCA stats agent registration race
     - net: microchip: vcap: fix races on the shared Super VCAP block
     - qede: fix off-by-one in BD ring consumption on build_skb failure
     - net: qualcomm: rmnet: validate MAP frame length before ingress parsing
       (CVE-2026-64550)
     - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload
     - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
     - amt: fix size calculation in amt_get_size()
     - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control
     - Bluetooth: MGMT: Fix adv monitor add failure cleanup
     - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length
     - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
       (CVE-2026-64549)
     - ring-buffer: Fix event length with forced 8-byte alignment
     - net/tls: Consume empty data records in tls_sw_read_sock()
     - net: usb: lan78xx: move functions to avoid forward definitions
     - net: usb: lan78xx: disable VLAN filter in promiscuous mode
     - [arm64] drm/v3d: Reject invalid indirect BO handle in indirect CSD setup
     - net/sched: cake: reject overhead values that underflow length
     - octeontx2-pf: check DMAC extraction support before filtering
     - [amd64] perf/x86/amd/core: Avoid enabling BRS from the SVM reload path
     - gpio: mvebu: free generic chips on unbind
     - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
     - ipv6: mcast: Replace locking comments with lockdep annotations.
     - ipv6: mcast: Fix potential UAF in MLD delayed work
     - netfilter: nft_lookup: fix catchall element handling with inverted lookups
     - ipvs: pass parsed transport offset to state handlers
     - ipvs: use parsed transport offset in TCP state lookup
     - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors
     - ipvs: ensure inner headers in ICMP errors are in headroom
     - [s390x] zcrypt: Remove the empty file
     - cifs: validate DFS referral string offsets
     - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED
     - SUNRPC: pin upper rpc_clnt across the TLS connect_worker
     - dm era: fix NULL pointer dereference in metadata_open()
     - regulator: core: regulator_lock_two() should test for EDEADLK not
       EDEADLOCK
     - net/mlx5: Fix L3 tunnel entropy refcount leak
     - octeontx2-af: fix VF bringup affecting PF promiscuous state
     - drm/xe: remove duplicate <kunit/test-bug.h> include
     - smb: client: fix overflow in passthrough ioctl bounds check
     - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()
     - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()
     - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter
     - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put
     - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc
     - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get
     - ASoC: SOF: topology: validate vendor array size before parsing
     - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()
     - net: atm: reject out-of-range traffic classes in QoS validation
     - net: ife: require ETH_HLEN to be pullable in ife_decode()
     - [arm64] fpsimd: Fix type mismatch in sve_{save,load}_state()
     - [arm64] dts: qcom: sdm630: describe adsp_mem region properly
     - [arm64] dts: ti: k3-am62a7-sk: Add bootph-all tag to vqmmc
     - [arm64] dts: imx8ulp-evk: Correct Type-C int GPIO flags
     - [s390x] KVM: s390: pci: Fix GISC refcount leak on AIF enable failure
     - [arm64] KVM: arm64: vgic: Check the interrupt is still ours before
       migrating it
     - [s390x] KVM: s390: pci: Fix handling of AIF enable without AISB
     - [amd64] KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs
     - [amd64] KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV
       EOIs
     - [arm64] KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2
     - [arm64] KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops()
       (CVE-2026-64555)
     - fbdev: metronomefb: fix potential memory leak in metronomefb_probe()
     - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()
     - fbdev: hecubafb: fix potential memory leak in hecubafb_probe()
     - fbdev: sm712: Fix operator precedence in big_swap macro
     - fbdev: efifb: fix memory leak in efifb_probe()
     - fbdev: radeon: fix potential memory leak in radeonfb_pci_register()
     - fbdev: i740fb: fix potential memory leak in i740fb_probe()
     - fbdev: s3fb: fix potential memory leak in s3_pci_probe()
     - fbdev: uvesafb: fix potential memory leak in uvesafb_probe()
     - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()
     - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()
     - fbdev: vesafb: fix memory leak in vesafb_probe()
     - fbdev: nvidia: fix potential memory leak in nvidiafb_probe()
     - fbdev: tridentfb: fix potential memory leak in trident_pci_probe()
     - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
     - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control
     - ASoC: mediatek: mt8192: Release reserved memory on cleanup
     - ASoC: mediatek: mt8183: Release reserved memory on cleanup
     - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback
     - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
     - netfilter: nfnl_cthelper: apply per-class values when updating policies
     - netfilter: xt_cluster: reject template conntracks in hash match
     - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
     - netfilter: nft_set_pipapo: don't leak bad clone into future transaction
     - netfilter: nf_nat_sip: reload possible stale data pointer
     - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6
       defrag
     - netfilter: nf_conncount: fix zone comparison in tuple dedup
     - netfilter: ecache: fix inverted time_after() check
     - netfilter: xt_nat: reject unsupported target families
     - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
       (CVE-2026-64554)
     - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error
       path
     - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy
     - soc: fsl: qe: panic on ioremap() failure in qe_reset()
     - selinux: check connect-related permissions on TCP Fast Open
     - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
     - selinux: fix incorrect execmem checks on overlayfs
     - leds: uleds: Fix potential buffer overread
     - mfd: sm501: Fix reference leak on failed device registration
     - [amd64] tools/power/x86/intel-speed-select: Harden daemon pidfile open
     - [amd64] x86/boot: Validate console=uart8250 baud rate to fix early boot
       hang
     - [amd64] x86/boot: Reject too long acpi_rsdp= values
     - [amd64] perf/x86/amd/lbr: Fix kernel address leakage
     - cpufreq: intel_pstate: Set non-turbo capacity to HWP_GUARANTEED_PERF()
     - [s390x] perf_cpum_cf: Add missing array_index_nospec() to
       __hw_perf_event_init()
     - batman-adv: gw: acquire ethernet header only after skb realloc
     - batman-adv: access unicast_ttvn skb->data only after skb realloc
     - batman-adv: dat: acquire ARP hw source only after skb realloc
     - batman-adv: bla: reacquire gw address after skb realloc
     - batman-adv: dat: ensure accessible eth_hdr proto field
     - batman-adv: dat: fix tie-break for candidate selection
     - batman-adv: tt: avoid request storms during pending request
     - batman-adv: fix VLAN priority offset
     - batman-adv: frag: free unfragmentable packet
     - batman-adv: frag: fix primary_if leak on failed linearization
     - batman-adv: mcast: avoid OOB read of num_dests header
     - batman-adv: tt: prevent TVLV OOB check overflow
     - cifs: invalidate cfid on unlink/rename/rmdir
     - mfd: tps6586x: Fix OF node refcount
     - HID: playstation: validate num_touch_reports in DualShock 4 reports
     - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready
     - Bluetooth: SCO: hold sk properly in sco_conn_ready
     - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()
     - nvdimm/btt: Free arenas on btt_init() error paths
     - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path
     - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback
     - sunrpc: wait for in-flight TLS handshake callback when cancel loses race
     - lockd: Plug nlm_file leak when nlm_do_fopen() fails
     - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure
     - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
     - remoteproc: qcom: Fix leak when custom dump_segments addition fails
     - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing
       reference leak
     - mm/memory_hotplug: fix incorrect altmap passing in error path
     - mm/damon/core: make charge_addr_from aware of end-address exclusivity
     - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename
     - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length
     - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass
     - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off
     - fs/ntfs3: validate lcns_follow in log_replay conversion (CVE-2026-64533)
     - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow
     - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}
       (CVE-2026-64532)
     - ntfs3: cap RESTART_TABLE free-chain walker at rt->used
     - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head
     - ntfs3: validate split-point offset in indx_insert_into_buffer
     - ntfs3: fix out-of-bounds read in decompress_lznt
     - power: supply: charger-manager: fix refcount leak in is_full_charged()
     - [riscv64] cacheinfo: Fix node reference leak in populate_cache_leaves
     - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()
     - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error
     - fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole()
     - fs/proc/task_mmu: use huge_page_size() in pagemap_scan_hugetlb_entry()
     - proc: only bump parent nlink when registering directories
     - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE
     - kcov: use WRITE_ONCE() for selftest mode stores
     - mtd: slram: remove failed entries from the device list
     - 9p: skip nlink update in cacheless mode to fix WARN_ON
     - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished()
     - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint
     - ocfs2: use kzalloc for quota recovery bitmap allocation
     - mtd: rawnand: pl353: fix probe resource allocation
     - net/9p: fix infinite loop in p9_client_rpc on fatal signal
     - mtd: rawnand: fix condition in 'nand_select_target()'
     - ocfs2: avoid moving extents to occupied clusters
     - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits
     - ocfs2: add journal NULL check in ocfs2_checkpoint_inode()
     - ocfs2: reject dinodes with non-canonical i_mode type
     - ocfs2: reject dinodes whose i_rdev disagrees with the file type
     - ocfs2: reject non-inline dinodes with i_size and zero i_clusters
     - fpga: dfl: add bounds check in dfh_get_param_size()
     - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path
     - net: thunderbolt: Fix frags[] overflow by bounding frame_count
     - fpga: microchip-spi: fix zero header_size OOB read in
       mpf_ops_parse_header()
     - [s390x] pkey: Check length in PKEY_VERIFYPROTK ioctl
     - [s390x] pkey: Check length in pkey_pckmo handler implementation
     - mtd: spi-nor: swp: Improve locking user experience
     - mtd: spi-nor: spansion: use die erase for multi-die devices only
     - mtd: rawnand: Pause continuous reads at block boundaries
     - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization
     - taskstats: retain dead thread stats in TGID queries
     - irqchip/crossbar: Use correct index in crossbar_domain_free()
     - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()
     - tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt
     - dmaengine: tegra: Fix burst size calculation
     - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and
       ABORT_INT_MASK
     - [amd64] platform/x86: dell-laptop: fix missing cleanups in init error path
     - [amd64] platform/x86/amd/pmc: Check for intermediate wakeup in function
     - [amd64] platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops
     - [amd64] platform/x86/amd/pmc: Add delay_suspend module parameter
     - [amd64] platform/x86/amd/pmc: Don't log during intermediate wakeups
     - pkey: Move keytype check from pkey api to handler
     - smb: client: use kvzalloc() for megabyte buffer in simple fallocate
     - ksmbd: fix integer overflow in set_file_allocation_info()
     - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig
     - hwmon: (max6697) add missing 'select REGMAP_I2C' to Kconfig
     - i2c: mediatek: fix WRRD for SoCs without auto_restart option
     - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()
     - ice: fix ice_init_link() error return preventing probe
     - xen/gntdev: fix error handling in ioctl
     - xfrm: use compat translator only for u64 alignment mismatch
     - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for
       changelink
     - tpm: fix event_size output in tpm1_binary_bios_measurements_show
     - tpm: Make the TPM character devices non-seekable
     - time: Fix off-by-one in compat settimeofday() usec validation
     - spi: uniphier: Fix completion initialization order before
       devm_request_irq()
     - sctp: validate STALE_COOKIE cause length before reading staleness
       (CVE-2026-64551)
     - NFS: Charge unstable writes by request size, not folio size
     - nvmet-rdma: handle inline data with a nonzero offset
     - netdev-genl: report NAPI thread PID in the caller's pid namespace
     - can: esd_usb: kill anchored URBs before freeing netdevs
     - can: isotp: use unconditional synchronize_rcu() in isotp_release()
     - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
     - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
     - can: bcm: add missing rcu list annotations and operations
     - bpf,fork: wipe ->bpf_storage before bailouts that access it
     - bpf: Add missing access_ok call to copy_user_syms
     - block: fix race in blk_time_get_ns() returning 0
     - net: sparx5: unregister blocking notifier on init failure
     - dm thin metadata: fix superblock refcount leak on snapshot shadow failure
     - dm thin metadata: fix metadata snapshot consistency on commit failure
     - dm era: fix out-of-bounds memory access for non-zero start sector
     - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard
     - dm-ioctl: fix a possible overflow in list_version_get_info
     - dm-log: fix a bitset_size overflow on 32bit machines
     - dm-stats: fix dm_jiffies_to_msec64
     - dm-stats: fix merge accounting
     - dm_early_create: fix freeing used table on dm_resume failure
     - dm-integrity: fix a bug if the bio is out of limits
     - dm-integrity: don't increment hash_offset twice
     - dm-verity: avoid double increment of &use_bh_wq_enabled
     - dm-verity: fix a possible NULL pointer dereference
     - dm-verity: increase sprintf buffer size
     - dm-verity: make error counter atomic
     - [amd64] accel/ivpu: Reject firmware log with size smaller than header
     - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
     - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
     - scsi: sg: Report request-table problems when any status is set
     - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path
     - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it
     - scsi: target: Bound PR-OUT TransportID parsing to the received buffer
     - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
     - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()
     - scsi: elx: efct: Fix I/O leak on unsupported additional CDB
     - Input: ims-pcu - fix use-after-free and double-free in disconnect
     - Input: ims-pcu - only expose sysfs attributes on control interface
     - Input: ims-pcu - release data interface on disconnect
     - Input: ims-pcu - validate control endpoint type
     - Input: ims-pcu - add response length checks
     - Input: ims-pcu - fix DMA mapping violation in line setup
     - Input: ims-pcu - fix firmware leak in async update
     - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging
     - Input: ims-pcu - fix potential infinite loop in CDC union descriptor
       parsing
     - Input: ims-pcu - fix race condition in reset_device sysfs callback
     - Input: ims-pcu - fix type confusion in CDC union descriptor parsing
     - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete
     - tracing/user_events: Fix use-after-free in user_event_mm_dup()
     - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
     - cpu: hotplug: Preserve per instance callback errors
     - cpu: hotplug: Bound hotplug states sysfs output
     - gpio: tegra: do not call pinctrl for GPIO direction
     - gpio-f7188x: Add support for NCT6126D version B
     - gpios: palmas: add .get_direction() op
     - net: sit: require CAP_NET_ADMIN in the device netns for changelink
     - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure
     - net: ixp4xx_hss: fix duplicate HDLC netdev allocation
     - net/sched: act_ct: preserve tc_skb_cb across defragmentation
     - net: ena: clean up XDP TX queues when regular TX setup fails
     - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink
     - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink
     - net: ipip: require CAP_NET_ADMIN in the device netns for changelink
     - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
     - octeontx2-af: Free BPID bitmap on setup failure
     - ieee802154: admin-gate legacy LLSEC dump operations
     - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation
     - ieee802154: ca8210: fix cas_ctl leak on spi_async failure
     - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit
     - [amd64] platform/x86/amd/pmc: Avoid logging "(null)" for DMI values
     - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants
     - [s390x] Revert support for DCACHE_WORD_ACCESS (CVE-2026-64369)
     - batman-adv: retrieve ethhdr after potential skb realloc on RX
     - batman-adv: ensure minimal ethernet header on TX
     - batman-adv: clean untagged VLAN on netdev registration failure
     - espintcp: use sk_msg_free_partial to fix partial send
     - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()
     - rtc: mpfs: fix counter upload completion condition
     - hwmon: (w83627hf) remove VID sysfs files on error and remove
     - hwmon: (w83793) remove vrm sysfs file on probe failure
     - net: liquidio: fix BAR resource leak on PF number failure
     - hwmon: (occ) unregister sysfs devices outside occ lock
     - fsl/fman: Free init resources on KeyGen failure in fman_init()
     - net: lan743x: Initialize eth_syslock spinlock before use
     - net/sched: sch_multiq: Replace direct dequeue call with peek and
       qdisc_dequeue_peeked
     - net/sched: sch_taprio: Replace direct dequeue call with peek and
       qdisc_dequeue_peeked
     - fhandle: reject detached mounts in capable_wrt_mount()
     - hwmon: (max1619) add missing 'select REGMAP' to Kconfig
     - tracing/probes: Fix double addition of offset for @+FOFFSET
     - orangefs: keep the readdir entry size 64-bit in fill_from_part()
     - ata: pata_pxa: Fix DMA channel leak on probe error
     - net: wwan: iosm: bound device offsets in the MUX downlink decoder
     - hwmon: (asus_atk0110) Check package count before accessing element
     - [riscv64] probes: save original sp in rethook trampoline
     - mm/compaction: handle free_pages_prepare() properly in compaction_free()
     - irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure
     - [s390x] monwriter: Reject buffer reuse with different data length
     - mac802154: remove interfaces with RCU list deletion
     - llc: fix SAP refcount leak in llc_ui_autobind()
     - ipvs: use parsed transport offset in SCTP state lookup
     - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
     - macsec: don't read an unset MAC header in macsec_encrypt()
     - [arm64] smp: Fix hot-unplug tearing by forcing unregistration
     - ata: libata-core: Skip HPA resize for locked drives
     - drbd: reject data replies with an out-of-range payload size
     - [riscv64] Prevent NULL pointer dereference in machine_kexec_prepare()
     - tracing/osnoise: Call synchronize_rcu() when unregistering
     - [s390x] mm: Fix type mismatch in get_align_mask().
     - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
     - pmdomain: imx: Fix i.MX8MP power notifier
     - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence
     - [powerpc*] pseries: fix memory leak on krealloc failure in papr_init
     - wifi: rt2x00: avoid full teardown before work setup in probe
     - wifi: mwifiex: fix roaming to different channel in host_mlme mode
     - wifi: mac80211: fix memory leak in ieee80211_register_hw()
     - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
     - net: openvswitch: reject oversized nested action attrs (CVE-2026-64531)
     - Bluetooth: btrtl: validate firmware patch bounds
     - llc: fix SAP refcount leak when creating incoming sockets
     - macsec: fix promiscuity refcount leak in macsec_dev_open()
     - memstick: ms_block: reject a card that reports too many blocks
     - ipvs: fix more places with wrong ipv6 transport offsets
     - ipvs: reload ip header after head reallocation
     - reset: sunxi: fix memory region leak on ioremap failure
     - [powerpc*] spufs: fix out-of-bounds access in spufs_mem_mmap_access()
     - wifi: mac80211: free ack status frame on TX header build failure
     - wifi: mwifiex: fix permanently busy scans after multiple roam iterations
     - mtd: onenand: samsung: report DMA completion timeouts
     - mtd: mchp23k256: use SPI match data for chip caps
     - mmc: vub300: defer reset until cmd_mutex is unlocked
     - mtd: rawnand: fsl_ifc: return errors for failed page reads
     - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
     - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
     - mmc: block: fix RPMB device unregister ordering
     - mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method
     - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
     - ACPI: driver: Check ACPI_COMPANION() against NULL during probe
     - ACPI: bus: Introduce devm_acpi_install_notify_handler()
     - ACPI: NFIT: core: Use devm_acpi_install_notify_handler()
     - ACPI: NFIT: core: Fix possible deadlock and missing notifications
     - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values
     - iio: adc: ad7380: select REGMAP
     - iio: pressure: Remove redundant pm_runtime_mark_last_busy() calls
     - iio: pressure: mpl115: fix runtime PM leak on read error (CVE-2026-64493)
     - ALSA: aoa: check snd_ctl_new1() return value
     - ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)
     - ALSA: scarlett2: Allow selecting config_set by firmware version
     - ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417
     - vfio/mlx5: Fix racy bitfields and tighten struct layout (CVE-2026-64472)
     - PCI: altera: Fix resource leaks on probe failure (CVE-2026-64462)
     - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle()
     - PCI: mediatek: Switch to msi_create_parent_irq_domain()
     - PCI: mediatek: Convert bool to single quirks entry and bitmap
     - PCI: mediatek: Use generic MACRO for TPVPERL delay
     - PCI: mediatek: Fix IRQ domain leak when port fails to enable
       (CVE-2026-64461)
     - PCI: Use pbus_select_window() during BAR resize
     - PCI: Prevent resource tree corruption when BAR resize fails
     - PCI: Free saved list without holding pci_bus_sem
     - PCI: Fix restoring BARs on BAR resize rollback path
     - PCI: Move Resizable BAR code to rebar.c
     - PCI: Skip Resizable BAR restore on read error
     - staging: rtl8723bs: core: move constants to right side in comparison
     - staging: rtl8723bs: fix spaces around binary operators
     - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(),
       and rtw_get_wps_attr()
     - [amd64] crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
       (CVE-2026-64438)
     - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
       (CVE-2026-64434)
     - gpio: sch: use raw_spinlock_t in the irq startup path (CVE-2026-64428)
     - io_uring/rw: ensure reissue path is correctly handled for IOPOLL
     - io_uring/rw: preserve partial result for iopoll
     - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code
     - media: nxp: imx8-isi: Fix use-after-free on remove (CVE-2026-64421)
     - netfilter: ebtables: Use vmalloc_array() to improve code
     - netfilter: ebtables: zero chainstack array (CVE-2026-64413)
     - Bluetooth: L2CAP: Fix not tracking outstanding TX ident
     - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
       (CVE-2026-64206)
     - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO
     - Bluetooth: separate CIS_LINK and BIS_LINK link types
     - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
       (CVE-2026-64405)
     - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
     - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
     - mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host
       (CVE-2026-64416)
     - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg()
     - smb: client: resolve SWN tcon from live registrations (CVE-2026-64401)
     - ksmbd_vfs_rename(): vfs_path_parent_lookup() accepts ERR_PTR() as name
     - vfs: make LAST_XXX private to fs/namei.c
     - ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
     - ksmbd: use opener credentials for FSCTL mutations
     - ksmbd: centralize ksmbd_conn final release to plug transport leak
     - ksmbd: track the connection owning a byte-range lock (CVE-2026-64390)
     - proc: rename proc_setattr to proc_nochmod_setattr
     - proc: protect ptrace_may_access() with exec_update_lock (FD links)
     - [amd64] perf/x86/intel/uncore: Defer ADL global PMON enable to
       enable_box()
     - HID: add haptics page defines
     - HID: multitouch: fix out-of-bounds bit access on mt_io_flags
       (CVE-2026-64364)
     - seqlock: Introduce scoped_seqlock_read()
     - seqlock: Change do_task_stat() to use scoped_seqlock_read()
     - proc: protect ptrace_may_access() with exec_update_lock (part 1)
     - treewide: Switch/rename to timer_delete[_sync]()
     - HID: appleir: fix UAF on pending key_up_timer in remove() (CVE-2026-64363)
     - HID: pidff: Fix missing blank lines after declarations
     - HID: pidff: Add missing spaces
     - HID: pidff: Rework pidff_upload_effect
     - HID: pidff: Use correct effect type in effect update
     - hfs/hfsplus: prevent getting negative values of offset/length
     - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
       (CVE-2026-64361)
     - bpf: Convert lpm_trie.c to rqspinlock
     - bpf, arm64, powerpc: Add bpf_jit_bypass_spec_v1/v4()
     - bpf: Consistently use bpf_rcu_lock_held() everywhere
     - bpf: Allow LPM map access from sleepable BPF programs (CVE-2026-64352)
     - usb: iowarrior: remove inherent race with minor number
     - USB: iowarrior: fix use-after-free on disconnect race (CVE-2026-64341)
     - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
     - crypto: atmel - Drop explicit initialization of struct
       i2c_device_id::driver_data to 0
     - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
     - usb: gadget: f_fs: initialize reset_work at allocation time
     - crypto: atmel-sha204a - fail on hwrng registration error in probe path
     - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
     - btrfs: concentrate the error handling of submit_one_sector()
     - btrfs: replace for_each_set_bit() with for_each_set_bitmap()
     - btrfs: remove folio parameter from ordered io related functions
     - btrfs: remove the COW fixup mechanism
     - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC
     - [amd64] crypto: ccp - Move dev_info/err messages for SEV/SNP init and
       shutdown
     - [amd64] crypto: ccp - Reset TMR size at SNP Shutdown
     - [amd64] crypto: ccp - Register SNP panic notifier only if SNP is enabled
     - [amd64] crypto: ccp - Move SEV/SNP Platform initialization to KVM
     - [amd64] crypto: ccp - Fix a case where SNP_SHUTDOWN is missed
     - [amd64] crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)
     - [amd64] crypto: qat - fix restarting state leak on allocation failure
     - exfat: remove unnecessary read entry in __exfat_rename()
     - exfat: rename argument name for exfat_move_file and exfat_rename_file
     - exfat: add exfat_get_dentry_set_by_ei() helper
     - exfat: move exfat_chain_set() out of __exfat_resolve_path()
     - exfat: fix incorrect directory checksum after rename to shorter name
     - exfat: preserve benign secondary entries during rename and move
     - btrfs: fix false IO failure after falling back to buffered write
     - btrfs: fix incorrect buffered IO fallback for append direct writes
     - slab: Introduce kmalloc_obj() and family
     - slab: Introduce kmalloc_flex() and family
     - add default_gfp() helper macro and use it in the new *alloc_obj() helpers
     - default_gfp(): avoid using the "newfangled" __VA_OPT__ trick
     - slab: recognize @GFP parameter as optional in kernel-doc
     - fscrypt: Fix key setup in edge case with multiple data unit sizes
     - fscrypt: Replace mk_users keyring with simple list
     - mm/damon/core: always put unsuccessfully committed target pids
     - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
     - [arm64] KVM: arm64: Ensure level is always initialized when relaxing perms
     - [arm64] KVM: arm64: Fix propagation of TLBI level in
       kvm_pgtable_stage2_relax_perms()
     - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is
       uninitialized (CVE-2026-64192)
     - [amd64] perf/x86/amd/brs: Fix kernel address leakage
     - dibs: loopback: validate offset and size in move_data()
     - seqlock: fix scoped_seqlock_read kernel-doc
     - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
     - rtnetlink: Make per-netns RTNL dereference helpers to macro.
     - net: airoha: Fix channel configuration for ETS Qdisc
     - jiffies: Cast to unsigned long in secs_to_jiffies() conversion
     - afs: Fix afs_atcell_get_link() to check if ws_cell is unset first
     - afs: Fix afs_dynroot_readdir() to not use the RCU read lock
     - [amd64] crypto: ccp - Fix __sev_snp_shutdown_locked
     - [amd64] crypto: ccp - Fix dereferencing uninitialized error pointer
     - [amd64] crypto: ccp - Fix SNP panic notifier unregistration
     - udp_tunnel: fix deadlock in udp_tunnel_nic_set_port_priv()
     - Bluetooth: hci_core: Remove check of BDADDR_ANY in
       hci_conn_hash_lookup_big_state
     - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle
     - [amd64] crypto: ccp - Always pass in an error pointer to
       __sev_platform_shutdown_locked()
     - i40e: drop udp_tunnel_get_rx_info() call from i40e_open()
     - ice: drop udp_tunnel_get_rx_info() call from ndo_open()
     - [amd64] crypto: ccp - Fix leaking the same page twice
     - Bluetooth: L2CAP: Fix regressions caused by reusing ident
     - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
     - Bluetooth: L2CAP: fix tx ident leak for commands without a response
     - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
     - tools/testing: add linux/args.h header and fix radix, VMA tests
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.98
     - ext4: fix fd leak in EXT4_IOC_MOVE_EXT cross-sb validation
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.99
     - mm: refactor mm_access() to not return NULL
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.100
     - posix-cpu-timers: Prevent UAF caused by non-leader exec() race
       (CVE-2026-64560)
linux-signed-arm64 (6.12.96+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.96-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.96
     - [arm64] bpf, arm64: Reject out-of-range B.cond targets
     - nfsd: fix file change detection in CB_GETATTR
     - nfsd: release layout stid on setlease failure
     - userfaultfd: gate must_wait writability check on pte_present()
     - perf: Fix dangling cgroup pointer in cpuctx backport
     - bcachefs: avoid truncating fiemap extent length
     - drm/amd: Fix set but not used warnings
     - gpio: rockchip: change the GPIO version judgment logic
     - gpio: rockchip: teardown bugs and resource leaks
     - gpio: rockchip: fix generic IRQ chip leak on remove (CVE-2026-53226)
     - mm/vmalloc: take vmap_purge_lock in shrinker (CVE-2026-46093)
     - device property: initialize the remaining fields of fwnode_handle in
       fwnode_init()
     - f2fs: validate orphan inode entry count
     - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode
     - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
     - f2fs: fix potential deadlock in f2fs_balance_fs()
     - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
     - f2fs: fix listxattr handling of corrupted xattr entries
     - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
     - nfsd: add nfsd_file_{get,put} to 'nfs_to' nfsd_localio_operations
     - nfs_common: rename functions that invalidate LOCALIO nfs_clients
     - NFSv4/flexfiles: Remove cred local variable dependency
     - NFSv4/flexfiles: Add data structure support for striped layouts
     - NFSv4/flexfiles: reject zero filehandle version count
     - locking/rtmutex: Make sure we wake anything on the wake_q when we release
       the lock->wait_lock
     - apparmor: advertise the tcp fast open fix is applied
     - nfsd: move name lookup out of nfsd4_list_rec_dir()
     - nfsd: change nfs4_client_to_reclaim() to allocate data
     - bonding: fix xfrm offload feature setup on active-backup mode
     - block: add a store_limit operations for sysfs entries
     - block: fix queue freeze vs limits lock order in sysfs store methods
       (CVE-2025-21807)
     - mm/khugepaged: write all dirty file folios when collapsing
     - perf trace beauty fcntl: Fix build with older kernel headers
     - ACPI: CPPC: Suppress UBSAN warning caused by field misuse
     - ACPI: NFIT: core: Fix possible NULL pointer dereference
     - [amd64] platform/x86: intel-hid: Protect ACPI notify handler against
       recursion
     - perf/core: Detach event groups during remove_on_exec
     - [amd64] drm/i915: ensure segment offset never exceeds allowed max
     - usb: gadget: function: rndis: add length check to response query
     - usb: gadget: function: rndis: add length check for header
     - iio: accel: bmc150: clamp the device-reported FIFO frame count
     - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
     - iio: adc: lpc32xx: Initialize completion before requesting IRQ
     - iio: adc: spear: Initialize completion before requesting IRQ
     - iio: adc: ti-ads1119: fix PM reference leak in buffer preenable
     - iio: adc: ti-ads124s08: Return reset GPIO lookup errors
     - iio: backend: fix uninitialized data in debugfs
     - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
     - iio: common: st_sensors: honour channel endianness in read_axis_data
     - iio: event: Fix event FIFO reset race
     - iio: gyro: bmg160: bail out when bandwidth/filter is not in table
     - iio: gyro: bmg160: wait full startup time after mode change at probe
     - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
     - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
     - iio: imu: inv_icm42600: fix timestamp clock period by using lower value
     - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
     - iio: imu: st_lsm6dsx: deselect shub page before reading whoami
     - iio: light: al3010: fix incorrect scale for the highest gain range
     - iio: light: gp2ap002: fix runtime PM leak on read error
     - iio: light: opt3001: fix missing state reset on timeout
     - iio: light: tsl2591: return actual error from probe IRQ failure
     - iio: light: veml6030: fix channel type when pushing events
     - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
     - iio: resolver: ad2s1210: notify trigger and clear state on fault read
       error
     - iio: temperature: Build mlx90635 with CONFIG_MLX90635
     - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check
     - iio: temperature: ltc2983: Fix reinit_completion() called after conversion
       start
     - ALSA: virtio: Add missing 384 kHz PCM rate mapping
     - ALSA: virtio: Validate control metadata from the device
     - ALSA: ymfpci: check snd_ctl_new1() return value
     - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
     - ALSA: cmipci: check snd_ctl_new1() return value
     - ALSA: es1938: check snd_ctl_new1() return value
     - ALSA: firewire: isight: bound the sample count to the packet payload
     - ALSA: gus: check snd_ctl_new1() return value
     - ALSA: ice1712: check snd_ctl_new1() return value
     - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
     - ALSA: usb-audio: avoid kobject path lookup in DualSense match
     - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
     - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch
       put callbacks
     - ALSA: usb-audio: Roll back quirk control caches on write errors
     - ALSA: usb-audio: Update Babyface Pro control caches only after successful
       writes
     - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful
       writes
     - vfio/pci: Use a private flag to prevent power state change with VFs
     - vfio/pci: Latch disable_idle_d3 per device
     - vfio/pci: Release the VGA arbiter client on register_device() failure
     - vfio/pci: Fix racy bitfields and tighten struct layout
     - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
     - vfio: Remove device debugfs before releasing devres
     - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB
     - Bluetooth: btusb: fix use-after-free on registration failure
     - Bluetooth: btusb: fix use-after-free on marvell probe failure
     - Bluetooth: btusb: fix wakeup source leak on probe failure
     - [arm*] binder: fix UAF in binder_thread_release()
     - [arm*] binder: fix UAF in binder_free_transaction()
     - usb: xhci: Fix sleep in atomic context in xhci_free_streams()
     - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
     - PCI: host-common: Request bus reassignment when not probe-only
     - [arm*] PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
     - mm/damon/ops-common: handle extreme intervals in damon_hot_score()
     - netfilter: ipset: fix race between dump and ip_set_list resize
     - virtio_pci: fix vq info pointer lookup via wrong index
     - virtio-mmio: fix device release warning on module unload
     - hwrng: virtio: clamp device-reported used.len at copy_data()
     - USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
     - usb: dwc3: run gadget disconnect from sleepable suspend context
     - 6lowpan: fix NHC entry use-after-free on error path
     - tipc: fix out-of-bounds read in broadcast Gap ACK blocks
     - staging: vme_user: bound slave read/write to the kern_buf size
     - smb: client: restrict implied bcc[0] exemption to responses without data
       area
     - staging: vme_user: fix location monitor leak in fake bridge
     - staging: vme_user: fix location monitor leak in tsi148 bridge
     - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
     - staging: media: atomisp: reduce load_primary_binaries() stack usage
     - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
     - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
     - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
     - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
     - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and
       join_cmd_hdl()
     - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
     - staging: rtl8723bs: fix OOB write in HT_caps_handler()
     - crypto: amlogic - avoid double cleanup in meson_crypto_probe()
     - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then
       SMB2_CANCEL
     - net: af_key: initialize alg_key_len for IPComp states
     - audit: Fix data races of skb_queue_len() readers on audit_queue
     - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
     - coresight: etb10: restore atomic_t for shared reading state
     - debugobjects: Plug race against a concurrent OOM disable
     - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns
     - NTB: epf: Avoid calling pci_irq_vector() from hardirq context
     - gpio: eic-sprd: use raw_spinlock_t in the irq startup path
     - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
     - netpoll: fix a use-after-free on shutdown path
     - ipv4: igmp: remove multicast group from hash table on device destruction
     - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
     - mfd: cros_ec: Delay dev_set_drvdata() until probe success
     - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
     - mm: shrinker: fix shrinker_info teardown race with expansion
     - mm: shrinker: fix NULL pointer dereference in debugfs
     - mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent
       softlockup
     - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump
     - netfilter: handle unreadable frags
     - netfilter: ebtables: module names must be null-terminated
     - netfilter: ebtables: terminate table name before find_table_lock()
     - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
     - Bluetooth: bnep: pin L2CAP connection during netdev registration
     - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in
       nxp_recv_fw_req_v3()
     - Bluetooth: fix UAF in bt_accept_dequeue()
     - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
     - Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
     - Bluetooth: L2CAP: validate option length before reading conf opt value
     - fs/ntfs3: rename ni_readpage_cmpr into ni_read_folio_cmpr
     - fs/ntfs3: fsync files by syncing parent inodes
     - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio()
     - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
       (CVE-2026-53027)
     - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()
     - smb/client: Fix error code in smb2_aead_req_alloc()
     - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
     - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA
     - ksmbd: serialize QUERY_DIRECTORY requests per file
     - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation
     - ksmbd: require source read access for duplicate extents
     - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY
     - ksmbd: run set info with opener credentials
     - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION
     - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION
     - ksmbd: use opener credentials for delete-on-close
     - ksmbd: use opener credentials for ADS I/O
     - smb: client: fix query directory replay double-free
     - smb: client: fix query_info() replay double-free
     - smb: client: fix double-free in SMB2_ioctl() replay
     - smb: client: fix change notify replay double-free
     - smb: client: fix double-free in SMB2_flush() replay
     - smb: client: fix double-free in SMB2_open() replay
     - smb: client: fix double-free in SMB2_close() replay
     - smb: client: Fix next buffer leak in receive_encrypted_standard()
     - smb: client: use unaligned reads in parse_posix_ctxt()
     - smb: client: harden POSIX SID length parsing
     - smb: client: fix atime clamp check in read completion
     - smb: client: mask server-provided mode to 07777 in modefromsid
     - writeback: fix race between cgroup_writeback_umount() and
       inode_switch_wbs()
     - cpufreq: qcom-cpufreq-hw: Fix possible double free
     - firmware_loader: fix device reference leak in firmware_upload_register()
     - [amd64] cpufreq: intel_pstate: Sync policy->cur during CPU offline
     - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
     - cpufreq: Fix hotplug-suspend race during reboot
     - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
     - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
     - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog
       instances
     - X.509: Fix validation of ASN.1 certificate header
     - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
     - tools/mm/slabinfo: Fix trace disable logic inversion
     - tools/mm/slabinfo: fix total_objects attribute name
     - HID: hid-goodix-spi: validate report size to prevent stack buffer overflow
     - HID: wacom: stop hardware after post-start probe failures
     - HID: letsketch: fix UAF on inrange_timer at driver unbind
     - HID: lg-g15: cancel pending work on remove to fix a use-after-free
     - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte
       reads
     - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
     - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
     - media: mtk-jpeg: cancel workqueue on release for supported platforms only
     - serial: 8250_mid: Disable DMA for selected platforms
     - xfs: use null daddr for unset first bad log block
     - xfs: release dquot buffer after dqflush failure
     - xfs: fix unreachable BIGTIME check in dquot flush validation
     - xfs: fix pointer arithmetic error on 32-bit systems
     - xfs: fix exchmaps reservation limit check
     - bpf: Reject fragmented frames in devmap
     - bpf: Restore sysctl new-value from 1 to 0
     - bpf: Validate BTF repeated field counts before expansion
     - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
     - usb: cdc_acm: Add quirk for Uniden BC125AT scanner
     - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
     - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub
     - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()
     - usb: free iso schedules on failed submit
     - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
     - usb: gadget: udc: Fix use-after-free in gadget_match_driver
     - usb: gadget: f_printer: take kref only for successful open
     - USB: idmouse: fix use-after-free on disconnect race
     - USB: ldusb: fix use-after-free on disconnect race
     - USB: iowarrior: fix use-after-free on disconnect
     - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD
     - USB: legousbtower: fix use-after-free on disconnect race
     - usb: sl811-hcd: disable controller wakeup on remove
     - USB: storage: include US_FL_NO_SAME in quirks mask
     - USB: misc: uss720: unregister parport on probe failure
     - usb: mtu3: unmap request DMA on queue failure
     - USB: serial: keyspan_pda: fix information leak
     - USB: serial: option: add Telit Cinterion FE990D50 compositions
     - USB: serial: digi_acceleport: fix broken rx after throttle
     - USB: serial: digi_acceleport: fix hard lockup on disconnect
     - USB: serial: digi_acceleport: fix write buffer corruption
     - USB: ulpi: fix memory leak on registration failure
     - USB: usb-storage: ene_ub6250: restore media-ready check
     - usbip: tools: support SuperSpeedPlus devices
     - usbip: vudc: fix NULL deref in vep_dequeue()
     - usb: typec: anx7411: use devm_pm_runtime_enable()
     - usb: typec: class: drop PD lookup reference
     - usb: typec: tcpm: Fix VDM type for Enter Mode commands
     - usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
     - usb: typec: ucsi: Invert DisplayPort role assignment
     - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt
       mode
     - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
     - usb: typec: ucsi: cancel pending work on system suspend
     - usb: gadget: f_fs: Fix DMA fence leak
     - block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
     - [amd64] x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU
       when SNC enabled
     - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining
     - udf: validate free block extents against the partition length
     - udf: validate VAT header length against the VAT inode size
     - udf: validate sparing table length as an entry count, not a byte count
     - hwrng: jh7110 - fix refcount leak in starfive_trng_read()
     - nvme: target: rdma: fix ndev refcount leak on queue connect
     - dm-ioctl: report an error if a device has no table
     - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace
       disks
     - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
     - nvmet-auth: validate reply message payload bounds against transfer length
     - btrfs: do not trim a device which is not writeable
     - partitions: aix: bound the pp_count scan to the ppe array
     - isofs: bound Rock Ridge symlink components to the SL record
     - crypto: af_alg - Remove zero-copy support from skcipher and aead
     - [arm64] crypto: caam - use print_hex_dump_devel to guard key hex dumps
     - [arm64] crypto: caam - use print_hex_dump_devel to guard key hex dumps
       again
     - crypto: ecc - Fix carry overflow in vli multiplication
     - crypto: pcrypt - restore callback for non-parallel fallback
     - [amd64] crypto: ccp - Do not initialize SNP for SEV ioctls
     - [amd64] crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)
     - [amd64] crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)
     - crypto: drbg - Fix returning success on failure in CTR_DRBG
     - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
     - crypto: drbg - Fix the fips_enabled priority boost
     - [amd64] crypto: qat - keep VFs enabled during reset
     - [amd64] crypto: qat - notify fatal error before AER reset preparation
     - [amd64] crypto: qat - protect service table iterations with service_lock
     - [amd64] crypto: qat - validate RSA CRT component lengths
     - [arm64] fpsimd: Fix type mismatch in sme_{save,load}_state()
     - spi: fsl-lpspi: replace dmaengine_terminate_all() with
       dmaengine_terminate_sync()
     - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
     - EDAC/i10nm: Don't fail probing if ADXL is missing
     - watchdog: apple: Add "apple,t8103-wdt" compatible
     - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
     - i2c: core: fix hang on adapter registration failure
     - tracing: Prevent out-of-bounds read in glob matching
     - audit: fix potential integer overflow in audit_log_n_hex()
     - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
     - module: decompress: check return value of module_extend_max_pages()
     - exfat: bound uniname advance in exfat_find_dir_entry()
     - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()
     - riscv: mm: Unconditionally sfence.vma for spurious fault
     - mm: fix mmap errno value when MAP_DROPPABLE is not supported
     - mm: do file ownership checks with the proper mount idmap
     - [amd64] iommu/amd: Don't split flush for amd_iommu_domain_flush_all()
     - iommufd: Set upper bounds on cache invalidation entry_num and entry_len
     - [amd64] KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected
       #DBs
     - [amd64] KVM: x86: Ensure vendor's exit handler runs before fastpath
       userspace exits
     - [amd64] KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in
       guest mode
     - udmabuf: fix DMA direction mismatch in release_udmabuf()
     - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
     - i2c: core: fix irq domain leak on adapter registration failure
     - i2c: core: fix NULL-deref on adapter registration failure
     - i2c: core: fix adapter probe deferral loop
     - i2c: core: fix adapter debugfs creation
     - i2c: core: fix adapter deregistration race
     - i2c: mpc: Fix timeout calculations
     - i2c: stm32f7: truncate clock period instead of rounding it
     - Input: synaptics-rmi4 - unregister function handlers on physical driver
       registration failure
     - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
     - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
     - Input: elan_i2c - prevent division by zero and arithmetic underflow
     - Input: goodix - clamp the device-reported contact count
     - Input: iforce - bound the device-reported force-feedback effect index
     - Input: mms114 - fix touch indexing for MMS134S and MMS136
     - Input: touchwin - reset the packet index on every complete packet
     - Input: mms114 - reject an oversized device packet size
     - Input: maplemouse - fix NULL pointer dereference in open()
     - Input: mms114 - fix multi-touch slot corruption
     - Input: maple_keyb - set driver data before registering input device
     - Input: maplemouse - set driver data before registering input device
     - Input: maplecontrol - set driver data before registering input device
     - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
     - RDMA/siw: bound Read Response placement to the RREAD length
     - fuse: fix device node leak in cuse_process_init_reply()
     - fuse: re-lock request before returning from fuse_ref_folio()
     - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req
     - usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction
       checks
     - smb: client: reject overlapping data areas in SMB2 responses
     - xfs: fix null pointer dereference in tracepoint
     - xfs: fail recovery on a committed log item with no regions
     - xfs: resample the data fork mapping after cycling ILOCK
     - xfs: don't wrap around quota ids in dqiterate
     - xfs: set xfarray killable sort correctly
     - xfs: clamp timestamp nanoseconds correctly
     - xfs: fully check the parent handle when it points to the rootdir
     - xfs: don't zap bmbt forks if they are MAXLEVELS tall
 .
   [ Han Gao ]
   * [riscv64] set NR_CPUS to 128 (Closes: #1140651)
 .
   [ Salvatore Bonaccorso ]
   * [rt] Refresh "locking/rt: Annotate unlock followed by lock for sparse."
     (context changes)
linux-signed-arm64 (6.12.95+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.95-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.95
     - wifi: mt76: mt7921: avoid undesired changes of the preset regulatory
       domain
     - wifi: mt76: mt7921: fix a potential scan no APs
     - wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync
       (CVE-2026-53101)
     - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (CVE-2026-53167)
     - gpiolib: Extract gpiochip_choose_fwnode() for wider use
     - gpiolib: Remove redundant assignment of return variable
     - gpio: Fix resource leaks on errors in gpiochip_add_data_with_key()
       (CVE-2026-31732)
     - io_uring/net: Avoid msghdr on op_connect/op_bind async data
     - drm/xe/display: fix oops in suspend/shutdown without display
       (CVE-2026-53142)
     - [arm64] drm/v3d: Store the active job inside the queue's state
     - [arm64] drm/v3d: Skip CSD when it has zeroed workgroups (CVE-2026-53139)
     - eventpoll: use hlist_is_singular_node() in __ep_remove()
     - eventpoll: split __ep_remove()
     - eventpoll: kill __ep_remove()
     - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()
     - eventpoll: rename ep_remove_safe() back to ep_remove()
     - eventpoll: move epi_fget() up
     - eventpoll: fix ep_remove struct eventpoll / struct file UAF
       (CVE-2026-46242)
     - iio: light: bh1780: fix PM runtime leak on error path (CVE-2026-43355)
     - net: Drop the lock in skb_may_tx_timestamp() (CVE-2026-43216)
     - Reapply "selftest/ptp: update ptp selftest to exercise the gettimex
       options"
     - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING
     - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP
     - debugobjects: Do not fill_pool() if pi_blocked_on
     - debugobjects: Dont call fill_pool() in early boot hardirq context
     - RDMA/bnxt_re: zero shared page before exposing to userspace
     - i2c: stub: Reject I2C block transfers with invalid length
     - [amd64] agp/amd64: Fix broken error propagation in agp_amd64_probe()
       (CVE-2026-53325)
     - bpf: Reject sleepable kprobe_multi programs at attach time
       (CVE-2026-43010)
     - ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn()
     - regulator: core: fix locking in regulator_resolve_supply() error path
     - dlm: prevent NPD when writing a positive value to event_done
       (CVE-2025-23131)
     - xfs: remove the expr argument to XFS_TEST_ERROR
     - xfs: fix error returns in CoW fork repair
     - Revert "net: bonding: fix use-after-free in bond_xmit_broadcast()"
     - net: bonding: add broadcast_neighbor option for 802.3ad
     - bonding: add support for per-port LACP actor priority
     - bonding: print churn state via netlink
     - bonding: 3ad: implement proper RCU rules for port->aggregator
       (CVE-2026-52975)
     - net: bonding: fix use-after-free in bond_xmit_broadcast() (CVE-2026-31419)
     - bonding: fix NULL pointer dereference in actor_port_prio setting
     - staging: rtl8723bs: fix buffer over-read in rtw_update_protection
       (CVE-2026-53179)
     - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
       (CVE-2026-53341)
     - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs
     - hv: utils: handle and propagate errors in kvp_register
     - locking/mutex: Remove wakeups from under mutex::wait_lock
     - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
     - phonet: Pass ifindex to fill_addr().
     - phonet: Pass net and ifindex to phonet_address_notify().
     - net: phonet: free phonet_device after RCU grace period (CVE-2026-53157)
     - rxrpc: Fix the ACK parser to extract the SACK table for parsing
       (CVE-2026-53151)
     - fuse: re-lock request before replacing page cache folio
     - ftrace: Update the mcount_loc check of skipped entries
     - ftrace: Have ftrace pages output reflect freed pages
     - ftrace: Do not over-allocate ftrace memory
     - ftrace: Test mcount_loc addr before calling ftrace_call_addr()
     - ftrace: Check against is_kernel_text() instead of kaslr_offset()
     - net: ipv6: Make udp_tunnel6_xmit_skb() void
     - sctp: disable BH before calling udp_tunnel_xmit_skb() (CVE-2026-53070)
     - iio: light: veml6075: add bounds check to veml6075_it_ms index
     - iio: adc: ti-ads1298: add bounds check to pga_settings index
     - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent
       vcs_write
     - [arm64] serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
     - ksmbd: reject non-VALID session in compound request branch
     - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
     - virtiofs: fix UAF on submount umount
     - [amd64] KVM: x86: Fix shadow paging use-after-free due to unexpected role
       (CVE-2026-53359)
     - [amd64] KVM: x86/mmu: Ensure hugepage is in by slot before checking max
       mapping level
     - Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command
       Completion support"
     - [amd64] KVM: SEV: Ignore MMIO requests of length '0'
     - [amd64] KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+
     - [amd64] KVM: SEV: Ignore Port I/O requests of length '0'
     - batman-adv: tp_meter: keep unacked list in ascending ordered
     - batman-adv: tp_meter: initialize dup_acks explicitly
     - batman-adv: tp_meter: initialize dec_cwnd explicitly
     - batman-adv: tp_meter: avoid window underflow
     - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
     - batman-adv: tp_meter: fix fast recovery precondition
     - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection
     - batman-adv: tp_meter: add only finished tp_vars to lists
     - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE
     - batman-adv: prevent ELP transmission interval underflow
     - batman-adv: tp_meter: initialize last_recv_time during init
     - batman-adv: ensure bcast is writable before modifying TTL
     - batman-adv: fix (m|b)cast csum after decrementing TTL
     - batman-adv: frag: ensure fragment is writable before modifying TTL
     - batman-adv: frag: avoid underflow of TTL
     - batman-adv: v: prevent OGM aggregation on disabled hardif
     - batman-adv: tp_meter: restrict number of unacked list entries
     - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE
     - batman-adv: tp_meter: prevent parallel modifications of last_recv
     - batman-adv: tp_meter: handle overlapping packets
     - batman-adv: tt: don't merge change entries with different VIDs
     - batman-adv: tt: track roam count per VID
     - batman-adv: dat: prevent false sharing between VLANs
     - batman-adv: tvlv: enforce 2-byte alignment
     - batman-adv: tvlv: avoid race of cifsnotfound handler state
     - ipv6: account for fraggap on the paged allocation path (CVE-2026-53362)
     - fs: constify file ptr in backing_file accessor helpers
     - lsm: add backing_file LSM hooks
     - selinux: fix overlayfs mmap() and mprotect() access checks
     - inet: add indirect call wrapper for getfrag() calls
     - ipv4: account for fraggap on the paged allocation path
     - ntfs3: reject direct userspace writes to reserved $LX* xattrs
     - [amd64] KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb()
     - [amd64] KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free
     - af_unix: Set gc_in_progress to true in unix_gc(). (CVE-2026-53361)
     - mtd: spi-nor: macronix: Add post_sfdp fixups for Quad Input Page Program
     - mtd: spi-nor: macronix: add support for mx66{l2, u1}g45g
     - mac802154: llsec: add skb_cow_data() before in-place crypto
     - net: skmsg: preserve sg.copy across SG transforms
     - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
     - apparmor: mediate the implicit connect of TCP fast open sendmsg
     - apparmor: fix use-after-free in rawdata dedup loop
     - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share
       BAR
     - fbdev: fix use-after-free in store_modes()
     - kernel/fork: clear PF_BLOCK_TS in copy_process()
     - block: invalidate cached plug timestamp after task switch
     - err.h: use __always_inline on all error pointer helpers
     - KEYS: fix overflow in keyctl_pkey_params_get_2()
     - keys: Pin request_key_auth payload in instantiate paths
     - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S
     - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer
     - wifi: ath11k: fix warning when unbinding
     - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor
     - wifi: rtw88: increase TX report timeout to fix race condition
     - wifi: rtw88: usb: fix memory leaks on USB write failures
     - wifi: iwlwifi: mvm: fix race condition in PTP removal
     - f2fs: validate compress cache inode only when enabled
     - f2fs: fix to round down start offset of fallocate for pin file
     - f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
     - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
     - f2fs: keep atomic write retry from zeroing original data
     - block: Avoid mounting the bdev pseudo-filesystem in userspace
     - bpf: use kvfree() for replaced sysctl write buffer
     - exfat: fix potential use-after-free in exfat_find_dir_entry()
     - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with
       get_unaligned()
     - gfs2: fix use-after-free in gfs2_qd_dealloc
     - [arm64] pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
     - hdlc_ppp: sync per-proto timers before freeing hdlc state
     - blk-cgroup: fix UAF in __blkcg_rstat_flush()
     - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
     - pNFS: Fix use-after-free in pnfs_update_layout()
     - fpga: region: fix use-after-free in child_regions_with_firmware()
     - rpmsg: char: Fix use-after-free on probe error path
     - ocfs2: reject oversized group bitmap descriptors
     - 9p: avoid putting oldfid in p9_client_walk() error path
     - [amd64] KVM: x86: hyper-v: Bound the bank index when querying sparse banks
     - [amd64] KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
     - power: reset: linkstation-poweroff: fix use-after-free in the
       linkstation_poweroff_init()
     - [riscv64] mm: Extract helper mark_new_valid_map()
     - [riscv64] kfence: Call mark_new_valid_map() for kfence_unprotect()
     - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in
       fb_videomode_to_var
     - fbdev: modedb: fix a possible UAF in fb_find_mode()
     - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
     - i2c: core: fix adapter registration race
     - NFSD: Fix SECINFO_NO_NAME decode error cleanup
     - nfsd: fix posix_acl leak on SETACL decode failure
     - nfsd: check get_user() return when reading princhashlen
     - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
     - nfsd: reset write verifier on deferred writeback errors
     - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
     - NFS: Prevent resource leak in nfs_alloc_server()
     - ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
     - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
     - drivers/base/memory: set mem->altmap after successful device registration
     - Documentation: ioctl-number: Fix linuxppc-dev mailto link
     - Documentation: ioctl-number: Extend "Include File" column width
     - [amd64] crypto: qat - Replace kzalloc() + copy_from_user() with
       memdup_user()
     - [amd64] crypto: qat - Return pointer directly in adf_ctl_alloc_resources
     - [amd64] crypto: qat - remove unused character device and IOCTLs
     - net/tcp-ao: fix use-after-free of key in del_async path
     - locking: rtmutex: Fix wake_q logic in task_blocks_on_rt_mutex
     - net: bonding: update the slave array for broadcast mode
     - bonding: annotate data-races arcound churn variables
     - bonding: do not set usable_slaves for broadcast mode
 .
   [ Salvatore Bonaccorso ]
   * net/netfilter: Enable NETFILTER_NETLINK_HOOK as module (Closes: #1139686)
   * [rt] Refresh "locking/rt: Annotate unlock followed by lock for sparse."
 .
   [ Uwe Kleine-König ]
   * [amd64] Enable CONFIG_PINCTRL_CS42L43 and CONFIG_SPI_CS42L43 explicitly
     (Closes: #1136179)
linux-signed-arm64 (6.12.95+1~bpo12+1) bookworm-backports; urgency=medium
 .
   * Sign kernel from linux 6.12.95-1~bpo12+1
 .
   * Rebuild for bookworm-backports

llvm-toolchain-22 (1:22.1.8-1~deb13u4) trixie; urgency=medium
 .
   * d/rules:
     - Disable OMP on i386, trixie's llvm-toolchain-19 doesn't have it.
     - Disable LIBUNWIND on s390x, trixie's llvm-toolchain-19 doesn't have it.
     - Disable OFFLOAD on ppc64el, it FTBFS.
     - Fix architecture list generation for libunwind build-dep (which was
       broken due to matching against llvm-libunwind1 instead of
       libunwind-19).
llvm-toolchain-22 (1:22.1.8-1~deb13u3) trixie; urgency=medium
 .
   * d/patches/x86-fix-incorrect-load-combining-causing-oob-reads.patch:
     Pull in upstream fix for llvm's tendency to miscompile rustc; see
     https://salsa.debian.org/pkg-llvm-team/llvm-toolchain/-/merge_requests/224
 .
 llvm-toolchain-22 (1:22.1.8-1~deb13u2) trixie; urgency=medium
 .
   * Update d/rules to liboffload depend on llvm 19's libomp.
 .
 llvm-toolchain-22 (1:22.1.8-1~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie.
   * Change build-dep from sid's llvm-spirv-22 to trixie's llvm-spirv-19.
   * Add s390x to g++-multilib build-dep.
   * Set SKIP_COMMON_PACKAGES=yes in d/rules to skip building the
     non-versioned library packages. Set the NEW_LLVM_VERSION to 19 (instead of
     23; not what the maintainers intended, but it works).
   * Regenerate d/control, dropping libc++1, libc++abi1, llvm-libunwind1, and
     libomp5 binary packages, and also adding build-deps on trixie's
     libc++1-19, libc++abi1-19, libomp5-19, libunwind-19, and libllvm19.
   * Add depends for the various -dev packages to those -19 shared lib
     packages, but also note in package descriptions that dynamic linking is
     unsupported. It *will* fail, as -22-dev headers include symbols that -19
     doesn't have.
llvm-toolchain-22 (1:22.1.8-1~deb13u2) trixie; urgency=medium
 .
   * Update d/rules to liboffload depend on llvm 19's libomp.
 .
 llvm-toolchain-22 (1:22.1.8-1~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie.
   * Change build-dep from sid's llvm-spirv-22 to trixie's llvm-spirv-19.
   * Add s390x to g++-multilib build-dep.
   * Set SKIP_COMMON_PACKAGES=yes in d/rules to skip building the
     non-versioned library packages. Set the NEW_LLVM_VERSION to 19 (instead of
     23; not what the maintainers intended, but it works).
   * Regenerate d/control, dropping libc++1, libc++abi1, llvm-libunwind1, and
     libomp5 binary packages, and also adding build-deps on trixie's
     libc++1-19, libc++abi1-19, libomp5-19, libunwind-19, and libllvm19.
   * Add depends for the various -dev packages to those -19 shared lib
     packages, but also note in package descriptions that dynamic linking is
     unsupported. It *will* fail, as -22-dev headers include symbols that -19
     doesn't have.
llvm-toolchain-22 (1:22.1.8-1~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie.
   * Change build-dep from sid's llvm-spirv-22 to trixie's llvm-spirv-19.
   * Add s390x to g++-multilib build-dep.
   * Set SKIP_COMMON_PACKAGES=yes in d/rules to skip building the
     non-versioned library packages. Set the NEW_LLVM_VERSION to 19 (instead of
     23; not what the maintainers intended, but it works).
   * Regenerate d/control, dropping libc++1, libc++abi1, llvm-libunwind1, and
     libomp5 binary packages, and also adding build-deps on trixie's
     libc++1-19, libc++abi1-19, libomp5-19, libunwind-19, and libllvm19.
   * Add depends for the various -dev packages to those -19 shared lib
     packages, but also note in package descriptions that dynamic linking is
     unsupported. It *will* fail, as -22-dev headers include symbols that -19
     doesn't have.
llvm-toolchain-22 (1:22.1.8-1~deb12u1) bookworm-security; urgency=medium
 .
   * Non-maintainer upload by the LTS Team.
   * Rebuild for bookworm.
   * Clean up leftover changelog.dch file.
   * Build with bookworm's llvm-spirv-14.
   * Disable omp on i386.
   * Disable offload on ppc64el, it FTBFS.
llvm-toolchain-22 (1:22.1.7-1) unstable; urgency=medium
 .
   * experimental New snapshot release
   * enable PRIF (coarray) support
     thanks to Alastair McKinstry
     (Closes: #1136346)
llvm-toolchain-22 (1:22.1.6-1) unstable; urgency=medium
 .
   [ Matthias Klose ]
   * Make stonking a known Ubuntu series.
   * Build OCaml for stonking.
 .
   [ Sylvestre Ledru ]
   * New upstream release
llvm-toolchain-22 (1:22.1.5-1) unstable; urgency=medium
 .
   * New upstream release
   * d/rules: Fail the build if debian/control is regenerated, except for
     apt.llvm.org snapshot builds where the substitutions legitimately
     differ between snapshots. Modifying debian/control during the build
     is forbidden by Debian policy and breaks reproducibility.
     (Closes: #1130335)
   * d/rules, d/control.in: Replace the post-substitution sed that rewrote
     the libc++/libomp/libunwind move version cap on apt.llvm.org snapshot
     builds with a @LIBCXX_MOVE_VERSION@ placeholder substituted in the
     same loop as the other variables. Removes one more in-build mutation
     of debian/control.
   * d/rules: Extend the regenerate-vs-fail check to debian/watch,
     debian/packages.ocaml and debian/packages.libclc. These three files
     are also tracked in git, kept by override_dh_auto_clean and rewritten
     in place by the substitution loop, so they have the same drift risk
     as debian/control.
   * d/source-integrity.mk: Move the source-package integrity logic
     (APT_LLVM_ORG, GENERATED_TRACKED_FILES and the snapshot/verify canned
     recipes) into a dedicated include file. Keeps debian/rules focused on
     the build itself.
   * d/tests.mk: Move the override_dh_auto_test definition (the whole
     ifeq RUN_TEST block, ARCH_LLVM_TEST_OK and the lcov coverage tail)
     into a dedicated include file. Pure relocation, no behavioural
     change.
   * d/build-wasm-mingw.mk: Move the wasm32/wasm64 + mingw-w64
     compiler-rt and libcxx pattern rules, the STAGE_2_WASM_C(XX)FLAGS
     filters and the stamps/debian-{wasm,mingw}-build aggregators into a
     dedicated include file. Pure relocation, no behavioural change.
   * Fix the autopkgtest for Polly. Thanks to Adrian Bunk for the fix
     (Closes: #1130893)
llvm-toolchain-22 (1:22.1.4-1) unstable; urgency=medium
 .
   [ Samuel Thibault ]
   * d/patches/hurd/hurd_orc_pathmax.diff: Update to version that does not need
     sys::fs::readlink.
   * patches/fix-readlink-not-in-fs-namespace.diff: Drop
 .
   [ Matthias Klose ]
   * d/rules, d/python3-lldb-X.Y.links.in: Fix location for extension.
 .
   [ Sylvestre Ledru ]
   * New upstream release
llvm-toolchain-22 (1:22.1.3-1) unstable; urgency=medium
 .
   [ Samuel Thibault ]
   * d/patches/hurd/hurd_orc_pathmax.diff: Fix GNU/Hurd build.
 .
   [ Sylvestre Ledru ]
   * new upstream release
   * patches/fix-readlink-not-in-fs-namespace.diff:
     Fix build issue #190659
llvm-toolchain-22 (1:22.1.2-1) unstable; urgency=medium
 .
   * New upstream release
llvm-toolchain-22 (1:22.1.1-1) unstable; urgency=medium
 .
   [ Matthias Klose ]
   * d/rules: Only disable Z3 support for Ubuntu when it is in main.
   * Install a lit binary. Addresses: #1122910.
   * llvm-tools: Don't install the lit tests. Addresses: #1122909.
   * d/rules: For Ubuntu, don't include i386 for CLANG_GRPC_ARCHS,
     not built on i386.
   * Update libc++1, libc++abi1 and libomp5 symbols files.
   * d/rules: Stop ignoring failure for dh_shlibdeps call.
 .
   [ Sylvestre Ledru ]
   * New upstream release
   * Add hello fallback for lld build dependency. For bullseye and jammy
     s390x backport in particular
   * Fix autopkgtests for Polly: Update to use LLVM 22's new pass manager
     syntax (-passes=polly-canonicalize instead of -polly-canonicalize).
     (Closes: #1130893)
   * Adjust the path to lit
llvm-toolchain-22 (1:22.1.0-2) unstable; urgency=medium
 .
   [ Matthias Klose ]
   * d/rules: Don't use lld for backport build, when not available.
   * d/rules: Add safety check for enablement of the RVA23 baseline.
 .
   [ Sylvestre Ledru ]
   * lldb: support global config file, thanks to Nobert Lange
   * Don't fallback to llvm-spirv-(N-1) when llvm-spirv-N isn't available.
     LLVM 22 bitcode contains new attributes that llvm-spirv-21 can't read,
     causing libclc build failures on full builds (not -B/binary-arch since
     libclc is arch=all):
     "Unknown attribute kind (105) (Producer: 'LLVM22.1.0' Reader: 'LLVM 21.1.8')"
     Update build-dep to llvm-spirv-22.
     (Closes: #1128822)
llvm-toolchain-22 (1:22.1.0-1) unstable; urgency=medium
 .
   * New upstream release
llvm-toolchain-22 (1:22.1.0~+rc3-1~exp1) experimental; urgency=medium
 .
   [ Matthias Klose ]
   * d/rules: Fix self-referencing macro.
 .
   [ Sylvestre Ledru ]
   * New rc release
   * Fix autopkgtest failure with CMake 4. thanks to Adrian Bunk
   * d/rules: Simplify and clean up:
     - Remove empty hurd-i386 conditional block
     - Fix inverted LLVM_LIBC_ENABLE and LTO_ENABLE info message conditions
     - Consolidate duplicate mips64el architecture handling
     - Factor out common sparc/sparc64 PARALLEL_LINK_JOBS setting
     - Consolidate sed commands for CMake export files
     - Consolidate wasm install commands into a loop
     - Simplify jquery/underscore symlink replacement
     - Consolidate Python cleanup commands
llvm-toolchain-22 (1:22.1.0~+rc2-1~exp1) experimental; urgency=medium
 .
   [ Matthias Klose ]
   * Enable libunwind on s390x (Michael R. Crusoe). Addresses: #1126263.
 .
   [ Sylvestre Ledru ]
   * New rc release
   * Dedup the flags declarations
   * Implement terse option in DEB_BUILD_OPTIONS to reduce build verbosity
   * Break the build if DEB_BUILD_OPTIONS contains a comma
llvm-toolchain-22 (1:22.1.0~+rc1-1~exp1) experimental; urgency=medium
 .
   [ Sylvestre Ledru ]
   * new rc release
   * grep is interpreting -Bno-symbolic as a context option.
   * Workaround the replaces/breaks on apt.llvm.org (upstream 167538)
   * flang: also ignore -fstack-protector-strong (happens on focal)
   * Rename ign_fail => ignore_if_fail
   * Fix file location for lintian source override.
   * mingw-w64 cross compilation is broken on focal, disable it
 .
   [ Fabian Grünbichler ]
   * workaround cmake 4
 .
   [ Matthias Klose ]
   * d/rules: Mark usage of SLOPPY_BUILD to ease searching in the build log.
   * Update watch file, use with --force-download to fetch the integration
     testsuite.
   * Introduce an OMPD_ARCHS macro and use it.
   * Add a llvm.noclang build profile (not enabled by default).
   * Bump llvm-spirv build dependency to 21 again.
   * Introduce an LLVM_SPIRV_ARCHS macro and use it.
   * Don't run the omp autopkg test on i386. Closes: #1118644.
   * d/tests/control.in: Add test dependency on g++-multilib. Closes: #1118643.
   * d/debian-llvm-testsuite.bats: Skip test. Closes: #1118641.
     The test "pthread_cancel with libunwind compatibility" is wrong.
   * d/tests/control.in: Add test dependency on binutils-gold. Closes: #1118646.
   * Introduce CLANG_GRPC_ARCHS macro and use it.
   * Also use the grpc bits for clang on i386.
   * Add the alternate hello b-d for grpc related build dependencies.
   * Add profile to ocaml build dependencies.
   * Re(?)-enable omp on i386.
   * d/control: Only use one build profile per binary package for now. The ORing
     of build profiles seems to be not working.
   * Rename build profiles from llvm.* to pkg.llvm.*.
   * Fix some lintian warnings, override some more.
   * Clarify the libunwind package descriptions, that it is not compatible
     with glibc.
   * Only run the flang autopkg tests where flang is available.
   * Rename the LIBC_ARCHS macro to LLVM_LIBC_ARCHS, and only run the
     libllvmlibc autopkg tests where the package is available.
   * Fix removing *.pyc files and __pycache__ dirs during installation.
   * Fix some lintian warnings, override some more.
   * Copy libc++1, libc++abi1 and libomp5 symbols files from 21.
   * Build and install libflang_rt.runtime. Addresses: #1117534.
   * Fix liborc install on hurd-amd64.
   * Also call dh_python for the llvm-X.Y-tools package.
   * libunwind-X.Y-dev: Stop providing libunwind-dev. As updated in the
     package description, the unwinder is incompatible with glibc.
   * d/rules, d/*.{install,links,lintian-overrides}.in: Use a macro LLVM_LIBDIR.
   * Fix one more libclang1 lintian override.
   * Fix one more libc++-22-dev-wasm32 lintian override.
   * Update symbols files from the buildd logs, including i386.
   * Fix syntax for OR-ed build profiles.
   * clang-22-tools, llvm-22-tools: Use dh_python3 substvars.
   * liblldb-22: Move the .so symlink to the liblldb-22-dev package.
   * d/rules: Remove unnecessary use of the CURDIR macro.
   * Enable offloading on riscv64 (Aurelian Jarno).
   * Manually fix the python3 shebangs. dh_python3 can only handle one
     private directory. Also install lit first in the dh_override_install
     target, fix it there, and move it to the package from there.
   * Add build conflicts on llvm-22-runtime and clang-22, or else the
     wasm build picks up stuff from the installed llvm-22 and fails.
   * Stop building multilibs on s390x. Closes: #1125254.
   * Still build-depend on spirv-21.
   * d/llvm-X.Y-tools.bcep.in: Fix Python 3.14 byte compilation by adding
     an exception for shtest-encoding.py test file containing non-UTF-8
     characters (Igor Luppi). LP: #2138890.
   * d/rules: Remove some invalid CLC targets.
   * Allow to build without CLC packages.
   * d/llvm-libunwind1.symbols: Update for 22.

lua-geoip (0.2-3+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Fix FTBFS after the geoip-database downgrade. (Closes: #1142063)

lwip (2.2.1+dfsg1-1+deb13u1) trixie; urgency=medium
 .
   * Fix CVE-2026-8836: snmpv3: fix handling packets with invalid
       msgAuthenticationParameters length
     * A remote attacker can send a crafted msgAuthenticationParameters field
       to overflow a stack buffer in snmp_parse_inbound_frame().
     * Re-enables the bounds check on msgAuthenticationParameters length in
       snmp_parse_inbound_frame() and clamps the copy length to
       SNMP_V3_MAX_AUTH_PARAM_LENGTH instead of using the attacker-controlled
       TLV value length
     * https://savannah.nongnu.org/bugs/?68194

lxc (1:6.0.4-4+deb13u4) trixie; urgency=medium
 .
   * Cherry-pick fix to properly free libcap-allocated memory
   * Cherry-pick fix for running nested containers using current versions of
     runc (ie, Docker) (Closes: #1146472)

mbedtls (3.6.6-0.1~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie.
 .
 mbedtls (3.6.6-0.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * New upstream release.
     - CVE-2026-25834: Signature Algorithm Injection
     - CVE-2026-25835: PSA random generator cloning
     - CVE-2026-34872: FFDH: improper input validation
     - CVE-2026-34873: Client impersonation resuming a TLS 1.3 session
     - CVE-2026-34874: Null pointer dereference setting a distinguished name
     - CVE-2026-34875: Buffer overflow in FFDH public key export
     - CVE-2026-34876: CCM multipart finish tag-length validation bypass
     (Closes: #1133841, #1132577)
mbedtls (3.6.5-0.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * New upstream release.
     - CVE-2025-54764: Side channel in RSA key generation and operations
       (Closes: #1118750)
     - CVE-2025-59438: Padding oracle through timing of cipher error reporting
       (Closes: #1118752)

milib (2.2.0+dfsg-1+deb13u1) trixie; urgency=medium
 .
   * Patching code to catch IOException (Closes: #1139472)

mongo-c-driver (1.30.4-1+deb13u3) trixie; urgency=medium
 .
   * Fix CVE-2026-81524: validate db and collection names

mrtg (2.17.10-13+deb13u2) trixie; urgency=medium
 .
   * debian/patches/110_fix-CVE-2026-72694: created to fix a symlink-following
     chown of pid file in daemon mode. Thanks to Tobias Oetiker
     <tobi@oetiker.ch>. This patch fixes CVE-2026-72694. (Closes: #1144393)

neutron (2:26.0.3-0+deb13u3) trixie-security; urgency=medium
 .
   * CVE-2026-55707: subnetpool onboarding cross-project subnet mutation.
     Applied upstream fix: CVE-2026-55707-stable-2025.1.patch.
     (Closes: #1143170).
   * OSSN-0102: sub-resource APIs do not verify parent ownership. Applied
     upstream patches (Closes: #1142937):
     - "Fix PF GET/PUT parent floating IP validation".
     - "Fix cross-project access to router conntrack helpers"

node-lodash (4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1) trixie; urgency=high
 .
   * Non-maintainer upload by the LTS team.
   * Add patch to prevent prototype pollution on baseUnset function.
     (Fixes: CVE-2025-13465) (Closes: #1126265)
   * Add patch to block prototype pollution in baseUnset via
     constructor/prototype traversal (array-wrapped path bypass of the
     CVE-2025-13465 fix). (Fixes: CVE-2026-2950)
   * Add patch to validate imports keys in _.template, preventing code
     injection via the Function() sink. (Fixes: CVE-2026-4800)
   * Add patch to update lodash-cli dependency map so the regenerated
     lodash.template module requires assignWith/arrayEach; without it the
     module throws "assignWith is not defined" at runtime (caught by the
     node-gulp-util autopkgtest). (Related: CVE-2026-4800)

nss (2:3.110-1+deb13u4) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * guard against integer overflow in CERT_Hexify (CVE-2026-16389)

ntfs-3g (1:2022.10.3-5+deb13u2) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Fix multiple vulnerabilities (CVE-2026-42616, CVE-2026-42617,
     CVE-2026-42618, CVE-2026-46569, CVE-2026-46570, CVE-2026-46571,
     CVE-2026-46572, CVE-2026-56135, CVE-2026-56136)

onionshare (2.6.3-1+deb13u2) trixie; urgency=medium
 .
   * Use CVE identifiers.
 .
 onionshare (2.6.3-1+deb13u1) trixie; urgency=medium
 .
   * Update debian branch in gbp.conf.
   * Fixes CVE-2026-54707. (Closes: #1139716)
     Backport upstream patches from 2.6.4:
     - a090e97193efc91fbeac9dace7793ea568b83cf5
     - e4ed559908b55cf41b993ed3d02052911025785b
     - 1d76494f5d819adc4c69f08f3842d564a425aa89
   * Fixes CVE-2026-54706. (Closes: #1139717)
     Backport upstream patches from 2.6.4:
     - 48f31cfac077fcc9c04c67c2a6dbf87d956f5eec
     - 96827bdd0580bd34b921a7b269198f65434178d8
     - d0697fa3d05a193138c6052422c313612301d98a

opam (2.3.0-1+deb13u2) trixie-security; urgency=medium
 .
   * Backport upstream patches (Closes: CVE-2026-57825)

opencryptoki (3.23.0+dfsg-0.3+deb13u1) trixie; urgency=medium
 .
   * CVE-2026-40253 (Closes: #1136019)
   * CVE-2026-23893 (Closes: #1126268)

openjdk-21 (21.0.12.1+1-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie
openjdk-21 (21.0.12+8-2) unstable; urgency=medium
 .
   [ Vladimir Petko ]
   * d/t/jtreg-autopkgtest.in: Do not fail tests if ulimit can not be
     set.
   * d/t/problems.csv: Add test exclusions.
   * d/rules: Enable S390x C2 compiler.
   * d/rules: Collect hotspot error and replay logs after jtreg tests.
   * d/copyright-generator: Fix license SPDX identifiers.
 .
   [ Matthias Klose ]
   * Build using GCC 16 on development releases.
openjdk-21 (21.0.12+8-1) unstable; urgency=medium
 .
   * OpenJDK 21.0.12 release, build 8.
     - CVEs:
       + CVE-2026-46968
       + CVE-2026-46917
       + CVE-2026-47010
       + CVE-2026-47021
       + CVE-2026-47027
       + CVE-2026-60147
       + CVE-2026-47059
       + CVE-2026-47063
       + CVE-2026-41254
     - Release notes: https://bit.ly/openjdk2112
openjdk-21 (21.0.12+8-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie
openjdk-21 (21.0.12~7ea-1) unstable; urgency=medium
 .
   * OpenJDK 21.0.12 early access, build 7.
   * d/copyright: Regenerate.
   * d/p/jdk-8387580.diff: Apply upstream patch to resolve S390x
     ftbfs (JDK-8387580).
   * d/t/problems.csv: Drop obsolete versions, add openjdk-28,
     add new exclusions.
openjdk-21 (21.0.12~5ea-1) unstable; urgency=medium
 .
   * OpenJDK 21.0.12 early access, build 5.
   * d/rules: Do not perform copyright validation for old releases.
   * d/rules: Check DEB_BUILD_PROFILES in addition to DEB_BUILD_OPTIONS
     to set up with_check variable. Do not check control files if
     with_check is disabled (Closes: #1137499).
   * d/control.in: Add myself to uploaders.
   * Regenerate files.
   * d/JB-jre-{headless,zero}.overrides.in: Drop exit-in-shared-library
     override.
openjdk-21 (21.0.11+10-1) unstable; urgency=medium
 .
   * OpenJDK 21.0.11 release, build 10.
     - CVEs:
       + CVE-2026-22016: 8370529: Enhance Path Factories Redux
       + CVE-2026-34282: 8374557: Enhance TLS connection handling
       + CVE-2026-22021: 8371830: Enhance certificate chain validation
       + CVE-2026-22013: 8370615: Improve Kerberos credentialing
       + CVE-2026-23865: 8379158: Update FreeType to 2.14.2
       + CVE-2026-22018: 8370986: Enhance Zip file reading
       + CVE-2026-22007: 8369575: Enhance crypto algorithm support
       + CVE-2026-34268: 8371935: Enhance key generation
   * d/rules: Check generated files only on amd64. This resolves riscv64
     ftbfs, as some architectures change with_check flag.
   * d/t/problems.csv: Fix typo in loong64 excluded tests lists.
   * Add common GPL and Apache license headers to copyright generator.
   * d/copyright: Regenerate.

openssl (3.5.7-1~deb13u2) trixie-security; urgency=medium
 .
   * CVE-2026-18798 ("QUIC Server May Trigger Double Free When Processing
     INITIAL Packet")
   * CVE-2026-63072 ("Heap Buffer Overflow in CMS Key Unwrapping")
   * CVE-2026-63076 ("Invalid Pointer Dereference in CMP Server via Crafted
     protectionAlg")
   * CVE-2026-14457 ("RPK Server Signature Algorithm Selection Can Dereference
     a Missing Certificate")
   * CVE-2026-54874 ("Excessive Memory Use Buffering DTLS Records for a Future
     Epoch")
   * CVE-2026-63073 ("Untrusted Sender DN Used as Format String in CMP Response
     Validation")
   * CVE-2026-63074 ("CMP Indefinite Cache Growth of ExtraCerts")
   * CVE-2026-63075 ("QUIC ACK-only Packet Retention Can Cause Memory
     Exhaustion")
   * CVE-2026-75803 ("AEAD Forgeries with Empty Ciphertext When Using
     EVP_Cipher()") (Closes: #1145172)
   * CVE-2026-14456 ("Unbounded Memory Growth in QUIC Server Incoming Channel
     Queue") (Closes: #1144615)
openssl (3.5.7-1~deb13u1) trixie; urgency=medium
 .
   * Import 3.5.7

openvpn-dco-dkms (0.0+git20241121-1+deb13u1) trixie; urgency=medium
 .
   * Add debian/gbp.conf for debian/trixie branch
   * Cherry-Pick upstream patches to fix NULL deref in ovpn_netlink_notify_del_peer
     (Closes: #1140548)

org-roam (2.3.1-1+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * Resolve undeclared mandatory dependency.  Org-roam does not function
     without emacsql-sqlite.el.  In trixie this library is provided by
     elpa-emacsql-sqlite, and this dependency must be declared
     (Closes: #1144053).

patool (4.0.0-1+deb13u1) trixie; urgency=medium
 .
   * Fix CVE-2026-29509: a path traversal vulnerability in the
     safe_extract() function. d/patches/CVE-2026-29509.patch

pcre2 (10.46-1~deb13u2) trixie; urgency=high
 .
   * Use upstream backports of security fixes from 10.48

pdns (4.9.17-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 4.9.17, fixing security issue
     CVE-2026-52682

pdns-recursor (5.2.13-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 5.2.13, fixing security issue
     CVE-2026-52682
pdns-recursor (5.2.12-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 5.2.12, fixing security issues
     CVE-2026-52686, CVE-2026-52688.

perl (5.40.1-6+deb13u1) trixie; urgency=medium
 .
   * [SECURITY] various upstream fixes:
     + CVE-2026-7017: HTTP::Tiny credential forwarding on redirects.
         (Closes: #1141639)
     + CVE-2026-42496: Archive::Tar symlink extraction.
         (Closes: #1138860)
     + CVE-2026-42497: Archive::Tar hardlink extraction.
         (Closes: #1138859)
     + CVE-2026-12087: Socket: pack_ip_mreq_source() out-of-bounds heap read.
         (Closes: #1140152)
     + CVE-2026-13221: silently incorrect regular expression matches.
         (Closes: #1142037)
     + CVE-2025-15649: header parsing in IO::Uncompress::Unzip.
         (Closes: #1138863)
     + CVE-2026-7010:  CRLF-validation in HTTP::Tiny.
         (Closes: #1138858)
     + CVE-2026-8376:  Buffer overflow in Perl_study_chunk.
         (Closes: #1137345)
     + CVE-2026-48959: CPU exhaustion in IO::Uncompress::Unzip.
         (Closes: #1138856)
     + CVE-2026-48961: crash in zipdetails.
         (Closes: #1138855)
     + CVE-2026-48962: code execution in IO-Compress via output globs.
         (Closes: #1138854)
     + CVE-2026-57432: out of bound heap reads in pack() and unpack().
          (Closes: #1138905)
     + CVE-2026-57433: signed integer overflow in Storable.
          (Closes: #1138906)

pgextwlist (1.19-1+deb13u1) trixie-security; urgency=medium
 .
   * Reject substituting extension schemas or owners matching ["$'\].
 .
     The extwlist.custom_path script mechanism was vulnerable to SQL
     injection via crafted schema and user names. The same problem was fixed
     in August 2023 in PostgreSQL (cd5f2a3570), and is now fixed in
     pgextwlist as well. Substitutions that attempt to insert any of "$'\ are
     now simply rejected. (We don't try to quote the values as we don't know
     which quoting context we are in.)
 .
     CVE-2023-39417

php-guzzlehttp-psr7 (2.7.1-1+deb13u2) trixie; urgency=medium
 .
   * Reject CR/LF in HTTP method, protocol version, and reason phrase
     (GHSA-vm85-hxw5-5432) [CVE-2026-55766]

php8.4 (8.4.24-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream version 8.4.24 (Closes: #1143153)
    + [CVE-2026-17544]: Out-of-bounds write in bccomp()
    + [CVE-2026-17543]: SQL injection via E'...' backslash breakout
    + [CVE-2026-7260]: Crash via recursive symlinks
php8.4 (8.4.23-1) unstable; urgency=medium
 .
   * New upstream version 8.4.23

postfix (3.10.13-0+deb13u1) trixie-security; urgency=medium
 .
   * new upstream stable/bugfix/security release
     From the release announcement by Wietse Wenema at
     https://www.postfix.org/announcements/postfix-3.11.6.html :
 .
     These defects were found by Qualys assisted by Claude Mythos Preview,
     and by OpenAI Security; more than half date from 20 or more years ago.
     When I implemented Postfix, I knew that there were going to be mistakes.
     That is the reason why Postfix has its architecture and safety nets.
     The number of defects may seem large, but considering that they were
     found in a code base of over 150 thousand lines, the error rate
     is still lower than what I designed for.
 .
   o Policy bypass:
 .
    - Bug (introduced: Postfix 2.2, date: 20041102): missing SMTP server
      resets of MAIL FROM and RCPT TO command state after
      smtpd_end_of_data_restrictions rejected a message.  This resulted in
      SMTP protocol state desynchronization between the remote SMTP client
      and the Postfix SMTP server.
 .
    - A crafted remote SMTP client could then send RCPT TO and DATA without
      MAIL FROM, and deliver a second message.  Then,
      smtpd_end_of_data_restrictions skipped check_recipient_access
      constraints, because a recipient counter was > 1.
 .
    - The failure to reset MAIL FROM and RCPT TO state also affected Milter
      support (added in Postfix 2.3).  Here, after a Milter replied with
      "accept this message" based on the message envelope, and
      smtpd_end_of_data_restrictions rejected the message, the Postfix SMTP
      server as before accepted RCPT TO and DATA without MAIL FROM, and
      smtpd_end_of_data_restrictions as before skipped check_recipient_access
      constraints for the second message.  Under these conditions, the Postfix
      Milter client remained in the "accept this message" state, skipping
      Milter policy enforcement for the second message.
 .
   o Denial of service:
 .
    - Bug (defect introduced: Postfix 3.4, date: 20180805): SMTP server
      command history memory exhaustion with a large number of very small
      BDAT requests.
 .
    - Bug (defect introduced: Postfix 1.1, date: 20021116): address
      verification cache poisoning. A local user could use the postdrop
      command to submit an address verification probe with envelope or
      message content that Postfix rejected later, resulting in a negative
      address verification cache entry for that address.  On systems that
      enable address verification, the negative address verification cache
      entry would force the Postfix SMTP server to reject a message that it
      should accept (denial of service).
 .
   o Server crashes and panic()s:
 .
    - Bug (defect introduced: Postfix 3.4, date: 20180805): missing SMTP server
      reset of RCPT TO state, after a BDAT command error.  A crafted remote
      SMTP client could then send a DATA command without MAIL FROM or RCPT TO,
      and crash a Postfix SMTP daemon process with a null pointer read error.
 .
    - Bug (defect introduced: Postfix 2.4, date: 20051222): null pointer read
      crash while parsing a malformed Dovecot AUTH server response.
 .
   o Read after free, uninitialized read, under/over read:
 .
    - Bug (defect introduced: Postfix 2.8, date: 20100914): read-after-free
      in the PSC_CALL_BACK_NOTIFY() macro.  This had no effect on program
      execution, because myfree() wiped memory, and that memory was not yet
      reused.
 .
    - Read after free (no privilege escalation) in debug logging (defect
      introduced: Postfix 2.2, date: 20050117).
 .
    - Bug (defect introduced: Postfix 2.10, date: 20120617): uninitialized
      memory read in postscreen HaProxy client after remote I/O exception,
      causing garbage to be logged.
 .
    - Latent bug (defect introduced: Postfix 2.7, date: 20090618):
      uninitialized memory read after dnsblog(8) returns a string
      that is not an IPv4 address.
 .
    - Bug (defect introduced: before Postfix alpha, date 19970424): the DNS
      client could read up to two bytes past the end of an MX record, before
      discovering that the record was too short.  This behavior was later
      copied with SRV records, potentially over-reading up to six bytes.
 .
    - Bug (defect introduced: Postfix 1,1, date: 20010524): the postsuper
      command under-read or over-read a very short queue filename.  No crash,
      information leak, or privilege escalation.
 .
   o Other code hygiene:
 .
    - Bug (defect introduced: before Postfix alpha, date: 19971106): 'int'
      over-shift, in the queue file record-length parser.  Postfix programs
      do not generate such records, but an attacker could cause postdrop to
      reject input or panic().
 .
    - Bug (defect introduced: Postfix 2.2, date: 20050117):
      non-transitive comparison of IPv4 addresses.
 .
    - Bug (defect introduced: Postfix 1.0, date: 20000928): the fast
      flush server, used by the SMTP command "ETRN", and by the commands
      "postqueue -s site" and "postqueue -i queue_id" (and their sendmail(1)
      equivalents), used the wrong duplicate suppression API, resulting in
      unnecessary queue scans by the queue manager.
 .
    - Queue hygiene: the postdrop command accepted the null record type
      which the rest of Postfix ignores.
postfix (3.10.12-0+deb13u2) trixie-security; urgency=medium
 .
   * fix previous changelog entry (remove item which is not relevant for 3.10.x)
   * re-upload to trixie-security

postgresql-17 (17.11-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 17.11.
 .
     + Restrict logical decoding output plugins to the set specified by
       a new server parameter `output_plugin_libraries` (Jacob
       Champion)
 .
       Previously, a replication user could select any loadable library
       for logical decoding, allowing exploits of various sorts. To
       allow locking this down without breaking setups that worked
       before, introduce a whitelist of allowed output plugins.
 .
       By default, only the output plugins shipped as part of
       PostgreSQL (`pgoutput` and `test_decoding`) are included in
       `output_plugin_libraries`. Installations that rely on other
       output plugins must add them after updating the server, for
       example
 .
       output_plugin_libraries = 'pgoutput, test_decoding, my_trusted_decoder'
 .
       Additionally, pg_upgrade --check will fail if the
       `output_plugin_libraries` parameter on the new cluster does not
       permit the plugins of logical replication slots on the old
       cluster, when migrating from versions 17 and later. Make
       necessary additions to the new cluster's setting before
       performing pg_upgrade.
 .
       The PostgreSQL Project thanks Vladimir Tokarev and Yu Kunpeng
       for reporting this problem. (CVE-2026-6471)
 .
     + Fix contrib/pgcrypto's PGP encryption to detect unsupported
       ciphers (Daniel Gustafsson)
 .
       Previously, if OpenSSL rejected the requested cipher (for
       example, because it is running in FIPS mode, or the legacy
       provider hasn't been loaded), pgcrypto failed to notice the
       failure and simply XOR'd the non-encrypted block with the
       plaintext, rendering the "encryption" trivially breakable. This
       will typically occur with deprecated or non-FIPS cipher
       algorithms (cipher-algo=blowfish/bf, twofish, cast5, or 3des).
 .
       By default, pgcrypto will now fail to decrypt any messages that
       were affected in this way. To allow retrieval of such data, a
       new option `ignore-cipher-failure` has been added to
       pgp_pub_decrypt() and pgp_sym_decrypt(). Setting
       `ignore-cipher-failure=1` will restore their previous behavior,
       allowing the faulty encryption wrapper to be stripped off:
 .
       pgp_sym_decrypt(encrypted_column, any key, 'ignore-cipher-failure=1')
 .
       Once the affected messages are identified and stripped of their
       wrappers, they can then be re-encrypted with a modern algorithm.
       It is important however that the behavior of OpenSSL be the same
       as it was when the faulty messages were created: if the set of
       unsupported algorithms is not the same, this approach will not
       work. See the documentation for `ignore-cipher-failure`.
 .
       The PostgreSQL Project thanks Shishir Sharma for reporting this
       problem. (CVE-2026-14663)
 .
     + Fix psql to skip in-line data following a scripted COPY ... FROM
       STDIN command, even if the COPY fails before sending
       `PGRES_COPY_IN` (Tom Lane)
 .
       Previously, if a `COPY` command failed at startup (for instance,
       because the target table doesn't exist) psql would not realize
       that and would proceed to read the following in-line data as SQL
       commands. In the best case that's wrong and in the worst case
       it's a SQL-injection hazard. Teach psql to recognize
       syntactically-valid COPY ... FROM STDIN commands and to skip
       data on its own authority if the server doesn't respond with
       `PGRES_COPY_IN`.
 .
       While this fix is unlikely to affect any production SQL scripts,
       test scripts might intentionally exercise failing COPY ... FROM
       STDIN commands. Those will need to gain a `\.` data terminator
       line after each such command.
 .
       The PostgreSQL Project thanks Alexander Lakhin for reporting
       this problem. (CVE-2026-6464)
 .
     + Cross-check the output row type of a portal running EXECUTE or
       FETCH (Robert Haas)
 .
       EXECUTE and FETCH use two portals: an outer one for the
       statement itself, and an inner one running the query being
       executed on its behalf. It was previously possible to make the
       declared row types of the two portals diverge, leading to server
       memory disclosure and arbitrary code execution.
 .
       The PostgreSQL Project thanks Ben Morris (in collaboration with
       Claude and Anthropic Research) and Peter Geoghegan for reporting
       this problem. (CVE-2026-16239)
 .
     + Fix buffer overrun with long time zone abbreviation in to_char()
       (Tom Lane)
 .
       This can easily crash the server, and exploits leading to
       arbitrary code execution have been reported.
 .
       The PostgreSQL Project thanks Hcamael, Amjad Shahzad, Tan Zhen
       of AntAISecurityLab, Tomer Fichman, Zheng Yu, Amy Burnett
       (OpenAI Codex Security), Rick de Jager, Heewon Song, Sylvie
       Mayer, Aleksander Alekseev, and Hillai Ben Sasson for reporting
       this problem. (CVE-2026-14669)
 .
     + Fix buffer overrun in regexp match/split functions (Masahiko
       Sawada)
 .
       If passed invalidly-encoded data, these functions could write
       past the end of their conversion buffer.
 .
       The PostgreSQL Project thanks Francesco Verardi for reporting
       this problem. (CVE-2026-14664)
 .
     + Harden the ascii() function against invalid input (Michael
       Paquier)
 .
       By supplying invalidly-encoded input, this function could be
       coaxed to read and return a few bytes of data that it shouldn't.
       In assert-enabled builds, its assertions could be triggered too.
 .
       The PostgreSQL Project thanks Hcamael for reporting this
       problem. (CVE-2026-18024)
 .
     + Fix multirange type handling in pg_restore_attribute_stats()
       (OpenAI Security Research Team)
 .
       pg_restore_attribute_stats() treated multirange types just like
       their underlying range type. This works correctly for the bounds
       histogram, but it was wrong for all the other statistics kinds.
 .
       The PostgreSQL Project thanks Amy Burnett (OpenAI Codex
       Security) for reporting this problem. (CVE-2026-16238)
 .
     + Make scalarineqsel() check that a constant it expects to be of
       type tid actually is (Tom Lane)
 .
       This expectation will hold for all the built-in operators that
       use this estimator, but a maliciously-constructed operator could
       violate it, leading to a crash or server memory disclosure.
 .
       The PostgreSQL Project thanks Hcamael for reporting this
       problem. (CVE-2026-14668)
 .
     + Harden tsvector and tsquery code against overly long values
       (both individual lexemes and total vector/query length) (Tom
       Lane)
 .
       The documented limits were not enforced in all code paths.
 .
       The PostgreSQL Project thanks Yuhang Wu, Zhenpeng Lin, Zheng Yu,
       and Hcamael for reporting these problems. (CVE-2026-14662)
 .
     + Fix various places that mistakenly assumed they would not have
       to deal with more than `FUNC_MAX_ARGS` function arguments (Tom
       Lane)
 .
       Notably, the server's actual limit on the number of arguments to
       an aggregate function is `FUNC_MAX_ARGS - 1`, but the parser
       failed to enforce that, creating hazards downstream.
 .
       The PostgreSQL Project thanks Zheng Yu, ylwangtju, and Masahiko
       Sawada for reporting these problems. (CVE-2026-14679)
 .
     + Reject calls from SQL to functions that take or return type
       internal (Tom Lane)
 .
       The existing defenses against doing this have been shown to be
       insufficient, so add more explicit checks.
 .
       The PostgreSQL Project thanks Amy Burnett (OpenAI Codex
       Security) for reporting this problem. (CVE-2026-14680)
 .
     + Preserve the ownership of extended statistics objects when they
       are rebuilt by ALTER TABLE (Masahiko Sawada)
 .
       Previously, the role running ALTER TABLE gained ownership of
       such objects, but that seems inappropriate.
 .
       The PostgreSQL Project thanks Noah Misch for reporting this
       problem. (CVE-2026-6469)
 .
     + When deparsing an EXTRACT() function call, quote the field name
       if needed (Nathan Bossart)
 .
       The parser accepts any string literal as a field name in
       EXTRACT(), deferring validation to execution. If the call is
       stored and deparsed (for example during pg_dump), the string
       body was regurgitated verbatim, allowing SQL injection.
 .
       The PostgreSQL Project thanks Ben Morris (in collaboration with
       Claude and Anthropic Research) for reporting this problem.
       (CVE-2026-15741)
 .
     + Check for `USAGE` privilege on data types in places that
       formerly failed to check that (Nathan Bossart)
 .
       CREATE TYPE AS RANGE did not check, nor did ALTER TABLE OF, nor
       did commands that create stored expressions. These omissions
       allowed roles without `USAGE` privilege to nonetheless create
       objects depending on the type, possibly blocking the type's
       owner from changing the type later.
 .
       The PostgreSQL Project thanks Jingzhou Fu for reporting this
       problem. (CVE-2026-6470)
 .
     + Invalidate role-dependent cached plans after role changes (Ilya
       Staroverov, Shinya Kato, Nathan Bossart)
 .
       Role membership, role attribute, and database ownership changes
       may impact the expected behavior of row-level security policies,
       but previously we'd continue to use cached plans that were made
       according to the old state of affairs.
 .
       The PostgreSQL Project thanks Ilya Staroverov and Shinya Kato
       for reporting this problem. (CVE-2026-14666)
 .
     + Reject GSSEncRequest after direct SSL connection (Michael
       Paquier)
 .
       After establishing a TLS-encrypted connection, the server would
       still accept a request for GSSAPI encryption. If that succeeded,
       the connection would proceed using TLS encryption, but it would
       look like a GSS connection to the pg_hba rules. Thus, a pg_hba
       policy intending to disallow TLS would not be enforced
       correctly.
 .
       The PostgreSQL Project thanks p4p3r for reporting this problem.
       (CVE-2026-14681)
 .
     + Make mock SCRAM authentication secrets more plausible (Nathan
       Bossart)
 .
       If a SCRAM login is attempted against a role that doesn't exist
       or doesn't have a SCRAM secret, we generate a mock secret and
       carry out the authentication handshake anyway, to avoid
       revealing these facts to an attacker. But the mock secret was
       made with a fixed iteration count, which in itself can be an
       observable response discrepancy. Use the configuration setting
       `scram_iterations` instead, to make the mock secret look more
       like the installation's real secrets.
 .
       The PostgreSQL Project thanks Radim Marek for reporting this
       problem. (CVE-2026-14672)
 .
     + Fix out-of-bounds writes in ecpg applications caused by invalid
       bytea data received from the server (Michael Paquier)
 .
       ecpg assumed without checking that any bytea value must begin
       with `\x`. A broken or malicious server might send a string
       shorter than 2 bytes, resulting in memory clobber in the
       application.
 .
       The PostgreSQL Project thanks ylwangtju for reporting this
       problem. (CVE-2026-16241)
 .
     + Do not do backquote expansion on the argument of psql's
       \unrestrict command (Nathan Bossart)
 .
       This oversight in the fix for CVE-2025-8714 allows a malicious
       server to inject shell commands into plain-text dump output that
       will be run at restore time on the machine running psql, the
       exact scenario that CVE-2025-8714 intended to prevent.
 .
       The PostgreSQL Project thanks Lucas Velgus, Filip Janus, and
       Daniel Bakker for reporting this problem. (CVE-2026-18408)
 .
     + Remove pg_dump's assumption that pg_proc.protrftypes cannot have
       more than `FUNC_MAX_ARGS` entries (Tom Lane)
 .
       Since there could be entries for both input and output
       arguments, it's feasible for this array's length to exceed
       `FUNC_MAX_ARGS` (which constrains only input arguments). Even if
       that were not so, pg_dump cannot assume that the server was
       built with the same value of `FUNC_MAX_ARGS` that it has. An
       overrun would lead to a memory clobber inside pg_dump.
 .
       The PostgreSQL Project thanks Masahiko Sawada for reporting this
       problem. (CVE-2026-19385)
 .
     + Harden PL/Perl against "tied" Perl arrays and hashes (Tom Lane)
 .
       A tied object that doesn't behave like a regular one could lead
       to memory overwrite, or to constructing a corrupt result array
       (which would likely cause problems later).
 .
       The PostgreSQL Project thanks Hcamael for reporting this
       problem. (CVE-2026-14670)
 .
     + Fix integer overflows in memory-allocation calculations in
       PL/Perl and PL/Tcl (Heikki Linnakangas)
 .
       This is the same type of problem as CVE-2026-6473, just in a
       different part of the code, and is fixed in the same way.
 .
       The PostgreSQL Project thanks the Tulya Project (Team Dhiutsa,
       Bitecope Technologies Private Ltd) for reporting this problem.
       (CVE-2026-14677)
 .
     + Ensure that contrib/amcheck functions restrict `search_path`
       before executing index expressions (Noah Misch)
 .
       Because amcheck will run such index expressions as the owner of
       their tables, a caller could potentially hijack
       `search_path`-dependent functions to run arbitrary code as the
       table owner. By default this is not a vulnerability because only
       superusers are allowed to call amcheck functions; but if that
       privilege was granted out, it created a larger hazard than the
       documentation suggests.
 .
       The PostgreSQL Project thanks Yuelin Wang and Jacob Brazeal for
       reporting this problem. (CVE-2026-14673)
 .
     + Fix integer overflows in contrib/fuzzystrmatch's levenshtein()
       and levenshtein_less_equal() functions (Nathan Bossart)
 .
       Passing large cost values to these functions could cause integer
       overflows, thereby producing nonsensical results, and even
       causing out-of-bounds writes in some cases.
 .
       The PostgreSQL Project thanks Ben Morris (in collaboration with
       Claude and Anthropic Research) for reporting this problem.
       (CVE-2026-15742)
 .
     + Fix buffer overrun in contrib/pg_stat_statements (Álvaro
       Herrera)
 .
       Query normalization didn't accurately account for the amount of
       space the normalized string would require.
 .
       The PostgreSQL Project thanks Sajeeb Lohani (with TrendAI Zero
       Day Initiative) and Yuelin Wang for reporting this problem.
       (CVE-2026-14676)
 .
     + Fix datatype error in contrib/pg_trgm's GiST picksplit function
       (Heikki Linnakangas)
 .
       This mistake resulted in reading past the end of the buffer,
       typically causing bad split decisions; but a crash could ensue
       if you're very unlucky.
 .
       The PostgreSQL Project thanks Mehmet D. Ince for reporting this
       problem. (CVE-2026-14678)
 .
     + Remove the plan cache in contrib/refint (Ayush Tiwari)
 .
       This caching behavior has several serious bugs, notably that
       check_foreign_key() embeds the new key values in its
       cascade-UPDATE queries, so a cached plan reuses the
       originally-needed values rather than the key values that should
       be used. The simplest solution is to remove it.
 .
       The PostgreSQL Project thanks Hcamael for reporting this
       problem. (CVE-2026-14671)
 .
   * Fix psql -c 'truncate/create table; copy from stdin'.

proftpd-dfsg (1.3.8.c+dfsg-4+deb13u3) trixie; urgency=medium
 .
   * Add patch for CVE-2026-44331 (Closes: #1135840).
   * Add patch for CVE-2026-53994.
   * Add patch for CVE-2026-63091.
   * Add patch for CVE-2026-63090.

pyasn1 (0.6.1-1+deb13u3) trixie; urgency=high
 .
   * Team upload.
   * CVE-2026-59886: uncontrolled resource consumption when converting
     decoded real values. univ.Real convertedts  mantissa, base,
     exponens to a Python float using exact big-integer exponentiation,
     so a real value only a few bytes long could carry a very large exponent.
   * CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded
     long-form tag IDs. The BER decoder accumulated tag continuation
     octets without an upper bound, so a crafted substrate could force
     construction of an arbitrarily large integer with quadratic CPU cost
     (Closes: #1142388).
   * CVE-2026-59885: fix quadratic complexity in OBJECT IDENTIFIER and
     RELATIVE-OID decoding and encoding, which allowed denial of service
     via a small payload with many arcs.

python-ecdsa (0.19.1-1+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * d/patches: (Closes: #1132164)
     - CVE-2026-33936: Import upstream patch
     - Fix-tests-with-new-Python: Import upstream patch
       (Tests fails with python 3.13)

python-httplib2 (0.22.0-1+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2026-59939: The httplib2 HTTP client library performs unbounded
     decompression of HTTP response bodies encoded with Content-Encoding:
     gzip or deflate. This is a classic decompression bomb (zip bomb)
     attack against the HTTP client.

python3.13 (3.13.5-2+deb13u5) trixie; urgency=medium
 .
   * CVE-2026-6879
   * CVE-2026-0864 (Closes: #1141524)
   * CVE-2026-4360 (Closes: #1141531)
   * CVE-2026-11940 (Closes: #1141533)
   * CVE-2026-11972 (Closes: #1141534)
python3.13 (3.13.5-2+deb13u4) trixie; urgency=medium
 .
   * Patch: Fix use-after-free in dict.clear() with embedded values.
     Resolves a regression in 3.13.5-2+deb13u3. (Closes: #1141977)

qemu (1:10.0.13+ds-0+deb13u1) trixie; urgency=medium
 .
   * new upstream stable/bugfix release, including multiple security fixes:
    -  Update version for 10.0.13 release
    -  target/riscv/tcg: sret in virtual user mode
       raises virtual instruction exception
       https://gitlab.com/qemu-project/qemu/-/work_items/3622
    -  target/riscv: enforce even register constraints for Zdinx fcvt pairs
       https://gitlab.com/qemu-project/qemu/-/work_items/4109
    -  target/riscv: reject FMV.X.W/FMV.W.X under Zfinx
       https://gitlab.com/qemu-project/qemu/-/work_items/4108
    -  target/riscv: honor zicbo* envcfg gating in linux-user mode
       https://gitlab.com/qemu-project/qemu/-/work_items/4107
    -  disas/riscv: Fix typo in th.lbib format
    -  disas/riscv: Fix isa decoding of rev8
    -  disas/riscv: Fix rv32 encoding of zext.h
    -  target/riscv: allow menvcfg/henvcfg LPE and SSE bits on RV32
       https://gitlab.com/qemu-project/qemu/-/work_items/4045
    -  hw/riscv/riscv-iommu: preserve requested perm in spa_fetch()
    -  hw/riscv/riscv-iommu: fix U-bit check to apply only to
       leaf S/VS-stage PTEs
    -  disas/riscv: Decode unsigned vector immediates as unsigned
    -  disas/riscv: Use signed type for vector immediates
    -  disas/riscv: Fix 6-bit immediate extraction
    -  disas/riscv: Fix th.srri decoding
    -  target/riscv: use SXL instead of MXL for read_sstatus
    -  target/riscv: Fix PC sync in trans_sspopchk for CFI exception handling
       https://gitlab.com/qemu-project/qemu/-/work_items/4118
    -  hw/watchdog: Add lower bound check for watchdogNumber
       https://gitlab.com/qemu-project/qemu/-/work_items/3600
    -  tcg: Export tcg_gen_ussub_i{32,64,tl}
    -  tcg: Defer tb_flush when initial thread region alloc fails
       https://gitlab.com/qemu-project/qemu/-/work_items/2984
    -  tcg: Return success from tcg_region_alloc
    -  tcg: Return success from tcg_region_alloc__locked
    -  target/loongarch: check FPE before reading fcc in bceqz/bcnez
       https://gitlab.com/qemu-project/qemu/-/work_items/4209
    -  meson: make linker warnings non-fatal on Linux
    -  serial: clear transmit retry callback on unrealize
       https://gitlab.com/qemu-project/qemu/-/work_items/4125
    -  target/i386: decode opcode extensions group 3 /1 as TEST
       https://gitlab.com/qemu-project/qemu/-/work_items/3580
    -  target/i386: allow transition to virtual-8086 mode
       only if CPL == 0 and CPU is not in long mode
       https://gitlab.com/qemu-project/qemu/-/work_items/3583
    -  target/i386: fix long mode segment override prefix decoding
       https://gitlab.com/qemu-project/qemu/-/work_items/3391
    -  target/i386: fix incorrect decoding of EXTRQ_i
       https://gitlab.com/qemu-project/qemu/-/work_items/3611
    -  target/i386: Clear OF, SF, and AF for fcomi/fucomi
       https://gitlab.com/qemu-project/qemu/-/work_items/4133
    -  target/i386: Use correct type for get_float_exception_flags() values
    -  tcg/optimize: Fix s_mask computation for shifts
    -  tcg/optimize: INDEX_op_mul is commutative
    -  hw/elf_ops: defend against weird elf headers
    -  hw/nvme: add SPDM_SOCKET Kconfig dependency
    -  hw/block/pflash_cfi01: Restore ROMD mode after migration
       https://gitlab.com/qemu-project/qemu/-/work_items/4042
    -  hw/net/rtl8139: Send whole of vlan-tagged packet when doing loopback
    -  hw/net/rtl8139: Fix handling of VLAN tags on incoming short packets
       https://gitlab.com/qemu-project/qemu/-/work_items/3518
    -  tests/qtest/ahci: regression test for ATAPI read vs. drain
    -  hw/ide/atapi: read the whole elementary transfer asynchronously
    -  tests/qtest/ahci: cover raw (2352-byte) ATAPI CD reads
    -  tests/qtest/libqos/ahci: support raw (2352-byte) READ CD
    -  tests/qtest/ide-test: cover raw (2352-byte) ATAPI CD reads
    -  tests/qtest/ide-test: add a multi-sector ATAPI DMA read test
    -  tests/qtest/ide-test: parametrize the ATAPI CD-ROM read test
    -  hw/net/vmxnet3: Do not abort if guest provides bad interrupt numbers
       https://gitlab.com/qemu-project/qemu/-/work_items/539
    -  hw/usb/dev-uas: Don't abort if guest provided an undersized buffer
       for status
       https://gitlab.com/qemu-project/qemu/-/work_items/3900
    -  hw/intc/loongarch_pch_pic: Validate htmsi_vector before indexing
       parent_irq
       https://gitlab.com/qemu-project/qemu/-/work_items/4114
    -  migration/multifd: Replace assert() with error_setg() in recv paths
    -  migration/multifd: Validate next_packet_size in zlib/zstd recv
       https://gitlab.com/qemu-project/qemu/-/work_items/3737
    -  tests/tcg/s390x: Test STCKF condition code on a faulting store
    -  target/s390x/tcg: Set STCK/STCKF condition code after the store
    -  pc-bios/s390-ccw.img: update s390x bios
    -  pc-bios/s390-ccw: bound zipl menu strlen and replace VLA
       in zipl_print_entry
    -  pc-bios/s390-ccw: bounds-check zipl menu entry index before array write
    -  pc-bios/s390-ccw: fix out-of-bounds read in iso_get_file_size()
    -  s390x/ipl: validate num_comp against iplb length before iterating
    -  hw/char/sclpconsole-lm: avoid guest triggerable assert
    -  tests/tcg/s390x: Test DR overflow (INT64_MIN / -1)
    -  target/s390x: Fix DR/D INT64_MIN / -1 host crash
    -  tests/tcg/s390x: Test PRNO TRNG interruptibility
    -  target/s390x: Make PRNO TRNG interruptible
    -  target/s390x: Have MSA helper pass a mmu_idx argument
    -  hw/arm/aspeed: Add missing Kconfig dependencies on required components
    -  linux-user: implement mount_setattr(2)
    -  linux-user/sh4: Fix crashes on signal delivery in conditional delay slot
    -  linux-user/sh4: Initialize the FPSCR register on signal
    -  linux-user/sh4: Deliver SIGILL on invalid instruction
    -  gitlab: disable provenance attestations to work around CI bug
    -  hw/nvme: fix leak on copy ranges
    -  hw/nvme: cancel inflight requests on controller reset
       https://gitlab.com/qemu-project/qemu/-/work_items/3398
       https://gitlab.com/qemu-project/qemu/-/work_items/3883
       https://gitlab.com/qemu-project/qemu/-/work_items/4068
       https://gitlab.com/qemu-project/qemu/-/work_items/4072
    -  hw/nvme: factor out nvme_sq_cancel_inflight()
    -  hw/nvme: drop AER requests without aiocb in nvme_del_sq()
    -  hw/display/virtio-gpu: Unmap DMA regions on reset
       https://gitlab.com/qemu-project/qemu/-/work_items/3467
    -  hw/display/virtio-gpu: Always reject invalid scanout bounds
    -  virtio-gpu: reject requests with short/truncated control headers
       Closes: CVE-2026-18054
    -  hw/display/virtio-gpu: fix offset wraparound in scanout_blob_to_fb
    -  vhost-user-gpu: fix integer overflow in buffer allocation
       Closes: CVE-2026-15264
    -  hw/display/vga: fix panning_buf OOB after text/graphics switch
       https://gitlab.com/qemu-project/qemu/-/work_items/4085
       Closes: CVE-2026-17516
    -  hw/display/virtio-gpu: validate blob iov size
       https://gitlab.com/qemu-project/qemu/-/work_items/3945
       Closes: CVE-2026-66021
    -  coroutine: fix lost wakeup in qemu_co_sleep_wake()
    -  iotests: run the test pool with the 'fork' start method
    -  qcow2: do not try to clear the dirty bit on a read-only node
    -  dmg: reject inconsistent UDRW chunk sector count and length
       https://gitlab.com/qemu-project/qemu/-/work_items/3846
       Closes: CVE-2026-65928
    -  dmg: refuse to open files with no chunks
       https://gitlab.com/qemu-project/qemu/-/work_items/4021
    -  dmg: fix out-of-bounds load in search_chunk()
       https://gitlab.com/qemu-project/qemu/-/work_items/3844
       Closes: CVE-2026-65929
    -  tests/unit: add reproducer for BlockAcctStats histogram locking race
    -  block/qapi: take stats->lock when reading BlockAcctStats
       for query-blockstats
    -  block/accounting: take stats->lock in latency histogram setters
    -  block: Fix crash after setting latency historygram with single bin
    -  block/cloop: fix integer overflow in total_sectors calculation
    -  linux-user: fix incorrect msg_l[sr]pid members of target_msqid_ds
    -  linux-user: Fix msqid_ds struct wrt 32-bit big endian architectures
    -  hw/nvme: fix assertion failure on subregion removal
    -  hw/nvme: fix unintentional integer overflow in shift
    -  hw/nvme: fix cross-namespace copy dif buffer overflow
    -  virtio-mmio: fix QUEUE_NUM_MAX
       https://gitlab.com/qemu-project/qemu/-/work_items/3882
       Closes: CVE-2026-50626
    -  hw/display/exynos4210_fimd: Clamp windows to screen size
       https://gitlab.com/qemu-project/qemu/-/work_items/3795
    -  hw/display/exynos4210_fimd: Pass width to draw_line functions
    -  hw/display/exynos4210_fimd: Factor out finding screen width/height
    -  hw/i2c/bcm2835_i2c: Correct CLKT register offset
    -  linux-user/sh4: allow full 32-bit address space
    -  target/sparc: set reg window data structures currently
       after vmstate load
    -  hw/net/igb: recalculate rx_desc_len on migration load
    -  hw/net/e1000e: recalculate rx_desc_len on migration load
    -  linux-user: fix guards for the fsmount(2) syscall series
    -  hw/net/xilinx_axienet: Don't write checksums off end of packet
    -  linux-user: Guard local FUTEX_CMD_MASK definition
    -  virtio: avoid packed vring virtio_queue_empty() infinite loops
       https://gitlab.com/qemu-project/qemu/-/work_items/3968
       Closes: CVE-2026-16457
    -  backends/rng: cap request size to avoid oversized allocation
       https://gitlab.com/qemu-project/qemu/-/work_items/3983
    -  hw/virtio-rng: Fix host use-after-free
       https://gitlab.com/qemu-project/qemu/-/work_items/3917
       Closes: CVE-2026-50624
    -  hw/net/virtio-net: Protect from DMA re-entrancy bugs
       https://gitlab.com/qemu-project/qemu/-/work_items/4073
       Closes: CVE-2026-66022 (again)
    -  intel_iommu: Check address mask before using it in
       pasid-based iotlb invalidation
       https://gitlab.com/qemu-project/qemu/-/work_items/3619
    -  hw/cxl: fix OOB access in cxl_doe_cdat_rsp via entry_handle
    -  hw/virtio/vdpa-dev: pass set_config buffer to vhost backend
    -  hw/pci-host/q35.c: Avoid early return in mch_write_config()
    -  hw/pci-host/q35.c: Factor out creation of SMRAM MRs
    -  hw/pci-host/q35.c: Always initialize smram-region even if SMM disabled
    -  virtio-iommu: fix OOM due to unbounded call_rcu
    -  libvduse: validate vq size
       https://gitlab.com/qemu-project/qemu/-/work_items/3652
       Closes: CVE-2026-61402
    -  libvhost-user: fix heap overflow in vu_check_queue_inflights
       https://gitlab.com/qemu-project/qemu/-/work_items/3974
       Closes: CVE-2026-63110
    -  libvhost-user: validate last_batch_head in vu_check_queue_inflights
       https://gitlab.com/qemu-project/qemu/-/work_items/3974
    -  virtio-pmem: wait for flush requests on unrealize
       https://gitlab.com/qemu-project/qemu/-/work_items/3938
       Closes: CVE-2026-63323
    -  vhost-user: assert nregions within limit
       https://gitlab.com/qemu-project/qemu/-/work_items/3910
    -  virtio: fail early on bad config_len in migration
       https://gitlab.com/qemu-project/qemu/-/work_items/3891
    -  virtio-scsi: fix SCSIRequest leak on a bad request
       https://gitlab.com/qemu-project/qemu/-/work_items/3875
       Closes: CVE-2026-61476
    -  vhost: do not crash on ring map failure
       https://gitlab.com/qemu-project/qemu/-/work_items/3783
    -  hw/virtio: reject zero-length packed indirect descriptor table
       https://gitlab.com/qemu-project/qemu/-/work_items/3984
    -  libvhost-user: protect against OOB vring queue access
       https://gitlab.com/qemu-project/qemu/-/work_items/3741
    -  libvhost-user: protect against OOB writes in vu_set_inflight_fd
       https://gitlab.com/qemu-project/qemu/-/work_items/3740
    -  virtio-net: fix short frame OOB read in receive_filter()
       https://gitlab.com/qemu-project/qemu/-/work_items/3626
       Closes: CVE-2026-63320
    -  virtio-net: fix OOB read in RSC receive path
       https://gitlab.com/qemu-project/qemu/-/work_items/3623
       Closes: CVE-2026-63321
    -  hw/display/virtio-gpu: Block Rutabaga migration
    -  rutabaga: improve error handling, fix potential crash during init
    -  hw/display/virtio-gpu: Initialize blob mapping for ATTACH_BACKING
    -  hw/display/virtio-gpu: Fix empty blob discrimination
    -  virtio-gpu: fix NULL deref in rutabaga set_scanout
       https://gitlab.com/qemu-project/qemu/-/work_items/3897
    -  target/i386/sev: fix MemoryRegion reference leaks in gpa2hva callers
    -  net/colo: fix g_hash_table_destroy assertion on uninitialized filter
    -  hw/display/qxl: unregister vm_change_state handler and BHs
       https://gitlab.com/qemu-project/qemu/-/work_items/3607
       Closes: CVE-2026-63322
    -  ui/vnc: remove redundant rows computation
    -  hw/display/vhost-user-gpu: validate message payload sizes
       https://gitlab.com/qemu-project/qemu/-/work_items/3866
    -  hw/display/virtio-gpu: Remove the bytes_pp field
    -  hw/display/virtio-gpu: reject strides exceeding INT_MAX
    -  hw/display/virtio-gpu: validate stride against width on scanout
       https://gitlab.com/qemu-project/qemu/-/work_items/3989
       Closes: CVE-2026-63109
    -  hw/usb/hcd-xhci: Check return value of xhci_xfer_create_sgl()
       for errors
       https://gitlab.com/qemu-project/qemu/-/work_items/3786
    -  hw/usb/core: Avoid possible assert() in do_parameter() -->
       usb_packet_copy()
       https://gitlab.com/qemu-project/qemu/-/work_items/3746
    -  hw/ide/core: Fix possible crash via NULL pointer
       in ide_cancel_dma_sync()
       https://gitlab.com/qemu-project/qemu/-/work_items/905
       https://gitlab.com/qemu-project/qemu/-/work_items/4052
    -  hw/usb/dev-uas: Fix guest-triggerable heap OOB access
       https://gitlab.com/qemu-project/qemu/-/work_items/3612
       https://gitlab.com/qemu-project/qemu/-/work_items/3986
    -  hw/9pfs/xen: drain in-flight PDUs before xen-9p disconnect
    -  hw/9pfs/virtio: drain in-flight PDUs before virtio-9p unrealize
       https://gitlab.com/qemu-project/qemu/-/work_items/3937
    -  hw/9pfs: fix O_TRUNC bypass on read-only export
       https://gitlab.com/qemu-project/qemu/-/work_items/4000
       Closes: CVE-2026-63318
    -  hw/display/vmware_vga: Don't allow guest to trigger
       long running loop in host
       https://gitlab.com/qemu-project/qemu/-/work_items/3782
       https://gitlab.com/qemu-project/qemu/-/work_items/4026
       https://gitlab.com/qemu-project/qemu/-/work_items/4076
    -  hw/ide: replace assert with proper error handling
       https://gitlab.com/qemu-project/qemu/-/work_items/2777
    -  scsi-disk: fix off by one in assertion
    -  scsi-disk: protect against guest sending truncated data
       for MODE SELECT commands
       https://gitlab.com/qemu-project/qemu/-/work_items/4051
    -  target/i386: helper_sysret(): Check that RCX contains
       a canonical address when emulating an Intel CPU
       https://gitlab.com/qemu-project/qemu/-/work_items/3223
    -  vfio/pci: reject invalid PCI_INTERRUPT_PIN values
    -  vfio/pci: don't narrow a failed config read to a plausible value
    -  vfio/igd: Clear saved BDSM in legacy VBIOS ROM at load time
       https://gitlab.com/qemu-project/qemu/-/work_items/3093
    -  vfio/pci: Initialize rom_read_failed in vfio_pci_load_rom()
    -  hw/uefi: make SetupMode read-only
       https://gitlab.com/qemu-project/qemu/-/work_items/4039
       Closes: CVE-2026-16288
    -  hw/uefi: add post_load checks
       https://gitlab.com/qemu-project/qemu/-/work_items/3837
       https://gitlab.com/qemu-project/qemu/-/work_items/3838
       https://gitlab.com/qemu-project/qemu/-/work_items/3839
       https://gitlab.com/qemu-project/qemu/-/work_items/3885
       Closes: CVE-2026-61404
    -  hw/uefi: account variable policy entries against storage size
       https://gitlab.com/qemu-project/qemu/-/work_items/3890
       Closes: CVE-2026-61405
    -  hw/uefi: check lower limit for signature list size
       https://gitlab.com/qemu-project/qemu/-/work_items/3899
       Closes: CVE-2026-61406
    -  hw/uefi: remove debug function
       https://gitlab.com/qemu-project/qemu/-/work_items/3615
       Closes: CVE-2026-58582
    -  hw/uefi: add sanity check
       https://gitlab.com/qemu-project/qemu/-/work_items/3614
       Closes: CVE-2026-58581

refpolicy (2:2.20250213-13~deb13u1) trixie; urgency=medium
 .
   * Fixes for Trixie stable update
refpolicy (2:2.20250213-12) unstable; urgency=medium
 .
   [ Russell Coker ]
   * Fix for usbguard
   * Label /var/lib/dbconfig-common/sqlite3/sympa/sympa
   * Allow pam sessions to create wtmp.db-journal
refpolicy (2:2.20250213-11) unstable; urgency=medium
 .
   * Added usbguard policy
   * Allow chromium to stat xattr filesystems, read xkb libs, and give fifo
     files to the window manager (to stop it crashing on paste)
   * Allow pulseaudio_client domains (including the $1_wm_t domains) to mmap
     the tmpfs files related to pulseaudio (for Chrome mostly)
   * Allow systemd_passwd_agent_t to watch user runtime dirs for systemd
     daemon restart
   * Allow dhcpd_t to execute ntpd_exec_t in ntpd_t for dhcp scripts and start
     generic units
   * Allow systemd-nspawn to use user terminal devices for directly running by
     sysadmin and allow managing mnt_t files

roundcube (1.6.18+dfsg-0+deb13u1) trixie-security; urgency=high
 .
   * New upstream security and bugfix release (closes: #1144059).
     + Fix CVE-2026-74998: Content proxied by the css proxy is not validated
       validation.
     + Fix CVE-2026-75006: SSRF bypass via specific local address URLs using
       100.64.0.0/10 and fe80::/10 subnets.
     + Fix CVE-2026-75006: SSRF filter bypass via various forms of
       nip.io/sslip.io hostnames evading `is_local_url()` check.
     + Fix CVE-2026-75003: Remote content blocking bypass via unclosed `url()`
       in a FuncIRI attribute.
     + Fix CVE-2026-75007: LDAP filter injection via unescaped %u/%fu/%d
       substitution into the `search_filter`.
     + Fix CVE-2026-75004: Arbitrary sieve script injection via a filter rule
       name bypassing `managesieve_disabled_actions`.
     + Fix CVE-2026-74997: RCE in the `cmd_learn` driver of markasjunk plugin.
     + Fix CVE-2026-75002: IMAP command injection via mail search and LITERAL+
       byte-count desynchronization.
     + Fix CVE-2026-75010: The modoboa driver of the passwd plugin leaks an
       authentication token to a user-controlled host.
     + Fix CVE-2026-74999: Stored XSS in "Add to address book" action.
     + Fix CVE-2026-75000: HTML/CSS sanitization bypass via SVG animate `by`
       attribute.
   * Refresh d/patches.
   * Cherry-pick follow-up change to fix PHP warning in markasjunk's
     cmd_learn.php.
roundcube (1.6.17+dfsg-1) unstable; urgency=high
 .
   * New upstream security and bugfix release (closes: #1141495).
     + Fix infinite loop in TNEF (winmail.dat) decoder.
     + Fix various vulnerabilities in the password plugin using
       session-injected username.
     + Fix CVE-2026-54432: Stored XSS via unescaped attachment MIME type on the
       attachment-validation warning page.
     + Fix SSRF bypass via specific local address URLs.
     + Fix CVE-2026-54433: Zero-click stored XSS in plain-text rendering.
     + Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file.
     + Enigma: Add support for automatic public key lookup (import) using HKP
       v1 protocol.
     + Enigma: Add support for Kolab's Web Of Anti-Trust (WOAT) feature.
   * d/p/Avoid-dependency-on-new-package-mlocati-ip-lib.patch: Improve patch
     and drop type annotations to restore compatibility with PHP<8 (closes:
     #1138086).
roundcube (1.6.17+dfsg-0+deb13u1) trixie-security; urgency=high
 .
   * New upstream security and bugfix release (closes: #1141495).
     + Fix CVE-2026-62642: Infinite loop in TNEF (winmail.dat) decoder.
     + Fix CVE-2026-62644: Various vulnerabilities in the password plugin using
       session-injected username.
     + Fix CVE-2026-54432: Stored XSS via unescaped attachment MIME type on the
       attachment-validation warning page.
     + Fix CVE-2026-62643: SSRF bypass via specific local address URLs.
     + Fix CVE-2026-54433: Zero-click stored XSS in plain-text rendering.
     + Fix CVE-2026-62641: DoS via crafted compressed-RTF size in the TNEF
       (winmail.dat) file.
     + Enigma: Add support for automatic public key lookup (import) using HKP
       v1 protocol.
     + Enigma: Add support for Kolab's Web Of Anti-Trust (WOAT) feature.
   * d/p/Avoid-dependency-on-new-package-mlocati-ip-lib.patch: Improve patch
     and drop type annotations to restore compatibility with PHP<8 (closes:
     #1138086).
   * Refresh d/patches.
roundcube (1.6.16+dfsg-1) unstable; urgency=medium
 .
   * New upstream security and bugfix release (closes: #1137507).
     + Fix stored XSS/HTML/CSS injection in subject field of the draft restore
       dialog.
     + Fix CSS injection bypass in HTML sanitizer via SVG <animate
       attributeName="style">.
     + Fix pre-auth SQL injection in `virtuser_query plugin` via
       `preg_replace()` backslash escape bypass.
     + Fix SSRF bypass via specific local address URLs.
     + Fix local/private URL fetch bypass when remote resources were not
       allowed.
     + Fix bypass of remote image blocking via CSS `var()`.
     + Fix pre-auth arbitrary file delete via redis/memcache session poisoning
       bypass.
     + Code injection vulnerability via code evaluation support in LDAP
       autovalues option.  Code evaluation support has been removed.
   * Refresh d/patches.
   * d/p/Avoid-dependency-on-new-package-mlocati-ip-lib.patch: Add support for
     non quad-dotted IPs and non-decimal fields to match the upstream behavior.
   * Update Standards-Version to 4.7.4 (no changes necessary).

rsyslog (8.2504.0-1+deb13u2) trixie; urgency=medium
 .
   * rainerscript: Avoid heap buffer overflow in replace() function.
     Patch cherry-picked from upstream Git.
     (CVE-2026-78002, Closes: #1145980)
   * mmpstrucdata: Fix stack buffer overflow with oversized RFC5424 structured
     data.
     Patch backported from upstream Git.
     (CVE-2026-61548)
rsyslog (8.2504.0-1+deb13u1) trixie; urgency=medium
 .
   * omfwd regression fix: avoid false active target change log message.
     Patch backported from upstream Git. (Closes: #1141981)
   * imptcp: reject invalid regex-framing recovery transitions.
     (CVE-2026-19654, Closes: #1144616)

rust-cbindgen-web (0.29.4+dfsg-1~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Backport to trixie as rust-cbindgen-web.
   * Only build the cbindgen binary. Since we're vendoring the dependencies,
     we can't easily ship a librust-cbindgen-web-dev package as its
     dependencies won't be available.
   * Vendor dependencies, they are not available in trixie.
rust-cbindgen-web (0.27.0-1~deb12u1) bookworm; urgency=medium
 .
   * Non-maintainer upload.
   * Backport to bookworm as rust-cbindgen-web. Since we're vendoring
     the dependencies, we can't easily ship a librust-cbindgen-dev package
     as it's dependencies won't be available, and there are build-rdeps
     for that binary now so we can't just disable it.
   * Vendor dependencies, they are not available in bookworm.
   * Only build the cbindgen binary. Since we're vendoring the dependencies,
     we can't easily ship a librust-cbindgen-web-dev package as its
     dependencies won't be available.
   * Build with rustc-web.
rust-cbindgen-web (0.26.0-3~deb12u1) bookworm; urgency=medium
 .
   * Non-maintainer upload.
   * Backport to bookworm as rust-cbindgen-web. Since we're vendoring
     the dependencies, we can't easily ship a librust-cbindgen-dev package
     as it's dependencies won't be available, and there are build-rdeps
     for that binary now so we can't just disable it.
   * Vendor dependencies, they are not available in bookworm.
   * Only build the cbindgen binary.
   * Build with rustc-web.
rust-cbindgen-web (0.26.0-3~deb11u1) bullseye; urgency=medium
 .
   * Backport to bullseye.
   * Lower dh-cargo requirement to 24.
   * Build with cargo-mozilla.

rustc (1.85.1+dfsg1-1+deb13u1) trixie; urgency=medium
 .
   * New upstream point release 1.85.1 (Closes: #1135220)
     - fix doctest merging with edition 2024
     - fix rustdoc on 32-bit ARM
   * backport tar CVE-2026-33055/CVE-2026-33056 fixes (Closes: #1135225)
   * cherry-pick cargo CVE-2026-5222/CVE-2026-5223 fixes

rustc-web (1.96.0+dfsg1-1~deb13u1) trixie; urgency=medium
 .
   [ Fabian Grünbichler ]
   * downgrade git2 for trixie
 .
   [ Emilio Pozuelo Monfort ]
   * Don't build wasm.
   * Rename to rustc-web.
   * Add missing provides.
rustc-web (1.96.0+dfsg1-1~deb12u1) bookworm-security; urgency=medium
 .
   * Rebuild for bookworm.
   * Lower libgit2-dev requirement to 1.5.
   * Drop build-dep on node-fortawesome-fontawesome-free, not available on
     bookworm.
   * Don't build -doc packages, they require the above font.
rustc-web (1.85.0+dfsg3-1~deb12u3) bookworm; urgency=medium
 .
   * Non-maintainer upload.
   * Remove hardcoded x86_64 string in debian/not-installed to fix non-amd64
     builds.
rustc-web (1.85.0+dfsg3-1~deb12u2) bookworm; urgency=medium
 .
   * Non-maintainer upload.
   * Fix rustfmt-web to properly depend on libstd-rust-web-*.
rustc-web (1.85.0+dfsg3-1~deb12u1) bookworm; urgency=medium
 .
   * Non-maintainer upload.
   * Backport to bookworm, as required by newer firefox & chromium.
   * Rename rustc & friends to rustc-web or similar.
   * Generate & include bootstrap compilers via orig-stage0.tar.xz.
   * Disable wasm, -all, and -llvm packages.
   * Vendor libgit2 dependency, switching from llhttp/builtin to the
     (debian package) http-parser.
   * Increase allowed test failures up to 15 to work around random fails.
   * Add 'Provides: cargo' for cargo-web (closes: #1084926).
 .
 rustc (1.85.0+dfsg3-1) unstable; urgency=medium
 .
   * backport fix for gix-features CVE-2025-31130
   * rust-lldb: fix lldb version (Closes: #1100950)
   * cherry-pick fix for crossbeam-channel RUSTSEC-2025-0024
 .
 rustc (1.85.0+dfsg2-3) unstable; urgency=medium
 .
   * baseline: enable SSE2 for i386 build (Closes: #1095862)
 .
 rustc (1.85.0+dfsg2-2) unstable; urgency=medium
 .
   * Upload to unstable
 .
 rustc (1.85.0+dfsg2-1) experimental; urgency=medium
 .
   * d/control: bump libgit2-dev version
   * vendor git2, git2-curl and libgit2-sys bindings for libgit2 1.9
   * cargo: bump git2* dependencies
 .
 rustc (1.85.0+dfsg1-1) unstable; urgency=medium
 .
   * New (stable) upstream release.
 .
 rustc (1.85.0~beta.9+dfsg1-1~exp1) experimental; urgency=medium
 .
   * New upstream release 1.85.0~beta999
   * build docs with -j1 to make them reproducible
   * build: make windows libstd build opt-in
 .
 rustc (1.84.0+dfsg1-2) unstable; urgency=medium
 .
   * revert upstream commit breaking cross builds
   * rust-llvm: ship symlink to llvm-objcopy instead of copy of binary
 .
 rustc (1.84.0+dfsg1-1) unstable; urgency=medium
 .
   * rust-analyzer: fix build on mips64el
   * fix hurd build (Closes: #1093125)
   * d/control: add Conflicts with rustup (Closes: #1093031)
 .
 rustc (1.84.0+dfsg1-1~exp1) experimental; urgency=medium
 .
   * New upstream release.
   * Stop building wasm32-wasi target
   * Build rust-analyzer (Closes: #1052319)
   * rust-llvm: ship rust-objcopy helper
   * rust-all: add rust-llvm and rust-analyzer packages
 .
 rustc (1.83.0+dfsg1-1) unstable; urgency=medium
 .
   * upload to unstable
   * fix/ignore some test failures
 .
 rustc (1.83.0+dfsg1-1~exp1) experimental; urgency=medium
 .
   * New upstream release
   * config: disable downloading LLVM from CI
   * blake3: adapt build.rs to skip bundled C code
   * remove libstd shared library
 .
 rustc (1.82.0+dfsg1-2) unstable; urgency=medium
 .
   * build: re-enable clang-rt on armel/armhf
   * build: drop workaround for riscv64/loong64
 .
 rustc (1.82.0+dfsg1-1) unstable; urgency=medium
 .
   * rust-src: ship original Cargo.lock file to fix rust-analyzer for libstd,
     and allow `-Z build-std`
   * build: disable profiler support on armel/armhf
   * build: extend riscv64 workaround to loong64
   * cargo wrapper: fix LTO position in argument lists (Closes: #1086025)
 .
 rustc (1.82.0+dfsg1-1~exp3) experimental; urgency=medium
 .
   * conditonalize riscv64 workaround
   * fix or disable more broken tests
 .
 rustc (1.82.0+dfsg1-1~exp2) experimental; urgency=medium
 .
   * fix some test breakage
   * riscv64: unbreak compiler_builtin build
 .
 rustc (1.82.0+dfsg1-1~exp1) experimental; urgency=medium
 .
   * New upstream release
   * New wasi-libc version 0.0~git20240708.3f43ea9
   * switch to LLVM 19
   * set LLVM profiler RT path via config
   * update bootstrap git commit info patch
   * re-instate bootstrap test config patch
   * make rust-src cleanup more robust
 .
 rustc (1.81.0+dfsg1-2) unstable; urgency=medium
 .
   * use system libz-sys even when cross-building (Closes: #1084754)
   * drop no longer needed loongarch64 patch
   * add temporary Breaks to force migration of libgit2
 .
 rustc (1.81.0+dfsg1-1) unstable; urgency=medium
 .
   * Upload to unstable
 .
 rustc (1.81.0+dfsg1-1~exp2) experimental; urgency=medium
 .
   * source: duplicate lintian overrides to make ftp-masters happy
   * cargo wrapper: fix LTO handling (Closes: #1079071)
 .
 rustc (1.81.0+dfsg1-1~exp1) experimental; urgency=medium
 .
   [ Fabian Grünbichler ]
   * New upstream release
   * switch to LLVM 18
   * bump libgit2 to 1.8.1
   * build and install wasm-component-ld for wasm-wasip2
   * make rust-llvm arch:any
 .
   [ Samuel Thibault ]
   * add hurd-amd64 support
 .
 rustc (1.80.1+dfsg1-1) unstable; urgency=medium
 .
   * upload to unstable
 .
 rustc (1.80.1+dfsg1-1~exp1) experimental; urgency=medium
 .
   * New upstream point release
 .
 rustc (1.80.0+dfsg1-1~exp1) experimental; urgency=medium
 .
   * New upstream release
   * Build wasi-p2 target
   * Use packaged libonig
   * Update lintian overrides
   * d/control: drop Build-Conflicts on gdb-minimal
 .
 rustc (1.79.0+dfsg1-2) unstable; urgency=medium
 .
   [ Fabian Grünbichler ]
   * build: remove more cache files (Closes: #1074373)
   * d/control: update Standards-Version to 4.7.0
 .
   [ Samuel Thibault ]
   * Avoid hurd-stuck test
 .
 rustc (1.79.0+dfsg1-1) unstable; urgency=medium
 .
   * cargo wrapper: switch to config.toml
   * cargo wrapper: ensure debug symbols are not stripped
   * add missing rustfmt dependency (Closes: #1074290)
 .
 rustc (1.79.0+dfsg1-1~exp1) experimental; urgency=medium
 .
   * New upstream release
   * New wasi-libc version (SDK 22)
   * config: adapt to new change tracking mechanism
rustc-web (1.78.0+dfsg1-2~deb12u3) bookworm; urgency=medium
 .
   * Depend on cargo-web for the autopkgtest.
   * Add missing conflicts (closes: #1079744, #1079653, #1076683).
rustc-web (1.78.0+dfsg1-2~deb12u2) bookworm; urgency=medium
 .
   * Also rename rustfmt to rustfmt-web.
rustc-web (1.78.0+dfsg1-2~deb12u1) bookworm; urgency=medium
 .
   * Non-maintainer upload.
   * Backport rustc 1.78, as required by newer firefox and chromium.
   * Rename rustc backport to rustc-web.
   * Use LLVM 16.
   * Disable wasm, -all, -llvm packages.
   * Vendor libgit2 dependency.
rustc-web (1.78.0+dfsg1-2~deb11u3) bullseye; urgency=medium
 .
   * Depend on cargo-web for the autopkgtest.
   * Add missing conflicts (closes: #1079744, #1079653, #1076683).
rustc-web (1.78.0+dfsg1-2~deb11u2) bullseye; urgency=medium
 .
   * Also rename rustfmt to rustfmt-web.
rustc-web (1.78.0+dfsg1-2~deb11u1) bullseye; urgency=medium
 .
   * Backport to bullseye.
   * Switch pkgconf build-dependency to pkg-config, pkgconf in bullseye
     doesn't provide `triplet`-pkgconf binaries.
rustc-web (1.70.0+dfsg1-7~deb12u2) bookworm; urgency=medium
 .
   * Non-maintainer upload.
   * Increase allowed test failures on armhf and ppc64el to fix FTBFS.
   * Provide Conflicts/Replaces for rust*-mozilla*, which could still be
     installed from oldstable (closes: #1064562).
   * Add Provides/Conflicts/Replaces for libstd-rust-1.70 (closes: #1064563).
rustc-web (1.70.0+dfsg1-7~deb12u1) bookworm; urgency=medium
 .
   * Non-maintainer upload.
   * Rename rustc backport to rustc-web, intended to be used for browsers.
   * Generate & include bootstrap compilers via an orig-stage0.tar.xz.
   * Add mipsel bootstrap compiler back, as mipsel is still in bookworm.
   * Disable profiler on mipsel, as it likely doesn't work either.
   * Disable wasm.
   * Drop -all virtual package, which doesn't make sense for us.
rustc-web (1.70.0+dfsg1-7~deb11u1) bullseye; urgency=medium
 .
   * Non-maintainer upload.
   * Backport to bullseye.

sabnzbdplus (4.5.0+dfsg-1+deb13u1) trixie-security; urgency=high
 .
   * Patches: add 11, backport of an upstream security fix for an
     authentication bypass in the web interface.

samba (2:4.22.11+dfsg-0+deb13u1) trixie; urgency=medium
 .
   * switch to actual new upstream release, dropping the security
     patchset (it is included into the upstream tarball now).
 .
     Besides all the security fixes, there's an addtional fix in
     this release (which was queued before the security fixes):
 .
     o libsecurity: Fix security_acl_dup()'s talloc hierarchy
       Bug: https://bugzilla.samba.org/show_bug.cgi?id=16095
samba (2:4.22.10+dfsg-0+deb13u2) trixie-security; urgency=medium
 .
   * 2026-jul-sec-update-bug-16039-v4-22-combined.patch:
     Jul-2026 samba security update addresses the following defects:
 .
     CVE-2026-6949: https://bugzilla.samba.org/show_bug.cgi?id=16083
       TSIG packet with crafted name compression can crash internal DNS server
 .
     CVE-2026-58224: https://bugzilla.samba.org/show_bug.cgi?id=16085
       CTDB: heap OOB read via unchecked packet length fields
 .
     CVE-2026-58216: https://bugzilla.samba.org/show_bug.cgi?id=16087
       kpasswd service: 6-byte heap OOB read in packet parser
 .
     CVE-2026-58218: https://bugzilla.samba.org/show_bug.cgi?id=16115
       DNS TKEY negotiation stores unauthenticated GSS contexts
       in a fixed FIFO before authentication completes
 .
     CVE-2026-58221: https://bugzilla.samba.org/show_bug.cgi?id=16147
       authenticated LDAP access to internal LDB special DNs
       permits domain takeover
 .
     CVE-2026-58222: https://bugzilla.samba.org/show_bug.cgi?id=16148
       LDAP Compare filter injection and trusted-request
       confusion disclose protected attributes

sbsigntool (0.9.4-3.2+deb13u1) trixie; urgency=medium
 .
   * Backport the "certificate validation with intermediates" fix for
     trixie. Closes: #1141851

sg3-utils (1.48-3~deb13u1) trixie; urgency=medium
 .
   * Rebuild for trixie.
 .
 sg3-utils (1.48-3) unstable; urgency=medium
 .
   * Add fix for missing output fields in sg_inq (Closes: #1109923)

socat (1.8.0.3-1+deb13u1) trixie; urgency=medium
 .
   * CVE-2026-56123

spip (4.4.21+dfsg-0+deb13u1) trixie-security; urgency=medium
 .
   [ Matthieu Marcillaud ]
   * build: up dependencies
   * build: Version 4.4.21
spip (4.4.20+dfsg-1) unstable; urgency=medium
 .
   [ Matthieu Marcillaud ]
   * build: up dependencies
   * build: Version 4.4.20
 .
   [ David Prévot ]
   * Use debhelper-compat = 14
spip (4.4.20+dfsg-0+deb13u1) trixie-security; urgency=medium
 .
   [ Matthieu Marcillaud ]
   * build: up dependencies
   * build: Version 4.4.20
spip (4.4.19+dfsg-1) unstable; urgency=medium
 .
   [ Matthieu Marcillaud ]
   * build: up dependencies
   * build: Version 4.4.19
spip (4.4.19+dfsg-0+deb13u1) trixie-security; urgency=medium
 .
   [ Matthieu Marcillaud ]
   * build: up dependencies
   * build: Version 4.4.19
     + Fix code injection [CVE-2026-66738]
 .
   [ David Prévot ]
   * Don’t install ecs, rector nor phplint files
spip (4.4.18+dfsg-1) unstable; urgency=medium
 .
   [ Matthieu Marcillaud ]
   * build: up dependencies
   * build: Version 4.4.18
     + Fix code injection [CVE-2026-66738]
 .
   [ David Prévot ]
   * Don’t install ecs, rector nor phplint files
   * Document lintian-overrides
spip (4.4.16+dfsg-1) unstable; urgency=medium
 .
   [ b_b ]
   * security: interdire l'accès aux fichiers PHP dans IMG et local
 .
   [ Matthieu Marcillaud ]
   * build: up dependencies
   * build: Version 4.4.16
 .
   [ David Prévot ]
   * Document CVE in previous changelog entry
   * Update mutualisation
spip (4.4.16+dfsg-0+deb13u1) trixie; urgency=medium
 .
   [ b_b ]
   * security: interdire l'accès aux fichiers PHP dans IMG et local
 .
   [ Matthieu Marcillaud ]
   * build: up dependencies
   * build: Version 4.4.16
 .
   [ David Prévot ]
   * Document CVE in previous changelog entry
spip (4.4.15+dfsg-1) unstable; urgency=medium
 .
   [ David Prévot ]
   * Document CVEs in previouss changelog entry
   * debian/watch: Update Source URL
 .
   [ Matthieu Marcillaud ]
   * build: up dependencies
   * build: Version 4.4.15

sqlite3 (3.46.1-7+deb13u2) trixie; urgency=medium
 .
   * Backport upstream security fix for CVE-2026-11822: memory corruption
     vulnerabilities in the FTS5 full-text search extension.
   * Backport upstream security fix for CVE-2026-11824: heap-based buffer
     overflow vulnerability in the FTS5 full-text search extension.

squid (6.13-2+deb13u3) trixie; urgency=medium
 .
   * CVE-2026-33515

srt (1.5.4-1+deb13u1) trixie-security; urgency=medium
 .
   * [4136a38] d/patches/CVE-2026-55869.patch: added from upstream.
     Fix KMREQ/KMRSP Stack-Based Buffer Overflow (CVE-2026-55869,
     GHSA-6xg9-784j-24rm), when used together with the patch for
     CVE-2026-55868 / GHSA-4mc6-qmpp-g7gw.
   * [76b1e2d] d/patches/CVE-2026-55868.patch: added from upstream.
     Fix Encryption State Machine Downgrade (CVE-2026-55868,
     GHSA-4mc6-qmpp-g7gw), and fix KMREQ/KMRSP Stack-Based Buffer Overflow
     (CVE-2026-55869, GHSA-6xg9-784j-24rm).

starlette (0.46.1-3+deb13u3) trixie-security; urgency=medium
 .
   * Team upload.
   * d/patches: (Closes: #1140631, #1140632)
     - CVE-2026-48817: Import and backport upstream patch
       (Prevent unintended HTTPEndpoint method dispatch)
     - CVE-2026-54282: Import upstream patch
       (Validate request paths to prevent host confusion)
     - CVE-2026-54283: Import and backport upstream patch
       (Enforce max_fields and max_part_size limits)

suricata-update (1.3.4-1+deb13u1) trixie-security; urgency=medium
 .
   * Fix CVE-2026-63347 in 1.3.4.
     Cherry-Picked from fae50697dff60364d6f0638908c6762eec3b421c.

swift (2.35.1-0+deb13u3) trixie-security; urgency=medium
 .
   * CVE-2026-71191 / OSSA-2026-030: Swift S3API header authorization bypass.
     Applied upstream patch:
     - "s3api: require signing of sensitive SigV4 x-amz headers"
     - "s3api: drop native Swift control headers from client requests"
     (Closes: #1142972).
   * CVE-2026-71192 / OSSA-2026-031: proxy denial of service via Accept header.
     Applied upstream patch:
     - "swob: avoid excessive backtracking in Accept parser"
     (Closes: #1142973).
   * CVE-2026-50221: Swift proxy-server SSRF via internal update header
     injection: applied upstream patch: Block internal update headers at the
     gatekeeper (Closes: #1140678).

tiff (4.7.0-3+deb13u3) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Address heap-based buffer overflow in pixarlog (CVE-2026-12912)
     (Closes: #1141320)
     - pixarlog: fix heap-buffer-overflow in 8BITABGR decode with stride 3
     - pixarlog: add comment explaining 4-byte advance in ABGR decode
     - pixarlog: complete ABGR bounds check for multi-row strip decoding
     - pixarlog: error out on invalid ABGR output buffer sizes

transmission (4.1.0~beta2+dfsg-3+deb13u2) trixie; urgency=medium
 .
   * CVE-2026-38978

tryton-modules-company (7.0.2-1+deb13u1) trixie-security; urgency=high
 .
   * Add 01_manage_ModelAccessProxy.patch.
     This patch is part of the required patch adding ModelAccessProxy
     https://foss.heptapod.net/tryton/tryton/-/merge_requests/3431
     needed for
     From https://discuss.tryton.org/t/security-release-for-issue-14907:
     Cédric Krier has discovered that access is not enforced when browsing
     record instances in templates.

tryton-modules-marketing-automation (7.0.1-1deb13u1) trixie-security; urgency=high
 .
   * Add 01_enforce_access_rights_on_the_email_template_record_of_marketing
     _automation.patch.
 .
     From https://discuss.tryton.org/t/security-release-for-issue-14907:
     Cédric Krier has discovered that access is not enforced when browsing
     record instances in templates.
     This patch also neeeds ModelAccessProxy
     https://foss.heptapod.net/tryton/tryton/-/merge_requests/3431

tryton-modules-marketing-email (7.0.0-3deb13u1) trixie-security; urgency=high
 .
   * Add 01_enforce_access_rights_on_the_email_template_record_of_marketing
     _email.patch.
     Enforce access rights on email template records
     From https://discuss.tryton.org/t/security-release-for-issue-14907:
     Cédric Krier has discovered that access is not enforced when browsing
     record instances in templates.
     This patch also neeeds ModelAccessProxy
     https://foss.heptapod.net/tryton/tryton/-/merge_requests/3431

tryton-server (7.0.30-1+deb13u2) trixie-security; urgency=high
 .
   * Add 06_restrict_genshi_evaluation.patch.
     From https://discuss.tryton.org/t/security-release-for-issue-5160-and-14869:
     Security Release for issue #5160 and #14869
     The user titou has discovered that the administrator group can execute
     Python code on the server which is hidden inside an uploaded report template.
     And Dan Shallom has discovered that the same can also be accomplished by
     the marketing group when uploading marketing email templates.
     This patch also contains the subsequent fixes from
     https://bugs.tryton.org/14928, https://bugs.tryton.org/14932
   * Add 07_enforce_access_right_on_email_template_records.patch.
     From https://discuss.tryton.org/t/security-release-for-issue-14907:
     Cédric Krier has discovered that access is not enforced when browsing
     record instances in templates.
     This patch also contains the required patch adding ModelAccessProxy
     https://foss.heptapod.net/tryton/tryton/-/merge_requests/3431
   * Add 08_restrict_weasyprint_protocol.patch.
     From https://discuss.tryton.org/t/security-release-for-issue-14947:
     Cédric Krier has discovered that Tryton does not prevent weasyprint
     to access local files when rendering HTML report to PDF.
     https://foss.heptapod.net/tryton/tryton/-/work_items/14947
     The weasyprint documentation states that it can be used to access local files.

tzdata (2026c-0+deb13u1) trixie; urgency=medium
 .
   * New upstream version 2026c:
     - Alberta moved to permanent -06 on 2026-06-18, so it will not fall back
        from -06 to -07 on 2026-11-01.
     - Morocco moves to permanent +00 on 2026-09-20.
     - No leap second on 2026-12-31.
tzdata (2026b-1) unstable; urgency=medium
 .
   * New upstream version 2026b:
     - British Columbia moved to permanent -07 on 2026-03-09, so it will not
       fall back from -07 to -08 on 2026-11-01.
   * Add autopkgtest test case for 2026b release

u-boot (2025.01-3+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload by the LTS Team.
   * CVE-2024-42040: buffer overread vulnerability in the DHCP implementation.
     (Closes: #1081557)
   * CVE-2026-46728: mishandles use of unit addresses in a FIT.
     (Closes: #1136954)

udisks2 (2.10.1-12.1+deb13u2) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Fix local privilege escalation via 'as-user' mount spoofing
     (CVE-2026-7867). Patches cherry-picked from the upstream
     2.10.x-branch.

unixodbc (2.3.12-2+deb13u1) trixie; urgency=medium
 .
   * debian/libodbcinst2.symbols: Add inst_logClose@Base.
   * debian/patches: Clear cached allocations on dlclose() in libodbcinst2
     (Closes: #1136221).

unzip (6.0-29+deb13u1) trixie-security; urgency=high
 .
   * Apply upstream fix for CAN-2026-2034440. Closes: #1142904.
     (heap out-of-bounds read in EF_IZUNIX3 extra field handler)
   * Apply upstream fix for CAN-2026-2034443. Closes: #1142905.
     (stack out-of-bounds NUL write in EF_SMARTZIP handler)
   * Apply upstream fix for CAN-2026-2034442. Closes: #1142906.
     (heap buffer overflow WRITE in memextract() STORED path)

util-linux (2.41.5-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 2.41.5, fixing CVE-2026-53612, CVE-2026-53613,
     CVE-2026-53614. (Closes: #1140194, #1140195, #1140196)
   * Drop patches from upstream which came from the stable release branch.
   * Pick upstream patch from stable release branch:
     loopdev: use openat2(RESOLVE_NO_SYMLINKS) for backing file
     Fixes CVE-2026-27456.
   * Pick upstream patch:
     libmount: restrict source path canonicalization for non-root users
   * Avoid installing new bash-completions.
   * d/gbp.conf: setup for trixie.
util-linux (2.41.3-4) unstable; urgency=medium
 .
   [ Chris Hofstaedtler ]
   * Follow libselinux1-dev to libselinux-dev rename (Closes: #1124751)
   * uuid-runtime: stop removing /var/run/uuidd on purge
     /run is a tmpfs, it will be cleaned up anyway. Lets us drop the postrm
     maintscript.
 .
   [ Luca Boccassi ]
   * uuid-runtime: drop manual scripting in postinst and rely on sysusers.d
util-linux (2.41.3-3) unstable; urgency=medium
 .
   * d/libsmartcols1.symbols: drop terminal crap
   * d/rules: make dpkg-gensymbols more strict
   * lintian: ignore groff-message tags
   * lintian: ignore groff-message tags in remaining packages
   * Add upstream patches
     * unshare: fix user namespace bind mounts
     * unshare: remove get_mnt_ino() check in bind_ns_files_from_child()
     * unshare: add --owner to set user namespace owner uid and gid
     * libfdisk: modernize ZFS GPT type description
util-linux (2.41.3-2) unstable; urgency=medium
 .
   [ Luca Boccassi ]
   * util-linux: do not fail postinst/prerm if update-alternatives is missing
util-linux (2.41.3-1) unstable; urgency=medium
 .
   * Stop installing lastlog2-import.service
   * New upstream release, fixing CVE-2025-14104. (Closes: #1122058)
util-linux (2.41.2-4) unstable; urgency=medium
 .
   * Install pivot_root into util-linux-extra.
     Thanks to Antonio Ospite (Closes: #1117538)
   * Ensure /var/lib/lastlog exists for pam_lastlog2.
     Previously this was created by lastlog2-tmpfiles.conf, installed by the
     lastlog2 package. But lastlog2 itself is optional and not stricly
     necessary for libpam-lastlog2 to function. Install lastlog2-tmpfiles.conf
     into libpam-lastlog2, and also have dpkg create the directory.
     Thanks to Joachim Jautz (Closes: #1117725)
   * Break older dracut for moved switch_root
util-linux (2.41.2-3) unstable; urgency=medium
 .
   * Revive switch_root for dracut, in util-linux-extra (Closes: #1116629)
util-linux (2.41.2-2) unstable; urgency=medium
 .
   * Reduce Installed-Size of util-linux:
     * Move lslogins from util-linux to util-linux-extra
     * Move rev from util-linux to bsdextrautils
     * Move blkzone, chcpu, chmem, lsmem from util-linux to util-linux-extra
     * Move isosize from util-linux to util-linux-extra
     * Move wdctl from util-linux to util-linux-extra
     * Move rename.ul from util-linux to util-linux-extra
     * Move ldattach from util-linux to util-linux-extra
     * Stop installing pivot_root, switch_root. Apparently unused on Debian.
   * util-linux-extra: Remove protectice diversions for usrmerge
util-linux (2.41.2-1) unstable; urgency=medium
 .
   * New upstream release.
   * Drop upstream-applied patches.
   * Release to unstable.
 .
   Includes from upstream:
 .
   [ Sam Fink ]
   * libblkid: Fix probe_ioctl_tp assigning BLKGETDISKSEQ as physical sector size
   (Closes: #1115590)
util-linux (2.41.1-4) experimental; urgency=medium
 .
   * d/copyright: remove (old) FSF address
   * fdisk-udeb: remove old lintian overrides
   * Ignore lintian warning about dh-exec-script-without-dh-exec-features
   * util-linux.README.Debian: fstrim is enabled by default (Closes: #1115239)
   * Install isosize into upstream-determined /usr/bin (Closes: #1025819)
   * Install chmem into upstream-determined /usr/bin
   * Install addpart,delpart into util-linux-extra (Closes: #1115193)
   * Fix enosys bash completion using upstream patches (Closes: #1108317)
   * Move newgrp, sg from login to util-linux-extra (Closes: #1111747)
   * Install ll2_rename_user.3 into util-linux-locales
   * Move logger to util-linux
   * Drop Essential: yes from bsdutils
util-linux (2.41.1-3) unstable; urgency=medium
 .
   [ Niels Thykier ]
   * Replace ad-hoc maintscripts substitution with `dh_installdeb` feature
 .
   [ Thomas Weißschuh ]
   * Install lsclocks into util-linux-extra
 .
   [ Chris Hofstaedtler ]
   * Install lsclocks bash completion and translated man pages
util-linux (2.41.1-2) unstable; urgency=medium
 .
   * Mark uuid_time64 symbol linux-only.
     Thanks to Samuel Thibault <sthibault@debian.org> (Closes: #1108994)
   * Install PAM configuration for login "remote" (Closes: #1103923)
   * Add patches from upstream
util-linux (2.41.1-1) unstable; urgency=medium
 .
   * New upstream release.
   * Drop upstream signing-key for the time being
   * d/README.source: update tag fetch instructions for current git
   * Rebase patches
   * d/README.source: update for current repo layout
   * login: drop Protected: yes.
     Bug #1099445.

webkit2gtk (2.52.6-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security.
   * Re-enable libmanette in i386.
   * Enable the transitional packages.
   * Use the default clang on armhf since trixie uses clang-19 and is not
     affected by WebKit bug #290167.
   * Add the 'Priority: optional' field.
webkit2gtk (2.52.5-1) unstable; urgency=high
 .
   * New upstream release.
   * The WebKitGTK security advisory WSA-2026-0004 lists the following
     security fixes in the latest versions of WebKitGTK:
     - CVE-2024-4367, CVE-2026-39872, CVE-2026-43663, CVE-2026-43676,
       CVE-2026-43699, CVE-2026-43701, CVE-2026-43705, CVE-2026-43707,
       CVE-2026-43712, CVE-2026-43713, CVE-2026-43715, CVE-2026-43716,
       CVE-2026-43720, CVE-2026-43721, CVE-2026-43725, CVE-2026-43726,
       CVE-2026-43727, CVE-2026-43731, CVE-2026-43732, CVE-2026-43734,
       CVE-2026-43740, CVE-2026-43742, CVE-2026-43745 (fixed in 2.52.5).
   * Drop fix-ftbfs-system-malloc.patch.
webkit2gtk (2.52.5-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security.
   * Re-enable libmanette in i386.
   * Enable the transitional packages.
   * Use the default clang on armhf since trixie uses clang-19 and is not
     affected by WebKit bug #290167.
   * Add the 'Priority: optional' field.
webkit2gtk (2.52.4-1) unstable; urgency=medium
 .
   * New upstream release.
   * Drop fix-atomics-detection.patch and fix-big-endian-string.patch.
   * fix-ftbfs-system-malloc.patch:
     - Fix FTBFS when USE_SYSTEM_MALLOC is enabled (for example i386).
   * Use clang-22 on armhf instead of gcc:
     - debian/control.in: add build dependency.
     - debian/rules: don't use -no-integrated-cpp as it causes build
       failures with clang due to missing includes.
webkit2gtk (2.52.3-2) unstable; urgency=medium
 .
   * debian/rules:
     - Use --param ggc-min-expand=10 on hppa, m68k and sh4 in order to
       reduce the memory usage during compilation (Closes: #1134391)
       (thanks, John Paul Adrian Glaubitz).
   * Refresh upstream signing keys with the expiration dates.
   * debian/control.in:
     - Update Standards-Version to 4.7.4.
   * fix-atomics-detection.patch:
     - Improve detection of whether libatomic is required. This was failing
       in some architectures (armhf, armel) with some versions of clang.
   * fix-big-endian-string.patch:
     - Use the native byte order when converting from utf8 to utf16.
       This fixes strings in big-endian machines (Closes: #1132818).

wireshark (4.4.18-0+deb13u1) trixie-security; urgency=medium
 .
   * Team upload.
   * New upstream version 4.4.18 (Closes: #1142268, #1144924)
     - CVE-2026-15163: Multiple loops in dissectors, allows DoS
     - CVE-2026-15164: Crash in ciscodump, allows DoS
     - CVE-2026-15166: IEEE 802.11 dissector crash, allows DoS
     - CVE-2026-15167: DBS Etherwatch parser crash, allows DoS
     - CVE-2026-15168: BLF parser, allows information disclosure
     - CVE-2026-15169: UMTS FP dissector crash, allows DoS
     - CVE-2026-15170: Z39.50 dissector crash, allows DoS
     - CVE-2026-15171: SSH dissector crash, allows DoS
     - CVE-2026-15172: FMP/NOTIFY dissector crash, allows DoS
     - CVE-2026-15174: Catapult DCT2000 dissector crash, allows DoS
     - CVE-2026-76879: C12.22 dissector crash, allows DoS
     - CVE-2026-76880: RRC dissector crash, allows DoS
     - CVE-2026-76881: CMS dissector crash, allows DoS
     - CVE-2026-76882: Bluetooth Attribute dissector crash, allows DoS
     - CVE-2026-76883: Catapult DCT2000 parser crash, allows DoS
     - CVE-2026-76884: ERF parser crash, allows DoS
     - CVE-2026-76885: Tektronix K12xx parser crash, allows DoS
     - CVE-2026-76886: C12.22 dissector crash, allows DoS
     - CVE-2026-76887: Dissection engine crash, allows DoS
     - CVE-2026-76888: RDP dissector crash, allows DoS
     - CVE-2026-76889: UMTS FP dissector crash, allows DoS
     - CVE-2026-76890: Crash in sharkd, allows DoS
     - CVE-2026-76891: Crash in sharkd, allows DoS
     - CVE-2026-76917: Bluetooth AVRCP dissector crash, allows DoS
     - CVE-2026-76918: SSH dissector crash, allows DoS
     - CVE-2026-76919: ESS dissector crash, allows DoS
     - CVE-2026-76920: 3gpp phone log parser crash, allows DoS
     - CVE-2026-76921: CMS dissector crash, allows DoS
     - CVE-2026-76922: Bluetooth BR/EDR FHS dissector crash, allows DoS
     - CVE-2026-76923: Bluetooth HFP dissector crash, allows DoS
     - CVE-2026-76924: Kerberos dissector crash, allows DoS
     - CVE-2026-76926: BUSMASTER parser abnormal exit, allows DoS
     - CVE-2026-76927: H.245 dissector crash, allows DoS
     - CVE-2026-76928: X.509IF dissector crash, allows DoS
     - CVE-2026-76929: Pcapng parser crash, allows DoS

wolfssl (5.7.2-0.1+deb13u2) trixie; urgency=high
 .
   * Backport upstream security fixes. (See #1140765, #1140815)
   * CVE-2026-5194: require certificate signature OID to match issuer key
     OID.
   * CVE-2026-55960: validate negotiated certificate type for raw public
     keys.
   * CVE-2026-55961: reject degenerate certs-only PKCS#7 in PKCS7_verify.
   * CVE-2026-55962: require client cert on outstanding TLS 1.3 post-
     handshake auth.
   * CVE-2026-55967: reject AES-GCM cumulative size overflow in streaming
     update.
   * CVE-2026-6092: enforce Encrypt-then-MAC on the TLS resumption path.
   * CVE-2026-6094: bound encrypted content size in PKCS7 EnvelopedData.
   * CVE-2026-6325: bound index in SetSuitesHashSigAlgo to prevent OOB
     write.
   * CVE-2026-6329: reject PKCS#12 MAC length mismatch.
   * CVE-2026-6331: require exact HMAC tag length in
     EVP_DigestVerifyFinal.
   * CVE-2026-6450: reject CRLs with unrecognized critical extensions.
   * CVE-2026-6678: fix integer underflow in wc_PKCS7_DecryptOri.
   * CVE-2026-6681: respect caller output buffer size in PKCS7 decode.
   * CVE-2026-6731: apply DNS name constraints to Subject CN when no SAN.
   * CVE-2026-7511: report the verifying cert as the PKCS#7 signer.

wordpress (6.8.7+dfsg1-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream security release
     CVE-2026-64638 fix XSS in login that leads to RCE Closes: #1143843
wordpress (6.8.6+dfsg1-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream security release 6.8.6
   * CVE-2026-60137 fix facilitated SQL injection Closes: #1142510
   * Includes release 6.8.4 and 6.8.5 updates
     - Check permissions on edit notes CVE-2026-3906 (not vulnerable)
wordpress (6.8.3+dfsg1-1) unstable; urgency=medium
 .
   * New upstream security release Closes: #1117047
     Fixes the following CVEs:
     - Stored XSS in nav menus CVE-2025-58674
     - Data exposure CVE-2025-58246
   * Update copyright files to use download links

xapian-core (1.4.29-3+deb13u1) trixie; urgency=medium
 .
   * Cherry-pick fix for missed corner case of CVE-2018-0499.  New patch:
     cve-2018-0499-mset-snippet-escaping-no-highlighting-1.4.x.patch
     (Closes: #1144490)

xdg-dbus-proxy (0.1.6-1+deb13u2) trixie-security; urgency=high
 .
   * d/p/GHSA-r7hp-698j-2h6c/*.patch:
     Fix a vulnerability in access control for receiving broadcasts.
     In 0.1.6 and 0.1.7, a malicious or compromised Flatpak app could
     receive any broadcast D-Bus message on the session bus or the AT-SPI
     bus, leading to unintended information disclosure.
   * d/p/tests/*.patch:
     Add automated test coverage for message filtering

xen (4.20.3+127-gc42374a105-0+deb13u1) trixie-security; urgency=medium
 .
   * Update to new upstream version 4.20.3+127-gc42374a105, which also contains
     security fixes for the following issues:
     (Closes: #1129037)
     - Use after free of paging structures in EPT
       XSA-480 CVE-2026-23554
     - Xenstored DoS by unprivileged domain
       XSA-481 CVE-2026-23555
     - oxenstored keeps quota related use counts across domain destruction
       XSA-483 CVE-2026-23556
     - Xenstored DoS via XS_RESET_WATCHES command
       XSA-484 CVE-2026-23557
     - grant table v2 race in status page mapping
       XSA-486 CVE-2026-23558
     - x86: Floating Point Divider State Sampling
       XSA-488 CVE-2025-54505
     - x86: CPU Opcode Cache corruption
       XSA-490 CVE-2025-54518
     - x86 HVM I/O port list traversal
       XSA-491 CVE-2026-42487
     - domctl lock open to abuse
       XSA-492 CVE-2026-42489 CVE-2026-42490
     - Arm: Completion of memory accesses not guaranteed by completion of a TLBI
       XSA-493 CVE-2025-10263
     - x86: mismatched mapcache metadata
       XSA-494 CVE-2026-42488
     - x86 shadow paging is deprecated
       XSA-495 CVE-2026-42493
     - buffer overruns in libfsimage iso9660 handling
       XSA-497 CVE-2026-42494 CVE-2026-42495 CVE-2026-62423 CVE-2026-62424 CVE-2026-62425
     - sysctl and platform-op locks open to abuse
       XSA-499 CVE-2026-62426 CVE-2026-62427
     - grant-table: type confusion in grant-copy
       XSA-500 CVE-2026-62428
     - grant-table: version change racing with other operations
       XSA-501 CVE-2026-62435 CVE-2026-62436
     - vNUMA domain cleanup may race other operations
       XSA-502 CVE-2026-62429
     - x86: Out-of-bounds read in vRTC emulation
       XSA-503 CVE-2026-62430
     - Viridian STIMER division by zero
       XSA-504 CVE-2026-62431
     - evtchn: Race between FIFO expand and reset
       XSA-505 CVE-2026-62432
     - correct buffer checks for DM_OP hypercalls
       XSA-506 CVE-2026-62433
     - PoD: Don't try to reclaim special pages
       XSA-507 CVE-2026-62434
     - pygrub: security-supported only when run de-privileged
       XSA-508
   * Drop the following patches which are now included upstream:
     - ARM: Drop ThumbEE support
     - xen/arm: Set ThumbEE as not present in PFR0
   * Note that the following XSA are not listed, because...
     - XSA-482 has patches for the Linux kernel
     - XSA-485 has patches for the Linux kernel
     - XSA-487 has patches for the Linux kernel
     - XSA-489 applies to XAPI which is not included in Debian
     - XSA-496 only applies to Xen 4.21 and later
     - XSA-498 applies to XAPI which is not included in Debian
 .
 xen (4.20.2+37-g61ff35323e-0+deb13u1) trixie; urgency=medium
 .
   * Update to new upstream version 4.20.2+37-g61ff35323e, which also contains
     security fixes for the following issues:
     - x86: buffer overrun with shadow paging + tracing
       XSA-477 CVE-2025-58150
     - x86: incomplete IBPB for vCPU isolation
       XSA-479 CVE-2026-23553
   * Note that the following XSA are not listed, because...
     - XSA-478 applies to XAPI which is not included in Debian
xen (4.20.2+37-g61ff35323e-1) unstable; urgency=medium
 .
   * Update to new upstream version 4.20.2+37-g61ff35323e, which also contains
     security fixes for the following issues:
     - x86: buffer overrun with shadow paging + tracing
       XSA-477 CVE-2025-58150
     - x86: incomplete IBPB for vCPU isolation
       XSA-479 CVE-2026-23553
   * Note that the following XSA are not listed, because...
     - XSA-478 applies to XAPI which is not included in Debian
   * Pick upstream commit 1ecb5946bd ("xen/arm: Set ThumbEE as not present in
     PFR0") which is an additional fix for the ThumbEE commit picked in
     previous upload.

xfsprogs (6.13.0-2+deb13u1) trixie; urgency=medium
 .
   * xfs_scrub_fail: reduce security lockdowns to avoid postfix problems
     (Closes: #1116595)

xrdp (0.10.1-3.1+deb13u2) trixie-security; urgency=high
 .
   * Non-maintainer upload.
   * CVE-CVE-2026-32105: modify encrypted traffic in transit without
     detection (Closes: #1134339)
   * CVE-2026-32107: improper privilege management allow attacker to
     escalate privileges to root and execute arbitrary code.
   * CVE-2026-32623: heap-based buffer overflow vulnerability
   * CVE-2026-32624: heap-based buffer overflow vulnerability
   * CVE-2026-33145: authenticated remote user to execute arbitrary
     commands
   * CVE-2026-33516: out-of-bounds read vulnerability
   * CVE-2026-33689: out-of-bounds read vulnerability
   * CVE-2026-35512: a heap-based buffer overflow
   * CVE-2026-41252: missing bounds check in xrdp, which allows a
     heap-based buffer overflow
   * CVE-2026-41521: nteger overflow vulnerability
   * CVE-2026-42218: a timing side-channel vulnerability in the login
     interface
   * CVE-2026-44178: heap-based buffer overflow vulnerability
   * CVE-2026-44978: heap out-of-bounds read vulnerability
   * CVE-2026-54538: sending a specially crafted packet that forces the
     process into an infinite, CPU-bound loop
   * CVE-2026-55238: Denial of Service
   * CVE-2026-55639: exploit by specially crafted RDP malformed data
     and read out-of-bound data block.
   * CVE-2026-55645: out-of-bounds memory reads

zfs-linux (2.3.9-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream stable point release 2.3.9, fix open zpool
     manipulation and escapes via unprivileged userns.
   * d/patches: drop patches that are now included, refresh remaining.
   * d/zfsutils-linux.install: add zfs-mount@.service and zfs-rewrite.8
   * d/*.symbols: update.
   * d/rules: fix dkms build by retaining more fields in configure.ac.
   * d/rules: install scripts/objtool-wrapper.in into dkms tree.
zfs-linux (2.3.5-2) unstable; urgency=medium
 .
   [ Shengqi Chen ]
   * d/watch: switch to version 5
 .
   [ Aron Xu ]
   * d/patches: resync with Ubuntu, changes
     - Enable ubuntu/4100-disable-bpool-upgrade.patch
     - Enable Linux 6.18 cherry-picks
   * Revert "d/patches: remove not used patch"
   * d/patches/bump-Linux-Minimum.patch: refresh
   * d/patches: enable-linux-experimental to allow building with 6.18
   * d/upstream/signing-key.asc: add 6AD860EED4598027
   * d/libzpool6linux.symbols: update
   * d/source/lintian-overrides: drop unused ones, add python test ones
   * d/control*: std-ver 4.7.2, no change required
   * d/pyzfs-doc.lintian-overrides: removed
   * d/control: remove redundant "Rules-Requires-Root: no"
zfs-linux (2.3.5-2~bpo13+1) trixie-backports; urgency=medium
 .
   * Rebuild for trixie-backports.
zfs-linux (2.3.5-1) unstable; urgency=medium
 .
   * New upstream version 2.3.5 (Closes: #1119915)
   * d/patch: remove not used patch
zfs-linux (2.3.4-1) unstable; urgency=medium
 .
   * New upstream version 2.3.4 (closes: #1111252).
   * d/symbols: add new symbols for libzpool6linux.
   * d/install: install new zfs-mount@.service in zfsutils-linux.
zfs-linux (2.3.4-1~bpo13+1) trixie-backports; urgency=medium
 .
   * Rebuild for trixie-backports.
zfs-linux (2.3.4~git20250812.3b64a96-1) experimental; urgency=medium
 .
   [ Shengqi Chen ]
   * New upstream version 2.3.4~git20250812.3b64a96 (from zfs-2.3.4-staging).
   * d/patches: further patch pyzfs to fix error on debian pre-release version.
   * d/install: add new manpage for zfs-rewrite in zfsutils-linux.
   * d/symbols: remove missing symbol for libzpool6linux.
   * d/rules: install scripts/objtool-wrapper.in into dkms tree.
 .
   [ Attila Fülöp ]
   * d/rules: fix dkms build by retaining more fields in configure.ac.
zfs-linux (2.3.3-1) unstable; urgency=medium
 .
   * New upstream version 2.3.3 (closes: #1106035, #1106556).
   * d/patches: refresh existing patches.
   * d/symbols: add symbols in new version, remove vanished ones.
   * d/copyright: remove deprecated FSF physical addresses.
zfs-linux (2.3.3-1~bpo13+1) trixie-backports; urgency=medium
 .
   * Rebuild for trixie-backports.

zip (3.0-15+deb13u1) trixie-security; urgency=high
 .
   * Fix command injection issue. Closes: #1143866.
=======================================
Sat, 11 Jul 2026 - Debian 13.6 released
=======================================
apache2 (2.4.68-1~deb13u1) trixie; urgency=medium
 .
   * New upstream version (Closes: CVE-2026-29167, CVE-2026-29170,
     CVE-2026-34355, CVE-2026-34356, CVE-2026-42535, CVE-2026-42536,
     CVE-2026-43951, CVE-2026-44119, CVE-2026-44185, CVE-2026-44186,
     CVE-2026-44631, CVE-2026-48913)
   * Drop CVE-2026-49975_*, now included in upstream
   * Update debian/convert_docs
   * Update test framework
apache2 (2.4.68-1~deb12u1) bookworm; urgency=medium
 .
   * New upstream version (Closes: CVE-2026-29167, CVE-2026-29170,
     CVE-2026-34355, CVE-2026-34356, CVE-2026-42535, CVE-2026-42536,
     CVE-2026-43951, CVE-2026-44119, CVE-2026-44185, CVE-2026-44186,
     CVE-2026-44631, CVE-2026-48913, CVE-2026-49975)
   * Drop CVE-2026-49975_1.patch, now included in upstream
   * Drop CVE-2026-49975_2.patch, now included in upstream
   * Update debian/convert_docs
   * Update test framewaork
apache2 (2.4.67-2) unstable; urgency=medium
 .
   * Fix a typo in NEWS file (Closes: #1135096)
   * Fix CVE-2026-49975 (HTTP/2 Bomb)
     The bomb targets HPACK, HTTP/2's header compression
     scheme: one byte on the wire becomes one full header
     allocation on the server, repeated thousands of times
     per request. The hold is a zero-byte flow-control
     window that keeps the server from ever freeing any of it.
apache2 (2.4.67-1) unstable; urgency=medium
 .
   * New upstream release (Closes: #1135737, CVE-2026-23918, CVE-2026-24072,
     CVE-2026-29169, CVE-2026-33006, CVE-2026-33007, CVE-2026-33523,
     CVE-2026-33857, CVE-2026-34032, CVE-2026-34059)
   * Refresh patches
apache2 (2.4.67-1~deb13u3) trixie-security; urgency=medium
 .
   * Fix CVE-2026-49975 (HTTP/2 Bomb)
     The bomb targets HPACK, HTTP/2's header compression
     scheme: one byte on the wire becomes one full header
     allocation on the server, repeated thousands of times
     per request. The hold is a zero-byte flow-control
     window that keeps the server from ever freeing any of it.

archlinux-keyring (0~20260420-1~deb13u1) trixie; urgency=medium
 .
   * gbp.conf: set branch to debian/trixie
   * salsa-ci.yml: set release to trixie
 .
 archlinux-keyring (0~20260420-1) unstable; urgency=medium
 .
   * Update standards version to 4.7.4
   * Fix version mangling in debian/watch
   * New upstream version 0~20260420
 .
 archlinux-keyring (0~20251116-1) unstable; urgency=medium
 .
   * New upstream version 0~20251116
   * Fix debian/watch to also set dversionmangle and upgrade to v5
 .
 archlinux-keyring (0~20250716-1) unstable; urgency=medium
 .
   * Add gbp.conf
   * New upstream version 0~20250716
archlinux-keyring (0~20251116-1) unstable; urgency=medium
 .
   * New upstream version 0~20251116
   * Fix debian/watch to also set dversionmangle and upgrade to v5
archlinux-keyring (0~20250716-1) unstable; urgency=medium
 .
   * Add gbp.conf
   * New upstream version 0~20250716

atril (1.26.2-4+deb13u1) trixie-security; urgency=medium
 .
   * Non-maintainer upload by the LTS Team.
   * CVE-2026-46529: command line argument injection (Closes: #1139874)

awstats (7.9-1+deb13u2) trixie; urgency=medium
 .
   * Add upstream patch to fix freeze on keyword stat (Closes: #1135203)

base-files (13.8+deb13u6) trixie; urgency=medium
 .
   * Update debian_version and os-release for Debian 13.6 point release.

beets (2.2.0-3+deb13u1) trixie; urgency=medium
 .
   * Add patch to fix xss vulnerability CVE-2026-42052 in web ui
     (Closes: #1135779)
   * Add patch with test for unsafe web ui input

bind9 (1:9.20.23-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream version 9.20.23
    + [CVE-2026-3592]: Limit resolver server list size.
    + [CVE-2026-3039]: Fix GSS-API resource leak.
    + [CVE-2026-5946]: Disable recursion, UPDATE, and NOTIFY for non-IN
      views.
    + [CVE-2026-5950]: Avoid unbounded recursion loop.
    + [CVE-2026-5947]: Fix crash in resolver when SIG(0)-signed responses
      are received under load.
    + [CVE-2026-3593]: Fix use-after-free error in DNS-over-HTTPS when
      processing HTTP/2 SETTINGS frames.
bind9 (1:9.20.23-1~deb13u1~bpo12+1) bookworm-backports; urgency=medium
 .
   * Rebuild for bookworm-backports.
bind9 (1:9.20.22-1) unstable; urgency=medium
 .
   * New upstream version 9.20.22
bind9 (1:9.20.21-1) unstable; urgency=high
 .
   * New upstream version 9.20.21
    - [CVE-2026-1519]: Fix unbounded NSEC3 iterations when validating
      referrals to unsigned delegations.
    - [CVE-2026-3104]: Fix memory leaks in code preparing DNSSEC proofs of
      non-existence.
    - [CVE-2026-3119]: Prevent a crash in code processing queries
      containing a TKEY record.
    - [CVE-2026-3591]: Fix a stack use-after-return flaw in SIG(0) handling
      code.

bird2 (2.17.5-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream release.
bird2 (2.17.3-2) unstable; urgency=medium
 .
   * bird.service: fix the Environment directive. (Closes: #1123567)
bird2 (2.17.3-1) unstable; urgency=medium
 .
   * New upstream release.
   * New maintainer.
   * Use Restart=on-abnormal instead of on-abort. (Closes: #1099513)
   * Do not install an example /etc/bird/bird.conf anymore, because there
     is no useful BIRD configuration that can be enabled by default.
   * Create /etc/bird/ with standard permissions: the local admin can
     use appropriate permission for bird.conf if access to it needs to
     be restricted.
   * Create the bird user with no home directory for added security.
bird2 (2.17.2-1) unstable; urgency=medium
 .
   * New upstream version 2.17.2
   * Update debian/watch for new BIRD download URL

bird3 (3.1.7-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream release.
bird3 (3.1.5-2) unstable; urgency=medium
 .
   * bird.service: fix the Environment directive.
bird3 (3.1.5-1) unstable; urgency=medium
 .
   * New upstream release.
   * New maintainer.
   * Use Restart=on-abnormal instead of on-abort. (Closes: #1099513)
   * Do not install an example /etc/bird/bird.conf anymore, because there
     is no useful BIRD configuration that can be enabled by default.
   * Create /etc/bird/ with standard permissions: the local admin can
     use appropriate permission for bird.conf if access to it needs to
     be restricted.
   * Create the bird user with no home directory for added security.
bird3 (3.1.4-1) unstable; urgency=medium
 .
   * New upstream version
   * Update debian/watch for new BIRD download URL

calibre (8.5.0+ds-1+deb13u3) trixie; urgency=medium
 .
   * Fix security vulnerabilities and code quality issues (Closes: #1135543)
   * CVE-2026-30853: RB Input: Ensure files are extracted within container
     dir
   * CVE-2026-33205 (1/2): E-book viewer: prevent reading background images
     from outside the config dir
   * CVE-2026-33205 (2/2): E-book viewer: Disallow background images from
     the internet. This was an unused feature anyway
   * CVE-2026-33206: TXT Input: Ensure resource files are read only from
     book contents

ceph (18.2.7+ds-1+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * mgr/alerts: enforce ssl context to SMTP_SSL (CVE-2024-31884)
     (Closes: #1126573)
   * Check if `HTTP_X_AMZ_COPY_SOURCE` header is empty (CVE-2024-47866)
     (Closes: #1120797)

chromium (150.0.7871.100-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE list still to be announced.
   * debian/patches/ungoogled/remove-navigation-source-param.patch: fix crash
     related to the previous version's resynch. Thanks to
     plmaneo <plmaneo@agent.qq.com> for the suggested patch (closes: #1141488).
chromium (150.0.7871.100-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE list still to be announced.
   * debian/patches/ungoogled/remove-navigation-source-param.patch: fix crash
     related to the previous version's resynch. Thanks to
     plmaneo <plmaneo@agent.qq.com> for the suggested patch (closes: #1141488).
chromium (150.0.7871.46-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream stable release.
     - CVE-2026-13774: Use after free in Extensions. Reported by Google.
     - CVE-2026-13775: Use after free in GPU. Reported by Google.
     - CVE-2026-14398: Use after free in ANGLE. Reported by Google.
     - CVE-2026-13776: Type Confusion in Dawn. Reported by Google.
     - CVE-2026-13777: Insufficient validation of untrusted input in iOSWeb.
       Reported by Google.
     - CVE-2026-13778: Use after free in WebUSB. Reported by Google.
     - CVE-2026-13779: Use after free in Chromoting. Reported by Google.
     - CVE-2026-13780: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-13781: Insufficient validation of untrusted input in Skia.
       Reported by Google.
     - CVE-2026-14417: Use after free in Dawn. Reported by Google.
     - CVE-2026-13782: Use after free in Browser. Reported by Google.
     - CVE-2026-13783: Use after free in Views. Reported by Google.
     - CVE-2026-13784: Use after free in Views. Reported by Google.
     - CVE-2026-14419: Use after free in Skia. Reported by Google.
     - CVE-2026-13785: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-14420: Out of bounds read and write in Dawn.
       Reported by Google.
     - CVE-2026-13786: Use after free in Ozone. Reported by Google.
     - CVE-2026-14427: Heap buffer overflow in Skia. Reported by Google.
     - CVE-2026-13787: Use after free in Chromoting. Reported by Google.
     - CVE-2026-13788: Use after free in Fullscreen. Reported by Google.
     - CVE-2026-14382: Insufficient validation of untrusted input in ANGLE.
       Reported by anonymous.
     - CVE-2026-13790: Side-channel information leakage in Scroll.
       Reported by Vsevolod Kokorin (Slonser) of Solidlab and Jorian Woltjer.
     - CVE-2026-14385: Heap buffer overflow in ANGLE.
       Reported by Thomas Guillem <thomas@gllm.fr>.
     - CVE-2026-13791: Insufficient validation of untrusted input in
       Downloads. Reported by Ron Masas (Imperva).
     - CVE-2026-13792: Use after free in Touchbar.
       Reported by Weipeng Jiang (@Krace) of VRI.
     - CVE-2026-13793: Insufficient policy enforcement in SVG.
       Reported by pakhunov.anton.n@gmail.com.
     - CVE-2026-14392: Out of bounds write in Tint.
       Reported by FastPL Group, Imperial College London.
     - CVE-2026-13794: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Daniel Rodríguez.
     - CVE-2026-14422: Out of bounds read and write in Tint.
       Reported by Michal Andryskowski.
     - CVE-2026-13795: Insufficient policy enforcement in Chrome for iOS.
       Reported by maitai.
     - CVE-2026-14426: Use after free in V8. Reported by ywatanabee.
     - CVE-2026-13796: Integer overflow in Chromecast. Reported by Google.
     - CVE-2026-13797: Insufficient validation of untrusted input in
       Chromecast. Reported by Google.
     - CVE-2026-14386: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-13798: Heap buffer overflow in Chromecast. Reported by Google.
     - CVE-2026-13799: Use after free in QUIC. Reported by Google.
     - CVE-2026-13800: Inappropriate implementation in Updater.
       Reported by Google.
     - CVE-2026-13801: Integer overflow in Chromecast. Reported by Google.
     - CVE-2026-13802: Use after free in Views. Reported by Google.
     - CVE-2026-13803: Type Confusion in Chrome Tabs. Reported by Google.
     - CVE-2026-13804: Use after free in Chromecast. Reported by Google.
     - CVE-2026-13805: Use after free in GFX. Reported by Google.
     - CVE-2026-14390: Use after free in ANGLE. Reported by Google.
     - CVE-2026-13806: Insufficient validation of untrusted input in
       Accessibility. Reported by Google.
     - CVE-2026-13807: Use after free in Import. Reported by Google.
     - CVE-2026-13808: Insufficient data validation in Chrome for iOS.
       Reported by Google.
     - CVE-2026-13809: Side-channel information leakage in Safe Browsing.
       Reported by Google.
     - CVE-2026-13810: Inappropriate implementation in Input.
       Reported by dilipsc03@gmail.com.
     - CVE-2026-13811: Use after free in IME. Reported by Google.
     - CVE-2026-13812: Insufficient validation of untrusted input in
       Chrome for iOS. Reported by Google.
     - CVE-2026-13813: Insufficient validation of untrusted input in
       Chrome for iOS. Reported by Google.
     - CVE-2026-13814: Use after free in Views. Reported by Google.
     - CVE-2026-13815: Use after free in Blink. Reported by Google.
     - CVE-2026-13816: Insufficient validation of untrusted input in File
       Input. Reported by Google.
     - CVE-2026-14396: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-13817: Insufficient validation of untrusted input in Glic.
       Reported by Google.
     - CVE-2026-13818: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-13819: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-13820: Out of bounds read in Skia. Reported by Google.
     - CVE-2026-14400: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-14401: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-14402: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-13821: Use after free in Canvas. Reported by Google.
     - CVE-2026-13822: Inappropriate implementation in Extensions.
       Reported by Google.
     - CVE-2026-13823: Use after free in Glic. Reported by Google.
     - CVE-2026-13824: Insufficient validation of untrusted input in
       Extensions. Reported by Google.
     - CVE-2026-13825: Uninitialized Use in Dawn. Reported by Google.
     - CVE-2026-13826: Inappropriate implementation in Autofill.
       Reported by Google.
     - CVE-2026-13827: Use after free in Updater. Reported by Google.
     - CVE-2026-13828: Inappropriate implementation in Enterprise.
       Reported by Google.
     - CVE-2026-13829: Insufficient validation of untrusted input in Settings.
       Reported by Google.
     - CVE-2026-13830: Use after free in Chromoting. Reported by Google.
     - CVE-2026-13831: Use after free in GPU. Reported by Google.
     - CVE-2026-13832: Use after free in Headless. Reported by Google.
     - CVE-2026-14411: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-13833: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-14412: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-14413: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-13834: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-13835: Inappropriate implementation in XML. Reported by Google.
     - CVE-2026-13836: Inappropriate implementation in CSS. Reported by Google.
     - CVE-2026-13837: Inappropriate implementation in CSS. Reported by Google.
     - CVE-2026-13838: Inappropriate implementation in CSS. Reported by Google.
     - CVE-2026-13839: Inappropriate implementation in CSS. Reported by Google.
     - CVE-2026-13840: Insufficient policy enforcement in Canvas.
       Reported by Binglin Song.
     - CVE-2026-13841: Integer overflow in Skia. Reported by Google.
     - CVE-2026-13842: Incorrect security UI in Chrome for iOS.
       Reported by Azza Tegar Naufal Ataullah.
     - CVE-2026-14418: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-13843: Insufficient validation of untrusted input in Chrome
       for iOS. Reported by Google.
     - CVE-2026-13844: Use after free in Updater. Reported by Google.
     - CVE-2026-13845: Use after free in DOM. Reported by Google.
     - CVE-2026-13846: Use after free in USB. Reported by Google.
     - CVE-2026-13847: Insufficient validation of untrusted input in Chrome
       for iOS. Reported by Google.
     - CVE-2026-13848: Use after free in Forms. Reported by Google.
     - CVE-2026-13849: Insufficient validation of untrusted input in
       Chromoting. Reported by Google.
     - CVE-2026-14423: Type Confusion in Tint. Reported by Google.
     - CVE-2026-13850: Insufficient validation of untrusted input in Chrome
       for iOS. Reported by Google.
     - CVE-2026-14424: Use after free in Dawn. Reported by Google.
     - CVE-2026-14425: Use after free in ANGLE. Reported by Google.
     - CVE-2026-13851: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Google.
     - CVE-2026-14428: Insufficient validation of untrusted input in Dawn.
       Reported by Google.
     - CVE-2026-14429: Insufficient validation of untrusted input in Skia.
       Reported by Google.
     - CVE-2026-14430: Integer overflow in V8. Reported by Google.
     - CVE-2026-13852: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Google.
     - CVE-2026-13853: Use after free in Journeys. Reported by Google.
     - CVE-2026-13854: Use after free in Ozone. Reported by Google.
     - CVE-2026-14431: Type Confusion in V8.
       Reported by OpenAI Codex Security (amyb).
     - CVE-2026-13855: Use after free in Ozone. Reported by Google.
     - CVE-2026-13856: Insufficient validation of untrusted input in Speech.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-13857: Inappropriate implementation in Geometry.
       Reported by Luan Herrera (@lbherrera_).
     - CVE-2026-13858: Out of bounds read in FFmpeg. Reported by Wongi Lee
       (@_qwerty_po) of Theori with Xint Code, Jungwoo Lee (@physicube).
     - CVE-2026-13859: Inappropriate implementation in ANGLE.
       Reported by Jason Villaluna.
     - CVE-2026-14391: Integer overflow in ANGLE. Reported by Quac Tran.
     - CVE-2026-13860: Incorrect security UI in Autofill.
       Reported by Khalil Zhani.
     - CVE-2026-14408: Uninitialized Use in Dawn. Reported by Chrovus.
     - CVE-2026-14381: Incorrect security UI in WebAppInstalls.
       Reported by Hafiizh.
     - CVE-2026-14383: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-13861: Use after free in Core. Reported by Google.
     - CVE-2026-13862: Insufficient policy enforcement in Web Authentication
       (Passkeys & Security Keys). Reported by Google.
     - CVE-2026-13863: Insufficient validation of untrusted input in
       CustomTabs. Reported by Google.
     - CVE-2026-13864: Insufficient policy enforcement in WebHID.
       Reported by Google.
     - CVE-2026-13865: Insufficient validation of untrusted input in
       Enterprise. Reported by Google.
     - CVE-2026-13866: Insufficient validation of untrusted input in Input.
       Reported by Google.
     - CVE-2026-13867: Inappropriate implementation in Geolocation.
       Reported by Google.
     - CVE-2026-13868: Inappropriate implementation in Network.
       Reported by Google.
     - CVE-2026-14384: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-13869: Use after free in Device. Reported by Google.
     - CVE-2026-13870: Use after free in WebView. Reported by Google.
     - CVE-2026-13871: Insufficient data validation in GuestView.
       Reported by Google.
     - CVE-2026-13872: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Google.
     - CVE-2026-13873: Out of bounds memory access in Layout. Reported by
       Google.
     - CVE-2026-13874: Inappropriate implementation in DataTransfer.
       Reported by Google.
     - CVE-2026-13875: Insufficient validation of untrusted input in GPU.
       Reported by Google.
     - CVE-2026-13876: Inappropriate implementation in Network.
       Reported by Google.
     - CVE-2026-13877: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-13878: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-13879: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-13880: Use after free in USB. Reported by Google.
     - CVE-2026-13881: Insufficient data validation in WebAppInstalls.
       Reported by Google.
     - CVE-2026-13882: Inappropriate implementation in USB. Reported by Google
     - CVE-2026-13883: Type Confusion in ANGLE. Reported by Google.
     - CVE-2026-13884: Heap buffer overflow in Chromecast. Reported by Google.
     - CVE-2026-14387: Integer overflow in Skia. Reported by Google.
     - CVE-2026-13885: Use after free in Skia. Reported by Google.
     - CVE-2026-13886: Policy bypass in Isolated Web Apps. Reported by Google.
     - CVE-2026-14388: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-14389: Integer overflow in Skia. Reported by Google.
     - CVE-2026-13887: Insufficient policy enforcement in NFC.
       Reported by Google.
     - CVE-2026-13888: Use after free in Extensions. Reported by Google.
     - CVE-2026-13889: Insufficient validation of untrusted input in
       WebAuthentication. Reported by Google.
     - CVE-2026-13890: Out of bounds read in Chromecast. Reported by Google.
     - CVE-2026-13891: Insufficient validation of untrusted input in
       Extensions. Reported by Google.
     - CVE-2026-13892: Inappropriate implementation in Chrome for iOS.
       Reported by Google.
     - CVE-2026-13893: Insufficient validation of untrusted input in WebUI.
       Reported by Google.
     - CVE-2026-13894: Insufficient policy enforcement in Network.
       Reported by Google.
     - CVE-2026-13895: Inappropriate implementation in Autofill.
       Reported by Google.
     - CVE-2026-13896: Insufficient policy enforcement in Glic.
       Reported by Google.
     - CVE-2026-13897: Insufficient policy enforcement in Chromecast.
       Reported by Google.
     - CVE-2026-13898: Use after free in Cast Receiver. Reported by Google.
     - CVE-2026-13899: Use after free in HTML. Reported by Google.
     - CVE-2026-13900: Insufficient validation of untrusted input in
       Chromecast. Reported by Google.
     - CVE-2026-13901: Insufficient validation of untrusted input in Serial.
       Reported by Google.
     - CVE-2026-13902: Inappropriate implementation in Chrome for iOS.
       Reported by Google.
     - CVE-2026-13903: Insufficient policy enforcement in Bluetooth.
       Reported by Google.
     - CVE-2026-13904: Incorrect security UI in Safe Browsing.
       Reported by Google.
     - CVE-2026-13905: Incorrect security UI in Chrome for iOS.
       Reported by Google.
     - CVE-2026-13906: Out of bounds read in Codecs. Reported by Google.
     - CVE-2026-13907: Inappropriate implementation in iOSWeb.
       Reported by Google.
     - CVE-2026-13908: Insufficient validation of untrusted input in Omnibox.
       Reported by Google.
     - CVE-2026-13909: Insufficient policy enforcement in DevTools.
       Reported by Google.
     - CVE-2026-13910: Insufficient policy enforcement in WebXR.
       Reported by Google.
     - CVE-2026-13911: Insufficient data validation in Spellcheck.
       Reported by Google.
     - CVE-2026-13912: Incorrect security UI in Safe Browsing.
       Reported by Google.
     - CVE-2026-13913: Insufficient policy enforcement in Autofill.
       Reported by Google.
     - CVE-2026-13914: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-13915: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-13916: Inappropriate implementation in Chrome for iOS.
       Reported by Google.
     - CVE-2026-13917: Insufficient validation of untrusted input in Chrome
       for iOS. Reported by Google.
     - CVE-2026-13918: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-13919: Insufficient data validation in Extensions.
       Reported by Google.
     - CVE-2026-14393: Use after free in V8. Reported by Google.
     - CVE-2026-13920: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-13921: Insufficient validation of untrusted input in
       DeviceBoundSessionCredentials. Reported by Google.
     - CVE-2026-13922: Side-channel information leakage in Paint.
       Reported by Google.
     - CVE-2026-13923: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-14397: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-13924: Insufficient validation of untrusted input in WebView.
       Reported by Google.
     - CVE-2026-13925: Inappropriate implementation in Downloads.
       Reported by Google.
     - CVE-2026-13926: Insufficient validation of untrusted input in Network.
       Reported by Google.
     - CVE-2026-13927: Insufficient validation of untrusted input in UI.
       Reported by Google.
     - CVE-2026-13928: Insufficient validation of untrusted input in
       Enterprise. Reported by Google.
     - CVE-2026-13929: Insufficient validation of untrusted input in DevTools.
       Reported by LegioSec.
     - CVE-2026-13930: Insufficient policy enforcement in Actor.
       Reported by Google.
     - CVE-2026-13931: Inappropriate implementation in Media.
       Reported by Google.
     - CVE-2026-13932: Inappropriate implementation in Sharing.
       Reported by Google.
     - CVE-2026-13933: Insufficient policy enforcement in Passwords.
       Reported by Google.
     - CVE-2026-13934: Insufficient validation of untrusted input in Dawn.
       Reported by Google.
     - CVE-2026-14399: Uninitialized Use in Dawn. Reported by Google.
     - CVE-2026-13935: Side-channel information leakage in ComputePressure.
       Reported by Google.
     - CVE-2026-13936: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-13937: Insufficient policy enforcement in Passwords.
       Reported by Google.
     - CVE-2026-13938: Integer overflow in Fonts. Reported by Google.
     - CVE-2026-13939: Insufficient validation of untrusted input in WebShare.
       Reported by Google.
     - CVE-2026-13940: Uninitialized Use in Cast. Reported by Google.
     - CVE-2026-13941: Inappropriate implementation in SiteSettings.
       Reported by Google.
     - CVE-2026-13942: Insufficient validation of untrusted input in Video
       Capture. Reported by Google.
     - CVE-2026-13943: Uninitialized Use in CSS. Reported by Google.
     - CVE-2026-13944: Inappropriate implementation in DataTransfer.
       Reported by Google.
     - CVE-2026-13945: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-13946: Inappropriate implementation in ScriptInjections.
       Reported by Google.
     - CVE-2026-13947: Uninitialized Use in XR. Reported by Google.
     - CVE-2026-13948: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-13949: Insufficient policy enforcement in Payments.
       Reported by Google.
     - CVE-2026-14404: Inappropriate implementation in PDFium.
       Reported by Google.
     - CVE-2026-13950: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-13951: Policy bypass in USB. Reported by Google.
     - CVE-2026-13952: Inappropriate implementation in PerformanceAPIs.
       Reported by Google.
     - CVE-2026-14406: Out of bounds read in V8. Reported by Google.
     - CVE-2026-13953: Inappropriate implementation in SplitView.
       Reported by Google.
     - CVE-2026-13954: Insufficient policy enforcement in XML.
       Reported by Google.
     - CVE-2026-13955: Insufficient validation of untrusted input in
       CustomTabs. Reported by Google.
     - CVE-2026-13956: Incorrect security UI in PageInfo. Reported by Google.
     - CVE-2026-13957: Incorrect security UI in Extensions. Reported by Google
     - CVE-2026-13958: Uninitialized Use in Codecs. Reported by Google.
     - CVE-2026-14407: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-13959: Insufficient validation of untrusted input in Blink.
       Reported by Google.
     - CVE-2026-13960: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-13961: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-13962: Insufficient data validation in PDF. Reported by Google
     - CVE-2026-13963: Inappropriate implementation in DevTools.
       Reported by Google.
     - CVE-2026-13964: Insufficient policy enforcement in WebView.
       Reported by Google.
     - CVE-2026-13965: Use after free in Oilpan. Reported by Google.
     - CVE-2026-13966: Inappropriate implementation in History.
       Reported by Google.
     - CVE-2026-13967: Type Confusion in V8. Reported by Google.
     - CVE-2026-13968: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-13969: Uninitialized Use in UI. Reported by Google.
     - CVE-2026-13970: Uninitialized Use in Media. Reported by Google.
     - CVE-2026-13971: Uninitialized Use in Skia. Reported by Google.
     - CVE-2026-13972: Inappropriate implementation in Paint.
       Reported by Google.
     - CVE-2026-13973: Inappropriate implementation in UI. Reported by Google.
     - CVE-2026-13974: Integer overflow in Safe Browsing. Reported by Google.
     - CVE-2026-13975: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-13976: Heap buffer overflow in Storage. Reported by Google.
     - CVE-2026-13977: Inappropriate implementation in HTMLParser.
       Reported by Google.
     - CVE-2026-13978: Insufficient policy enforcement in PageInfo.
       Reported by Google.
     - CVE-2026-14414: Insufficient validation of untrusted input in Skia.
       Reported by Google.
     - CVE-2026-13979: Inappropriate implementation in Paint. Reported by
       Google.
     - CVE-2026-13980: Incorrect security UI in Chrome for iOS.
       Reported by Google.
     - CVE-2026-13981: Inappropriate implementation in Chrome for iOS.
       Reported by Google.
     - CVE-2026-13982: Incorrect security UI in Passwords. Reported by Google.
     - CVE-2026-13983: Incorrect security UI in Chrome for iOS.
       Reported by Google.
     - CVE-2026-13984: Incorrect security UI in TabStrip. Reported by Google.
     - CVE-2026-13985: Inappropriate implementation in MediaCapture.
       Reported by Google.
     - CVE-2026-13986: Inappropriate implementation in Media UI.
       Reported by Google.
     - CVE-2026-13987: Incorrect security UI in Mobile. Reported by Google.
     - CVE-2026-13988: Inappropriate implementation in Paint.
       Reported by Google.
     - CVE-2026-13989: Insufficient policy enforcement in PageInfo.
       Reported by Google.
     - CVE-2026-13990: Insufficient validation of untrusted input in
       DataTransfer. Reported by Google.
     - CVE-2026-13991: Insufficient validation of untrusted input in Chrome
       for iOS. Reported by Google.
     - CVE-2026-13992: Inappropriate implementation in UI. Reported by Google.
     - CVE-2026-13993: Incorrect security UI in WebAppInstalls.
       Reported by Google.
     - CVE-2026-13994: Inappropriate implementation in Credential Management.
       Reported by Google.
     - CVE-2026-13995: Insufficient validation of untrusted input in Autofill.
       Reported by Google.
     - CVE-2026-13996: Incorrect security UI in Permissions.
       Reported by Google.
     - CVE-2026-13997: Incorrect security UI in Extensions. Reported by Google
     - CVE-2026-13998: Incorrect security UI in File Input. Reported by Google
     - CVE-2026-13999: Inappropriate implementation in Extensions.
       Reported by Google.
     - CVE-2026-14000: Inappropriate implementation in XML. Reported by Google
     - CVE-2026-14001: Inappropriate implementation in Network.
       Reported by Google.
     - CVE-2026-14002: Inappropriate implementation in Geolocation.
       Reported by Google.
     - CVE-2026-14003: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-14004: Inappropriate implementation in CSS. Reported by Google
     - CVE-2026-14005: Use after free in Omnibox. Reported by Google.
     - CVE-2026-14006: Use after free in Navigation. Reported by Google.
     - CVE-2026-14007: Insufficient policy enforcement in PermissionsPolicy.
       Reported by Google.
     - CVE-2026-14008: Uninitialized Use in WebXR. Reported by Google.
     - CVE-2026-14009: Insufficient data validation in Passwords.
       Reported by Google.
     - CVE-2026-14010: Uninitialized Use in Codecs. Reported by Google.
     - CVE-2026-14011: Out of bounds read in SurfaceCapture.
       Reported by Google.
     - CVE-2026-14421: Uninitialized Use in Dawn. Reported by Google.
     - CVE-2026-14012: Side-channel information leakage in CSS.
       Reported by Google.
     - CVE-2026-14013: Inappropriate implementation in SVG. Reported by Google
     - CVE-2026-14014: Inappropriate implementation in Paint.
       Reported by Google.
     - CVE-2026-14015: Inappropriate implementation in WebRTC.
       Reported by Google.
     - CVE-2026-14016: Insufficient policy enforcement in SVG.
       Reported by Google.
     - CVE-2026-14017: Inappropriate implementation in Navigation.
       Reported by Google.
     - CVE-2026-14018: Use after free in Updater. Reported by Google.
     - CVE-2026-14019: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-14020: Insufficient validation of untrusted input in WebXR.
       Reported by Google.
     - CVE-2026-14021: Insufficient validation of untrusted input in
       StorageAccessAPI. Reported by Google.
     - CVE-2026-14022: Insufficient validation of untrusted input in Network.
       Reported by Google.
     - CVE-2026-14023: Insufficient validation of untrusted input in
       SanitizerAPI. Reported by Google.
     - CVE-2026-14024: Use after free in Ozone. Reported by Google.
     - CVE-2026-14432: Use after free in V8. Reported by Google.
     - CVE-2026-14025: Use after free in Views. Reported by asjidkalam.
     - CVE-2026-14026: Incorrect security UI in SplitView.
       Reported by adisahilna35@gmail.com.
     - CVE-2026-14027: Use after free in SignIn.
       Reported by Sven Dysthe (@svn-dys).
     - CVE-2026-14028: Incorrect security UI in Chrome for iOS.
       Reported by Ameen Basha M K.
     - CVE-2026-14030: Incorrect security UI in SplitView.
       Reported by Khalil Zhani.
     - CVE-2026-14031: Incorrect security UI in File Input. Reported by Google
     - CVE-2026-14032: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-14033: Insufficient policy enforcement in Media.
       Reported by Google.
     - CVE-2026-14034: Inappropriate implementation in WebXR.
       Reported by Google.
     - CVE-2026-14035: Insufficient policy enforcement in Bluetooth.
       Reported by Google.
     - CVE-2026-14036: Insufficient policy enforcement in Bluetooth.
       Reported by Google.
     - CVE-2026-14037: Insufficient policy enforcement in GPU.
       Reported by Google.
     - CVE-2026-14038: Insufficient validation of untrusted input in New
       Tab Page. Reported by Google.
     - CVE-2026-14039: Insufficient policy enforcement in GetUserMedia.
       Reported by Google.
     - CVE-2026-14040: Use after free in BrowserTag. Reported by Google.
     - CVE-2026-14041: Insufficient policy enforcement in Serial.
       Reported by Google.
     - CVE-2026-14042: Inappropriate implementation in Isolated Web Apps.
       Reported by Google.
     - CVE-2026-14043: Use after free in GetUserMedia. Reported by Google.
     - CVE-2026-14044: Use after free in ANGLE. Reported by Google.
     - CVE-2026-14045: Insufficient validation of untrusted input in Network.
       Reported by Google.
     - CVE-2026-14046: Inappropriate implementation in CustomTabs.
       Reported by Google.
     - CVE-2026-14047: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-14048: Use after free in Chromecast. Reported by Google.
     - CVE-2026-14049: Inappropriate implementation in GPU. Reported by Google
     - CVE-2026-14050: Insufficient policy enforcement in Passwords.
       Reported by Google.
     - CVE-2026-14051: Uninitialized Use in GamepadAPI. Reported by Google.
     - CVE-2026-14052: Insufficient policy enforcement in FileSystem.
       Reported by Google.
     - CVE-2026-14053: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-14054: Insufficient policy enforcement in Network.
       Reported by Google.
     - CVE-2026-14055: Insufficient validation of untrusted input in Device
       Trust. Reported by Google.
     - CVE-2026-14056: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-14057: Insufficient policy enforcement in FedCM.
       Reported by Google.
     - CVE-2026-14058: Policy bypass in Parser. Reported by Google.
     - CVE-2026-14059: Insufficient policy enforcement in
       Related-Website-Sets. Reported by Google.
     - CVE-2026-14060: Insufficient validation of untrusted input in
       Chromoting. Reported by Google.
     - CVE-2026-14061: Inappropriate implementation in Dawn.
       Reported by Google.
     - CVE-2026-14062: Inappropriate implementation in Views.
       Reported by Google.
     - CVE-2026-14063: Out of bounds memory access in Chromecast.
       Reported by Google.
     - CVE-2026-14064: Use after free in PageInfo. Reported by Google.
     - CVE-2026-14065: Insufficient validation of untrusted input in
       PageInfo. Reported by Google.
     - CVE-2026-14066: Insufficient validation of untrusted input in Chrome
       for iOS. Reported by Google.
     - CVE-2026-14067: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-14068: Inappropriate implementation in Omnibox.
       Reported by Google.
     - CVE-2026-14069: Integer overflow in WebNN. Reported by Google.
     - CVE-2026-14070: Uninitialized Use in WebNN. Reported by Google.
     - CVE-2026-14071: Side-channel information leakage in WebAudio.
       Reported by Google.
     - CVE-2026-14072: Incorrect security UI in SplitView.
       Reported by FARISSAL B.
     - CVE-2026-14073: Insufficient policy enforcement in WebXR.
       Reported by Google.
     - CVE-2026-14394: Use after free in V8. Reported by Google.
     - CVE-2026-14395: Out of bounds write in V8. Reported by Google.
     - CVE-2026-14074: Side-channel information leakage in WebAuthentication.
       Reported by Google.
     - CVE-2026-14075: Policy bypass in Chrome for iOS. Reported by Google.
     - CVE-2026-14076: Policy bypass in Network. Reported by Google.
     - CVE-2026-14077: Incorrect security UI in Select. Reported by pwn.ai.
     - CVE-2026-14078: Policy bypass in WebRTC. Reported by Google.
     - CVE-2026-14079: Policy bypass in Network. Reported by Google.
     - CVE-2026-14080: Insufficient validation of untrusted input in
       TabSwitcher. Reported by Google.
     - CVE-2026-14081: Insufficient policy enforcement in DevTools.
       Reported by Google.
     - CVE-2026-14082: Race in Storage. Reported by Google.
     - CVE-2026-14083: Insufficient validation of untrusted input in HTML.
       Reported by Google.
     - CVE-2026-14084: Insufficient validation of untrusted input in
       Chromoting. Reported by Google.
     - CVE-2026-14085: Side-channel information leakage in CSS.
       Reported by Google.
     - CVE-2026-14086: Insufficient policy enforcement in HID.
       Reported by Google.
     - CVE-2026-14087: Insufficient validation of untrusted input in WebNN.
       Reported by Google.
     - CVE-2026-14088: Uninitialized Use in Canvas. Reported by Google.
     - CVE-2026-14089: Insufficient validation of untrusted input in
       PopupBlocker. Reported by Google.
     - CVE-2026-14090: Out of bounds read in CameraCapture. Reported by Google
     - CVE-2026-14091: Use after free in DevTools. Reported by Google.
     - CVE-2026-14092: Insufficient policy enforcement in Privacy.
       Reported by Google.
     - CVE-2026-14093: Use after free in Cast. Reported by Google.
     - CVE-2026-14094: Use after free in Installer. Reported by Google.
     - CVE-2026-14095: Insufficient validation of untrusted input in Browser.
       Reported by Google.
     - CVE-2026-14403: Use after free in V8. Reported by Google.
     - CVE-2026-14096: Object lifecycle issue in Input. Reported by Google.
     - CVE-2026-14097: Inappropriate implementation in WebAppInstalls.
       Reported by Google.
     - CVE-2026-14098: Inappropriate implementation in CSS. Reported by Google
     - CVE-2026-14405: Uninitialized Use in V8. Reported by Google.
     - CVE-2026-14099: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-14100: Insufficient data validation in NetworkCache.
       Reported by Google.
     - CVE-2026-14101: Insufficient policy enforcement in Sandbox.
       Reported by Google.
     - CVE-2026-14102: Use after free in Passwords. Reported by Google.
     - CVE-2026-14103: Use after free in SSL. Reported by Google.
     - CVE-2026-14104: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Google.
     - CVE-2026-14105: Insufficient policy enforcement in Speech.
       Reported by Google.
     - CVE-2026-14106: Insufficient validation of untrusted input in Text.
       Reported by Google.
     - CVE-2026-14107: Use after free in Scheduling. Reported by Google.
     - CVE-2026-14108: Use after free in PDFium. Reported by Google.
     - CVE-2026-14109: Insufficient policy enforcement in Mojo.
       Reported by Google.
     - CVE-2026-14110: Inappropriate implementation in DarkMode.
       Reported by Google.
     - CVE-2026-14111: Use after free in WebProtect. Reported by Google.
     - CVE-2026-14112: Inappropriate implementation in Enterprise.
       Reported by Google.
     - CVE-2026-14113: Use after free in Updater. Reported by Google.
     - CVE-2026-14114: Inappropriate implementation in WebAppInstalls.
       Reported by Google.
     - CVE-2026-14115: Insufficient validation of untrusted input in Cast.
       Reported by Google.
     - CVE-2026-14116: Insufficient validation of untrusted input in
       DevTools. Reported by Google.
     - CVE-2026-14117: Insufficient validation of untrusted input in
       DevTools. Reported by Google.
     - CVE-2026-14118: Insufficient data validation in DevTools.
       Reported by Google.
     - CVE-2026-14119: Type Confusion in Bluetooth. Reported by Google.
     - CVE-2026-14120: Inappropriate implementation in DevTools.
       Reported by Google.
     - CVE-2026-14121: Use after free in Chromoting. Reported by Google.
     - CVE-2026-14409: Inappropriate implementation in V8.
       Reported by Yuntao You (@GraVity0) of Bytedance Wuheng Lab.
     - CVE-2026-14122: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Google.
     - CVE-2026-14410: Inappropriate implementation in Skia.
       Reported by Google.
     - CVE-2026-14123: Incorrect security UI in Chrome for iOS.
       Reported by Google.
     - CVE-2026-14124: Inappropriate implementation in CredentialProvider.
       Reported by Google.
     - CVE-2026-14125: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-14126: Incorrect security UI in UI. Reported by Google.
     - CVE-2026-14127: Inappropriate implementation in Printing.
       Reported by Google.
     - CVE-2026-14128: Insufficient data validation in Chrome for iOS.
       Reported by Google.
     - CVE-2026-14129: Incorrect security UI in PreviewTab. Reported by Google
     - CVE-2026-14130: Incorrect security UI in Omnibox. Reported by Google.
     - CVE-2026-14131: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Google.
     - CVE-2026-14132: Inappropriate implementation in WebXR.
       Reported by Google.
     - CVE-2026-14133: Race in History Embeddings. Reported by Google.
     - CVE-2026-14134: Inappropriate implementation in Autofill.
       Reported by Google.
     - CVE-2026-14135: Insufficient validation of untrusted input in Network.
       Reported by Google.
     - CVE-2026-14136: Incorrect security UI in Chrome for iOS.
       Reported by Google.
     - CVE-2026-14137: Insufficient validation of untrusted input in Chrome
       for iOS. Reported by Google.
     - CVE-2026-14138: Inappropriate implementation in WebAppInstalls.
       Reported by Google.
     - CVE-2026-14139: Inappropriate implementation in TabStrip.
       Reported by Google.
     - CVE-2026-14140: Insufficient validation of untrusted input in Input.
       Reported by Google.
     - CVE-2026-14141: Incorrect security UI in Document Picture-in-Picture.
       Reported by Google.
     - CVE-2026-14142: Inappropriate implementation in Extensions.
       Reported by Google.
     - CVE-2026-14143: Incorrect security UI in Passwords. Reported by Google.
     - CVE-2026-14144: Incorrect security UI in Views. Reported by Google.
     - CVE-2026-14145: Inappropriate implementation in CSS. Reported by Google
     - CVE-2026-14146: Inappropriate implementation in CSS. Reported by Google
     - CVE-2026-14147: Inappropriate implementation in CSS. Reported by Google
     - CVE-2026-14415: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-14148: Type Confusion in CSS. Reported by Google.
     - CVE-2026-14149: Use after free in Audio. Reported by Google.
     - CVE-2026-14416: Out of bounds read in Dawn. Reported by Google.
     - CVE-2026-14150: Insufficient validation of untrusted input in Speech.
       Reported by Google.
     - CVE-2026-14151: Inappropriate implementation in AI. Reported by Google.
     - CVE-2026-14152: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-14153: Inappropriate implementation in Glic.
       Reported by Google.
     - CVE-2026-14154: Inappropriate implementation in DevTools.
       Reported by Google.
     - CVE-2026-14155: Insufficient policy enforcement in StorageAccessAPI.
       Reported by Google.
     - CVE-2026-14156: Policy bypass in StorageAccessAPI. Reported by Google.
     - CVE-2026-13281: Integer overflow in Mojo. Reported by Google.
     - CVE-2026-13282: Use after free in Payments. Reported by Google.
     - CVE-2026-13283: Use after free in AdFilter. Reported by Google.
   * d/copyright:
     - delete third_party/webpagereplay/.
     - delete tsgo (typescript compiler in Go) binary.
   * d/patches:
     - upstream/0001-Fix-build-for-CPU-yield-on-LoongArch.patch: drop, merged
       upstream.
     - disable/android.patch: drop, merged upstream.
     - debianization/clang-version.patch: refresh.
     - fixes/libcpp-headers.patch: rework parts of the patch due to
       upstream changes.
     - disable/catapult.patch: refresh.
     - disable/tests.patch: refresh.
     - llvm-19/clang19.patch: refresh.
     - trixie/gn-expand-dir-allowlist.patch: refresh.
     - ungoogled/disable-ai.patch: sync from u-c.
     - ungoogled/remove-navigation-source-param.patch: sync from u-c.
     - i386/support-i386.patch: refresh.
     - upstream/sysroot.patch: add a new build fix pulled from upstream.
     - upstream/ar-path1.patch, upstream/ar-path2.patch: add two more
       vendoring-related build fixes from upstream.
     - trixie/gn-additional-outputs.patch: add patch to partially revert usage
       of a newer generate-ninja feature.
     - llvm-19/i18n-builder-enum.patch: add a workaround for clang-19 being
       confused between a class declaration (with default template parameter)
       and definition.
     - llvm-19/00*-revert-v8-libm.patch: add 9 patches backing out usage of
       internal libc++/libm symbols; this requires a newer llvm than we have.
     - llvm-19/value-or.patch: work around more places where value_or() can't
       figure out the type of a passed init value.
     - trixie/node20-compat.patch: break out part of Daniel's
       node18-compat.patch (below) into one for trixie that also fixes nodejs
       20 issues [trixie, bookworm].
     - rust-1.85/std-from-utf8.patch: add workaround for str::from_utf8 added
       in 1.87 [trixie, bookworm].
     - trixie/bindgen-boringssl.patch: add workaround for older bindgen
       [trixie, bookworm].
 .
   [ Daniel Richard G. ]
   * d/patches:
     - bookworm/gn-absl.patch: Refresh [bookworm].
     - bookworm/gn-funcs.patch: Zap new usage of filter_labels_include()
       [bookworm].
     - bookworm/node18-compat.patch: Fix more cases of nodejs v18 breakage
       [bookworm].
     - trixie/gn-module-name.patch: add more spots where the workaround is
       needed [trixie, bookworm].
 .
   [ Jianfeng Liu ]
   * d/patches:
     - upstream/libyuv-loongarch-fix-row_lsx.cc-and-row_lasx.cc.patch: Fix
       build for libyuv loongarch64.
     - loongarch64/0015-ffmpeg-support-for-loongarch.patch: Refresh.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0002-regenerate-xnn-buildgn.patch: refresh for upstream
       changes
     - fixes/fix-rust-linking.patch: refresh for upstream changes
     - fixes/fix-breakpad-compile.patch: refresh for upstream changes
     - third_party/dawn-fix-ppc64le-detection.patch: refresh for upstream
       changes
     - 0001-Add-pregenerated-config-for-libaom-on-ppc64.patch: refresh for
       upstream changes
chromium (150.0.7871.46-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream stable release.
     - CVE-2026-13774: Use after free in Extensions. Reported by Google.
     - CVE-2026-13775: Use after free in GPU. Reported by Google.
     - CVE-2026-14398: Use after free in ANGLE. Reported by Google.
     - CVE-2026-13776: Type Confusion in Dawn. Reported by Google.
     - CVE-2026-13777: Insufficient validation of untrusted input in iOSWeb.
       Reported by Google.
     - CVE-2026-13778: Use after free in WebUSB. Reported by Google.
     - CVE-2026-13779: Use after free in Chromoting. Reported by Google.
     - CVE-2026-13780: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-13781: Insufficient validation of untrusted input in Skia.
       Reported by Google.
     - CVE-2026-14417: Use after free in Dawn. Reported by Google.
     - CVE-2026-13782: Use after free in Browser. Reported by Google.
     - CVE-2026-13783: Use after free in Views. Reported by Google.
     - CVE-2026-13784: Use after free in Views. Reported by Google.
     - CVE-2026-14419: Use after free in Skia. Reported by Google.
     - CVE-2026-13785: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-14420: Out of bounds read and write in Dawn.
       Reported by Google.
     - CVE-2026-13786: Use after free in Ozone. Reported by Google.
     - CVE-2026-14427: Heap buffer overflow in Skia. Reported by Google.
     - CVE-2026-13787: Use after free in Chromoting. Reported by Google.
     - CVE-2026-13788: Use after free in Fullscreen. Reported by Google.
     - CVE-2026-14382: Insufficient validation of untrusted input in ANGLE.
       Reported by anonymous.
     - CVE-2026-13790: Side-channel information leakage in Scroll.
       Reported by Vsevolod Kokorin (Slonser) of Solidlab and Jorian Woltjer.
     - CVE-2026-14385: Heap buffer overflow in ANGLE.
       Reported by Thomas Guillem <thomas@gllm.fr>.
     - CVE-2026-13791: Insufficient validation of untrusted input in
       Downloads. Reported by Ron Masas (Imperva).
     - CVE-2026-13792: Use after free in Touchbar.
       Reported by Weipeng Jiang (@Krace) of VRI.
     - CVE-2026-13793: Insufficient policy enforcement in SVG.
       Reported by pakhunov.anton.n@gmail.com.
     - CVE-2026-14392: Out of bounds write in Tint.
       Reported by FastPL Group, Imperial College London.
     - CVE-2026-13794: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Daniel Rodríguez.
     - CVE-2026-14422: Out of bounds read and write in Tint.
       Reported by Michal Andryskowski.
     - CVE-2026-13795: Insufficient policy enforcement in Chrome for iOS.
       Reported by maitai.
     - CVE-2026-14426: Use after free in V8. Reported by ywatanabee.
     - CVE-2026-13796: Integer overflow in Chromecast. Reported by Google.
     - CVE-2026-13797: Insufficient validation of untrusted input in
       Chromecast. Reported by Google.
     - CVE-2026-14386: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-13798: Heap buffer overflow in Chromecast. Reported by Google.
     - CVE-2026-13799: Use after free in QUIC. Reported by Google.
     - CVE-2026-13800: Inappropriate implementation in Updater.
       Reported by Google.
     - CVE-2026-13801: Integer overflow in Chromecast. Reported by Google.
     - CVE-2026-13802: Use after free in Views. Reported by Google.
     - CVE-2026-13803: Type Confusion in Chrome Tabs. Reported by Google.
     - CVE-2026-13804: Use after free in Chromecast. Reported by Google.
     - CVE-2026-13805: Use after free in GFX. Reported by Google.
     - CVE-2026-14390: Use after free in ANGLE. Reported by Google.
     - CVE-2026-13806: Insufficient validation of untrusted input in
       Accessibility. Reported by Google.
     - CVE-2026-13807: Use after free in Import. Reported by Google.
     - CVE-2026-13808: Insufficient data validation in Chrome for iOS.
       Reported by Google.
     - CVE-2026-13809: Side-channel information leakage in Safe Browsing.
       Reported by Google.
     - CVE-2026-13810: Inappropriate implementation in Input.
       Reported by dilipsc03@gmail.com.
     - CVE-2026-13811: Use after free in IME. Reported by Google.
     - CVE-2026-13812: Insufficient validation of untrusted input in
       Chrome for iOS. Reported by Google.
     - CVE-2026-13813: Insufficient validation of untrusted input in
       Chrome for iOS. Reported by Google.
     - CVE-2026-13814: Use after free in Views. Reported by Google.
     - CVE-2026-13815: Use after free in Blink. Reported by Google.
     - CVE-2026-13816: Insufficient validation of untrusted input in File
       Input. Reported by Google.
     - CVE-2026-14396: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-13817: Insufficient validation of untrusted input in Glic.
       Reported by Google.
     - CVE-2026-13818: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-13819: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-13820: Out of bounds read in Skia. Reported by Google.
     - CVE-2026-14400: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-14401: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-14402: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-13821: Use after free in Canvas. Reported by Google.
     - CVE-2026-13822: Inappropriate implementation in Extensions.
       Reported by Google.
     - CVE-2026-13823: Use after free in Glic. Reported by Google.
     - CVE-2026-13824: Insufficient validation of untrusted input in
       Extensions. Reported by Google.
     - CVE-2026-13825: Uninitialized Use in Dawn. Reported by Google.
     - CVE-2026-13826: Inappropriate implementation in Autofill.
       Reported by Google.
     - CVE-2026-13827: Use after free in Updater. Reported by Google.
     - CVE-2026-13828: Inappropriate implementation in Enterprise.
       Reported by Google.
     - CVE-2026-13829: Insufficient validation of untrusted input in Settings.
       Reported by Google.
     - CVE-2026-13830: Use after free in Chromoting. Reported by Google.
     - CVE-2026-13831: Use after free in GPU. Reported by Google.
     - CVE-2026-13832: Use after free in Headless. Reported by Google.
     - CVE-2026-14411: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-13833: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-14412: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-14413: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-13834: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-13835: Inappropriate implementation in XML. Reported by Google.
     - CVE-2026-13836: Inappropriate implementation in CSS. Reported by Google.
     - CVE-2026-13837: Inappropriate implementation in CSS. Reported by Google.
     - CVE-2026-13838: Inappropriate implementation in CSS. Reported by Google.
     - CVE-2026-13839: Inappropriate implementation in CSS. Reported by Google.
     - CVE-2026-13840: Insufficient policy enforcement in Canvas.
       Reported by Binglin Song.
     - CVE-2026-13841: Integer overflow in Skia. Reported by Google.
     - CVE-2026-13842: Incorrect security UI in Chrome for iOS.
       Reported by Azza Tegar Naufal Ataullah.
     - CVE-2026-14418: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-13843: Insufficient validation of untrusted input in Chrome
       for iOS. Reported by Google.
     - CVE-2026-13844: Use after free in Updater. Reported by Google.
     - CVE-2026-13845: Use after free in DOM. Reported by Google.
     - CVE-2026-13846: Use after free in USB. Reported by Google.
     - CVE-2026-13847: Insufficient validation of untrusted input in Chrome
       for iOS. Reported by Google.
     - CVE-2026-13848: Use after free in Forms. Reported by Google.
     - CVE-2026-13849: Insufficient validation of untrusted input in
       Chromoting. Reported by Google.
     - CVE-2026-14423: Type Confusion in Tint. Reported by Google.
     - CVE-2026-13850: Insufficient validation of untrusted input in Chrome
       for iOS. Reported by Google.
     - CVE-2026-14424: Use after free in Dawn. Reported by Google.
     - CVE-2026-14425: Use after free in ANGLE. Reported by Google.
     - CVE-2026-13851: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Google.
     - CVE-2026-14428: Insufficient validation of untrusted input in Dawn.
       Reported by Google.
     - CVE-2026-14429: Insufficient validation of untrusted input in Skia.
       Reported by Google.
     - CVE-2026-14430: Integer overflow in V8. Reported by Google.
     - CVE-2026-13852: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Google.
     - CVE-2026-13853: Use after free in Journeys. Reported by Google.
     - CVE-2026-13854: Use after free in Ozone. Reported by Google.
     - CVE-2026-14431: Type Confusion in V8.
       Reported by OpenAI Codex Security (amyb).
     - CVE-2026-13855: Use after free in Ozone. Reported by Google.
     - CVE-2026-13856: Insufficient validation of untrusted input in Speech.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-13857: Inappropriate implementation in Geometry.
       Reported by Luan Herrera (@lbherrera_).
     - CVE-2026-13858: Out of bounds read in FFmpeg. Reported by Wongi Lee
       (@_qwerty_po) of Theori with Xint Code, Jungwoo Lee (@physicube).
     - CVE-2026-13859: Inappropriate implementation in ANGLE.
       Reported by Jason Villaluna.
     - CVE-2026-14391: Integer overflow in ANGLE. Reported by Quac Tran.
     - CVE-2026-13860: Incorrect security UI in Autofill.
       Reported by Khalil Zhani.
     - CVE-2026-14408: Uninitialized Use in Dawn. Reported by Chrovus.
     - CVE-2026-14381: Incorrect security UI in WebAppInstalls.
       Reported by Hafiizh.
     - CVE-2026-14383: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-13861: Use after free in Core. Reported by Google.
     - CVE-2026-13862: Insufficient policy enforcement in Web Authentication
       (Passkeys & Security Keys). Reported by Google.
     - CVE-2026-13863: Insufficient validation of untrusted input in
       CustomTabs. Reported by Google.
     - CVE-2026-13864: Insufficient policy enforcement in WebHID.
       Reported by Google.
     - CVE-2026-13865: Insufficient validation of untrusted input in
       Enterprise. Reported by Google.
     - CVE-2026-13866: Insufficient validation of untrusted input in Input.
       Reported by Google.
     - CVE-2026-13867: Inappropriate implementation in Geolocation.
       Reported by Google.
     - CVE-2026-13868: Inappropriate implementation in Network.
       Reported by Google.
     - CVE-2026-14384: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-13869: Use after free in Device. Reported by Google.
     - CVE-2026-13870: Use after free in WebView. Reported by Google.
     - CVE-2026-13871: Insufficient data validation in GuestView.
       Reported by Google.
     - CVE-2026-13872: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Google.
     - CVE-2026-13873: Out of bounds memory access in Layout. Reported by
       Google.
     - CVE-2026-13874: Inappropriate implementation in DataTransfer.
       Reported by Google.
     - CVE-2026-13875: Insufficient validation of untrusted input in GPU.
       Reported by Google.
     - CVE-2026-13876: Inappropriate implementation in Network.
       Reported by Google.
     - CVE-2026-13877: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-13878: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-13879: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-13880: Use after free in USB. Reported by Google.
     - CVE-2026-13881: Insufficient data validation in WebAppInstalls.
       Reported by Google.
     - CVE-2026-13882: Inappropriate implementation in USB. Reported by Google
     - CVE-2026-13883: Type Confusion in ANGLE. Reported by Google.
     - CVE-2026-13884: Heap buffer overflow in Chromecast. Reported by Google.
     - CVE-2026-14387: Integer overflow in Skia. Reported by Google.
     - CVE-2026-13885: Use after free in Skia. Reported by Google.
     - CVE-2026-13886: Policy bypass in Isolated Web Apps. Reported by Google.
     - CVE-2026-14388: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-14389: Integer overflow in Skia. Reported by Google.
     - CVE-2026-13887: Insufficient policy enforcement in NFC.
       Reported by Google.
     - CVE-2026-13888: Use after free in Extensions. Reported by Google.
     - CVE-2026-13889: Insufficient validation of untrusted input in
       WebAuthentication. Reported by Google.
     - CVE-2026-13890: Out of bounds read in Chromecast. Reported by Google.
     - CVE-2026-13891: Insufficient validation of untrusted input in
       Extensions. Reported by Google.
     - CVE-2026-13892: Inappropriate implementation in Chrome for iOS.
       Reported by Google.
     - CVE-2026-13893: Insufficient validation of untrusted input in WebUI.
       Reported by Google.
     - CVE-2026-13894: Insufficient policy enforcement in Network.
       Reported by Google.
     - CVE-2026-13895: Inappropriate implementation in Autofill.
       Reported by Google.
     - CVE-2026-13896: Insufficient policy enforcement in Glic.
       Reported by Google.
     - CVE-2026-13897: Insufficient policy enforcement in Chromecast.
       Reported by Google.
     - CVE-2026-13898: Use after free in Cast Receiver. Reported by Google.
     - CVE-2026-13899: Use after free in HTML. Reported by Google.
     - CVE-2026-13900: Insufficient validation of untrusted input in
       Chromecast. Reported by Google.
     - CVE-2026-13901: Insufficient validation of untrusted input in Serial.
       Reported by Google.
     - CVE-2026-13902: Inappropriate implementation in Chrome for iOS.
       Reported by Google.
     - CVE-2026-13903: Insufficient policy enforcement in Bluetooth.
       Reported by Google.
     - CVE-2026-13904: Incorrect security UI in Safe Browsing.
       Reported by Google.
     - CVE-2026-13905: Incorrect security UI in Chrome for iOS.
       Reported by Google.
     - CVE-2026-13906: Out of bounds read in Codecs. Reported by Google.
     - CVE-2026-13907: Inappropriate implementation in iOSWeb.
       Reported by Google.
     - CVE-2026-13908: Insufficient validation of untrusted input in Omnibox.
       Reported by Google.
     - CVE-2026-13909: Insufficient policy enforcement in DevTools.
       Reported by Google.
     - CVE-2026-13910: Insufficient policy enforcement in WebXR.
       Reported by Google.
     - CVE-2026-13911: Insufficient data validation in Spellcheck.
       Reported by Google.
     - CVE-2026-13912: Incorrect security UI in Safe Browsing.
       Reported by Google.
     - CVE-2026-13913: Insufficient policy enforcement in Autofill.
       Reported by Google.
     - CVE-2026-13914: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-13915: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-13916: Inappropriate implementation in Chrome for iOS.
       Reported by Google.
     - CVE-2026-13917: Insufficient validation of untrusted input in Chrome
       for iOS. Reported by Google.
     - CVE-2026-13918: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-13919: Insufficient data validation in Extensions.
       Reported by Google.
     - CVE-2026-14393: Use after free in V8. Reported by Google.
     - CVE-2026-13920: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-13921: Insufficient validation of untrusted input in
       DeviceBoundSessionCredentials. Reported by Google.
     - CVE-2026-13922: Side-channel information leakage in Paint.
       Reported by Google.
     - CVE-2026-13923: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-14397: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-13924: Insufficient validation of untrusted input in WebView.
       Reported by Google.
     - CVE-2026-13925: Inappropriate implementation in Downloads.
       Reported by Google.
     - CVE-2026-13926: Insufficient validation of untrusted input in Network.
       Reported by Google.
     - CVE-2026-13927: Insufficient validation of untrusted input in UI.
       Reported by Google.
     - CVE-2026-13928: Insufficient validation of untrusted input in
       Enterprise. Reported by Google.
     - CVE-2026-13929: Insufficient validation of untrusted input in DevTools.
       Reported by LegioSec.
     - CVE-2026-13930: Insufficient policy enforcement in Actor.
       Reported by Google.
     - CVE-2026-13931: Inappropriate implementation in Media.
       Reported by Google.
     - CVE-2026-13932: Inappropriate implementation in Sharing.
       Reported by Google.
     - CVE-2026-13933: Insufficient policy enforcement in Passwords.
       Reported by Google.
     - CVE-2026-13934: Insufficient validation of untrusted input in Dawn.
       Reported by Google.
     - CVE-2026-14399: Uninitialized Use in Dawn. Reported by Google.
     - CVE-2026-13935: Side-channel information leakage in ComputePressure.
       Reported by Google.
     - CVE-2026-13936: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-13937: Insufficient policy enforcement in Passwords.
       Reported by Google.
     - CVE-2026-13938: Integer overflow in Fonts. Reported by Google.
     - CVE-2026-13939: Insufficient validation of untrusted input in WebShare.
       Reported by Google.
     - CVE-2026-13940: Uninitialized Use in Cast. Reported by Google.
     - CVE-2026-13941: Inappropriate implementation in SiteSettings.
       Reported by Google.
     - CVE-2026-13942: Insufficient validation of untrusted input in Video
       Capture. Reported by Google.
     - CVE-2026-13943: Uninitialized Use in CSS. Reported by Google.
     - CVE-2026-13944: Inappropriate implementation in DataTransfer.
       Reported by Google.
     - CVE-2026-13945: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-13946: Inappropriate implementation in ScriptInjections.
       Reported by Google.
     - CVE-2026-13947: Uninitialized Use in XR. Reported by Google.
     - CVE-2026-13948: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-13949: Insufficient policy enforcement in Payments.
       Reported by Google.
     - CVE-2026-14404: Inappropriate implementation in PDFium.
       Reported by Google.
     - CVE-2026-13950: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-13951: Policy bypass in USB. Reported by Google.
     - CVE-2026-13952: Inappropriate implementation in PerformanceAPIs.
       Reported by Google.
     - CVE-2026-14406: Out of bounds read in V8. Reported by Google.
     - CVE-2026-13953: Inappropriate implementation in SplitView.
       Reported by Google.
     - CVE-2026-13954: Insufficient policy enforcement in XML.
       Reported by Google.
     - CVE-2026-13955: Insufficient validation of untrusted input in
       CustomTabs. Reported by Google.
     - CVE-2026-13956: Incorrect security UI in PageInfo. Reported by Google.
     - CVE-2026-13957: Incorrect security UI in Extensions. Reported by Google
     - CVE-2026-13958: Uninitialized Use in Codecs. Reported by Google.
     - CVE-2026-14407: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-13959: Insufficient validation of untrusted input in Blink.
       Reported by Google.
     - CVE-2026-13960: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-13961: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-13962: Insufficient data validation in PDF. Reported by Google
     - CVE-2026-13963: Inappropriate implementation in DevTools.
       Reported by Google.
     - CVE-2026-13964: Insufficient policy enforcement in WebView.
       Reported by Google.
     - CVE-2026-13965: Use after free in Oilpan. Reported by Google.
     - CVE-2026-13966: Inappropriate implementation in History.
       Reported by Google.
     - CVE-2026-13967: Type Confusion in V8. Reported by Google.
     - CVE-2026-13968: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-13969: Uninitialized Use in UI. Reported by Google.
     - CVE-2026-13970: Uninitialized Use in Media. Reported by Google.
     - CVE-2026-13971: Uninitialized Use in Skia. Reported by Google.
     - CVE-2026-13972: Inappropriate implementation in Paint.
       Reported by Google.
     - CVE-2026-13973: Inappropriate implementation in UI. Reported by Google.
     - CVE-2026-13974: Integer overflow in Safe Browsing. Reported by Google.
     - CVE-2026-13975: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-13976: Heap buffer overflow in Storage. Reported by Google.
     - CVE-2026-13977: Inappropriate implementation in HTMLParser.
       Reported by Google.
     - CVE-2026-13978: Insufficient policy enforcement in PageInfo.
       Reported by Google.
     - CVE-2026-14414: Insufficient validation of untrusted input in Skia.
       Reported by Google.
     - CVE-2026-13979: Inappropriate implementation in Paint. Reported by
       Google.
     - CVE-2026-13980: Incorrect security UI in Chrome for iOS.
       Reported by Google.
     - CVE-2026-13981: Inappropriate implementation in Chrome for iOS.
       Reported by Google.
     - CVE-2026-13982: Incorrect security UI in Passwords. Reported by Google.
     - CVE-2026-13983: Incorrect security UI in Chrome for iOS.
       Reported by Google.
     - CVE-2026-13984: Incorrect security UI in TabStrip. Reported by Google.
     - CVE-2026-13985: Inappropriate implementation in MediaCapture.
       Reported by Google.
     - CVE-2026-13986: Inappropriate implementation in Media UI.
       Reported by Google.
     - CVE-2026-13987: Incorrect security UI in Mobile. Reported by Google.
     - CVE-2026-13988: Inappropriate implementation in Paint.
       Reported by Google.
     - CVE-2026-13989: Insufficient policy enforcement in PageInfo.
       Reported by Google.
     - CVE-2026-13990: Insufficient validation of untrusted input in
       DataTransfer. Reported by Google.
     - CVE-2026-13991: Insufficient validation of untrusted input in Chrome
       for iOS. Reported by Google.
     - CVE-2026-13992: Inappropriate implementation in UI. Reported by Google.
     - CVE-2026-13993: Incorrect security UI in WebAppInstalls.
       Reported by Google.
     - CVE-2026-13994: Inappropriate implementation in Credential Management.
       Reported by Google.
     - CVE-2026-13995: Insufficient validation of untrusted input in Autofill.
       Reported by Google.
     - CVE-2026-13996: Incorrect security UI in Permissions.
       Reported by Google.
     - CVE-2026-13997: Incorrect security UI in Extensions. Reported by Google
     - CVE-2026-13998: Incorrect security UI in File Input. Reported by Google
     - CVE-2026-13999: Inappropriate implementation in Extensions.
       Reported by Google.
     - CVE-2026-14000: Inappropriate implementation in XML. Reported by Google
     - CVE-2026-14001: Inappropriate implementation in Network.
       Reported by Google.
     - CVE-2026-14002: Inappropriate implementation in Geolocation.
       Reported by Google.
     - CVE-2026-14003: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-14004: Inappropriate implementation in CSS. Reported by Google
     - CVE-2026-14005: Use after free in Omnibox. Reported by Google.
     - CVE-2026-14006: Use after free in Navigation. Reported by Google.
     - CVE-2026-14007: Insufficient policy enforcement in PermissionsPolicy.
       Reported by Google.
     - CVE-2026-14008: Uninitialized Use in WebXR. Reported by Google.
     - CVE-2026-14009: Insufficient data validation in Passwords.
       Reported by Google.
     - CVE-2026-14010: Uninitialized Use in Codecs. Reported by Google.
     - CVE-2026-14011: Out of bounds read in SurfaceCapture.
       Reported by Google.
     - CVE-2026-14421: Uninitialized Use in Dawn. Reported by Google.
     - CVE-2026-14012: Side-channel information leakage in CSS.
       Reported by Google.
     - CVE-2026-14013: Inappropriate implementation in SVG. Reported by Google
     - CVE-2026-14014: Inappropriate implementation in Paint.
       Reported by Google.
     - CVE-2026-14015: Inappropriate implementation in WebRTC.
       Reported by Google.
     - CVE-2026-14016: Insufficient policy enforcement in SVG.
       Reported by Google.
     - CVE-2026-14017: Inappropriate implementation in Navigation.
       Reported by Google.
     - CVE-2026-14018: Use after free in Updater. Reported by Google.
     - CVE-2026-14019: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-14020: Insufficient validation of untrusted input in WebXR.
       Reported by Google.
     - CVE-2026-14021: Insufficient validation of untrusted input in
       StorageAccessAPI. Reported by Google.
     - CVE-2026-14022: Insufficient validation of untrusted input in Network.
       Reported by Google.
     - CVE-2026-14023: Insufficient validation of untrusted input in
       SanitizerAPI. Reported by Google.
     - CVE-2026-14024: Use after free in Ozone. Reported by Google.
     - CVE-2026-14432: Use after free in V8. Reported by Google.
     - CVE-2026-14025: Use after free in Views. Reported by asjidkalam.
     - CVE-2026-14026: Incorrect security UI in SplitView.
       Reported by adisahilna35@gmail.com.
     - CVE-2026-14027: Use after free in SignIn.
       Reported by Sven Dysthe (@svn-dys).
     - CVE-2026-14028: Incorrect security UI in Chrome for iOS.
       Reported by Ameen Basha M K.
     - CVE-2026-14030: Incorrect security UI in SplitView.
       Reported by Khalil Zhani.
     - CVE-2026-14031: Incorrect security UI in File Input. Reported by Google
     - CVE-2026-14032: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-14033: Insufficient policy enforcement in Media.
       Reported by Google.
     - CVE-2026-14034: Inappropriate implementation in WebXR.
       Reported by Google.
     - CVE-2026-14035: Insufficient policy enforcement in Bluetooth.
       Reported by Google.
     - CVE-2026-14036: Insufficient policy enforcement in Bluetooth.
       Reported by Google.
     - CVE-2026-14037: Insufficient policy enforcement in GPU.
       Reported by Google.
     - CVE-2026-14038: Insufficient validation of untrusted input in New
       Tab Page. Reported by Google.
     - CVE-2026-14039: Insufficient policy enforcement in GetUserMedia.
       Reported by Google.
     - CVE-2026-14040: Use after free in BrowserTag. Reported by Google.
     - CVE-2026-14041: Insufficient policy enforcement in Serial.
       Reported by Google.
     - CVE-2026-14042: Inappropriate implementation in Isolated Web Apps.
       Reported by Google.
     - CVE-2026-14043: Use after free in GetUserMedia. Reported by Google.
     - CVE-2026-14044: Use after free in ANGLE. Reported by Google.
     - CVE-2026-14045: Insufficient validation of untrusted input in Network.
       Reported by Google.
     - CVE-2026-14046: Inappropriate implementation in CustomTabs.
       Reported by Google.
     - CVE-2026-14047: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-14048: Use after free in Chromecast. Reported by Google.
     - CVE-2026-14049: Inappropriate implementation in GPU. Reported by Google
     - CVE-2026-14050: Insufficient policy enforcement in Passwords.
       Reported by Google.
     - CVE-2026-14051: Uninitialized Use in GamepadAPI. Reported by Google.
     - CVE-2026-14052: Insufficient policy enforcement in FileSystem.
       Reported by Google.
     - CVE-2026-14053: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-14054: Insufficient policy enforcement in Network.
       Reported by Google.
     - CVE-2026-14055: Insufficient validation of untrusted input in Device
       Trust. Reported by Google.
     - CVE-2026-14056: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-14057: Insufficient policy enforcement in FedCM.
       Reported by Google.
     - CVE-2026-14058: Policy bypass in Parser. Reported by Google.
     - CVE-2026-14059: Insufficient policy enforcement in
       Related-Website-Sets. Reported by Google.
     - CVE-2026-14060: Insufficient validation of untrusted input in
       Chromoting. Reported by Google.
     - CVE-2026-14061: Inappropriate implementation in Dawn.
       Reported by Google.
     - CVE-2026-14062: Inappropriate implementation in Views.
       Reported by Google.
     - CVE-2026-14063: Out of bounds memory access in Chromecast.
       Reported by Google.
     - CVE-2026-14064: Use after free in PageInfo. Reported by Google.
     - CVE-2026-14065: Insufficient validation of untrusted input in
       PageInfo. Reported by Google.
     - CVE-2026-14066: Insufficient validation of untrusted input in Chrome
       for iOS. Reported by Google.
     - CVE-2026-14067: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-14068: Inappropriate implementation in Omnibox.
       Reported by Google.
     - CVE-2026-14069: Integer overflow in WebNN. Reported by Google.
     - CVE-2026-14070: Uninitialized Use in WebNN. Reported by Google.
     - CVE-2026-14071: Side-channel information leakage in WebAudio.
       Reported by Google.
     - CVE-2026-14072: Incorrect security UI in SplitView.
       Reported by FARISSAL B.
     - CVE-2026-14073: Insufficient policy enforcement in WebXR.
       Reported by Google.
     - CVE-2026-14394: Use after free in V8. Reported by Google.
     - CVE-2026-14395: Out of bounds write in V8. Reported by Google.
     - CVE-2026-14074: Side-channel information leakage in WebAuthentication.
       Reported by Google.
     - CVE-2026-14075: Policy bypass in Chrome for iOS. Reported by Google.
     - CVE-2026-14076: Policy bypass in Network. Reported by Google.
     - CVE-2026-14077: Incorrect security UI in Select. Reported by pwn.ai.
     - CVE-2026-14078: Policy bypass in WebRTC. Reported by Google.
     - CVE-2026-14079: Policy bypass in Network. Reported by Google.
     - CVE-2026-14080: Insufficient validation of untrusted input in
       TabSwitcher. Reported by Google.
     - CVE-2026-14081: Insufficient policy enforcement in DevTools.
       Reported by Google.
     - CVE-2026-14082: Race in Storage. Reported by Google.
     - CVE-2026-14083: Insufficient validation of untrusted input in HTML.
       Reported by Google.
     - CVE-2026-14084: Insufficient validation of untrusted input in
       Chromoting. Reported by Google.
     - CVE-2026-14085: Side-channel information leakage in CSS.
       Reported by Google.
     - CVE-2026-14086: Insufficient policy enforcement in HID.
       Reported by Google.
     - CVE-2026-14087: Insufficient validation of untrusted input in WebNN.
       Reported by Google.
     - CVE-2026-14088: Uninitialized Use in Canvas. Reported by Google.
     - CVE-2026-14089: Insufficient validation of untrusted input in
       PopupBlocker. Reported by Google.
     - CVE-2026-14090: Out of bounds read in CameraCapture. Reported by Google
     - CVE-2026-14091: Use after free in DevTools. Reported by Google.
     - CVE-2026-14092: Insufficient policy enforcement in Privacy.
       Reported by Google.
     - CVE-2026-14093: Use after free in Cast. Reported by Google.
     - CVE-2026-14094: Use after free in Installer. Reported by Google.
     - CVE-2026-14095: Insufficient validation of untrusted input in Browser.
       Reported by Google.
     - CVE-2026-14403: Use after free in V8. Reported by Google.
     - CVE-2026-14096: Object lifecycle issue in Input. Reported by Google.
     - CVE-2026-14097: Inappropriate implementation in WebAppInstalls.
       Reported by Google.
     - CVE-2026-14098: Inappropriate implementation in CSS. Reported by Google
     - CVE-2026-14405: Uninitialized Use in V8. Reported by Google.
     - CVE-2026-14099: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-14100: Insufficient data validation in NetworkCache.
       Reported by Google.
     - CVE-2026-14101: Insufficient policy enforcement in Sandbox.
       Reported by Google.
     - CVE-2026-14102: Use after free in Passwords. Reported by Google.
     - CVE-2026-14103: Use after free in SSL. Reported by Google.
     - CVE-2026-14104: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Google.
     - CVE-2026-14105: Insufficient policy enforcement in Speech.
       Reported by Google.
     - CVE-2026-14106: Insufficient validation of untrusted input in Text.
       Reported by Google.
     - CVE-2026-14107: Use after free in Scheduling. Reported by Google.
     - CVE-2026-14108: Use after free in PDFium. Reported by Google.
     - CVE-2026-14109: Insufficient policy enforcement in Mojo.
       Reported by Google.
     - CVE-2026-14110: Inappropriate implementation in DarkMode.
       Reported by Google.
     - CVE-2026-14111: Use after free in WebProtect. Reported by Google.
     - CVE-2026-14112: Inappropriate implementation in Enterprise.
       Reported by Google.
     - CVE-2026-14113: Use after free in Updater. Reported by Google.
     - CVE-2026-14114: Inappropriate implementation in WebAppInstalls.
       Reported by Google.
     - CVE-2026-14115: Insufficient validation of untrusted input in Cast.
       Reported by Google.
     - CVE-2026-14116: Insufficient validation of untrusted input in
       DevTools. Reported by Google.
     - CVE-2026-14117: Insufficient validation of untrusted input in
       DevTools. Reported by Google.
     - CVE-2026-14118: Insufficient data validation in DevTools.
       Reported by Google.
     - CVE-2026-14119: Type Confusion in Bluetooth. Reported by Google.
     - CVE-2026-14120: Inappropriate implementation in DevTools.
       Reported by Google.
     - CVE-2026-14121: Use after free in Chromoting. Reported by Google.
     - CVE-2026-14409: Inappropriate implementation in V8.
       Reported by Yuntao You (@GraVity0) of Bytedance Wuheng Lab.
     - CVE-2026-14122: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Google.
     - CVE-2026-14410: Inappropriate implementation in Skia.
       Reported by Google.
     - CVE-2026-14123: Incorrect security UI in Chrome for iOS.
       Reported by Google.
     - CVE-2026-14124: Inappropriate implementation in CredentialProvider.
       Reported by Google.
     - CVE-2026-14125: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-14126: Incorrect security UI in UI. Reported by Google.
     - CVE-2026-14127: Inappropriate implementation in Printing.
       Reported by Google.
     - CVE-2026-14128: Insufficient data validation in Chrome for iOS.
       Reported by Google.
     - CVE-2026-14129: Incorrect security UI in PreviewTab. Reported by Google
     - CVE-2026-14130: Incorrect security UI in Omnibox. Reported by Google.
     - CVE-2026-14131: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Google.
     - CVE-2026-14132: Inappropriate implementation in WebXR.
       Reported by Google.
     - CVE-2026-14133: Race in History Embeddings. Reported by Google.
     - CVE-2026-14134: Inappropriate implementation in Autofill.
       Reported by Google.
     - CVE-2026-14135: Insufficient validation of untrusted input in Network.
       Reported by Google.
     - CVE-2026-14136: Incorrect security UI in Chrome for iOS.
       Reported by Google.
     - CVE-2026-14137: Insufficient validation of untrusted input in Chrome
       for iOS. Reported by Google.
     - CVE-2026-14138: Inappropriate implementation in WebAppInstalls.
       Reported by Google.
     - CVE-2026-14139: Inappropriate implementation in TabStrip.
       Reported by Google.
     - CVE-2026-14140: Insufficient validation of untrusted input in Input.
       Reported by Google.
     - CVE-2026-14141: Incorrect security UI in Document Picture-in-Picture.
       Reported by Google.
     - CVE-2026-14142: Inappropriate implementation in Extensions.
       Reported by Google.
     - CVE-2026-14143: Incorrect security UI in Passwords. Reported by Google.
     - CVE-2026-14144: Incorrect security UI in Views. Reported by Google.
     - CVE-2026-14145: Inappropriate implementation in CSS. Reported by Google
     - CVE-2026-14146: Inappropriate implementation in CSS. Reported by Google
     - CVE-2026-14147: Inappropriate implementation in CSS. Reported by Google
     - CVE-2026-14415: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-14148: Type Confusion in CSS. Reported by Google.
     - CVE-2026-14149: Use after free in Audio. Reported by Google.
     - CVE-2026-14416: Out of bounds read in Dawn. Reported by Google.
     - CVE-2026-14150: Insufficient validation of untrusted input in Speech.
       Reported by Google.
     - CVE-2026-14151: Inappropriate implementation in AI. Reported by Google.
     - CVE-2026-14152: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-14153: Inappropriate implementation in Glic.
       Reported by Google.
     - CVE-2026-14154: Inappropriate implementation in DevTools.
       Reported by Google.
     - CVE-2026-14155: Insufficient policy enforcement in StorageAccessAPI.
       Reported by Google.
     - CVE-2026-14156: Policy bypass in StorageAccessAPI. Reported by Google.
     - CVE-2026-13281: Integer overflow in Mojo. Reported by Google.
     - CVE-2026-13282: Use after free in Payments. Reported by Google.
     - CVE-2026-13283: Use after free in AdFilter. Reported by Google.
   * d/copyright:
     - delete third_party/webpagereplay/.
     - delete tsgo (typescript compiler in Go) binary.
   * d/patches:
     - upstream/0001-Fix-build-for-CPU-yield-on-LoongArch.patch: drop, merged
       upstream.
     - disable/android.patch: drop, merged upstream.
     - debianization/clang-version.patch: refresh.
     - fixes/libcpp-headers.patch: rework parts of the patch due to
       upstream changes.
     - disable/catapult.patch: refresh.
     - disable/tests.patch: refresh.
     - llvm-19/clang19.patch: refresh.
     - trixie/gn-expand-dir-allowlist.patch: refresh.
     - ungoogled/disable-ai.patch: sync from u-c.
     - ungoogled/remove-navigation-source-param.patch: sync from u-c.
     - i386/support-i386.patch: refresh.
     - upstream/sysroot.patch: add a new build fix pulled from upstream.
     - upstream/ar-path1.patch, upstream/ar-path2.patch: add two more
       vendoring-related build fixes from upstream.
     - trixie/gn-additional-outputs.patch: add patch to partially revert usage
       of a newer generate-ninja feature.
     - llvm-19/i18n-builder-enum.patch: add a workaround for clang-19 being
       confused between a class declaration (with default template parameter)
       and definition.
     - llvm-19/00*-revert-v8-libm.patch: add 9 patches backing out usage of
       internal libc++/libm symbols; this requires a newer llvm than we have.
     - llvm-19/value-or.patch: work around more places where value_or() can't
       figure out the type of a passed init value.
     - trixie/node20-compat.patch: break out part of Daniel's
       node18-compat.patch (below) into one for trixie that also fixes nodejs
       20 issues [trixie, bookworm].
     - rust-1.85/std-from-utf8.patch: add workaround for str::from_utf8 added
       in 1.87 [trixie, bookworm].
     - trixie/bindgen-boringssl.patch: add workaround for older bindgen
       [trixie, bookworm].
 .
   [ Daniel Richard G. ]
   * d/patches:
     - bookworm/gn-absl.patch: Refresh [bookworm].
     - bookworm/gn-funcs.patch: Zap new usage of filter_labels_include()
       [bookworm].
     - bookworm/node18-compat.patch: Fix more cases of nodejs v18 breakage
       [bookworm].
     - trixie/gn-module-name.patch: add more spots where the workaround is
       needed [trixie, bookworm].
 .
   [ Jianfeng Liu ]
   * d/patches:
     - upstream/libyuv-loongarch-fix-row_lsx.cc-and-row_lasx.cc.patch: Fix
       build for libyuv loongarch64.
     - loongarch64/0015-ffmpeg-support-for-loongarch.patch: Refresh.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0002-regenerate-xnn-buildgn.patch: refresh for upstream
       changes
     - fixes/fix-rust-linking.patch: refresh for upstream changes
     - fixes/fix-breakpad-compile.patch: refresh for upstream changes
     - third_party/dawn-fix-ppc64le-detection.patch: refresh for upstream
       changes
     - 0001-Add-pregenerated-config-for-libaom-on-ppc64.patch: refresh for
       upstream changes
chromium (150.0.7871.46-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream stable release.
     - CVE-2026-13774: Use after free in Extensions. Reported by Google.
     - CVE-2026-13775: Use after free in GPU. Reported by Google.
     - CVE-2026-14398: Use after free in ANGLE. Reported by Google.
     - CVE-2026-13776: Type Confusion in Dawn. Reported by Google.
     - CVE-2026-13777: Insufficient validation of untrusted input in iOSWeb.
       Reported by Google.
     - CVE-2026-13778: Use after free in WebUSB. Reported by Google.
     - CVE-2026-13779: Use after free in Chromoting. Reported by Google.
     - CVE-2026-13780: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-13781: Insufficient validation of untrusted input in Skia.
       Reported by Google.
     - CVE-2026-14417: Use after free in Dawn. Reported by Google.
     - CVE-2026-13782: Use after free in Browser. Reported by Google.
     - CVE-2026-13783: Use after free in Views. Reported by Google.
     - CVE-2026-13784: Use after free in Views. Reported by Google.
     - CVE-2026-14419: Use after free in Skia. Reported by Google.
     - CVE-2026-13785: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-14420: Out of bounds read and write in Dawn.
       Reported by Google.
     - CVE-2026-13786: Use after free in Ozone. Reported by Google.
     - CVE-2026-14427: Heap buffer overflow in Skia. Reported by Google.
     - CVE-2026-13787: Use after free in Chromoting. Reported by Google.
     - CVE-2026-13788: Use after free in Fullscreen. Reported by Google.
     - CVE-2026-14382: Insufficient validation of untrusted input in ANGLE.
       Reported by anonymous.
     - CVE-2026-13790: Side-channel information leakage in Scroll.
       Reported by Vsevolod Kokorin (Slonser) of Solidlab and Jorian Woltjer.
     - CVE-2026-14385: Heap buffer overflow in ANGLE.
       Reported by Thomas Guillem <thomas@gllm.fr>.
     - CVE-2026-13791: Insufficient validation of untrusted input in
       Downloads. Reported by Ron Masas (Imperva).
     - CVE-2026-13792: Use after free in Touchbar.
       Reported by Weipeng Jiang (@Krace) of VRI.
     - CVE-2026-13793: Insufficient policy enforcement in SVG.
       Reported by pakhunov.anton.n@gmail.com.
     - CVE-2026-14392: Out of bounds write in Tint.
       Reported by FastPL Group, Imperial College London.
     - CVE-2026-13794: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Daniel Rodríguez.
     - CVE-2026-14422: Out of bounds read and write in Tint.
       Reported by Michal Andryskowski.
     - CVE-2026-13795: Insufficient policy enforcement in Chrome for iOS.
       Reported by maitai.
     - CVE-2026-14426: Use after free in V8. Reported by ywatanabee.
     - CVE-2026-13796: Integer overflow in Chromecast. Reported by Google.
     - CVE-2026-13797: Insufficient validation of untrusted input in
       Chromecast. Reported by Google.
     - CVE-2026-14386: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-13798: Heap buffer overflow in Chromecast. Reported by Google.
     - CVE-2026-13799: Use after free in QUIC. Reported by Google.
     - CVE-2026-13800: Inappropriate implementation in Updater.
       Reported by Google.
     - CVE-2026-13801: Integer overflow in Chromecast. Reported by Google.
     - CVE-2026-13802: Use after free in Views. Reported by Google.
     - CVE-2026-13803: Type Confusion in Chrome Tabs. Reported by Google.
     - CVE-2026-13804: Use after free in Chromecast. Reported by Google.
     - CVE-2026-13805: Use after free in GFX. Reported by Google.
     - CVE-2026-14390: Use after free in ANGLE. Reported by Google.
     - CVE-2026-13806: Insufficient validation of untrusted input in
       Accessibility. Reported by Google.
     - CVE-2026-13807: Use after free in Import. Reported by Google.
     - CVE-2026-13808: Insufficient data validation in Chrome for iOS.
       Reported by Google.
     - CVE-2026-13809: Side-channel information leakage in Safe Browsing.
       Reported by Google.
     - CVE-2026-13810: Inappropriate implementation in Input.
       Reported by dilipsc03@gmail.com.
     - CVE-2026-13811: Use after free in IME. Reported by Google.
     - CVE-2026-13812: Insufficient validation of untrusted input in
       Chrome for iOS. Reported by Google.
     - CVE-2026-13813: Insufficient validation of untrusted input in
       Chrome for iOS. Reported by Google.
     - CVE-2026-13814: Use after free in Views. Reported by Google.
     - CVE-2026-13815: Use after free in Blink. Reported by Google.
     - CVE-2026-13816: Insufficient validation of untrusted input in File
       Input. Reported by Google.
     - CVE-2026-14396: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-13817: Insufficient validation of untrusted input in Glic.
       Reported by Google.
     - CVE-2026-13818: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-13819: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-13820: Out of bounds read in Skia. Reported by Google.
     - CVE-2026-14400: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-14401: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-14402: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-13821: Use after free in Canvas. Reported by Google.
     - CVE-2026-13822: Inappropriate implementation in Extensions.
       Reported by Google.
     - CVE-2026-13823: Use after free in Glic. Reported by Google.
     - CVE-2026-13824: Insufficient validation of untrusted input in
       Extensions. Reported by Google.
     - CVE-2026-13825: Uninitialized Use in Dawn. Reported by Google.
     - CVE-2026-13826: Inappropriate implementation in Autofill.
       Reported by Google.
     - CVE-2026-13827: Use after free in Updater. Reported by Google.
     - CVE-2026-13828: Inappropriate implementation in Enterprise.
       Reported by Google.
     - CVE-2026-13829: Insufficient validation of untrusted input in Settings.
       Reported by Google.
     - CVE-2026-13830: Use after free in Chromoting. Reported by Google.
     - CVE-2026-13831: Use after free in GPU. Reported by Google.
     - CVE-2026-13832: Use after free in Headless. Reported by Google.
     - CVE-2026-14411: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-13833: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-14412: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-14413: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-13834: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-13835: Inappropriate implementation in XML. Reported by Google.
     - CVE-2026-13836: Inappropriate implementation in CSS. Reported by Google.
     - CVE-2026-13837: Inappropriate implementation in CSS. Reported by Google.
     - CVE-2026-13838: Inappropriate implementation in CSS. Reported by Google.
     - CVE-2026-13839: Inappropriate implementation in CSS. Reported by Google.
     - CVE-2026-13840: Insufficient policy enforcement in Canvas.
       Reported by Binglin Song.
     - CVE-2026-13841: Integer overflow in Skia. Reported by Google.
     - CVE-2026-13842: Incorrect security UI in Chrome for iOS.
       Reported by Azza Tegar Naufal Ataullah.
     - CVE-2026-14418: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-13843: Insufficient validation of untrusted input in Chrome
       for iOS. Reported by Google.
     - CVE-2026-13844: Use after free in Updater. Reported by Google.
     - CVE-2026-13845: Use after free in DOM. Reported by Google.
     - CVE-2026-13846: Use after free in USB. Reported by Google.
     - CVE-2026-13847: Insufficient validation of untrusted input in Chrome
       for iOS. Reported by Google.
     - CVE-2026-13848: Use after free in Forms. Reported by Google.
     - CVE-2026-13849: Insufficient validation of untrusted input in
       Chromoting. Reported by Google.
     - CVE-2026-14423: Type Confusion in Tint. Reported by Google.
     - CVE-2026-13850: Insufficient validation of untrusted input in Chrome
       for iOS. Reported by Google.
     - CVE-2026-14424: Use after free in Dawn. Reported by Google.
     - CVE-2026-14425: Use after free in ANGLE. Reported by Google.
     - CVE-2026-13851: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Google.
     - CVE-2026-14428: Insufficient validation of untrusted input in Dawn.
       Reported by Google.
     - CVE-2026-14429: Insufficient validation of untrusted input in Skia.
       Reported by Google.
     - CVE-2026-14430: Integer overflow in V8. Reported by Google.
     - CVE-2026-13852: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Google.
     - CVE-2026-13853: Use after free in Journeys. Reported by Google.
     - CVE-2026-13854: Use after free in Ozone. Reported by Google.
     - CVE-2026-14431: Type Confusion in V8.
       Reported by OpenAI Codex Security (amyb).
     - CVE-2026-13855: Use after free in Ozone. Reported by Google.
     - CVE-2026-13856: Insufficient validation of untrusted input in Speech.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-13857: Inappropriate implementation in Geometry.
       Reported by Luan Herrera (@lbherrera_).
     - CVE-2026-13858: Out of bounds read in FFmpeg. Reported by Wongi Lee
       (@_qwerty_po) of Theori with Xint Code, Jungwoo Lee (@physicube).
     - CVE-2026-13859: Inappropriate implementation in ANGLE.
       Reported by Jason Villaluna.
     - CVE-2026-14391: Integer overflow in ANGLE. Reported by Quac Tran.
     - CVE-2026-13860: Incorrect security UI in Autofill.
       Reported by Khalil Zhani.
     - CVE-2026-14408: Uninitialized Use in Dawn. Reported by Chrovus.
     - CVE-2026-14381: Incorrect security UI in WebAppInstalls.
       Reported by Hafiizh.
     - CVE-2026-14383: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-13861: Use after free in Core. Reported by Google.
     - CVE-2026-13862: Insufficient policy enforcement in Web Authentication
       (Passkeys & Security Keys). Reported by Google.
     - CVE-2026-13863: Insufficient validation of untrusted input in
       CustomTabs. Reported by Google.
     - CVE-2026-13864: Insufficient policy enforcement in WebHID.
       Reported by Google.
     - CVE-2026-13865: Insufficient validation of untrusted input in
       Enterprise. Reported by Google.
     - CVE-2026-13866: Insufficient validation of untrusted input in Input.
       Reported by Google.
     - CVE-2026-13867: Inappropriate implementation in Geolocation.
       Reported by Google.
     - CVE-2026-13868: Inappropriate implementation in Network.
       Reported by Google.
     - CVE-2026-14384: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-13869: Use after free in Device. Reported by Google.
     - CVE-2026-13870: Use after free in WebView. Reported by Google.
     - CVE-2026-13871: Insufficient data validation in GuestView.
       Reported by Google.
     - CVE-2026-13872: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Google.
     - CVE-2026-13873: Out of bounds memory access in Layout. Reported by
       Google.
     - CVE-2026-13874: Inappropriate implementation in DataTransfer.
       Reported by Google.
     - CVE-2026-13875: Insufficient validation of untrusted input in GPU.
       Reported by Google.
     - CVE-2026-13876: Inappropriate implementation in Network.
       Reported by Google.
     - CVE-2026-13877: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-13878: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-13879: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-13880: Use after free in USB. Reported by Google.
     - CVE-2026-13881: Insufficient data validation in WebAppInstalls.
       Reported by Google.
     - CVE-2026-13882: Inappropriate implementation in USB. Reported by Google
     - CVE-2026-13883: Type Confusion in ANGLE. Reported by Google.
     - CVE-2026-13884: Heap buffer overflow in Chromecast. Reported by Google.
     - CVE-2026-14387: Integer overflow in Skia. Reported by Google.
     - CVE-2026-13885: Use after free in Skia. Reported by Google.
     - CVE-2026-13886: Policy bypass in Isolated Web Apps. Reported by Google.
     - CVE-2026-14388: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-14389: Integer overflow in Skia. Reported by Google.
     - CVE-2026-13887: Insufficient policy enforcement in NFC.
       Reported by Google.
     - CVE-2026-13888: Use after free in Extensions. Reported by Google.
     - CVE-2026-13889: Insufficient validation of untrusted input in
       WebAuthentication. Reported by Google.
     - CVE-2026-13890: Out of bounds read in Chromecast. Reported by Google.
     - CVE-2026-13891: Insufficient validation of untrusted input in
       Extensions. Reported by Google.
     - CVE-2026-13892: Inappropriate implementation in Chrome for iOS.
       Reported by Google.
     - CVE-2026-13893: Insufficient validation of untrusted input in WebUI.
       Reported by Google.
     - CVE-2026-13894: Insufficient policy enforcement in Network.
       Reported by Google.
     - CVE-2026-13895: Inappropriate implementation in Autofill.
       Reported by Google.
     - CVE-2026-13896: Insufficient policy enforcement in Glic.
       Reported by Google.
     - CVE-2026-13897: Insufficient policy enforcement in Chromecast.
       Reported by Google.
     - CVE-2026-13898: Use after free in Cast Receiver. Reported by Google.
     - CVE-2026-13899: Use after free in HTML. Reported by Google.
     - CVE-2026-13900: Insufficient validation of untrusted input in
       Chromecast. Reported by Google.
     - CVE-2026-13901: Insufficient validation of untrusted input in Serial.
       Reported by Google.
     - CVE-2026-13902: Inappropriate implementation in Chrome for iOS.
       Reported by Google.
     - CVE-2026-13903: Insufficient policy enforcement in Bluetooth.
       Reported by Google.
     - CVE-2026-13904: Incorrect security UI in Safe Browsing.
       Reported by Google.
     - CVE-2026-13905: Incorrect security UI in Chrome for iOS.
       Reported by Google.
     - CVE-2026-13906: Out of bounds read in Codecs. Reported by Google.
     - CVE-2026-13907: Inappropriate implementation in iOSWeb.
       Reported by Google.
     - CVE-2026-13908: Insufficient validation of untrusted input in Omnibox.
       Reported by Google.
     - CVE-2026-13909: Insufficient policy enforcement in DevTools.
       Reported by Google.
     - CVE-2026-13910: Insufficient policy enforcement in WebXR.
       Reported by Google.
     - CVE-2026-13911: Insufficient data validation in Spellcheck.
       Reported by Google.
     - CVE-2026-13912: Incorrect security UI in Safe Browsing.
       Reported by Google.
     - CVE-2026-13913: Insufficient policy enforcement in Autofill.
       Reported by Google.
     - CVE-2026-13914: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-13915: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-13916: Inappropriate implementation in Chrome for iOS.
       Reported by Google.
     - CVE-2026-13917: Insufficient validation of untrusted input in Chrome
       for iOS. Reported by Google.
     - CVE-2026-13918: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-13919: Insufficient data validation in Extensions.
       Reported by Google.
     - CVE-2026-14393: Use after free in V8. Reported by Google.
     - CVE-2026-13920: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-13921: Insufficient validation of untrusted input in
       DeviceBoundSessionCredentials. Reported by Google.
     - CVE-2026-13922: Side-channel information leakage in Paint.
       Reported by Google.
     - CVE-2026-13923: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-14397: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-13924: Insufficient validation of untrusted input in WebView.
       Reported by Google.
     - CVE-2026-13925: Inappropriate implementation in Downloads.
       Reported by Google.
     - CVE-2026-13926: Insufficient validation of untrusted input in Network.
       Reported by Google.
     - CVE-2026-13927: Insufficient validation of untrusted input in UI.
       Reported by Google.
     - CVE-2026-13928: Insufficient validation of untrusted input in
       Enterprise. Reported by Google.
     - CVE-2026-13929: Insufficient validation of untrusted input in DevTools.
       Reported by LegioSec.
     - CVE-2026-13930: Insufficient policy enforcement in Actor.
       Reported by Google.
     - CVE-2026-13931: Inappropriate implementation in Media.
       Reported by Google.
     - CVE-2026-13932: Inappropriate implementation in Sharing.
       Reported by Google.
     - CVE-2026-13933: Insufficient policy enforcement in Passwords.
       Reported by Google.
     - CVE-2026-13934: Insufficient validation of untrusted input in Dawn.
       Reported by Google.
     - CVE-2026-14399: Uninitialized Use in Dawn. Reported by Google.
     - CVE-2026-13935: Side-channel information leakage in ComputePressure.
       Reported by Google.
     - CVE-2026-13936: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-13937: Insufficient policy enforcement in Passwords.
       Reported by Google.
     - CVE-2026-13938: Integer overflow in Fonts. Reported by Google.
     - CVE-2026-13939: Insufficient validation of untrusted input in WebShare.
       Reported by Google.
     - CVE-2026-13940: Uninitialized Use in Cast. Reported by Google.
     - CVE-2026-13941: Inappropriate implementation in SiteSettings.
       Reported by Google.
     - CVE-2026-13942: Insufficient validation of untrusted input in Video
       Capture. Reported by Google.
     - CVE-2026-13943: Uninitialized Use in CSS. Reported by Google.
     - CVE-2026-13944: Inappropriate implementation in DataTransfer.
       Reported by Google.
     - CVE-2026-13945: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-13946: Inappropriate implementation in ScriptInjections.
       Reported by Google.
     - CVE-2026-13947: Uninitialized Use in XR. Reported by Google.
     - CVE-2026-13948: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-13949: Insufficient policy enforcement in Payments.
       Reported by Google.
     - CVE-2026-14404: Inappropriate implementation in PDFium.
       Reported by Google.
     - CVE-2026-13950: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-13951: Policy bypass in USB. Reported by Google.
     - CVE-2026-13952: Inappropriate implementation in PerformanceAPIs.
       Reported by Google.
     - CVE-2026-14406: Out of bounds read in V8. Reported by Google.
     - CVE-2026-13953: Inappropriate implementation in SplitView.
       Reported by Google.
     - CVE-2026-13954: Insufficient policy enforcement in XML.
       Reported by Google.
     - CVE-2026-13955: Insufficient validation of untrusted input in
       CustomTabs. Reported by Google.
     - CVE-2026-13956: Incorrect security UI in PageInfo. Reported by Google.
     - CVE-2026-13957: Incorrect security UI in Extensions. Reported by Google
     - CVE-2026-13958: Uninitialized Use in Codecs. Reported by Google.
     - CVE-2026-14407: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-13959: Insufficient validation of untrusted input in Blink.
       Reported by Google.
     - CVE-2026-13960: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-13961: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-13962: Insufficient data validation in PDF. Reported by Google
     - CVE-2026-13963: Inappropriate implementation in DevTools.
       Reported by Google.
     - CVE-2026-13964: Insufficient policy enforcement in WebView.
       Reported by Google.
     - CVE-2026-13965: Use after free in Oilpan. Reported by Google.
     - CVE-2026-13966: Inappropriate implementation in History.
       Reported by Google.
     - CVE-2026-13967: Type Confusion in V8. Reported by Google.
     - CVE-2026-13968: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-13969: Uninitialized Use in UI. Reported by Google.
     - CVE-2026-13970: Uninitialized Use in Media. Reported by Google.
     - CVE-2026-13971: Uninitialized Use in Skia. Reported by Google.
     - CVE-2026-13972: Inappropriate implementation in Paint.
       Reported by Google.
     - CVE-2026-13973: Inappropriate implementation in UI. Reported by Google.
     - CVE-2026-13974: Integer overflow in Safe Browsing. Reported by Google.
     - CVE-2026-13975: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-13976: Heap buffer overflow in Storage. Reported by Google.
     - CVE-2026-13977: Inappropriate implementation in HTMLParser.
       Reported by Google.
     - CVE-2026-13978: Insufficient policy enforcement in PageInfo.
       Reported by Google.
     - CVE-2026-14414: Insufficient validation of untrusted input in Skia.
       Reported by Google.
     - CVE-2026-13979: Inappropriate implementation in Paint. Reported by
       Google.
     - CVE-2026-13980: Incorrect security UI in Chrome for iOS.
       Reported by Google.
     - CVE-2026-13981: Inappropriate implementation in Chrome for iOS.
       Reported by Google.
     - CVE-2026-13982: Incorrect security UI in Passwords. Reported by Google.
     - CVE-2026-13983: Incorrect security UI in Chrome for iOS.
       Reported by Google.
     - CVE-2026-13984: Incorrect security UI in TabStrip. Reported by Google.
     - CVE-2026-13985: Inappropriate implementation in MediaCapture.
       Reported by Google.
     - CVE-2026-13986: Inappropriate implementation in Media UI.
       Reported by Google.
     - CVE-2026-13987: Incorrect security UI in Mobile. Reported by Google.
     - CVE-2026-13988: Inappropriate implementation in Paint.
       Reported by Google.
     - CVE-2026-13989: Insufficient policy enforcement in PageInfo.
       Reported by Google.
     - CVE-2026-13990: Insufficient validation of untrusted input in
       DataTransfer. Reported by Google.
     - CVE-2026-13991: Insufficient validation of untrusted input in Chrome
       for iOS. Reported by Google.
     - CVE-2026-13992: Inappropriate implementation in UI. Reported by Google.
     - CVE-2026-13993: Incorrect security UI in WebAppInstalls.
       Reported by Google.
     - CVE-2026-13994: Inappropriate implementation in Credential Management.
       Reported by Google.
     - CVE-2026-13995: Insufficient validation of untrusted input in Autofill.
       Reported by Google.
     - CVE-2026-13996: Incorrect security UI in Permissions.
       Reported by Google.
     - CVE-2026-13997: Incorrect security UI in Extensions. Reported by Google
     - CVE-2026-13998: Incorrect security UI in File Input. Reported by Google
     - CVE-2026-13999: Inappropriate implementation in Extensions.
       Reported by Google.
     - CVE-2026-14000: Inappropriate implementation in XML. Reported by Google
     - CVE-2026-14001: Inappropriate implementation in Network.
       Reported by Google.
     - CVE-2026-14002: Inappropriate implementation in Geolocation.
       Reported by Google.
     - CVE-2026-14003: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-14004: Inappropriate implementation in CSS. Reported by Google
     - CVE-2026-14005: Use after free in Omnibox. Reported by Google.
     - CVE-2026-14006: Use after free in Navigation. Reported by Google.
     - CVE-2026-14007: Insufficient policy enforcement in PermissionsPolicy.
       Reported by Google.
     - CVE-2026-14008: Uninitialized Use in WebXR. Reported by Google.
     - CVE-2026-14009: Insufficient data validation in Passwords.
       Reported by Google.
     - CVE-2026-14010: Uninitialized Use in Codecs. Reported by Google.
     - CVE-2026-14011: Out of bounds read in SurfaceCapture.
       Reported by Google.
     - CVE-2026-14421: Uninitialized Use in Dawn. Reported by Google.
     - CVE-2026-14012: Side-channel information leakage in CSS.
       Reported by Google.
     - CVE-2026-14013: Inappropriate implementation in SVG. Reported by Google
     - CVE-2026-14014: Inappropriate implementation in Paint.
       Reported by Google.
     - CVE-2026-14015: Inappropriate implementation in WebRTC.
       Reported by Google.
     - CVE-2026-14016: Insufficient policy enforcement in SVG.
       Reported by Google.
     - CVE-2026-14017: Inappropriate implementation in Navigation.
       Reported by Google.
     - CVE-2026-14018: Use after free in Updater. Reported by Google.
     - CVE-2026-14019: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-14020: Insufficient validation of untrusted input in WebXR.
       Reported by Google.
     - CVE-2026-14021: Insufficient validation of untrusted input in
       StorageAccessAPI. Reported by Google.
     - CVE-2026-14022: Insufficient validation of untrusted input in Network.
       Reported by Google.
     - CVE-2026-14023: Insufficient validation of untrusted input in
       SanitizerAPI. Reported by Google.
     - CVE-2026-14024: Use after free in Ozone. Reported by Google.
     - CVE-2026-14432: Use after free in V8. Reported by Google.
     - CVE-2026-14025: Use after free in Views. Reported by asjidkalam.
     - CVE-2026-14026: Incorrect security UI in SplitView.
       Reported by adisahilna35@gmail.com.
     - CVE-2026-14027: Use after free in SignIn.
       Reported by Sven Dysthe (@svn-dys).
     - CVE-2026-14028: Incorrect security UI in Chrome for iOS.
       Reported by Ameen Basha M K.
     - CVE-2026-14030: Incorrect security UI in SplitView.
       Reported by Khalil Zhani.
     - CVE-2026-14031: Incorrect security UI in File Input. Reported by Google
     - CVE-2026-14032: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-14033: Insufficient policy enforcement in Media.
       Reported by Google.
     - CVE-2026-14034: Inappropriate implementation in WebXR.
       Reported by Google.
     - CVE-2026-14035: Insufficient policy enforcement in Bluetooth.
       Reported by Google.
     - CVE-2026-14036: Insufficient policy enforcement in Bluetooth.
       Reported by Google.
     - CVE-2026-14037: Insufficient policy enforcement in GPU.
       Reported by Google.
     - CVE-2026-14038: Insufficient validation of untrusted input in New
       Tab Page. Reported by Google.
     - CVE-2026-14039: Insufficient policy enforcement in GetUserMedia.
       Reported by Google.
     - CVE-2026-14040: Use after free in BrowserTag. Reported by Google.
     - CVE-2026-14041: Insufficient policy enforcement in Serial.
       Reported by Google.
     - CVE-2026-14042: Inappropriate implementation in Isolated Web Apps.
       Reported by Google.
     - CVE-2026-14043: Use after free in GetUserMedia. Reported by Google.
     - CVE-2026-14044: Use after free in ANGLE. Reported by Google.
     - CVE-2026-14045: Insufficient validation of untrusted input in Network.
       Reported by Google.
     - CVE-2026-14046: Inappropriate implementation in CustomTabs.
       Reported by Google.
     - CVE-2026-14047: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-14048: Use after free in Chromecast. Reported by Google.
     - CVE-2026-14049: Inappropriate implementation in GPU. Reported by Google
     - CVE-2026-14050: Insufficient policy enforcement in Passwords.
       Reported by Google.
     - CVE-2026-14051: Uninitialized Use in GamepadAPI. Reported by Google.
     - CVE-2026-14052: Insufficient policy enforcement in FileSystem.
       Reported by Google.
     - CVE-2026-14053: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-14054: Insufficient policy enforcement in Network.
       Reported by Google.
     - CVE-2026-14055: Insufficient validation of untrusted input in Device
       Trust. Reported by Google.
     - CVE-2026-14056: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-14057: Insufficient policy enforcement in FedCM.
       Reported by Google.
     - CVE-2026-14058: Policy bypass in Parser. Reported by Google.
     - CVE-2026-14059: Insufficient policy enforcement in
       Related-Website-Sets. Reported by Google.
     - CVE-2026-14060: Insufficient validation of untrusted input in
       Chromoting. Reported by Google.
     - CVE-2026-14061: Inappropriate implementation in Dawn.
       Reported by Google.
     - CVE-2026-14062: Inappropriate implementation in Views.
       Reported by Google.
     - CVE-2026-14063: Out of bounds memory access in Chromecast.
       Reported by Google.
     - CVE-2026-14064: Use after free in PageInfo. Reported by Google.
     - CVE-2026-14065: Insufficient validation of untrusted input in
       PageInfo. Reported by Google.
     - CVE-2026-14066: Insufficient validation of untrusted input in Chrome
       for iOS. Reported by Google.
     - CVE-2026-14067: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-14068: Inappropriate implementation in Omnibox.
       Reported by Google.
     - CVE-2026-14069: Integer overflow in WebNN. Reported by Google.
     - CVE-2026-14070: Uninitialized Use in WebNN. Reported by Google.
     - CVE-2026-14071: Side-channel information leakage in WebAudio.
       Reported by Google.
     - CVE-2026-14072: Incorrect security UI in SplitView.
       Reported by FARISSAL B.
     - CVE-2026-14073: Insufficient policy enforcement in WebXR.
       Reported by Google.
     - CVE-2026-14394: Use after free in V8. Reported by Google.
     - CVE-2026-14395: Out of bounds write in V8. Reported by Google.
     - CVE-2026-14074: Side-channel information leakage in WebAuthentication.
       Reported by Google.
     - CVE-2026-14075: Policy bypass in Chrome for iOS. Reported by Google.
     - CVE-2026-14076: Policy bypass in Network. Reported by Google.
     - CVE-2026-14077: Incorrect security UI in Select. Reported by pwn.ai.
     - CVE-2026-14078: Policy bypass in WebRTC. Reported by Google.
     - CVE-2026-14079: Policy bypass in Network. Reported by Google.
     - CVE-2026-14080: Insufficient validation of untrusted input in
       TabSwitcher. Reported by Google.
     - CVE-2026-14081: Insufficient policy enforcement in DevTools.
       Reported by Google.
     - CVE-2026-14082: Race in Storage. Reported by Google.
     - CVE-2026-14083: Insufficient validation of untrusted input in HTML.
       Reported by Google.
     - CVE-2026-14084: Insufficient validation of untrusted input in
       Chromoting. Reported by Google.
     - CVE-2026-14085: Side-channel information leakage in CSS.
       Reported by Google.
     - CVE-2026-14086: Insufficient policy enforcement in HID.
       Reported by Google.
     - CVE-2026-14087: Insufficient validation of untrusted input in WebNN.
       Reported by Google.
     - CVE-2026-14088: Uninitialized Use in Canvas. Reported by Google.
     - CVE-2026-14089: Insufficient validation of untrusted input in
       PopupBlocker. Reported by Google.
     - CVE-2026-14090: Out of bounds read in CameraCapture. Reported by Google
     - CVE-2026-14091: Use after free in DevTools. Reported by Google.
     - CVE-2026-14092: Insufficient policy enforcement in Privacy.
       Reported by Google.
     - CVE-2026-14093: Use after free in Cast. Reported by Google.
     - CVE-2026-14094: Use after free in Installer. Reported by Google.
     - CVE-2026-14095: Insufficient validation of untrusted input in Browser.
       Reported by Google.
     - CVE-2026-14403: Use after free in V8. Reported by Google.
     - CVE-2026-14096: Object lifecycle issue in Input. Reported by Google.
     - CVE-2026-14097: Inappropriate implementation in WebAppInstalls.
       Reported by Google.
     - CVE-2026-14098: Inappropriate implementation in CSS. Reported by Google
     - CVE-2026-14405: Uninitialized Use in V8. Reported by Google.
     - CVE-2026-14099: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-14100: Insufficient data validation in NetworkCache.
       Reported by Google.
     - CVE-2026-14101: Insufficient policy enforcement in Sandbox.
       Reported by Google.
     - CVE-2026-14102: Use after free in Passwords. Reported by Google.
     - CVE-2026-14103: Use after free in SSL. Reported by Google.
     - CVE-2026-14104: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Google.
     - CVE-2026-14105: Insufficient policy enforcement in Speech.
       Reported by Google.
     - CVE-2026-14106: Insufficient validation of untrusted input in Text.
       Reported by Google.
     - CVE-2026-14107: Use after free in Scheduling. Reported by Google.
     - CVE-2026-14108: Use after free in PDFium. Reported by Google.
     - CVE-2026-14109: Insufficient policy enforcement in Mojo.
       Reported by Google.
     - CVE-2026-14110: Inappropriate implementation in DarkMode.
       Reported by Google.
     - CVE-2026-14111: Use after free in WebProtect. Reported by Google.
     - CVE-2026-14112: Inappropriate implementation in Enterprise.
       Reported by Google.
     - CVE-2026-14113: Use after free in Updater. Reported by Google.
     - CVE-2026-14114: Inappropriate implementation in WebAppInstalls.
       Reported by Google.
     - CVE-2026-14115: Insufficient validation of untrusted input in Cast.
       Reported by Google.
     - CVE-2026-14116: Insufficient validation of untrusted input in
       DevTools. Reported by Google.
     - CVE-2026-14117: Insufficient validation of untrusted input in
       DevTools. Reported by Google.
     - CVE-2026-14118: Insufficient data validation in DevTools.
       Reported by Google.
     - CVE-2026-14119: Type Confusion in Bluetooth. Reported by Google.
     - CVE-2026-14120: Inappropriate implementation in DevTools.
       Reported by Google.
     - CVE-2026-14121: Use after free in Chromoting. Reported by Google.
     - CVE-2026-14409: Inappropriate implementation in V8.
       Reported by Yuntao You (@GraVity0) of Bytedance Wuheng Lab.
     - CVE-2026-14122: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Google.
     - CVE-2026-14410: Inappropriate implementation in Skia.
       Reported by Google.
     - CVE-2026-14123: Incorrect security UI in Chrome for iOS.
       Reported by Google.
     - CVE-2026-14124: Inappropriate implementation in CredentialProvider.
       Reported by Google.
     - CVE-2026-14125: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-14126: Incorrect security UI in UI. Reported by Google.
     - CVE-2026-14127: Inappropriate implementation in Printing.
       Reported by Google.
     - CVE-2026-14128: Insufficient data validation in Chrome for iOS.
       Reported by Google.
     - CVE-2026-14129: Incorrect security UI in PreviewTab. Reported by Google
     - CVE-2026-14130: Incorrect security UI in Omnibox. Reported by Google.
     - CVE-2026-14131: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Google.
     - CVE-2026-14132: Inappropriate implementation in WebXR.
       Reported by Google.
     - CVE-2026-14133: Race in History Embeddings. Reported by Google.
     - CVE-2026-14134: Inappropriate implementation in Autofill.
       Reported by Google.
     - CVE-2026-14135: Insufficient validation of untrusted input in Network.
       Reported by Google.
     - CVE-2026-14136: Incorrect security UI in Chrome for iOS.
       Reported by Google.
     - CVE-2026-14137: Insufficient validation of untrusted input in Chrome
       for iOS. Reported by Google.
     - CVE-2026-14138: Inappropriate implementation in WebAppInstalls.
       Reported by Google.
     - CVE-2026-14139: Inappropriate implementation in TabStrip.
       Reported by Google.
     - CVE-2026-14140: Insufficient validation of untrusted input in Input.
       Reported by Google.
     - CVE-2026-14141: Incorrect security UI in Document Picture-in-Picture.
       Reported by Google.
     - CVE-2026-14142: Inappropriate implementation in Extensions.
       Reported by Google.
     - CVE-2026-14143: Incorrect security UI in Passwords. Reported by Google.
     - CVE-2026-14144: Incorrect security UI in Views. Reported by Google.
     - CVE-2026-14145: Inappropriate implementation in CSS. Reported by Google
     - CVE-2026-14146: Inappropriate implementation in CSS. Reported by Google
     - CVE-2026-14147: Inappropriate implementation in CSS. Reported by Google
     - CVE-2026-14415: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-14148: Type Confusion in CSS. Reported by Google.
     - CVE-2026-14149: Use after free in Audio. Reported by Google.
     - CVE-2026-14416: Out of bounds read in Dawn. Reported by Google.
     - CVE-2026-14150: Insufficient validation of untrusted input in Speech.
       Reported by Google.
     - CVE-2026-14151: Inappropriate implementation in AI. Reported by Google.
     - CVE-2026-14152: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-14153: Inappropriate implementation in Glic.
       Reported by Google.
     - CVE-2026-14154: Inappropriate implementation in DevTools.
       Reported by Google.
     - CVE-2026-14155: Insufficient policy enforcement in StorageAccessAPI.
       Reported by Google.
     - CVE-2026-14156: Policy bypass in StorageAccessAPI. Reported by Google.
     - CVE-2026-13281: Integer overflow in Mojo. Reported by Google.
     - CVE-2026-13282: Use after free in Payments. Reported by Google.
     - CVE-2026-13283: Use after free in AdFilter. Reported by Google.
   * d/copyright:
     - delete third_party/webpagereplay/.
     - delete tsgo (typescript compiler in Go) binary.
   * d/patches:
     - upstream/0001-Fix-build-for-CPU-yield-on-LoongArch.patch: drop, merged
       upstream.
     - disable/android.patch: drop, merged upstream.
     - debianization/clang-version.patch: refresh.
     - fixes/libcpp-headers.patch: rework parts of the patch due to
       upstream changes.
     - disable/catapult.patch: refresh.
     - disable/tests.patch: refresh.
     - llvm-19/clang19.patch: refresh.
     - trixie/gn-expand-dir-allowlist.patch: refresh.
     - ungoogled/disable-ai.patch: sync from u-c.
     - ungoogled/remove-navigation-source-param.patch: sync from u-c.
     - i386/support-i386.patch: refresh.
     - upstream/sysroot.patch: add a new build fix pulled from upstream.
     - upstream/ar-path1.patch, upstream/ar-path2.patch: add two more
       vendoring-related build fixes from upstream.
     - trixie/gn-additional-outputs.patch: add patch to partially revert usage
       of a newer generate-ninja feature.
     - llvm-19/i18n-builder-enum.patch: add a workaround for clang-19 being
       confused between a class declaration (with default template parameter)
       and definition.
     - llvm-19/00*-revert-v8-libm.patch: add 9 patches backing out usage of
       internal libc++/libm symbols; this requires a newer llvm than we have.
     - llvm-19/value-or.patch: work around more places where value_or() can't
       figure out the type of a passed init value.
     - trixie/node20-compat.patch: break out part of Daniel's
       node18-compat.patch (below) into one for trixie that also fixes nodejs
       20 issues [trixie, bookworm].
     - rust-1.85/std-from-utf8.patch: add workaround for str::from_utf8 added
       in 1.87 [trixie, bookworm].
     - trixie/bindgen-boringssl.patch: add workaround for older bindgen
       [trixie, bookworm].
 .
   [ Daniel Richard G. ]
   * d/patches:
     - bookworm/gn-absl.patch: Refresh [bookworm].
     - bookworm/gn-funcs.patch: Zap new usage of filter_labels_include()
       [bookworm].
     - bookworm/node18-compat.patch: Fix more cases of nodejs v18 breakage
       [bookworm].
     - trixie/gn-module-name.patch: add more spots where the workaround is
       needed [trixie, bookworm].
 .
   [ Jianfeng Liu ]
   * d/patches:
     - upstream/libyuv-loongarch-fix-row_lsx.cc-and-row_lasx.cc.patch: Fix
       build for libyuv loongarch64.
     - loongarch64/0015-ffmpeg-support-for-loongarch.patch: Refresh.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0002-regenerate-xnn-buildgn.patch: refresh for upstream
       changes
     - fixes/fix-rust-linking.patch: refresh for upstream changes
     - fixes/fix-breakpad-compile.patch: refresh for upstream changes
     - third_party/dawn-fix-ppc64le-detection.patch: refresh for upstream
       changes
     - 0001-Add-pregenerated-config-for-libaom-on-ppc64.patch: refresh for
       upstream changes
chromium (149.0.7827.196-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
chromium (149.0.7827.196-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-13028: Use after free in WebGL. Reported by anonymous.
     - CVE-2026-13032: Use after free in WebGL. Reported by Google.
     - CVE-2026-13033: Out of bounds read in Blink>InterestGroups.
       Reported by Google.
     - CVE-2026-13038: Use after free in Autofill. Reported by Google.
     - CVE-2026-13021: Inappropriate implementation in
       DeviceBoundSessionCredentials. Reported by Google.
     - CVE-2026-13022: Inappropriate implementation in Autofill.
       Reported by Google.
     - CVE-2026-13023: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-13024: Insufficient validation of untrusted input in
       Navigation. Reported by Google.
     - CVE-2026-13025: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-13026: Use after free in Digital Credentials.
       Reported by Google.
     - CVE-2026-13027: Use after free in FileSystem. Reported by Google.
     - CVE-2026-13029: Use after free in Web Authentication. Reported by Google
     - CVE-2026-13030: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-13031: Use after free in Blink. Reported by Google.
     - CVE-2026-13034: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-13035: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-13036: Use after free in Blink. Reported by Google.
     - CVE-2026-13037: Use after free in WebView. Reported by Google.
chromium (149.0.7827.196-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-13028: Use after free in WebGL. Reported by anonymous.
     - CVE-2026-13032: Use after free in WebGL. Reported by Google.
     - CVE-2026-13033: Out of bounds read in Blink>InterestGroups.
       Reported by Google.
     - CVE-2026-13038: Use after free in Autofill. Reported by Google.
     - CVE-2026-13021: Inappropriate implementation in
       DeviceBoundSessionCredentials. Reported by Google.
     - CVE-2026-13022: Inappropriate implementation in Autofill.
       Reported by Google.
     - CVE-2026-13023: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-13024: Insufficient validation of untrusted input in
       Navigation. Reported by Google.
     - CVE-2026-13025: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-13026: Use after free in Digital Credentials.
       Reported by Google.
     - CVE-2026-13027: Use after free in FileSystem. Reported by Google.
     - CVE-2026-13029: Use after free in Web Authentication. Reported by Google
     - CVE-2026-13030: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-13031: Use after free in Blink. Reported by Google.
     - CVE-2026-13034: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-13035: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-13036: Use after free in Blink. Reported by Google.
     - CVE-2026-13037: Use after free in WebView. Reported by Google.
chromium (149.0.7827.155-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-12437: Use after free in WebShare. Reported by Google.
     - CVE-2026-12438: Inappropriate implementation in WebView.
       Reported by Google.
     - CVE-2026-12439: Use after free in Digital Credentials.
       Reported by Google.
     - CVE-2026-12440: Use after free in DigitalCredentials. Reported by Google
     - CVE-2026-12441: Use after free in File Input. Reported by Google.
     - CVE-2026-12442: Use after free in Passwords. Reported by Google.
     - CVE-2026-12443: Use after free in Web Authentication. Reported by Google
     - CVE-2026-12444: Out of bounds read in Chromoting. Reported by Google.
     - CVE-2026-12445: Use after free in Extensions. Reported by Google.
     - CVE-2026-12446: Insufficient data validation in Passwords.
       Reported by Google.
     - CVE-2026-12447: Heap buffer overflow in WebRTC. Reported by Google.
     - CVE-2026-12448: Inappropriate implementation in WebView.
       Reported by Google.
     - CVE-2026-12449: Use after free in Chromoting. Reported by Google.
     - CVE-2026-12450: Inappropriate implementation in Media.
       Reported by Zhixin Tu.
     - CVE-2026-12451: Use after free in DigitalCredentials. Reported by Google
     - CVE-2026-12452: Use after free in Downloads. Reported by Google.
     - CVE-2026-12453: Insufficient validation of untrusted input in Input.
       Reported by Google.
     - CVE-2026-12454: Race in Safe Browsing. Reported by Google.
     - CVE-2026-12455: Use after free in Tab Strip. Reported by Google.
     - CVE-2026-12456: Insufficient validation of untrusted input in
       Extensions. Reported by Google.
     - CVE-2026-12457: Insufficient data validation in Extensions.
       Reported by Google.
     - CVE-2026-12458: Incorrect security UI in Passwords. Reported by Google.
     - CVE-2026-12459: Inappropriate implementation in Serial.
       Reported by Google.
     - CVE-2026-12460: Insufficient policy enforcement in File System Access.
       Reported by Google.
     - CVE-2026-12461: Out of bounds read in WebRTC. Reported by Google.
     - CVE-2026-12462: Use after free in Media. Reported by Google.
     - CVE-2026-12463: Inappropriate implementation in Views.
       Reported by Google.
     - CVE-2026-12464: Use after free in Browser. Reported by Google.
     - CVE-2026-12465: Insufficient validation of untrusted input in Metrics.
       Reported by Google.
     - CVE-2026-12466: Heap buffer overflow in WebRTC. Reported by Google.
     - CVE-2026-12467: Use after free in Extensions. Reported by Google.
     - CVE-2026-12468: Inappropriate implementation in Updater.
       Reported by Google.
     - CVE-2026-12469: Uninitialized Use in GPU. Reported by Google.
chromium (149.0.7827.155-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-12437: Use after free in WebShare. Reported by Google.
     - CVE-2026-12438: Inappropriate implementation in WebView.
       Reported by Google.
     - CVE-2026-12439: Use after free in Digital Credentials.
       Reported by Google.
     - CVE-2026-12440: Use after free in DigitalCredentials. Reported by Google
     - CVE-2026-12441: Use after free in File Input. Reported by Google.
     - CVE-2026-12442: Use after free in Passwords. Reported by Google.
     - CVE-2026-12443: Use after free in Web Authentication. Reported by Google
     - CVE-2026-12444: Out of bounds read in Chromoting. Reported by Google.
     - CVE-2026-12445: Use after free in Extensions. Reported by Google.
     - CVE-2026-12446: Insufficient data validation in Passwords.
       Reported by Google.
     - CVE-2026-12447: Heap buffer overflow in WebRTC. Reported by Google.
     - CVE-2026-12448: Inappropriate implementation in WebView.
       Reported by Google.
     - CVE-2026-12449: Use after free in Chromoting. Reported by Google.
     - CVE-2026-12450: Inappropriate implementation in Media.
       Reported by Zhixin Tu.
     - CVE-2026-12451: Use after free in DigitalCredentials. Reported by Google
     - CVE-2026-12452: Use after free in Downloads. Reported by Google.
     - CVE-2026-12453: Insufficient validation of untrusted input in Input.
       Reported by Google.
     - CVE-2026-12454: Race in Safe Browsing. Reported by Google.
     - CVE-2026-12455: Use after free in Tab Strip. Reported by Google.
     - CVE-2026-12456: Insufficient validation of untrusted input in
       Extensions. Reported by Google.
     - CVE-2026-12457: Insufficient data validation in Extensions.
       Reported by Google.
     - CVE-2026-12458: Incorrect security UI in Passwords. Reported by Google.
     - CVE-2026-12459: Inappropriate implementation in Serial.
       Reported by Google.
     - CVE-2026-12460: Insufficient policy enforcement in File System Access.
       Reported by Google.
     - CVE-2026-12461: Out of bounds read in WebRTC. Reported by Google.
     - CVE-2026-12462: Use after free in Media. Reported by Google.
     - CVE-2026-12463: Inappropriate implementation in Views.
       Reported by Google.
     - CVE-2026-12464: Use after free in Browser. Reported by Google.
     - CVE-2026-12465: Insufficient validation of untrusted input in Metrics.
       Reported by Google.
     - CVE-2026-12466: Heap buffer overflow in WebRTC. Reported by Google.
     - CVE-2026-12467: Use after free in Extensions. Reported by Google.
     - CVE-2026-12468: Inappropriate implementation in Updater.
       Reported by Google.
     - CVE-2026-12469: Uninitialized Use in GPU. Reported by Google.
chromium (149.0.7827.155-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-12437: Use after free in WebShare. Reported by Google.
     - CVE-2026-12438: Inappropriate implementation in WebView.
       Reported by Google.
     - CVE-2026-12439: Use after free in Digital Credentials.
       Reported by Google.
     - CVE-2026-12440: Use after free in DigitalCredentials. Reported by Google
     - CVE-2026-12441: Use after free in File Input. Reported by Google.
     - CVE-2026-12442: Use after free in Passwords. Reported by Google.
     - CVE-2026-12443: Use after free in Web Authentication. Reported by Google
     - CVE-2026-12444: Out of bounds read in Chromoting. Reported by Google.
     - CVE-2026-12445: Use after free in Extensions. Reported by Google.
     - CVE-2026-12446: Insufficient data validation in Passwords.
       Reported by Google.
     - CVE-2026-12447: Heap buffer overflow in WebRTC. Reported by Google.
     - CVE-2026-12448: Inappropriate implementation in WebView.
       Reported by Google.
     - CVE-2026-12449: Use after free in Chromoting. Reported by Google.
     - CVE-2026-12450: Inappropriate implementation in Media.
       Reported by Zhixin Tu.
     - CVE-2026-12451: Use after free in DigitalCredentials. Reported by Google
     - CVE-2026-12452: Use after free in Downloads. Reported by Google.
     - CVE-2026-12453: Insufficient validation of untrusted input in Input.
       Reported by Google.
     - CVE-2026-12454: Race in Safe Browsing. Reported by Google.
     - CVE-2026-12455: Use after free in Tab Strip. Reported by Google.
     - CVE-2026-12456: Insufficient validation of untrusted input in
       Extensions. Reported by Google.
     - CVE-2026-12457: Insufficient data validation in Extensions.
       Reported by Google.
     - CVE-2026-12458: Incorrect security UI in Passwords. Reported by Google.
     - CVE-2026-12459: Inappropriate implementation in Serial.
       Reported by Google.
     - CVE-2026-12460: Insufficient policy enforcement in File System Access.
       Reported by Google.
     - CVE-2026-12461: Out of bounds read in WebRTC. Reported by Google.
     - CVE-2026-12462: Use after free in Media. Reported by Google.
     - CVE-2026-12463: Inappropriate implementation in Views.
       Reported by Google.
     - CVE-2026-12464: Use after free in Browser. Reported by Google.
     - CVE-2026-12465: Insufficient validation of untrusted input in Metrics.
       Reported by Google.
     - CVE-2026-12466: Heap buffer overflow in WebRTC. Reported by Google.
     - CVE-2026-12467: Use after free in Extensions. Reported by Google.
     - CVE-2026-12468: Inappropriate implementation in Updater.
       Reported by Google.
     - CVE-2026-12469: Uninitialized Use in GPU. Reported by Google.
chromium (149.0.7827.114-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-12007: Use after free  Core. Reported by Google.
     - CVE-2026-12008: Use after free  DigitalCredentials. Reported by Google.
     - CVE-2026-12009: Insufficient validation of untrusted input
       Accessibility. Reported by Google.
     - CVE-2026-12010: Heap buffer overflow  GPU. Reported by Google.
     - CVE-2026-12011: Use after free  WebMIDI. Reported by Google.
     - CVE-2026-12012: Use after free  Network. Reported by Google.
     - CVE-2026-12013: Use after free  Media.
       Reported by Henock Habte, Independent Security Researcher.
     - CVE-2026-12014: Use after free  Cast. Reported by Google.
     - CVE-2026-12015: Use after free  Autofill. Reported by Google.
     - CVE-2026-12016: Insufficient validation of untrusted input  DevTools.
       Reported by Google.
     - CVE-2026-12017: Insufficient validation of untrusted input
       Extensions. Reported by Google.
     - CVE-2026-12018: Inappropriate implementation  Mojo. Reported by Google.
     - CVE-2026-12019: Out of bounds write  Codecs. Reported by Google.
     - CVE-2026-12020: Use after free  Autofill. Reported by Google.
     - CVE-2026-12022: Race  Safe Browsing. Reported by Google.
     - CVE-2026-12023: Use after free  GPU. Reported by Google.
     - CVE-2026-12024: Insufficient policy enforcement  DevTools.
       Reported by Google.
     - CVE-2026-12025: Insufficient validation of untrusted input  Network.
       Reported by Google.
     - CVE-2026-12026: Out of bounds read  Video. Reported by Google.
     - CVE-2026-12027: Insufficient policy enforcement  Headless.
       Reported by Google.
     - CVE-2026-12028: Use after free  GPU. Reported by Google.
     - CVE-2026-12029: Use after free  Video. Reported by Google.
     - CVE-2026-12030: Heap buffer overflow  GPU. Reported by Google.
     - CVE-2026-12031: Inappropriate implementation  Views. Reported by Google
     - CVE-2026-12032: Inappropriate implementation  Passwords.
       Reported by Google.
     - CVE-2026-12033: Out of bounds read  VideoCapture. Reported by Google.
     - CVE-2026-12034: Insufficient validation of untrusted input  Linux
       Toolkit Theming. Reported by Google.
     - CVE-2026-12035: Use after free  Views. Reported by Google.
 .
   [ Jianfeng Liu ]
   * d/patches/loongarch64/0024-fix-libyuv-lsx.patch: drop due to upstream
     reverting to version of libyuv that doesn't have lsx issue.
chromium (149.0.7827.114-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-12007: Use after free  Core. Reported by Google.
     - CVE-2026-12008: Use after free  DigitalCredentials. Reported by Google.
     - CVE-2026-12009: Insufficient validation of untrusted input
       Accessibility. Reported by Google.
     - CVE-2026-12010: Heap buffer overflow  GPU. Reported by Google.
     - CVE-2026-12011: Use after free  WebMIDI. Reported by Google.
     - CVE-2026-12012: Use after free  Network. Reported by Google.
     - CVE-2026-12013: Use after free  Media.
       Reported by Henock Habte, Independent Security Researcher.
     - CVE-2026-12014: Use after free  Cast. Reported by Google.
     - CVE-2026-12015: Use after free  Autofill. Reported by Google.
     - CVE-2026-12016: Insufficient validation of untrusted input  DevTools.
       Reported by Google.
     - CVE-2026-12017: Insufficient validation of untrusted input
       Extensions. Reported by Google.
     - CVE-2026-12018: Inappropriate implementation  Mojo. Reported by Google.
     - CVE-2026-12019: Out of bounds write  Codecs. Reported by Google.
     - CVE-2026-12020: Use after free  Autofill. Reported by Google.
     - CVE-2026-12022: Race  Safe Browsing. Reported by Google.
     - CVE-2026-12023: Use after free  GPU. Reported by Google.
     - CVE-2026-12024: Insufficient policy enforcement  DevTools.
       Reported by Google.
     - CVE-2026-12025: Insufficient validation of untrusted input  Network.
       Reported by Google.
     - CVE-2026-12026: Out of bounds read  Video. Reported by Google.
     - CVE-2026-12027: Insufficient policy enforcement  Headless.
       Reported by Google.
     - CVE-2026-12028: Use after free  GPU. Reported by Google.
     - CVE-2026-12029: Use after free  Video. Reported by Google.
     - CVE-2026-12030: Heap buffer overflow  GPU. Reported by Google.
     - CVE-2026-12031: Inappropriate implementation  Views. Reported by Google
     - CVE-2026-12032: Inappropriate implementation  Passwords.
       Reported by Google.
     - CVE-2026-12033: Out of bounds read  VideoCapture. Reported by Google.
     - CVE-2026-12034: Insufficient validation of untrusted input  Linux
       Toolkit Theming. Reported by Google.
     - CVE-2026-12035: Use after free  Views. Reported by Google.
 .
   [ Jianfeng Liu ]
   * d/patches/loongarch64/0024-fix-libyuv-lsx.patch: drop due to upstream
     reverting to version of libyuv that doesn't have lsx issue.
chromium (149.0.7827.114-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-12007: Use after free  Core. Reported by Google.
     - CVE-2026-12008: Use after free  DigitalCredentials. Reported by Google.
     - CVE-2026-12009: Insufficient validation of untrusted input
       Accessibility. Reported by Google.
     - CVE-2026-12010: Heap buffer overflow  GPU. Reported by Google.
     - CVE-2026-12011: Use after free  WebMIDI. Reported by Google.
     - CVE-2026-12012: Use after free  Network. Reported by Google.
     - CVE-2026-12013: Use after free  Media.
       Reported by Henock Habte, Independent Security Researcher.
     - CVE-2026-12014: Use after free  Cast. Reported by Google.
     - CVE-2026-12015: Use after free  Autofill. Reported by Google.
     - CVE-2026-12016: Insufficient validation of untrusted input  DevTools.
       Reported by Google.
     - CVE-2026-12017: Insufficient validation of untrusted input
       Extensions. Reported by Google.
     - CVE-2026-12018: Inappropriate implementation  Mojo. Reported by Google.
     - CVE-2026-12019: Out of bounds write  Codecs. Reported by Google.
     - CVE-2026-12020: Use after free  Autofill. Reported by Google.
     - CVE-2026-12022: Race  Safe Browsing. Reported by Google.
     - CVE-2026-12023: Use after free  GPU. Reported by Google.
     - CVE-2026-12024: Insufficient policy enforcement  DevTools.
       Reported by Google.
     - CVE-2026-12025: Insufficient validation of untrusted input  Network.
       Reported by Google.
     - CVE-2026-12026: Out of bounds read  Video. Reported by Google.
     - CVE-2026-12027: Insufficient policy enforcement  Headless.
       Reported by Google.
     - CVE-2026-12028: Use after free  GPU. Reported by Google.
     - CVE-2026-12029: Use after free  Video. Reported by Google.
     - CVE-2026-12030: Heap buffer overflow  GPU. Reported by Google.
     - CVE-2026-12031: Inappropriate implementation  Views. Reported by Google
     - CVE-2026-12032: Inappropriate implementation  Passwords.
       Reported by Google.
     - CVE-2026-12033: Out of bounds read  VideoCapture. Reported by Google.
     - CVE-2026-12034: Insufficient validation of untrusted input  Linux
       Toolkit Theming. Reported by Google.
     - CVE-2026-12035: Use after free  Views. Reported by Google.
chromium (149.0.7827.102-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-11628: Use after free in Ozone. Reported by Google.
     - CVE-2026-11629: Use after free in Ozone. Reported by Google.
     - CVE-2026-11630: Use after free in File Input. Reported by Google.
     - CVE-2026-11631: Use after free in Aura. Reported by Google.
     - CVE-2026-11632: Use after free in TabStrip. Reported by Google.
     - CVE-2026-11633: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-11634: Use after free in Gamepad. Reported by Google.
     - CVE-2026-11635: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-11636: Use after free in Autofill. Reported by Google.
     - CVE-2026-11637: Use after free in Views. Reported by Google.
     - CVE-2026-11638: Use after free in Printing. Reported by Google.
     - CVE-2026-11639: Use after free in Compositing. Reported by Google.
     - CVE-2026-11640: Integer overflow in libyuv. Reported by Google.
     - CVE-2026-11641: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-11642: Use after free in Web Apps. Reported by Google.
     - CVE-2026-11643: Use after free in Proxy. Reported by Google.
     - CVE-2026-11644: Use after free in Views. Reported by Google.
     - CVE-2026-11645: Out of bounds memory access in V8. Reported by 303f06e3
     - CVE-2026-11646: Use after free in ViewTransitions.
       Reported by Quac Tran.
     - CVE-2026-11647: Use after free in Printing. Reported by Google.
     - CVE-2026-11648: Use after free in FullScreen.
       Reported by Mihnea Nicolau.
     - CVE-2026-11649: Use after free in V8. Reported by Google.
     - CVE-2026-11650: Use after free in V8. Reported by Google.
     - CVE-2026-11651: Use after free in Network. Reported by Google.
     - CVE-2026-11652: Use after free in Extensions. Reported by Google.
     - CVE-2026-11653: Insufficient validation of untrusted input in
       Extensions. Reported by Google.
     - CVE-2026-11654: Use after free in CameraCapture. Reported by Google.
     - CVE-2026-11655: Integer overflow in Media. Reported by Google.
     - CVE-2026-11656: Use after free in ServiceWorker. Reported by Google.
     - CVE-2026-11657: Use after free in Payments. Reported by Google.
     - CVE-2026-11658: Insufficient validation of untrusted input in
       Extensions. Reported by Google.
     - CVE-2026-11659: Insufficient validation of untrusted input in UI.
       Reported by Google.
     - CVE-2026-11660: Insufficient validation of untrusted input in
       New Tab Page. Reported by Google.
     - CVE-2026-11661: Use after free in Views. Reported by Google.
     - CVE-2026-11662: Type Confusion in Bindings. Reported by Google.
     - CVE-2026-11663: Use after free in Skia. Reported by Google.
     - CVE-2026-11664: Use after free in Payments. Reported by Google.
     - CVE-2026-11665: Out of bounds read in Dawn. Reported by Google.
     - CVE-2026-11666: Insufficient validation of untrusted input in Input.
       Reported by Google.
     - CVE-2026-11667: Out of bounds read in WebRTC. Reported by Google.
     - CVE-2026-11668: Uninitialized Use in Codecs. Reported by Google.
     - CVE-2026-11669: Integer overflow in Media. Reported by Google.
     - CVE-2026-11670: Use after free in PDF. Reported by Google.
     - CVE-2026-11671: Use after free in Navigation. Reported by Google.
     - CVE-2026-11672: Out of bounds write in GPU. Reported by Google.
     - CVE-2026-11673: Use after free in InterestGroups. Reported by Google.
     - CVE-2026-11674: Use after free in Guest View. Reported by Google.
     - CVE-2026-11675: Insufficient validation of untrusted input in Skia.
       Reported by Google.
     - CVE-2026-11676: Insufficient validation of untrusted input in Dawn.
       Reported by Google.
     - CVE-2026-11677: Race in Network. Reported by Google.
     - CVE-2026-11678: Integer overflow in libyuv. Reported by Google.
     - CVE-2026-11679: Use after free in Codecs. Reported by Google.
     - CVE-2026-11680: Use after free in Media. Reported by Google.
     - CVE-2026-11681: Use after free in Ozone. Reported by Google.
     - CVE-2026-11682: Insufficient validation of untrusted input in Views.
       Reported by Google.
     - CVE-2026-11683: Use after free in WebCodecs. Reported by Google.
     - CVE-2026-11684: Insufficient policy enforcement in Network.
       Reported by Google.
     - CVE-2026-11685: Insufficient data validation in MediaCapture.
       Reported by Google.
     - CVE-2026-11686: Insufficient validation of untrusted input in Dawn.
       Reported by Google.
     - CVE-2026-11687: Use after free in Dawn. Reported by Google.
     - CVE-2026-11688: Object lifecycle issue in SVG. Reported by Google.
     - CVE-2026-11689: Insufficient validation of untrusted input in
       Passwords. Reported by Google.
     - CVE-2026-11690: Out of bounds read and write in Media.
       Reported by Google.
     - CVE-2026-11691: Insufficient validation of untrusted input in
       New Tab Page. Reported by Google.
     - CVE-2026-11692: Use after free in Read Anything. Reported by Google.
     - CVE-2026-11693: Inappropriate implementation in Plugins.
       Reported by Google.
     - CVE-2026-11694: Use after free in ServiceWorker. Reported by Google.
     - CVE-2026-11695: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-11696: Uninitialized Use in Video. Reported by Google.
     - CVE-2026-11697: Insufficient validation of untrusted input in UI.
       Reported by Google.
     - CVE-2026-11698: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-11699: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-11700: Use after free in Tracing. Reported by Google.
     - CVE-2026-11701: Insufficient validation of untrusted input in Guest
       View. Reported by Google.
   * d/patches:
     - fixes/arm-logging.patch: add patch to hopefully fix build failure
       on arm*.
     - loongarch64/0024-fix-libyuv-lsx.patch: refresh.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - 0001-Add-pregenerated-config-for-libaom-on-ppc64.patch: refresh for
       upstream changes
     - core/baseline-isa-3-0.patch: refresh
chromium (149.0.7827.102-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-11628: Use after free in Ozone. Reported by Google.
     - CVE-2026-11629: Use after free in Ozone. Reported by Google.
     - CVE-2026-11630: Use after free in File Input. Reported by Google.
     - CVE-2026-11631: Use after free in Aura. Reported by Google.
     - CVE-2026-11632: Use after free in TabStrip. Reported by Google.
     - CVE-2026-11633: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-11634: Use after free in Gamepad. Reported by Google.
     - CVE-2026-11635: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-11636: Use after free in Autofill. Reported by Google.
     - CVE-2026-11637: Use after free in Views. Reported by Google.
     - CVE-2026-11638: Use after free in Printing. Reported by Google.
     - CVE-2026-11639: Use after free in Compositing. Reported by Google.
     - CVE-2026-11640: Integer overflow in libyuv. Reported by Google.
     - CVE-2026-11641: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-11642: Use after free in Web Apps. Reported by Google.
     - CVE-2026-11643: Use after free in Proxy. Reported by Google.
     - CVE-2026-11644: Use after free in Views. Reported by Google.
     - CVE-2026-11645: Out of bounds memory access in V8. Reported by 303f06e3
     - CVE-2026-11646: Use after free in ViewTransitions.
       Reported by Quac Tran.
     - CVE-2026-11647: Use after free in Printing. Reported by Google.
     - CVE-2026-11648: Use after free in FullScreen.
       Reported by Mihnea Nicolau.
     - CVE-2026-11649: Use after free in V8. Reported by Google.
     - CVE-2026-11650: Use after free in V8. Reported by Google.
     - CVE-2026-11651: Use after free in Network. Reported by Google.
     - CVE-2026-11652: Use after free in Extensions. Reported by Google.
     - CVE-2026-11653: Insufficient validation of untrusted input in
       Extensions. Reported by Google.
     - CVE-2026-11654: Use after free in CameraCapture. Reported by Google.
     - CVE-2026-11655: Integer overflow in Media. Reported by Google.
     - CVE-2026-11656: Use after free in ServiceWorker. Reported by Google.
     - CVE-2026-11657: Use after free in Payments. Reported by Google.
     - CVE-2026-11658: Insufficient validation of untrusted input in
       Extensions. Reported by Google.
     - CVE-2026-11659: Insufficient validation of untrusted input in UI.
       Reported by Google.
     - CVE-2026-11660: Insufficient validation of untrusted input in
       New Tab Page. Reported by Google.
     - CVE-2026-11661: Use after free in Views. Reported by Google.
     - CVE-2026-11662: Type Confusion in Bindings. Reported by Google.
     - CVE-2026-11663: Use after free in Skia. Reported by Google.
     - CVE-2026-11664: Use after free in Payments. Reported by Google.
     - CVE-2026-11665: Out of bounds read in Dawn. Reported by Google.
     - CVE-2026-11666: Insufficient validation of untrusted input in Input.
       Reported by Google.
     - CVE-2026-11667: Out of bounds read in WebRTC. Reported by Google.
     - CVE-2026-11668: Uninitialized Use in Codecs. Reported by Google.
     - CVE-2026-11669: Integer overflow in Media. Reported by Google.
     - CVE-2026-11670: Use after free in PDF. Reported by Google.
     - CVE-2026-11671: Use after free in Navigation. Reported by Google.
     - CVE-2026-11672: Out of bounds write in GPU. Reported by Google.
     - CVE-2026-11673: Use after free in InterestGroups. Reported by Google.
     - CVE-2026-11674: Use after free in Guest View. Reported by Google.
     - CVE-2026-11675: Insufficient validation of untrusted input in Skia.
       Reported by Google.
     - CVE-2026-11676: Insufficient validation of untrusted input in Dawn.
       Reported by Google.
     - CVE-2026-11677: Race in Network. Reported by Google.
     - CVE-2026-11678: Integer overflow in libyuv. Reported by Google.
     - CVE-2026-11679: Use after free in Codecs. Reported by Google.
     - CVE-2026-11680: Use after free in Media. Reported by Google.
     - CVE-2026-11681: Use after free in Ozone. Reported by Google.
     - CVE-2026-11682: Insufficient validation of untrusted input in Views.
       Reported by Google.
     - CVE-2026-11683: Use after free in WebCodecs. Reported by Google.
     - CVE-2026-11684: Insufficient policy enforcement in Network.
       Reported by Google.
     - CVE-2026-11685: Insufficient data validation in MediaCapture.
       Reported by Google.
     - CVE-2026-11686: Insufficient validation of untrusted input in Dawn.
       Reported by Google.
     - CVE-2026-11687: Use after free in Dawn. Reported by Google.
     - CVE-2026-11688: Object lifecycle issue in SVG. Reported by Google.
     - CVE-2026-11689: Insufficient validation of untrusted input in
       Passwords. Reported by Google.
     - CVE-2026-11690: Out of bounds read and write in Media.
       Reported by Google.
     - CVE-2026-11691: Insufficient validation of untrusted input in
       New Tab Page. Reported by Google.
     - CVE-2026-11692: Use after free in Read Anything. Reported by Google.
     - CVE-2026-11693: Inappropriate implementation in Plugins.
       Reported by Google.
     - CVE-2026-11694: Use after free in ServiceWorker. Reported by Google.
     - CVE-2026-11695: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-11696: Uninitialized Use in Video. Reported by Google.
     - CVE-2026-11697: Insufficient validation of untrusted input in UI.
       Reported by Google.
     - CVE-2026-11698: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-11699: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-11700: Use after free in Tracing. Reported by Google.
     - CVE-2026-11701: Insufficient validation of untrusted input in Guest
       View. Reported by Google.
   * d/patches:
     - fixes/arm-logging.patch: add patch to hopefully fix build failure
       on arm*.
     - loongarch64/0024-fix-libyuv-lsx.patch: refresh.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - 0001-Add-pregenerated-config-for-libaom-on-ppc64.patch: refresh for
       upstream changes
     - core/baseline-isa-3-0.patch: refresh
chromium (149.0.7827.102-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-11628: Use after free in Ozone. Reported by Google.
     - CVE-2026-11629: Use after free in Ozone. Reported by Google.
     - CVE-2026-11630: Use after free in File Input. Reported by Google.
     - CVE-2026-11631: Use after free in Aura. Reported by Google.
     - CVE-2026-11632: Use after free in TabStrip. Reported by Google.
     - CVE-2026-11633: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-11634: Use after free in Gamepad. Reported by Google.
     - CVE-2026-11635: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-11636: Use after free in Autofill. Reported by Google.
     - CVE-2026-11637: Use after free in Views. Reported by Google.
     - CVE-2026-11638: Use after free in Printing. Reported by Google.
     - CVE-2026-11639: Use after free in Compositing. Reported by Google.
     - CVE-2026-11640: Integer overflow in libyuv. Reported by Google.
     - CVE-2026-11641: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-11642: Use after free in Web Apps. Reported by Google.
     - CVE-2026-11643: Use after free in Proxy. Reported by Google.
     - CVE-2026-11644: Use after free in Views. Reported by Google.
     - CVE-2026-11645: Out of bounds memory access in V8. Reported by 303f06e3
     - CVE-2026-11646: Use after free in ViewTransitions.
       Reported by Quac Tran.
     - CVE-2026-11647: Use after free in Printing. Reported by Google.
     - CVE-2026-11648: Use after free in FullScreen.
       Reported by Mihnea Nicolau.
     - CVE-2026-11649: Use after free in V8. Reported by Google.
     - CVE-2026-11650: Use after free in V8. Reported by Google.
     - CVE-2026-11651: Use after free in Network. Reported by Google.
     - CVE-2026-11652: Use after free in Extensions. Reported by Google.
     - CVE-2026-11653: Insufficient validation of untrusted input in
       Extensions. Reported by Google.
     - CVE-2026-11654: Use after free in CameraCapture. Reported by Google.
     - CVE-2026-11655: Integer overflow in Media. Reported by Google.
     - CVE-2026-11656: Use after free in ServiceWorker. Reported by Google.
     - CVE-2026-11657: Use after free in Payments. Reported by Google.
     - CVE-2026-11658: Insufficient validation of untrusted input in
       Extensions. Reported by Google.
     - CVE-2026-11659: Insufficient validation of untrusted input in UI.
       Reported by Google.
     - CVE-2026-11660: Insufficient validation of untrusted input in
       New Tab Page. Reported by Google.
     - CVE-2026-11661: Use after free in Views. Reported by Google.
     - CVE-2026-11662: Type Confusion in Bindings. Reported by Google.
     - CVE-2026-11663: Use after free in Skia. Reported by Google.
     - CVE-2026-11664: Use after free in Payments. Reported by Google.
     - CVE-2026-11665: Out of bounds read in Dawn. Reported by Google.
     - CVE-2026-11666: Insufficient validation of untrusted input in Input.
       Reported by Google.
     - CVE-2026-11667: Out of bounds read in WebRTC. Reported by Google.
     - CVE-2026-11668: Uninitialized Use in Codecs. Reported by Google.
     - CVE-2026-11669: Integer overflow in Media. Reported by Google.
     - CVE-2026-11670: Use after free in PDF. Reported by Google.
     - CVE-2026-11671: Use after free in Navigation. Reported by Google.
     - CVE-2026-11672: Out of bounds write in GPU. Reported by Google.
     - CVE-2026-11673: Use after free in InterestGroups. Reported by Google.
     - CVE-2026-11674: Use after free in Guest View. Reported by Google.
     - CVE-2026-11675: Insufficient validation of untrusted input in Skia.
       Reported by Google.
     - CVE-2026-11676: Insufficient validation of untrusted input in Dawn.
       Reported by Google.
     - CVE-2026-11677: Race in Network. Reported by Google.
     - CVE-2026-11678: Integer overflow in libyuv. Reported by Google.
     - CVE-2026-11679: Use after free in Codecs. Reported by Google.
     - CVE-2026-11680: Use after free in Media. Reported by Google.
     - CVE-2026-11681: Use after free in Ozone. Reported by Google.
     - CVE-2026-11682: Insufficient validation of untrusted input in Views.
       Reported by Google.
     - CVE-2026-11683: Use after free in WebCodecs. Reported by Google.
     - CVE-2026-11684: Insufficient policy enforcement in Network.
       Reported by Google.
     - CVE-2026-11685: Insufficient data validation in MediaCapture.
       Reported by Google.
     - CVE-2026-11686: Insufficient validation of untrusted input in Dawn.
       Reported by Google.
     - CVE-2026-11687: Use after free in Dawn. Reported by Google.
     - CVE-2026-11688: Object lifecycle issue in SVG. Reported by Google.
     - CVE-2026-11689: Insufficient validation of untrusted input in
       Passwords. Reported by Google.
     - CVE-2026-11690: Out of bounds read and write in Media.
       Reported by Google.
     - CVE-2026-11691: Insufficient validation of untrusted input in
       New Tab Page. Reported by Google.
     - CVE-2026-11692: Use after free in Read Anything. Reported by Google.
     - CVE-2026-11693: Inappropriate implementation in Plugins.
       Reported by Google.
     - CVE-2026-11694: Use after free in ServiceWorker. Reported by Google.
     - CVE-2026-11695: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-11696: Uninitialized Use in Video. Reported by Google.
     - CVE-2026-11697: Insufficient validation of untrusted input in UI.
       Reported by Google.
     - CVE-2026-11698: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-11699: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-11700: Use after free in Tracing. Reported by Google.
     - CVE-2026-11701: Insufficient validation of untrusted input in Guest
       View. Reported by Google.
   * d/patches:
     - fixes/arm-logging.patch: add patch to hopefully fix build failure
       on arm*.
     - loongarch64/0024-fix-libyuv-lsx.patch: refresh.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - 0001-Add-pregenerated-config-for-libaom-on-ppc64.patch: refresh for
       upstream changes
     - core/baseline-isa-3-0.patch: refresh
chromium (149.0.7827.53-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream stable release.
     - CVE-2026-10881: Out of bounds read and write in ANGLE.
       Reported by Anonymous.
     - CVE-2026-10882: Use after free in Network.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-10883: Out of bounds write in ANGLE. Reported by Maher Azzouzi.
     - CVE-2026-10884: Use after free in Chromecast. Reported by Google.
     - CVE-2026-10885: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-10886: Use after free in FileSystem. Reported by Andrew Boni.
     - CVE-2026-10887: Use after free in Chromoting. Reported by Google.
     - CVE-2026-10888: Use after free in Cast Streaming. Reported by Google.
     - CVE-2026-10889: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-10890: Use after free in Cast. Reported by Google.
     - CVE-2026-10891: Use after free in GFX. Reported by Google.
     - CVE-2026-10892: Out of bounds write in GPU. Reported by Google.
     - CVE-2026-10893: Use after free in Chromoting. Reported by Google.
     - CVE-2026-10894: Use after free in Printing. Reported by Google.
     - CVE-2026-10895: Use after free in Ozone. Reported by Google.
     - CVE-2026-10896: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-10897: Out of bounds write in GPU. Reported by Google.
     - CVE-2026-10898: Stack buffer overflow in GPU. Reported by Google.
     - CVE-2026-10899: Use after free in Ozone. Reported by Google.
     - CVE-2026-10900: Use after free in Passwords. Reported by Google.
     - CVE-2026-10901: Use after free in Passwords. Reported by Google.
     - CVE-2026-10902: Use after free in Ozone. Reported by Google.
     - CVE-2026-10903: Use after free in WebRTC.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-10904: Inappropriate implementation in V8. Reported by 303f06e3
     - CVE-2026-10905: Use after free in Network.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-10906: Use after free in WebAuthentication.
       Reported by Weipeng Jiang (@Krace) of VRI.
     - CVE-2026-10907: Out of bounds write in ANGLE. Reported by sweetchip.
     - CVE-2026-10908: Use after free in FullScreen. Reported by Mihnea Nicolau
     - CVE-2026-10909: Use after free in Dawn. Reported by whiter@xuanyusec.
     - CVE-2026-10910: Type Confusion in V8.
       Reported by Mufeed VH from Winfunc Research (winfunc.com).
     - CVE-2026-10911: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-10912: Insufficient validation of untrusted input
       in Extensions. Reported by Google.
     - CVE-2026-10913: Use after free in ANGLE. Reported by Google.
     - CVE-2026-10914: Use after free in ANGLE. Reported by Google.
     - CVE-2026-10915: Use after free in Core. Reported by Google.
     - CVE-2026-10916: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-10917: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-10918: Use after free in Viz. Reported by Google.
     - CVE-2026-10919: Use after free in ANGLE. Reported by Google.
     - CVE-2026-10920: Insufficient validation of untrusted input in WebShare.
       Reported by Google.
     - CVE-2026-10921: Integer overflow in Dawn. Reported by Google.
     - CVE-2026-10922: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-10923: Use after free in WebAppInstalls. Reported by Google.
     - CVE-2026-10924: Integer overflow in Chromecast. Reported by Google.
     - CVE-2026-10925: Out of bounds write in Skia. Reported by Google.
     - CVE-2026-10926: Use after free in Cast. Reported by Google.
     - CVE-2026-10927: Out of bounds read in Dawn. Reported by Google.
     - CVE-2026-10928: Script injection in Headless. Reported by Google.
     - CVE-2026-10929: Heap buffer overflow in ANGLE. Reported by Google.
     - CVE-2026-10930: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-10931: Use after free in FileSystem. Reported by asjidkalam.
     - CVE-2026-10932: Use after free in UI. Reported by Google.
     - CVE-2026-10933: Use after free in Audio. Reported by Google.
     - CVE-2026-10934: Use after free in Autofill. Reported by Google.
     - CVE-2026-10935: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-10936: Type Confusion in V8. Reported by Google.
     - CVE-2026-10937: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-10938: Insufficient validation of untrusted input in Input.
       Reported by Google.
     - CVE-2026-10939: Use after free in WebRTC. Reported by Google.
     - CVE-2026-10940: Race in Codecs. Reported by Google.
     - CVE-2026-10941: Out of bounds memory access in Skia. Reported by Google.
     - CVE-2026-10942: Insufficient validation of untrusted input in UI.
       Reported by Google.
     - CVE-2026-10943: Use after free in WebRTC. Reported by Rayyan Kadar.
     - CVE-2026-10944: Insufficient policy enforcement in Autofill.
       Reported by Google.
     - CVE-2026-10945: Use after free in PDF. Reported by Google.
     - CVE-2026-10946: Heap buffer overflow in Media. Reported by Google.
     - CVE-2026-10947: Use after free in WebRTC. Reported by Google.
     - CVE-2026-10948: Use after free in WebRTC. Reported by Google.
     - CVE-2026-10949: Heap buffer overflow in Video. Reported by Google.
     - CVE-2026-10950: Insufficient policy enforcement in Autofill.
       Reported by Google.
     - CVE-2026-10951: Use after free in Autofill. Reported by Google.
     - CVE-2026-10952: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-10953: Use after free in Core. Reported by Google.
     - CVE-2026-10954: Use after free in Actor. Reported by Google.
     - CVE-2026-10955: Type Confusion in ANGLE. Reported by Google.
     - CVE-2026-10956: Use after free in MimeHandlerView. Reported by Google.
     - CVE-2026-10957: Use after free in Glic. Reported by Google.
     - CVE-2026-10958: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-10959: Use after free in Input. Reported by Google.
     - CVE-2026-10960: Uninitialized Use in Codecs. Reported by Google.
     - CVE-2026-10961: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-10962: Type Confusion in Media. Reported by Google.
     - CVE-2026-10963: Integer overflow in V8. Reported by Google.
     - CVE-2026-10964: Integer overflow in V8. Reported by Google.
     - CVE-2026-10965: Integer overflow in DevTools. Reported by Google.
     - CVE-2026-10966: Insufficient validation of untrusted input in Codecs.
       Reported by Google.
     - CVE-2026-10967: Use after free in SurfaceCapture. Reported by Google.
     - CVE-2026-10968: Insufficient validation of untrusted input in Dawn.
       Reported by Google.
     - CVE-2026-10969: Insufficient validation of untrusted input in Extensions
       Reported by Google.
     - CVE-2026-10970: Insufficient validation of untrusted input
       in InterestGroups. Reported by Google.
     - CVE-2026-10971: Insufficient validation of untrusted input in Printing.
       Reported by Google.
     - CVE-2026-10972: Use after free in Ozone. Reported by Google.
     - CVE-2026-10973: Uninitialized Use in Dawn. Reported by Google.
     - CVE-2026-10974: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-10975: Use after free in WebRTC. Reported by Google.
     - CVE-2026-10976: Uninitialized Use in Dawn. Reported by Google.
     - CVE-2026-10977: Uninitialized Use in Skia. Reported by Google.
     - CVE-2026-10978: Use after free in Chromoting. Reported by Google.
     - CVE-2026-10979: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-10980: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-10981: Insufficient validation of untrusted input in Codecs.
       Reported by Google.
     - CVE-2026-10982: Use after free in WebXR. Reported by Google.
     - CVE-2026-10983: Insufficient validation of untrusted input in Dawn.
       Reported by Google.
     - CVE-2026-10984: Inappropriate implementation in Accessibility.
       Reported by Google.
     - CVE-2026-10985: Out of bounds read in Skia. Reported by Google.
     - CVE-2026-10986: Integer overflow in Media. Reported by Google.
     - CVE-2026-10987: Integer overflow in V8. Reported by Google.
     - CVE-2026-10988: Use after free in Views. Reported by Google.
     - CVE-2026-10989: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-10990: Use after free in Glic.
       Reported by Weipeng Jiang (@Krace) of VRI.
     - CVE-2026-10991: Use after free in V8.
       Reported by Alisa Esage (@alisaesage).
     - CVE-2026-10992: Insufficient data validation in Animation.
       Reported by heapracer (@heapracer).
     - CVE-2026-10993: Heap buffer overflow in Skia.
       Reported by M. Fauzan Wijaya (Gh05t666nero).
     - CVE-2026-10994: Uninitialized Use in ANGLE.
       Reported by Mufeed VH from Winfunc Research (winfunc.com).
     - CVE-2026-10995: Heap buffer overflow in TabStrip.
       Reported by Sven Dysthe (@svn-dys).
     - CVE-2026-10996: Inappropriate implementation in Workers.
       Reported by Jayateertha Guruprasad.
     - CVE-2026-10997: Insufficient policy enforcement in Extensions.
       Reported by djallalakira@gmail.com.
     - CVE-2026-10998: Out of bounds read in Media. Reported by Ameen Basha M K
     - CVE-2026-10999: Out of bounds memory access in ANGLE.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-11000: Use after free in Fonts.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-11001: Incorrect security UI in Payments. Reported by Google.
     - CVE-2026-11002: Use after free in Autofill.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-11003: Use after free in WebRTC.
       Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab.
     - CVE-2026-11004: Out of bounds read in ANGLE.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-11005: Out of bounds read in ANGLE.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-11006: Out of bounds read in Dawn. Reported by Google.
     - CVE-2026-11007: Insufficient validation of untrusted input in WebView.
       Reported by Google.
     - CVE-2026-11008: Insufficient validation of untrusted input
       in WebAppInstalls. Reported by Google.
     - CVE-2026-11009: Use after free in USB. Reported by Google.
     - CVE-2026-11010: Use after free in WebShare. Reported by David Sievers.
     - CVE-2026-11011: Insufficient policy enforcement in Password Manager.
       Reported by Google.
     - CVE-2026-11012: Use after free in Serial. Reported by Google.
     - CVE-2026-11013: Insufficient validation of untrusted input in Network.
       Reported by Google.
     - CVE-2026-11014: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-11015: Out of bounds read in WebGPU. Reported by Yuma Takeuchi.
     - CVE-2026-11016: Insufficient validation of untrusted input in Network.
       Reported by Google.
     - CVE-2026-11017: Inappropriate implementation in Link Preview.
       Reported by Google.
     - CVE-2026-11018: Insufficient policy enforcement in Actor.
       Reported by Google.
     - CVE-2026-11019: Inappropriate implementation in Payments.
       Reported by Google.
     - CVE-2026-11020: Inappropriate implementation in Extensions.
       Reported by Google.
     - CVE-2026-11021: Insufficient validation of untrusted input in GPU.
       Reported by Google.
     - CVE-2026-11022: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-11023: Insufficient validation of untrusted input
       in WebAppInstalls. Reported by Google.
     - CVE-2026-11024: Stack buffer overflow in Skia. Reported by Google.
     - CVE-2026-11025: Insufficient policy enforcement in Navigation.
       Reported by Google.
     - CVE-2026-11026: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-11027: Insufficient validation of untrusted input in Glic.
       Reported by Google.
     - CVE-2026-11028: Use after free in Media. Reported by Google.
     - CVE-2026-11029: Insufficient validation of untrusted input
       in Drag and Drop. Reported by Google.
     - CVE-2026-11030: Use after free in Network. Reported by Google.
     - CVE-2026-11031: Insufficient validation of untrusted input
       in Password Manager. Reported by Google.
     - CVE-2026-11032: Insufficient data validation in Password Manager.
       Reported by Google.
     - CVE-2026-11033: Uninitialized Use in WebML. Reported by Google.
     - CVE-2026-11034: Insufficient validation of untrusted input
       in Tab Group Sync. Reported by Google.
     - CVE-2026-11035: Insufficient validation of untrusted input
       in Custom Tabs. Reported by Google.
     - CVE-2026-11036: Inappropriate implementation in DOM. Reported by Google
     - CVE-2026-11037: Out of bounds write in Codecs. Reported by Google.
     - CVE-2026-11038: Insufficient validation of untrusted input
       in Subresource Integrity. Reported by Google.
     - CVE-2026-11039: Uninitialized Use in Skia. Reported by Google.
     - CVE-2026-11040: Use after free in ANGLE. Reported by Google.
     - CVE-2026-11041: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-11042: Use after free in Views. Reported by Google.
     - CVE-2026-11043: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-11044: Integer overflow in ANGLE. Reported by Google.
     - CVE-2026-11045: Insufficient validation of untrusted input in GPU.
       Reported by Google.
     - CVE-2026-11046: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-11047: Insufficient validation of untrusted input in Base.
       Reported by Google.
     - CVE-2026-11048: Inappropriate implementation in Extensions.
       Reported by Google.
     - CVE-2026-11049: Use after free in Password Manager. Reported by Google.
     - CVE-2026-11050: Use after free in V8. Reported by Google.
     - CVE-2026-11051: Out of bounds read in ANGLE.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-11052: Type Confusion in GPU. Reported by Google.
     - CVE-2026-11053: VULNERABILITY in WebRTC. Reported by Google.
     - CVE-2026-11054: Use after free in WebRTC. Reported by Google.
     - CVE-2026-11055: Use after free in ANGLE. Reported by Google.
     - CVE-2026-11056: Insufficient validation of untrusted input
       in SiteIsolation. Reported by Google.
     - CVE-2026-11057: Uninitialized Use in Skia. Reported by Google.
     - CVE-2026-11058: Integer overflow in CredentialProvider.
       Reported by Google.
     - CVE-2026-11059: Use after free in Blink. Reported by Google.
     - CVE-2026-11060: Use after free in Media. Reported by Google.
     - CVE-2026-11061: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-11062: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-11063: Insufficient validation of untrusted input in WebNN.
       Reported by Google.
     - CVE-2026-11064: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-11065: Use after free in ANGLE. Reported by Google.
     - CVE-2026-11066: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-11067: Uninitialized Use in Dawn. Reported by Google.
     - CVE-2026-11068: Use after free in WebSockets. Reported by Google.
     - CVE-2026-11069: Insufficient validation of untrusted input in Cast.
       Reported by Google.
     - CVE-2026-11070: Insufficient validation of untrusted input in Chromoting
       Reported by Google.
     - CVE-2026-11071: Use after free in Base. Reported by Google.
     - CVE-2026-11072: Use after free in WebView. Reported by Google.
     - CVE-2026-11073: Use after free in WebGL. Reported by Google.
     - CVE-2026-11074: Use after free in WebRTC.
       Reported by boboliverfrancishoward@gmail.com.
     - CVE-2026-11075: Out of bounds read in V8.
       Reported by JunYoung Park(@candymate) of KAIST Hacking Lab.
     - CVE-2026-11076: Type Confusion in CSS. Reported by Google.
     - CVE-2026-11077: Out of bounds read in Dawn. Reported by Anonymous.
     - CVE-2026-11078: Insufficient validation of untrusted input
       in FileSystem. Reported by Eran Rom of Palo Alto Networks.
     - CVE-2026-11079: Insufficient validation of untrusted input in Codecs.
       Reported by Google.
     - CVE-2026-11080: Use after free in WebView. Reported by Google.
     - CVE-2026-11081: Policy bypass in Canvas. Reported by Google.
     - CVE-2026-11082: Use after free in GPU. Reported by Google.
     - CVE-2026-11083: Inappropriate implementation in Password Manager.
       Reported by Google.
     - CVE-2026-11084: Inappropriate implementation in Password Manager.
       Reported by Google.
     - CVE-2026-11085: Integer overflow in GPU. Reported by Google.
     - CVE-2026-11086: Insufficient validation of untrusted input in Dawn.
       Reported by Google.
     - CVE-2026-11087: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11088: Integer overflow in ANGLE. Reported by Google.
     - CVE-2026-11089: Uninitialized Use in Media. Reported by Google.
     - CVE-2026-11090: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11091: Inappropriate implementation in Dawn. Reported by Google
     - CVE-2026-11092: Insufficient policy enforcement in DevTools.
       Reported by Google.
     - CVE-2026-11093: Insufficient validation of untrusted input in Printing.
       Reported by Google.
     - CVE-2026-11094: Use after free in Codecs. Reported by Google.
     - CVE-2026-11095: Insufficient validation of untrusted input in Codecs.
       Reported by Google.
     - CVE-2026-11096: Out of bounds read in WebRTC. Reported by Google.
     - CVE-2026-11097: Inappropriate implementation in WebView.
       Reported by Google.
     - CVE-2026-11098: Insufficient validation of untrusted input in GPU.
       Reported by Google.
     - CVE-2026-11099: Vulnerability in Skia. Reported by Google.
     - CVE-2026-11100: Use after free in File Input. Reported by Google.
     - CVE-2026-11101: Uninitialized Use in Dawn. Reported by Google.
     - CVE-2026-11102: Inappropriate implementation in Isolated Web Apps.
       Reported by Google.
     - CVE-2026-11103: Inappropriate implementation in Installer.
       Reported by Google.
     - CVE-2026-11104: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11105: Insufficient validation of untrusted input in WebUI.
       Reported by Google.
     - CVE-2026-11106: Inappropriate implementation in Media.
       Reported by Google.
     - CVE-2026-11107: Inappropriate implementation in Downloads.
       Reported by Google.
     - CVE-2026-11108: Inappropriate implementation in NFC. Reported by Google
     - CVE-2026-11109: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11110: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11111: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-11112: Insufficient validation of untrusted input
       in Chromoting. Reported by Google.
     - CVE-2026-11113: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-11114: Use after free in Device Trust. Reported by Google.
     - CVE-2026-11115: Use after free in Updater. Reported by Google.
     - CVE-2026-11116: Use after free in Chromoting. Reported by Google.
     - CVE-2026-11117: Use after free in Views. Reported by Google.
     - CVE-2026-11118: Use after free in WebRTC. Reported by Google.
     - CVE-2026-11119: Insufficient validation of untrusted input in GPU.
       Reported by Google.
     - CVE-2026-11120: Insufficient validation of untrusted input
       in Enterprise Reporting. Reported by Google.
     - CVE-2026-11121: Insufficient validation of untrusted input in Skia.
       Reported by Google.
     - CVE-2026-11122: Inappropriate implementation in Keyboard.
       Reported by Google.
     - CVE-2026-11123: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11124: Heap buffer overflow in Skia. Reported by Google.
     - CVE-2026-11125: Use after free in Compositing. Reported by Google.
     - CVE-2026-11126: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-11127: Inappropriate implementation in WebAPKs.
       Reported by Google.
     - CVE-2026-11128: Insufficient validation of untrusted input
       in Web Share. Reported by Google.
     - CVE-2026-11129: Inappropriate implementation in Extensions.
       Reported by Google.
     - CVE-2026-11130: Use after free in Media. Reported by Google.
     - CVE-2026-11131: Use after free in Autofill. Reported by Google.
     - CVE-2026-11132: Policy bypass in Paint. Reported by Google.
     - CVE-2026-11133: Insufficient policy enforcement in Paint.
       Reported by Google.
     - CVE-2026-11134: Insufficient data validation in Media.
       Reported by Google.
     - CVE-2026-11135: Insufficient policy enforcement in Autofill.
       Reported by Google.
     - CVE-2026-11136: Use after free in Canvas.
       Reported by Jungwoo Lee (@physicube) and Wongi Lee (@_qwerty_po).
     - CVE-2026-11137: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11138: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11139: Policy bypass in Paint. Reported by Google.
     - CVE-2026-11140: Insufficient validation of untrusted input
       in Chromecast. Reported by Google.
     - CVE-2026-11141: Uninitialized Use in Audio. Reported by Google.
     - CVE-2026-11142: Policy bypass in Paint. Reported by Google.
     - CVE-2026-11143: Heap buffer overflow in Extensions. Reported by Google.
     - CVE-2026-11144: Use after free in Media. Reported by Google.
     - CVE-2026-11145: Race in Geolocation. Reported by Google.
     - CVE-2026-11146: Insufficient validation of untrusted input
       in Chromoting. Reported by Google.
     - CVE-2026-11147: Use after free in WebML. Reported by Google.
     - CVE-2026-11148: Inappropriate implementation in Payments.
       Reported by Google.
     - CVE-2026-11149: Insufficient validation of untrusted input
       in Extensions. Reported by Google.
     - CVE-2026-11150: Inappropriate implementation in XML. Reported by Google
     - CVE-2026-11151: Insufficient validation of untrusted input
       in Password Manager. Reported by Google.
     - CVE-2026-11152: Object lifecycle issue in Dawn. Reported by Google.
     - CVE-2026-11153: Side-channel information leakage in Forms.
       Reported by Google.
     - CVE-2026-11154: Use after free in Dawn. Reported by Google.
     - CVE-2026-11155: Insufficient policy enforcement in CSS.
       Reported by Google.
     - CVE-2026-11156: Inappropriate implementation in CSS. Reported by Google
     - CVE-2026-11157: Script injection in Accessibility. Reported by Google.
     - CVE-2026-11158: Insufficient validation of untrusted input in
       Downloads. Reported by Google.
     - CVE-2026-11159: Uninitialized Use in Skia. Reported by Google.
     - CVE-2026-11160: Out of bounds read in Input. Reported by Google.
     - CVE-2026-11161: Insufficient data validation in DataTransfer.
       Reported by Google.
     - CVE-2026-11162: Insufficient policy enforcement in CSS.
       Reported by Google.
     - CVE-2026-11163: Use after free in Messages. Reported by Google.
     - CVE-2026-11164: Use after free in Blink. Reported by Google.
     - CVE-2026-11165: Use after free in WebMIDI. Reported by Google.
     - CVE-2026-11166: Inappropriate implementation in SVG. Reported by Google
     - CVE-2026-11167: Inappropriate implementation in WebView.
       Reported by Google.
     - CVE-2026-11168: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-11169: Inappropriate implementation in XML. Reported by Google
     - CVE-2026-11170: Inappropriate implementation in Chromoting.
       Reported by Google.
     - CVE-2026-11171: Integer overflow in Blink. Reported by Google.
     - CVE-2026-11172: Incorrect security UI in Contact Picker.
       Reported by mochazril.ti@gmail.com.
     - CVE-2026-11173: Out of bounds write in V8. Reported by Google.
     - CVE-2026-11174: Insufficient policy enforcement in Site Isolation.
       Reported by Google.
     - CVE-2026-11175: Incorrect security UI in Messages. Reported by Google.
     - CVE-2026-11176: Inappropriate implementation in Media.
       Reported by Google.
     - CVE-2026-11177: Use after free in Omnibox. Reported by gevakun.
     - CVE-2026-11178: Policy bypass in WebView. Reported by Google.
     - CVE-2026-11179: Inappropriate implementation in ORB. Reported by Google
     - CVE-2026-11180: Policy bypass in SVG. Reported by Google.
     - CVE-2026-11181: Inappropriate implementation in Media Session.
       Reported by Google.
     - CVE-2026-11182: Inappropriate implementation in SVG. Reported by Google
     - CVE-2026-11183: Out of bounds read in GWP-ASan. Reported by Google.
     - CVE-2026-11184: Insufficient policy enforcement in Actor.
       Reported by Google.
     - CVE-2026-11185: Use after free in V8. Reported by Google.
     - CVE-2026-11186: Inappropriate implementation in CSS. Reported by Google
     - CVE-2026-11187: Insufficient policy enforcement in Glic.
       Reported by Google.
     - CVE-2026-11188: Use after free in USB. Reported by Google.
     - CVE-2026-11189: Insufficient validation of untrusted input in DevTools.
       Reported by lebr0nli of National Yang Ming Chiao Tung University,
       Dept. of CS, Security and Systems Lab.
     - CVE-2026-11190: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-11191: Out of bounds memory access in ANGLE.
       Reported by Google.
     - CVE-2026-11192: Insufficient validation of untrusted input
       in Password Manager. Reported by Google.
     - CVE-2026-11193: Insufficient policy enforcement in Password Manager.
       Reported by Google.
     - CVE-2026-11194: Inappropriate implementation in Network.
       Reported by Google.
     - CVE-2026-11195: Inappropriate implementation in MHTML.
       Reported by Google.
     - CVE-2026-11196: Type Confusion in XML. Reported by Google.
     - CVE-2026-11197: Insufficient policy enforcement in Workers.
       Reported by VEZEKA.
     - CVE-2026-11198: Insufficient validation of untrusted input in Codecs.
       Reported by Google.
     - CVE-2026-11199: Insufficient validation of untrusted input in WebRTC.
       Reported by Google.
     - CVE-2026-11200: Inappropriate implementation in WebRTC.
       Reported by Google.
     - CVE-2026-11201: Use after free in ServiceWorker.
       Reported by Weipeng Jiang (@Krace) of VRI.
     - CVE-2026-11202: Insufficient validation of untrusted input
       in Chrome for iOS. Reported by Google.
     - CVE-2026-11203: Policy bypass in GPU. Reported by Google.
     - CVE-2026-11204: Inappropriate implementation in Signin.
       Reported by Google.
     - CVE-2026-11205: Insufficient validation of untrusted input
       in Chrome for iOS. Reported by Google.
     - CVE-2026-11206: Policy bypass in ServiceWorker.
       Reported by David Bors, Catalin Iovita.
     - CVE-2026-11207: Insufficient validation of untrusted input in Autofill.
       Reported by Google.
     - CVE-2026-11208: Use after free in Codecs. Reported by Google.
     - CVE-2026-11209: Insufficient policy enforcement in Passwords.
       Reported by Google.
     - CVE-2026-11210: Insufficient policy enforcement in Safe Browsing.
       Reported by Google.
     - CVE-2026-11211: Integer overflow in V8. Reported by Google.
     - CVE-2026-11212: Insufficient policy enforcement in DevTools.
       Reported by Google.
     - CVE-2026-11213: Insufficient validation of untrusted input
       in Reading Mode. Reported by Google.
     - CVE-2026-11214: Inappropriate implementation in Chrome for iOS.
       Reported by Google.
     - CVE-2026-11215: Inappropriate implementation in Cronet.
       Reported by Google.
     - CVE-2026-11216: Incorrect security UI in File Input.
       Reported by Azza Tegar Naufal Ataullah.
     - CVE-2026-11217: Insufficient policy enforcement in Fenced Frames.
       Reported by Tianyi Hu.
     - CVE-2026-11218: Inappropriate implementation in PlatformIntegration.
       Reported by Han Liu (Xi’an Jiaotong University, School of
       Cyber Science and Engineering).
     - CVE-2026-11219: Insufficient data validation in Navigation.
       Reported by Bharat (mrnoob) .
     - CVE-2026-11220: Insufficient validation of untrusted input in
       Navigation. Reported by Tianyi Hu.
     - CVE-2026-11221: Insufficient validation of untrusted input
       in PointerLock. Reported by mihalis.haatainen@bountyy.fi.
     - CVE-2026-11222: Incorrect security UI in Tab Strip. Reported by Hafiizh
     - CVE-2026-11223: Insufficient validation of untrusted input in Network.
       Reported by Tianyi Hu.
     - CVE-2026-11224: Use after free in Chromoting.
       Reported by David Bors, Catalin Iovita.
     - CVE-2026-11225: Incorrect security UI in WebUI.
       Reported by Tareq Ahamed - itztrq.
     - CVE-2026-11226: Insufficient policy enforcement in PreviewTab.
       Reported by Google.
     - CVE-2026-11227: Incorrect security UI in Tab Hover Cards.
       Reported by Hafiizh.
     - CVE-2026-11228: Incorrect security UI in File Input.
       Reported by Umar Farooq .
     - CVE-2026-11229: Insufficient policy enforcement in Enterprise.
       Reported by Povcfe of Tencent Security Xuanwu Lab.
     - CVE-2026-11230: Use after free in Extensions. Reported by Google.
     - CVE-2026-11231: Inappropriate implementation in Safe Browsing.
       Reported by Google.
     - CVE-2026-11232: Inappropriate implementation in TabGroups.
       Reported by Google.
     - CVE-2026-11233: Insufficient validation of untrusted input in
       FoldableAPIs. Reported by Google.
     - CVE-2026-11234: Insufficient policy enforcement in FoldableAPIs.
       Reported by Google.
     - CVE-2026-11235: Insufficient validation of untrusted input
       in Compositing. Reported by Google.
     - CVE-2026-11236: Insufficient policy enforcement in Web Bluetooth.
       Reported by Google.
     - CVE-2026-11237: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-11238: Inappropriate implementation in DevTools.
       Reported by Google.
     - CVE-2026-11239: Insufficient validation of untrusted input in
       Extensions. Reported by Google.
     - CVE-2026-11240: Insufficient validation of untrusted input in Loader.
       Reported by Google.
     - CVE-2026-11241: Insufficient validation of untrusted input in Cast.
       Reported by Google.
     - CVE-2026-11242: Insufficient validation of untrusted input in Plugins.
       Reported by Google.
     - CVE-2026-11243: Incorrect security UI in Downloads. Reported by Google.
     - CVE-2026-11244: Insufficient validation of untrusted input in
       WebAuthentication. Reported by Google.
     - CVE-2026-11245: Inappropriate implementation in Payments.
       Reported by Google.
     - CVE-2026-11246: Insufficient validation of untrusted input in
       IndexedDB. Reported by Google.
     - CVE-2026-11247: Insufficient policy enforcement in CustomTabs.
       Reported by Google.
     - CVE-2026-11248: Policy bypass in Google Lens. Reported by Google.
     - CVE-2026-11249: Use after free in Network. Reported by Google.
     - CVE-2026-11250: Inappropriate implementation in DevTools.
       Reported by Google.
     - CVE-2026-11251: Insufficient validation of untrusted input in
       Password Manager. Reported by Google.
     - CVE-2026-11252: Policy bypass in Content Settings. Reported by Google.
     - CVE-2026-11253: Race in Permissions. Reported by Google.
     - CVE-2026-11254: Inappropriate implementation in Permissions.
       Reported by Google.
     - CVE-2026-11255: Insufficient validation of untrusted input in
       Storage Access API. Reported by Google.
     - CVE-2026-11256: Out of bounds read in GPU. Reported by Google.
     - CVE-2026-11257: Inappropriate implementation in Browser.
       Reported by Google.
     - CVE-2026-11258: Inappropriate implementation in File System Access.
       Reported by Google.
     - CVE-2026-11259: Insufficient validation of untrusted input in Cast.
       Reported by Google.
     - CVE-2026-11260: Policy bypass in Permissions. Reported by Google.
     - CVE-2026-11261: Insufficient validation of untrusted input in PDF.
       Reported by Google.
     - CVE-2026-11262: Use after free in TabStrip. Reported by Google.
     - CVE-2026-11263: Insufficient policy enforcement in WebAuthentication.
       Reported by Google.
     - CVE-2026-11264: Policy bypass in Content Security Policy.
       Reported by Google.
     - CVE-2026-11265: Insufficient data validation in Autofill.
       Reported by Google.
     - CVE-2026-11266: Policy bypass in SafeBrowsing. Reported by Google.
     - CVE-2026-11267: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-11268: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11269: Inappropriate implementation in Extensions.
       Reported by Google.
     - CVE-2026-11270: Inappropriate implementation in UI. Reported by Google.
     - CVE-2026-11271: Incorrect security UI in Passwords. Reported by Google.
     - CVE-2026-11272: Insufficient validation of untrusted input in
       Reading List. Reported by Google.
     - CVE-2026-11273: Insufficient validation of untrusted input in Omnibox.
       Reported by Google.
     - CVE-2026-11274: Inappropriate implementation in DOM Distiller.
       Reported by Google.
     - CVE-2026-11275: Insufficient policy enforcement in Page Info.
       Reported by Google.
     - CVE-2026-11276: Inappropriate implementation in Cast. Reported by Google
     - CVE-2026-11277: Insufficient policy enforcement in Chrome for iOS.
       Reported by Google.
     - CVE-2026-11278: Inappropriate implementation in CustomTabs.
       Reported by Google.
     - CVE-2026-11279: Out of bounds read in DevTools. Reported by Google.
     - CVE-2026-11280: Insufficient validation of untrusted input in Signin.
       Reported by Google.
     - CVE-2026-11281: Integer overflow in Chromoting. Reported by Google.
     - CVE-2026-11282: Policy bypass in Sandbox. Reported by Google.
     - CVE-2026-11283: Policy bypass in Shortcuts. Reported by Google.
     - CVE-2026-11284: Side-channel information leakage in PerformanceAPIs.
       Reported by Google.
     - CVE-2026-11285: Insufficient policy enforcement in Chrome for iOS.
       Reported by Google.
     - CVE-2026-11286: Insufficient validation of untrusted input in Wallet.
       Reported by Google.
     - CVE-2026-11287: Insufficient validation of untrusted input in
       Navigation. Reported by Google.
     - CVE-2026-11288: Policy bypass in CSS. Reported by Google.
     - CVE-2026-11289: Side-channel information leakage in Paint.
       Reported by Google.
     - CVE-2026-11290: Integer overflow in WebView. Reported by Google.
     - CVE-2026-11291: Policy bypass in Android Autofill. Reported by Google.
     - CVE-2026-11292: Policy bypass in Blink. Reported by Google.
     - CVE-2026-11293: Use after free in Input.
       Reported by Weipeng Jiang (@Krace) of VRI.
     - CVE-2026-11294: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-11295: Inappropriate implementation in WebView.
       Reported by Google.
     - CVE-2026-11296: Inappropriate implementation in ImageCapture.
       Reported by Google.
     - CVE-2026-11297: Insufficient validation of untrusted input in
       Reader Mode. Reported by Google.
     - CVE-2026-11298: Insufficient policy enforcement in Chrome for iOS.
       Reported by Google.
     - CVE-2026-11299: Out of bounds read in Fonts.
       Reported by sharadboni@gmail.com.
     - CVE-2026-11300: Inappropriate implementation in Permissions.
       Reported by Google.
     - CVE-2026-11301: Out of bounds read in LiveCaption. Reported by Google.
     - CVE-2026-11302: Insufficient policy enforcement in Chrome for iOS.
       Reported by Google.
     - CVE-2026-11303: Use after free in PDFium. Reported by Google.
     - CVE-2026-11304: Use after free in PDFium. Reported by Google.
     - CVE-2026-11305: Use after free in PDFium. Reported by Google.
     - CVE-2026-11306: Use after free in PDFium. Reported by Google.
     - CVE-2026-11307: Use after free in PDFium. Reported by Google.
     - CVE-2026-11308: Inappropriate implementation in Extensions.
       Reported by Google.
     - CVE-2026-11309: Insufficient policy enforcement in History.
       Reported by Google.
   * d/patches:
     - upstream/turboshaft.patch: drop, merged upstream.
     - fixes/enable-widevine-on-arm64-linux-platform.patch: drop, merged
       upstream.
     - debianization/clang-version.patch: refresh.
     - fixes/armhf-icf.patch: refresh.
     - disable/catapult.patch: refresh.
     - llvm-19/clang19.patch: add more bits to drop unsupported warning and
       diagnostic flags.
     - trixie/gn-inputs.patch: drop portion of patch due to upstream changes.
     - trixie/gn-inputs2.patch: refresh.
     - bookworm/bindgen.patch: drop due to upgraded bindgen [sid, trixie].
     - bookworm/gn-allowlist.patch: drop due to upgraded generate-ninja [sid,
       trixie].
     - llvm-22/ignore-for-ubsan.patch: update for upstream reworking.
     - ungoogled/disable-ai.patch: sync from u-c.
     - ungoogled/disable-privacy-sandbox.patch: sync from u-c.
     - ungoogled/remove-navigation-source-param.patch: sync from u-c.
     - trixie/gn-expand-dir-allowlist.patch: add new patch to work around
       older generate-ninja.
     - fixes/libcpp-headers.patch: update for upstream changes reworking how
       this was done.
     - disable/libei.patch: add patch to fix build failure due to libei
       removal.
     - llvm-19/value-or.patch: add another clang-19 build workaround.
     - llvm-19/const-profile.patch: add patch to work around const-related
       clang-19 build failure.
     - rust-1.85/file_as_c_str.patch: rework patch due to upstream changes
       [trixie, bookworm].
     - rust-1.85/zip8.patch: refresh [trixie, bookworm].
     - bookworm/dav1d-drop-hdr.patch: refresh [bookworm].
   * d/copyright: properly delete harfbuzz (due to harfbuzz-ng rename).
 .
   [ Daniel Richard G. ]
   * d/patches:
     - bookworm/bindgen.patch: Refresh [bookworm].
     - bookworm/gn-absl.patch: Update absl_source_set("no_destructor") with
       visibility directive, and refresh [bookworm].
     - rust-1.85/mojo-features.patch: Add feature to new Rust source file
       [trixie, bookworm].
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0002-third_party-libvpx-Remove-bad-ppc64-config.patch:
       refresh for upstream changes
     - third_party/0002-regenerate-xnn-buildgn.patch: refresh for upstream
       changes
     - third_party/0005-blink-add-audio-vector-support.patch: refresh for
       upstream changes
     - libaom/0001-Add-pregenerated-config-for-libaom-on-ppc64.patch: regenerate
     - third_party/0003-third_party-libvpx-Add-ppc64-generated-config.patch:
       regenerate
     - third_party/0001-third_party-libvpx-Disable-vsx-on-ppc64.patch: ensure
       VSX is disabled until VP9 artifacting can be fixed upstream
 .
   [ Jianfeng Liu ]
   * d/patches:
     - upstream/0001-Fix-build-for-CPU-yield-on-LoongArch.patch: This is a
       patch aleady merged to v150 to fix build on loongarch64.
     - loongarch64/0024-fix-libyuv-lsx.patch: Upstream has bumped the version
       of libyuv and it has broken build with lsx enabled on loongarch64. Add
       a patch to fix the build first.
chromium (149.0.7827.53-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream stable release.
     - CVE-2026-10881: Out of bounds read and write in ANGLE.
       Reported by Anonymous.
     - CVE-2026-10882: Use after free in Network.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-10883: Out of bounds write in ANGLE. Reported by Maher Azzouzi.
     - CVE-2026-10884: Use after free in Chromecast. Reported by Google.
     - CVE-2026-10885: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-10886: Use after free in FileSystem. Reported by Andrew Boni.
     - CVE-2026-10887: Use after free in Chromoting. Reported by Google.
     - CVE-2026-10888: Use after free in Cast Streaming. Reported by Google.
     - CVE-2026-10889: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-10890: Use after free in Cast. Reported by Google.
     - CVE-2026-10891: Use after free in GFX. Reported by Google.
     - CVE-2026-10892: Out of bounds write in GPU. Reported by Google.
     - CVE-2026-10893: Use after free in Chromoting. Reported by Google.
     - CVE-2026-10894: Use after free in Printing. Reported by Google.
     - CVE-2026-10895: Use after free in Ozone. Reported by Google.
     - CVE-2026-10896: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-10897: Out of bounds write in GPU. Reported by Google.
     - CVE-2026-10898: Stack buffer overflow in GPU. Reported by Google.
     - CVE-2026-10899: Use after free in Ozone. Reported by Google.
     - CVE-2026-10900: Use after free in Passwords. Reported by Google.
     - CVE-2026-10901: Use after free in Passwords. Reported by Google.
     - CVE-2026-10902: Use after free in Ozone. Reported by Google.
     - CVE-2026-10903: Use after free in WebRTC.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-10904: Inappropriate implementation in V8. Reported by 303f06e3
     - CVE-2026-10905: Use after free in Network.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-10906: Use after free in WebAuthentication.
       Reported by Weipeng Jiang (@Krace) of VRI.
     - CVE-2026-10907: Out of bounds write in ANGLE. Reported by sweetchip.
     - CVE-2026-10908: Use after free in FullScreen. Reported by Mihnea Nicolau
     - CVE-2026-10909: Use after free in Dawn. Reported by whiter@xuanyusec.
     - CVE-2026-10910: Type Confusion in V8.
       Reported by Mufeed VH from Winfunc Research (winfunc.com).
     - CVE-2026-10911: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-10912: Insufficient validation of untrusted input
       in Extensions. Reported by Google.
     - CVE-2026-10913: Use after free in ANGLE. Reported by Google.
     - CVE-2026-10914: Use after free in ANGLE. Reported by Google.
     - CVE-2026-10915: Use after free in Core. Reported by Google.
     - CVE-2026-10916: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-10917: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-10918: Use after free in Viz. Reported by Google.
     - CVE-2026-10919: Use after free in ANGLE. Reported by Google.
     - CVE-2026-10920: Insufficient validation of untrusted input in WebShare.
       Reported by Google.
     - CVE-2026-10921: Integer overflow in Dawn. Reported by Google.
     - CVE-2026-10922: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-10923: Use after free in WebAppInstalls. Reported by Google.
     - CVE-2026-10924: Integer overflow in Chromecast. Reported by Google.
     - CVE-2026-10925: Out of bounds write in Skia. Reported by Google.
     - CVE-2026-10926: Use after free in Cast. Reported by Google.
     - CVE-2026-10927: Out of bounds read in Dawn. Reported by Google.
     - CVE-2026-10928: Script injection in Headless. Reported by Google.
     - CVE-2026-10929: Heap buffer overflow in ANGLE. Reported by Google.
     - CVE-2026-10930: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-10931: Use after free in FileSystem. Reported by asjidkalam.
     - CVE-2026-10932: Use after free in UI. Reported by Google.
     - CVE-2026-10933: Use after free in Audio. Reported by Google.
     - CVE-2026-10934: Use after free in Autofill. Reported by Google.
     - CVE-2026-10935: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-10936: Type Confusion in V8. Reported by Google.
     - CVE-2026-10937: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-10938: Insufficient validation of untrusted input in Input.
       Reported by Google.
     - CVE-2026-10939: Use after free in WebRTC. Reported by Google.
     - CVE-2026-10940: Race in Codecs. Reported by Google.
     - CVE-2026-10941: Out of bounds memory access in Skia. Reported by Google.
     - CVE-2026-10942: Insufficient validation of untrusted input in UI.
       Reported by Google.
     - CVE-2026-10943: Use after free in WebRTC. Reported by Rayyan Kadar.
     - CVE-2026-10944: Insufficient policy enforcement in Autofill.
       Reported by Google.
     - CVE-2026-10945: Use after free in PDF. Reported by Google.
     - CVE-2026-10946: Heap buffer overflow in Media. Reported by Google.
     - CVE-2026-10947: Use after free in WebRTC. Reported by Google.
     - CVE-2026-10948: Use after free in WebRTC. Reported by Google.
     - CVE-2026-10949: Heap buffer overflow in Video. Reported by Google.
     - CVE-2026-10950: Insufficient policy enforcement in Autofill.
       Reported by Google.
     - CVE-2026-10951: Use after free in Autofill. Reported by Google.
     - CVE-2026-10952: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-10953: Use after free in Core. Reported by Google.
     - CVE-2026-10954: Use after free in Actor. Reported by Google.
     - CVE-2026-10955: Type Confusion in ANGLE. Reported by Google.
     - CVE-2026-10956: Use after free in MimeHandlerView. Reported by Google.
     - CVE-2026-10957: Use after free in Glic. Reported by Google.
     - CVE-2026-10958: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-10959: Use after free in Input. Reported by Google.
     - CVE-2026-10960: Uninitialized Use in Codecs. Reported by Google.
     - CVE-2026-10961: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-10962: Type Confusion in Media. Reported by Google.
     - CVE-2026-10963: Integer overflow in V8. Reported by Google.
     - CVE-2026-10964: Integer overflow in V8. Reported by Google.
     - CVE-2026-10965: Integer overflow in DevTools. Reported by Google.
     - CVE-2026-10966: Insufficient validation of untrusted input in Codecs.
       Reported by Google.
     - CVE-2026-10967: Use after free in SurfaceCapture. Reported by Google.
     - CVE-2026-10968: Insufficient validation of untrusted input in Dawn.
       Reported by Google.
     - CVE-2026-10969: Insufficient validation of untrusted input in Extensions
       Reported by Google.
     - CVE-2026-10970: Insufficient validation of untrusted input
       in InterestGroups. Reported by Google.
     - CVE-2026-10971: Insufficient validation of untrusted input in Printing.
       Reported by Google.
     - CVE-2026-10972: Use after free in Ozone. Reported by Google.
     - CVE-2026-10973: Uninitialized Use in Dawn. Reported by Google.
     - CVE-2026-10974: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-10975: Use after free in WebRTC. Reported by Google.
     - CVE-2026-10976: Uninitialized Use in Dawn. Reported by Google.
     - CVE-2026-10977: Uninitialized Use in Skia. Reported by Google.
     - CVE-2026-10978: Use after free in Chromoting. Reported by Google.
     - CVE-2026-10979: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-10980: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-10981: Insufficient validation of untrusted input in Codecs.
       Reported by Google.
     - CVE-2026-10982: Use after free in WebXR. Reported by Google.
     - CVE-2026-10983: Insufficient validation of untrusted input in Dawn.
       Reported by Google.
     - CVE-2026-10984: Inappropriate implementation in Accessibility.
       Reported by Google.
     - CVE-2026-10985: Out of bounds read in Skia. Reported by Google.
     - CVE-2026-10986: Integer overflow in Media. Reported by Google.
     - CVE-2026-10987: Integer overflow in V8. Reported by Google.
     - CVE-2026-10988: Use after free in Views. Reported by Google.
     - CVE-2026-10989: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-10990: Use after free in Glic.
       Reported by Weipeng Jiang (@Krace) of VRI.
     - CVE-2026-10991: Use after free in V8.
       Reported by Alisa Esage (@alisaesage).
     - CVE-2026-10992: Insufficient data validation in Animation.
       Reported by heapracer (@heapracer).
     - CVE-2026-10993: Heap buffer overflow in Skia.
       Reported by M. Fauzan Wijaya (Gh05t666nero).
     - CVE-2026-10994: Uninitialized Use in ANGLE.
       Reported by Mufeed VH from Winfunc Research (winfunc.com).
     - CVE-2026-10995: Heap buffer overflow in TabStrip.
       Reported by Sven Dysthe (@svn-dys).
     - CVE-2026-10996: Inappropriate implementation in Workers.
       Reported by Jayateertha Guruprasad.
     - CVE-2026-10997: Insufficient policy enforcement in Extensions.
       Reported by djallalakira@gmail.com.
     - CVE-2026-10998: Out of bounds read in Media. Reported by Ameen Basha M K
     - CVE-2026-10999: Out of bounds memory access in ANGLE.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-11000: Use after free in Fonts.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-11001: Incorrect security UI in Payments. Reported by Google.
     - CVE-2026-11002: Use after free in Autofill.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-11003: Use after free in WebRTC.
       Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab.
     - CVE-2026-11004: Out of bounds read in ANGLE.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-11005: Out of bounds read in ANGLE.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-11006: Out of bounds read in Dawn. Reported by Google.
     - CVE-2026-11007: Insufficient validation of untrusted input in WebView.
       Reported by Google.
     - CVE-2026-11008: Insufficient validation of untrusted input
       in WebAppInstalls. Reported by Google.
     - CVE-2026-11009: Use after free in USB. Reported by Google.
     - CVE-2026-11010: Use after free in WebShare. Reported by David Sievers.
     - CVE-2026-11011: Insufficient policy enforcement in Password Manager.
       Reported by Google.
     - CVE-2026-11012: Use after free in Serial. Reported by Google.
     - CVE-2026-11013: Insufficient validation of untrusted input in Network.
       Reported by Google.
     - CVE-2026-11014: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-11015: Out of bounds read in WebGPU. Reported by Yuma Takeuchi.
     - CVE-2026-11016: Insufficient validation of untrusted input in Network.
       Reported by Google.
     - CVE-2026-11017: Inappropriate implementation in Link Preview.
       Reported by Google.
     - CVE-2026-11018: Insufficient policy enforcement in Actor.
       Reported by Google.
     - CVE-2026-11019: Inappropriate implementation in Payments.
       Reported by Google.
     - CVE-2026-11020: Inappropriate implementation in Extensions.
       Reported by Google.
     - CVE-2026-11021: Insufficient validation of untrusted input in GPU.
       Reported by Google.
     - CVE-2026-11022: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-11023: Insufficient validation of untrusted input
       in WebAppInstalls. Reported by Google.
     - CVE-2026-11024: Stack buffer overflow in Skia. Reported by Google.
     - CVE-2026-11025: Insufficient policy enforcement in Navigation.
       Reported by Google.
     - CVE-2026-11026: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-11027: Insufficient validation of untrusted input in Glic.
       Reported by Google.
     - CVE-2026-11028: Use after free in Media. Reported by Google.
     - CVE-2026-11029: Insufficient validation of untrusted input
       in Drag and Drop. Reported by Google.
     - CVE-2026-11030: Use after free in Network. Reported by Google.
     - CVE-2026-11031: Insufficient validation of untrusted input
       in Password Manager. Reported by Google.
     - CVE-2026-11032: Insufficient data validation in Password Manager.
       Reported by Google.
     - CVE-2026-11033: Uninitialized Use in WebML. Reported by Google.
     - CVE-2026-11034: Insufficient validation of untrusted input
       in Tab Group Sync. Reported by Google.
     - CVE-2026-11035: Insufficient validation of untrusted input
       in Custom Tabs. Reported by Google.
     - CVE-2026-11036: Inappropriate implementation in DOM. Reported by Google
     - CVE-2026-11037: Out of bounds write in Codecs. Reported by Google.
     - CVE-2026-11038: Insufficient validation of untrusted input
       in Subresource Integrity. Reported by Google.
     - CVE-2026-11039: Uninitialized Use in Skia. Reported by Google.
     - CVE-2026-11040: Use after free in ANGLE. Reported by Google.
     - CVE-2026-11041: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-11042: Use after free in Views. Reported by Google.
     - CVE-2026-11043: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-11044: Integer overflow in ANGLE. Reported by Google.
     - CVE-2026-11045: Insufficient validation of untrusted input in GPU.
       Reported by Google.
     - CVE-2026-11046: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-11047: Insufficient validation of untrusted input in Base.
       Reported by Google.
     - CVE-2026-11048: Inappropriate implementation in Extensions.
       Reported by Google.
     - CVE-2026-11049: Use after free in Password Manager. Reported by Google.
     - CVE-2026-11050: Use after free in V8. Reported by Google.
     - CVE-2026-11051: Out of bounds read in ANGLE.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-11052: Type Confusion in GPU. Reported by Google.
     - CVE-2026-11053: VULNERABILITY in WebRTC. Reported by Google.
     - CVE-2026-11054: Use after free in WebRTC. Reported by Google.
     - CVE-2026-11055: Use after free in ANGLE. Reported by Google.
     - CVE-2026-11056: Insufficient validation of untrusted input
       in SiteIsolation. Reported by Google.
     - CVE-2026-11057: Uninitialized Use in Skia. Reported by Google.
     - CVE-2026-11058: Integer overflow in CredentialProvider.
       Reported by Google.
     - CVE-2026-11059: Use after free in Blink. Reported by Google.
     - CVE-2026-11060: Use after free in Media. Reported by Google.
     - CVE-2026-11061: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-11062: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-11063: Insufficient validation of untrusted input in WebNN.
       Reported by Google.
     - CVE-2026-11064: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-11065: Use after free in ANGLE. Reported by Google.
     - CVE-2026-11066: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-11067: Uninitialized Use in Dawn. Reported by Google.
     - CVE-2026-11068: Use after free in WebSockets. Reported by Google.
     - CVE-2026-11069: Insufficient validation of untrusted input in Cast.
       Reported by Google.
     - CVE-2026-11070: Insufficient validation of untrusted input in Chromoting
       Reported by Google.
     - CVE-2026-11071: Use after free in Base. Reported by Google.
     - CVE-2026-11072: Use after free in WebView. Reported by Google.
     - CVE-2026-11073: Use after free in WebGL. Reported by Google.
     - CVE-2026-11074: Use after free in WebRTC.
       Reported by boboliverfrancishoward@gmail.com.
     - CVE-2026-11075: Out of bounds read in V8.
       Reported by JunYoung Park(@candymate) of KAIST Hacking Lab.
     - CVE-2026-11076: Type Confusion in CSS. Reported by Google.
     - CVE-2026-11077: Out of bounds read in Dawn. Reported by Anonymous.
     - CVE-2026-11078: Insufficient validation of untrusted input
       in FileSystem. Reported by Eran Rom of Palo Alto Networks.
     - CVE-2026-11079: Insufficient validation of untrusted input in Codecs.
       Reported by Google.
     - CVE-2026-11080: Use after free in WebView. Reported by Google.
     - CVE-2026-11081: Policy bypass in Canvas. Reported by Google.
     - CVE-2026-11082: Use after free in GPU. Reported by Google.
     - CVE-2026-11083: Inappropriate implementation in Password Manager.
       Reported by Google.
     - CVE-2026-11084: Inappropriate implementation in Password Manager.
       Reported by Google.
     - CVE-2026-11085: Integer overflow in GPU. Reported by Google.
     - CVE-2026-11086: Insufficient validation of untrusted input in Dawn.
       Reported by Google.
     - CVE-2026-11087: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11088: Integer overflow in ANGLE. Reported by Google.
     - CVE-2026-11089: Uninitialized Use in Media. Reported by Google.
     - CVE-2026-11090: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11091: Inappropriate implementation in Dawn. Reported by Google
     - CVE-2026-11092: Insufficient policy enforcement in DevTools.
       Reported by Google.
     - CVE-2026-11093: Insufficient validation of untrusted input in Printing.
       Reported by Google.
     - CVE-2026-11094: Use after free in Codecs. Reported by Google.
     - CVE-2026-11095: Insufficient validation of untrusted input in Codecs.
       Reported by Google.
     - CVE-2026-11096: Out of bounds read in WebRTC. Reported by Google.
     - CVE-2026-11097: Inappropriate implementation in WebView.
       Reported by Google.
     - CVE-2026-11098: Insufficient validation of untrusted input in GPU.
       Reported by Google.
     - CVE-2026-11099: Vulnerability in Skia. Reported by Google.
     - CVE-2026-11100: Use after free in File Input. Reported by Google.
     - CVE-2026-11101: Uninitialized Use in Dawn. Reported by Google.
     - CVE-2026-11102: Inappropriate implementation in Isolated Web Apps.
       Reported by Google.
     - CVE-2026-11103: Inappropriate implementation in Installer.
       Reported by Google.
     - CVE-2026-11104: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11105: Insufficient validation of untrusted input in WebUI.
       Reported by Google.
     - CVE-2026-11106: Inappropriate implementation in Media.
       Reported by Google.
     - CVE-2026-11107: Inappropriate implementation in Downloads.
       Reported by Google.
     - CVE-2026-11108: Inappropriate implementation in NFC. Reported by Google
     - CVE-2026-11109: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11110: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11111: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-11112: Insufficient validation of untrusted input
       in Chromoting. Reported by Google.
     - CVE-2026-11113: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-11114: Use after free in Device Trust. Reported by Google.
     - CVE-2026-11115: Use after free in Updater. Reported by Google.
     - CVE-2026-11116: Use after free in Chromoting. Reported by Google.
     - CVE-2026-11117: Use after free in Views. Reported by Google.
     - CVE-2026-11118: Use after free in WebRTC. Reported by Google.
     - CVE-2026-11119: Insufficient validation of untrusted input in GPU.
       Reported by Google.
     - CVE-2026-11120: Insufficient validation of untrusted input
       in Enterprise Reporting. Reported by Google.
     - CVE-2026-11121: Insufficient validation of untrusted input in Skia.
       Reported by Google.
     - CVE-2026-11122: Inappropriate implementation in Keyboard.
       Reported by Google.
     - CVE-2026-11123: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11124: Heap buffer overflow in Skia. Reported by Google.
     - CVE-2026-11125: Use after free in Compositing. Reported by Google.
     - CVE-2026-11126: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-11127: Inappropriate implementation in WebAPKs.
       Reported by Google.
     - CVE-2026-11128: Insufficient validation of untrusted input
       in Web Share. Reported by Google.
     - CVE-2026-11129: Inappropriate implementation in Extensions.
       Reported by Google.
     - CVE-2026-11130: Use after free in Media. Reported by Google.
     - CVE-2026-11131: Use after free in Autofill. Reported by Google.
     - CVE-2026-11132: Policy bypass in Paint. Reported by Google.
     - CVE-2026-11133: Insufficient policy enforcement in Paint.
       Reported by Google.
     - CVE-2026-11134: Insufficient data validation in Media.
       Reported by Google.
     - CVE-2026-11135: Insufficient policy enforcement in Autofill.
       Reported by Google.
     - CVE-2026-11136: Use after free in Canvas.
       Reported by Jungwoo Lee (@physicube) and Wongi Lee (@_qwerty_po).
     - CVE-2026-11137: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11138: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11139: Policy bypass in Paint. Reported by Google.
     - CVE-2026-11140: Insufficient validation of untrusted input
       in Chromecast. Reported by Google.
     - CVE-2026-11141: Uninitialized Use in Audio. Reported by Google.
     - CVE-2026-11142: Policy bypass in Paint. Reported by Google.
     - CVE-2026-11143: Heap buffer overflow in Extensions. Reported by Google.
     - CVE-2026-11144: Use after free in Media. Reported by Google.
     - CVE-2026-11145: Race in Geolocation. Reported by Google.
     - CVE-2026-11146: Insufficient validation of untrusted input
       in Chromoting. Reported by Google.
     - CVE-2026-11147: Use after free in WebML. Reported by Google.
     - CVE-2026-11148: Inappropriate implementation in Payments.
       Reported by Google.
     - CVE-2026-11149: Insufficient validation of untrusted input
       in Extensions. Reported by Google.
     - CVE-2026-11150: Inappropriate implementation in XML. Reported by Google
     - CVE-2026-11151: Insufficient validation of untrusted input
       in Password Manager. Reported by Google.
     - CVE-2026-11152: Object lifecycle issue in Dawn. Reported by Google.
     - CVE-2026-11153: Side-channel information leakage in Forms.
       Reported by Google.
     - CVE-2026-11154: Use after free in Dawn. Reported by Google.
     - CVE-2026-11155: Insufficient policy enforcement in CSS.
       Reported by Google.
     - CVE-2026-11156: Inappropriate implementation in CSS. Reported by Google
     - CVE-2026-11157: Script injection in Accessibility. Reported by Google.
     - CVE-2026-11158: Insufficient validation of untrusted input in
       Downloads. Reported by Google.
     - CVE-2026-11159: Uninitialized Use in Skia. Reported by Google.
     - CVE-2026-11160: Out of bounds read in Input. Reported by Google.
     - CVE-2026-11161: Insufficient data validation in DataTransfer.
       Reported by Google.
     - CVE-2026-11162: Insufficient policy enforcement in CSS.
       Reported by Google.
     - CVE-2026-11163: Use after free in Messages. Reported by Google.
     - CVE-2026-11164: Use after free in Blink. Reported by Google.
     - CVE-2026-11165: Use after free in WebMIDI. Reported by Google.
     - CVE-2026-11166: Inappropriate implementation in SVG. Reported by Google
     - CVE-2026-11167: Inappropriate implementation in WebView.
       Reported by Google.
     - CVE-2026-11168: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-11169: Inappropriate implementation in XML. Reported by Google
     - CVE-2026-11170: Inappropriate implementation in Chromoting.
       Reported by Google.
     - CVE-2026-11171: Integer overflow in Blink. Reported by Google.
     - CVE-2026-11172: Incorrect security UI in Contact Picker.
       Reported by mochazril.ti@gmail.com.
     - CVE-2026-11173: Out of bounds write in V8. Reported by Google.
     - CVE-2026-11174: Insufficient policy enforcement in Site Isolation.
       Reported by Google.
     - CVE-2026-11175: Incorrect security UI in Messages. Reported by Google.
     - CVE-2026-11176: Inappropriate implementation in Media.
       Reported by Google.
     - CVE-2026-11177: Use after free in Omnibox. Reported by gevakun.
     - CVE-2026-11178: Policy bypass in WebView. Reported by Google.
     - CVE-2026-11179: Inappropriate implementation in ORB. Reported by Google
     - CVE-2026-11180: Policy bypass in SVG. Reported by Google.
     - CVE-2026-11181: Inappropriate implementation in Media Session.
       Reported by Google.
     - CVE-2026-11182: Inappropriate implementation in SVG. Reported by Google
     - CVE-2026-11183: Out of bounds read in GWP-ASan. Reported by Google.
     - CVE-2026-11184: Insufficient policy enforcement in Actor.
       Reported by Google.
     - CVE-2026-11185: Use after free in V8. Reported by Google.
     - CVE-2026-11186: Inappropriate implementation in CSS. Reported by Google
     - CVE-2026-11187: Insufficient policy enforcement in Glic.
       Reported by Google.
     - CVE-2026-11188: Use after free in USB. Reported by Google.
     - CVE-2026-11189: Insufficient validation of untrusted input in DevTools.
       Reported by lebr0nli of National Yang Ming Chiao Tung University,
       Dept. of CS, Security and Systems Lab.
     - CVE-2026-11190: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-11191: Out of bounds memory access in ANGLE.
       Reported by Google.
     - CVE-2026-11192: Insufficient validation of untrusted input
       in Password Manager. Reported by Google.
     - CVE-2026-11193: Insufficient policy enforcement in Password Manager.
       Reported by Google.
     - CVE-2026-11194: Inappropriate implementation in Network.
       Reported by Google.
     - CVE-2026-11195: Inappropriate implementation in MHTML.
       Reported by Google.
     - CVE-2026-11196: Type Confusion in XML. Reported by Google.
     - CVE-2026-11197: Insufficient policy enforcement in Workers.
       Reported by VEZEKA.
     - CVE-2026-11198: Insufficient validation of untrusted input in Codecs.
       Reported by Google.
     - CVE-2026-11199: Insufficient validation of untrusted input in WebRTC.
       Reported by Google.
     - CVE-2026-11200: Inappropriate implementation in WebRTC.
       Reported by Google.
     - CVE-2026-11201: Use after free in ServiceWorker.
       Reported by Weipeng Jiang (@Krace) of VRI.
     - CVE-2026-11202: Insufficient validation of untrusted input
       in Chrome for iOS. Reported by Google.
     - CVE-2026-11203: Policy bypass in GPU. Reported by Google.
     - CVE-2026-11204: Inappropriate implementation in Signin.
       Reported by Google.
     - CVE-2026-11205: Insufficient validation of untrusted input
       in Chrome for iOS. Reported by Google.
     - CVE-2026-11206: Policy bypass in ServiceWorker.
       Reported by David Bors, Catalin Iovita.
     - CVE-2026-11207: Insufficient validation of untrusted input in Autofill.
       Reported by Google.
     - CVE-2026-11208: Use after free in Codecs. Reported by Google.
     - CVE-2026-11209: Insufficient policy enforcement in Passwords.
       Reported by Google.
     - CVE-2026-11210: Insufficient policy enforcement in Safe Browsing.
       Reported by Google.
     - CVE-2026-11211: Integer overflow in V8. Reported by Google.
     - CVE-2026-11212: Insufficient policy enforcement in DevTools.
       Reported by Google.
     - CVE-2026-11213: Insufficient validation of untrusted input
       in Reading Mode. Reported by Google.
     - CVE-2026-11214: Inappropriate implementation in Chrome for iOS.
       Reported by Google.
     - CVE-2026-11215: Inappropriate implementation in Cronet.
       Reported by Google.
     - CVE-2026-11216: Incorrect security UI in File Input.
       Reported by Azza Tegar Naufal Ataullah.
     - CVE-2026-11217: Insufficient policy enforcement in Fenced Frames.
       Reported by Tianyi Hu.
     - CVE-2026-11218: Inappropriate implementation in PlatformIntegration.
       Reported by Han Liu (Xi’an Jiaotong University, School of
       Cyber Science and Engineering).
     - CVE-2026-11219: Insufficient data validation in Navigation.
       Reported by Bharat (mrnoob) .
     - CVE-2026-11220: Insufficient validation of untrusted input in
       Navigation. Reported by Tianyi Hu.
     - CVE-2026-11221: Insufficient validation of untrusted input
       in PointerLock. Reported by mihalis.haatainen@bountyy.fi.
     - CVE-2026-11222: Incorrect security UI in Tab Strip. Reported by Hafiizh
     - CVE-2026-11223: Insufficient validation of untrusted input in Network.
       Reported by Tianyi Hu.
     - CVE-2026-11224: Use after free in Chromoting.
       Reported by David Bors, Catalin Iovita.
     - CVE-2026-11225: Incorrect security UI in WebUI.
       Reported by Tareq Ahamed - itztrq.
     - CVE-2026-11226: Insufficient policy enforcement in PreviewTab.
       Reported by Google.
     - CVE-2026-11227: Incorrect security UI in Tab Hover Cards.
       Reported by Hafiizh.
     - CVE-2026-11228: Incorrect security UI in File Input.
       Reported by Umar Farooq .
     - CVE-2026-11229: Insufficient policy enforcement in Enterprise.
       Reported by Povcfe of Tencent Security Xuanwu Lab.
     - CVE-2026-11230: Use after free in Extensions. Reported by Google.
     - CVE-2026-11231: Inappropriate implementation in Safe Browsing.
       Reported by Google.
     - CVE-2026-11232: Inappropriate implementation in TabGroups.
       Reported by Google.
     - CVE-2026-11233: Insufficient validation of untrusted input in
       FoldableAPIs. Reported by Google.
     - CVE-2026-11234: Insufficient policy enforcement in FoldableAPIs.
       Reported by Google.
     - CVE-2026-11235: Insufficient validation of untrusted input
       in Compositing. Reported by Google.
     - CVE-2026-11236: Insufficient policy enforcement in Web Bluetooth.
       Reported by Google.
     - CVE-2026-11237: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-11238: Inappropriate implementation in DevTools.
       Reported by Google.
     - CVE-2026-11239: Insufficient validation of untrusted input in
       Extensions. Reported by Google.
     - CVE-2026-11240: Insufficient validation of untrusted input in Loader.
       Reported by Google.
     - CVE-2026-11241: Insufficient validation of untrusted input in Cast.
       Reported by Google.
     - CVE-2026-11242: Insufficient validation of untrusted input in Plugins.
       Reported by Google.
     - CVE-2026-11243: Incorrect security UI in Downloads. Reported by Google.
     - CVE-2026-11244: Insufficient validation of untrusted input in
       WebAuthentication. Reported by Google.
     - CVE-2026-11245: Inappropriate implementation in Payments.
       Reported by Google.
     - CVE-2026-11246: Insufficient validation of untrusted input in
       IndexedDB. Reported by Google.
     - CVE-2026-11247: Insufficient policy enforcement in CustomTabs.
       Reported by Google.
     - CVE-2026-11248: Policy bypass in Google Lens. Reported by Google.
     - CVE-2026-11249: Use after free in Network. Reported by Google.
     - CVE-2026-11250: Inappropriate implementation in DevTools.
       Reported by Google.
     - CVE-2026-11251: Insufficient validation of untrusted input in
       Password Manager. Reported by Google.
     - CVE-2026-11252: Policy bypass in Content Settings. Reported by Google.
     - CVE-2026-11253: Race in Permissions. Reported by Google.
     - CVE-2026-11254: Inappropriate implementation in Permissions.
       Reported by Google.
     - CVE-2026-11255: Insufficient validation of untrusted input in
       Storage Access API. Reported by Google.
     - CVE-2026-11256: Out of bounds read in GPU. Reported by Google.
     - CVE-2026-11257: Inappropriate implementation in Browser.
       Reported by Google.
     - CVE-2026-11258: Inappropriate implementation in File System Access.
       Reported by Google.
     - CVE-2026-11259: Insufficient validation of untrusted input in Cast.
       Reported by Google.
     - CVE-2026-11260: Policy bypass in Permissions. Reported by Google.
     - CVE-2026-11261: Insufficient validation of untrusted input in PDF.
       Reported by Google.
     - CVE-2026-11262: Use after free in TabStrip. Reported by Google.
     - CVE-2026-11263: Insufficient policy enforcement in WebAuthentication.
       Reported by Google.
     - CVE-2026-11264: Policy bypass in Content Security Policy.
       Reported by Google.
     - CVE-2026-11265: Insufficient data validation in Autofill.
       Reported by Google.
     - CVE-2026-11266: Policy bypass in SafeBrowsing. Reported by Google.
     - CVE-2026-11267: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-11268: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11269: Inappropriate implementation in Extensions.
       Reported by Google.
     - CVE-2026-11270: Inappropriate implementation in UI. Reported by Google.
     - CVE-2026-11271: Incorrect security UI in Passwords. Reported by Google.
     - CVE-2026-11272: Insufficient validation of untrusted input in
       Reading List. Reported by Google.
     - CVE-2026-11273: Insufficient validation of untrusted input in Omnibox.
       Reported by Google.
     - CVE-2026-11274: Inappropriate implementation in DOM Distiller.
       Reported by Google.
     - CVE-2026-11275: Insufficient policy enforcement in Page Info.
       Reported by Google.
     - CVE-2026-11276: Inappropriate implementation in Cast. Reported by Google
     - CVE-2026-11277: Insufficient policy enforcement in Chrome for iOS.
       Reported by Google.
     - CVE-2026-11278: Inappropriate implementation in CustomTabs.
       Reported by Google.
     - CVE-2026-11279: Out of bounds read in DevTools. Reported by Google.
     - CVE-2026-11280: Insufficient validation of untrusted input in Signin.
       Reported by Google.
     - CVE-2026-11281: Integer overflow in Chromoting. Reported by Google.
     - CVE-2026-11282: Policy bypass in Sandbox. Reported by Google.
     - CVE-2026-11283: Policy bypass in Shortcuts. Reported by Google.
     - CVE-2026-11284: Side-channel information leakage in PerformanceAPIs.
       Reported by Google.
     - CVE-2026-11285: Insufficient policy enforcement in Chrome for iOS.
       Reported by Google.
     - CVE-2026-11286: Insufficient validation of untrusted input in Wallet.
       Reported by Google.
     - CVE-2026-11287: Insufficient validation of untrusted input in
       Navigation. Reported by Google.
     - CVE-2026-11288: Policy bypass in CSS. Reported by Google.
     - CVE-2026-11289: Side-channel information leakage in Paint.
       Reported by Google.
     - CVE-2026-11290: Integer overflow in WebView. Reported by Google.
     - CVE-2026-11291: Policy bypass in Android Autofill. Reported by Google.
     - CVE-2026-11292: Policy bypass in Blink. Reported by Google.
     - CVE-2026-11293: Use after free in Input.
       Reported by Weipeng Jiang (@Krace) of VRI.
     - CVE-2026-11294: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-11295: Inappropriate implementation in WebView.
       Reported by Google.
     - CVE-2026-11296: Inappropriate implementation in ImageCapture.
       Reported by Google.
     - CVE-2026-11297: Insufficient validation of untrusted input in
       Reader Mode. Reported by Google.
     - CVE-2026-11298: Insufficient policy enforcement in Chrome for iOS.
       Reported by Google.
     - CVE-2026-11299: Out of bounds read in Fonts.
       Reported by sharadboni@gmail.com.
     - CVE-2026-11300: Inappropriate implementation in Permissions.
       Reported by Google.
     - CVE-2026-11301: Out of bounds read in LiveCaption. Reported by Google.
     - CVE-2026-11302: Insufficient policy enforcement in Chrome for iOS.
       Reported by Google.
     - CVE-2026-11303: Use after free in PDFium. Reported by Google.
     - CVE-2026-11304: Use after free in PDFium. Reported by Google.
     - CVE-2026-11305: Use after free in PDFium. Reported by Google.
     - CVE-2026-11306: Use after free in PDFium. Reported by Google.
     - CVE-2026-11307: Use after free in PDFium. Reported by Google.
     - CVE-2026-11308: Inappropriate implementation in Extensions.
       Reported by Google.
     - CVE-2026-11309: Insufficient policy enforcement in History.
       Reported by Google.
   * d/patches:
     - upstream/turboshaft.patch: drop, merged upstream.
     - fixes/enable-widevine-on-arm64-linux-platform.patch: drop, merged
       upstream.
     - debianization/clang-version.patch: refresh.
     - fixes/armhf-icf.patch: refresh.
     - disable/catapult.patch: refresh.
     - llvm-19/clang19.patch: add more bits to drop unsupported warning and
       diagnostic flags.
     - trixie/gn-inputs.patch: drop portion of patch due to upstream changes.
     - trixie/gn-inputs2.patch: refresh.
     - bookworm/bindgen.patch: drop due to upgraded bindgen [sid, trixie].
     - bookworm/gn-allowlist.patch: drop due to upgraded generate-ninja [sid,
       trixie].
     - llvm-22/ignore-for-ubsan.patch: update for upstream reworking.
     - ungoogled/disable-ai.patch: sync from u-c.
     - ungoogled/disable-privacy-sandbox.patch: sync from u-c.
     - ungoogled/remove-navigation-source-param.patch: sync from u-c.
     - trixie/gn-expand-dir-allowlist.patch: add new patch to work around
       older generate-ninja.
     - fixes/libcpp-headers.patch: update for upstream changes reworking how
       this was done.
     - disable/libei.patch: add patch to fix build failure due to libei
       removal.
     - llvm-19/value-or.patch: add another clang-19 build workaround.
     - llvm-19/const-profile.patch: add patch to work around const-related
       clang-19 build failure.
     - rust-1.85/file_as_c_str.patch: rework patch due to upstream changes
       [trixie, bookworm].
     - rust-1.85/zip8.patch: refresh [trixie, bookworm].
     - bookworm/dav1d-drop-hdr.patch: refresh [bookworm].
   * d/copyright: properly delete harfbuzz (due to harfbuzz-ng rename).
 .
   [ Daniel Richard G. ]
   * d/patches:
     - bookworm/bindgen.patch: Refresh [bookworm].
     - bookworm/gn-absl.patch: Update absl_source_set("no_destructor") with
       visibility directive, and refresh [bookworm].
     - rust-1.85/mojo-features.patch: Add feature to new Rust source file
       [trixie, bookworm].
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0002-third_party-libvpx-Remove-bad-ppc64-config.patch:
       refresh for upstream changes
     - third_party/0002-regenerate-xnn-buildgn.patch: refresh for upstream
       changes
     - third_party/0005-blink-add-audio-vector-support.patch: refresh for
       upstream changes
     - libaom/0001-Add-pregenerated-config-for-libaom-on-ppc64.patch: regenerate
     - third_party/0003-third_party-libvpx-Add-ppc64-generated-config.patch:
       regenerate
     - third_party/0001-third_party-libvpx-Disable-vsx-on-ppc64.patch: ensure
       VSX is disabled until VP9 artifacting can be fixed upstream
 .
   [ Jianfeng Liu ]
   * d/patches:
     - upstream/0001-Fix-build-for-CPU-yield-on-LoongArch.patch: This is a
       patch aleady merged to v150 to fix build on loongarch64.
     - loongarch64/0024-fix-libyuv-lsx.patch: Upstream has bumped the version
       of libyuv and it has broken build with lsx enabled on loongarch64. Add
       a patch to fix the build first.
chromium (149.0.7827.53-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream stable release.
     - CVE-2026-10881: Out of bounds read and write in ANGLE.
       Reported by Anonymous.
     - CVE-2026-10882: Use after free in Network.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-10883: Out of bounds write in ANGLE. Reported by Maher Azzouzi.
     - CVE-2026-10884: Use after free in Chromecast. Reported by Google.
     - CVE-2026-10885: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-10886: Use after free in FileSystem. Reported by Andrew Boni.
     - CVE-2026-10887: Use after free in Chromoting. Reported by Google.
     - CVE-2026-10888: Use after free in Cast Streaming. Reported by Google.
     - CVE-2026-10889: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-10890: Use after free in Cast. Reported by Google.
     - CVE-2026-10891: Use after free in GFX. Reported by Google.
     - CVE-2026-10892: Out of bounds write in GPU. Reported by Google.
     - CVE-2026-10893: Use after free in Chromoting. Reported by Google.
     - CVE-2026-10894: Use after free in Printing. Reported by Google.
     - CVE-2026-10895: Use after free in Ozone. Reported by Google.
     - CVE-2026-10896: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-10897: Out of bounds write in GPU. Reported by Google.
     - CVE-2026-10898: Stack buffer overflow in GPU. Reported by Google.
     - CVE-2026-10899: Use after free in Ozone. Reported by Google.
     - CVE-2026-10900: Use after free in Passwords. Reported by Google.
     - CVE-2026-10901: Use after free in Passwords. Reported by Google.
     - CVE-2026-10902: Use after free in Ozone. Reported by Google.
     - CVE-2026-10903: Use after free in WebRTC.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-10904: Inappropriate implementation in V8. Reported by 303f06e3
     - CVE-2026-10905: Use after free in Network.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-10906: Use after free in WebAuthentication.
       Reported by Weipeng Jiang (@Krace) of VRI.
     - CVE-2026-10907: Out of bounds write in ANGLE. Reported by sweetchip.
     - CVE-2026-10908: Use after free in FullScreen. Reported by Mihnea Nicolau
     - CVE-2026-10909: Use after free in Dawn. Reported by whiter@xuanyusec.
     - CVE-2026-10910: Type Confusion in V8.
       Reported by Mufeed VH from Winfunc Research (winfunc.com).
     - CVE-2026-10911: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-10912: Insufficient validation of untrusted input
       in Extensions. Reported by Google.
     - CVE-2026-10913: Use after free in ANGLE. Reported by Google.
     - CVE-2026-10914: Use after free in ANGLE. Reported by Google.
     - CVE-2026-10915: Use after free in Core. Reported by Google.
     - CVE-2026-10916: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-10917: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-10918: Use after free in Viz. Reported by Google.
     - CVE-2026-10919: Use after free in ANGLE. Reported by Google.
     - CVE-2026-10920: Insufficient validation of untrusted input in WebShare.
       Reported by Google.
     - CVE-2026-10921: Integer overflow in Dawn. Reported by Google.
     - CVE-2026-10922: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-10923: Use after free in WebAppInstalls. Reported by Google.
     - CVE-2026-10924: Integer overflow in Chromecast. Reported by Google.
     - CVE-2026-10925: Out of bounds write in Skia. Reported by Google.
     - CVE-2026-10926: Use after free in Cast. Reported by Google.
     - CVE-2026-10927: Out of bounds read in Dawn. Reported by Google.
     - CVE-2026-10928: Script injection in Headless. Reported by Google.
     - CVE-2026-10929: Heap buffer overflow in ANGLE. Reported by Google.
     - CVE-2026-10930: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-10931: Use after free in FileSystem. Reported by asjidkalam.
     - CVE-2026-10932: Use after free in UI. Reported by Google.
     - CVE-2026-10933: Use after free in Audio. Reported by Google.
     - CVE-2026-10934: Use after free in Autofill. Reported by Google.
     - CVE-2026-10935: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-10936: Type Confusion in V8. Reported by Google.
     - CVE-2026-10937: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-10938: Insufficient validation of untrusted input in Input.
       Reported by Google.
     - CVE-2026-10939: Use after free in WebRTC. Reported by Google.
     - CVE-2026-10940: Race in Codecs. Reported by Google.
     - CVE-2026-10941: Out of bounds memory access in Skia. Reported by Google.
     - CVE-2026-10942: Insufficient validation of untrusted input in UI.
       Reported by Google.
     - CVE-2026-10943: Use after free in WebRTC. Reported by Rayyan Kadar.
     - CVE-2026-10944: Insufficient policy enforcement in Autofill.
       Reported by Google.
     - CVE-2026-10945: Use after free in PDF. Reported by Google.
     - CVE-2026-10946: Heap buffer overflow in Media. Reported by Google.
     - CVE-2026-10947: Use after free in WebRTC. Reported by Google.
     - CVE-2026-10948: Use after free in WebRTC. Reported by Google.
     - CVE-2026-10949: Heap buffer overflow in Video. Reported by Google.
     - CVE-2026-10950: Insufficient policy enforcement in Autofill.
       Reported by Google.
     - CVE-2026-10951: Use after free in Autofill. Reported by Google.
     - CVE-2026-10952: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-10953: Use after free in Core. Reported by Google.
     - CVE-2026-10954: Use after free in Actor. Reported by Google.
     - CVE-2026-10955: Type Confusion in ANGLE. Reported by Google.
     - CVE-2026-10956: Use after free in MimeHandlerView. Reported by Google.
     - CVE-2026-10957: Use after free in Glic. Reported by Google.
     - CVE-2026-10958: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-10959: Use after free in Input. Reported by Google.
     - CVE-2026-10960: Uninitialized Use in Codecs. Reported by Google.
     - CVE-2026-10961: Use after free in Chrome for iOS. Reported by Google.
     - CVE-2026-10962: Type Confusion in Media. Reported by Google.
     - CVE-2026-10963: Integer overflow in V8. Reported by Google.
     - CVE-2026-10964: Integer overflow in V8. Reported by Google.
     - CVE-2026-10965: Integer overflow in DevTools. Reported by Google.
     - CVE-2026-10966: Insufficient validation of untrusted input in Codecs.
       Reported by Google.
     - CVE-2026-10967: Use after free in SurfaceCapture. Reported by Google.
     - CVE-2026-10968: Insufficient validation of untrusted input in Dawn.
       Reported by Google.
     - CVE-2026-10969: Insufficient validation of untrusted input in Extensions
       Reported by Google.
     - CVE-2026-10970: Insufficient validation of untrusted input
       in InterestGroups. Reported by Google.
     - CVE-2026-10971: Insufficient validation of untrusted input in Printing.
       Reported by Google.
     - CVE-2026-10972: Use after free in Ozone. Reported by Google.
     - CVE-2026-10973: Uninitialized Use in Dawn. Reported by Google.
     - CVE-2026-10974: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-10975: Use after free in WebRTC. Reported by Google.
     - CVE-2026-10976: Uninitialized Use in Dawn. Reported by Google.
     - CVE-2026-10977: Uninitialized Use in Skia. Reported by Google.
     - CVE-2026-10978: Use after free in Chromoting. Reported by Google.
     - CVE-2026-10979: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-10980: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-10981: Insufficient validation of untrusted input in Codecs.
       Reported by Google.
     - CVE-2026-10982: Use after free in WebXR. Reported by Google.
     - CVE-2026-10983: Insufficient validation of untrusted input in Dawn.
       Reported by Google.
     - CVE-2026-10984: Inappropriate implementation in Accessibility.
       Reported by Google.
     - CVE-2026-10985: Out of bounds read in Skia. Reported by Google.
     - CVE-2026-10986: Integer overflow in Media. Reported by Google.
     - CVE-2026-10987: Integer overflow in V8. Reported by Google.
     - CVE-2026-10988: Use after free in Views. Reported by Google.
     - CVE-2026-10989: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-10990: Use after free in Glic.
       Reported by Weipeng Jiang (@Krace) of VRI.
     - CVE-2026-10991: Use after free in V8.
       Reported by Alisa Esage (@alisaesage).
     - CVE-2026-10992: Insufficient data validation in Animation.
       Reported by heapracer (@heapracer).
     - CVE-2026-10993: Heap buffer overflow in Skia.
       Reported by M. Fauzan Wijaya (Gh05t666nero).
     - CVE-2026-10994: Uninitialized Use in ANGLE.
       Reported by Mufeed VH from Winfunc Research (winfunc.com).
     - CVE-2026-10995: Heap buffer overflow in TabStrip.
       Reported by Sven Dysthe (@svn-dys).
     - CVE-2026-10996: Inappropriate implementation in Workers.
       Reported by Jayateertha Guruprasad.
     - CVE-2026-10997: Insufficient policy enforcement in Extensions.
       Reported by djallalakira@gmail.com.
     - CVE-2026-10998: Out of bounds read in Media. Reported by Ameen Basha M K
     - CVE-2026-10999: Out of bounds memory access in ANGLE.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-11000: Use after free in Fonts.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-11001: Incorrect security UI in Payments. Reported by Google.
     - CVE-2026-11002: Use after free in Autofill.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-11003: Use after free in WebRTC.
       Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab.
     - CVE-2026-11004: Out of bounds read in ANGLE.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-11005: Out of bounds read in ANGLE.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-11006: Out of bounds read in Dawn. Reported by Google.
     - CVE-2026-11007: Insufficient validation of untrusted input in WebView.
       Reported by Google.
     - CVE-2026-11008: Insufficient validation of untrusted input
       in WebAppInstalls. Reported by Google.
     - CVE-2026-11009: Use after free in USB. Reported by Google.
     - CVE-2026-11010: Use after free in WebShare. Reported by David Sievers.
     - CVE-2026-11011: Insufficient policy enforcement in Password Manager.
       Reported by Google.
     - CVE-2026-11012: Use after free in Serial. Reported by Google.
     - CVE-2026-11013: Insufficient validation of untrusted input in Network.
       Reported by Google.
     - CVE-2026-11014: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-11015: Out of bounds read in WebGPU. Reported by Yuma Takeuchi.
     - CVE-2026-11016: Insufficient validation of untrusted input in Network.
       Reported by Google.
     - CVE-2026-11017: Inappropriate implementation in Link Preview.
       Reported by Google.
     - CVE-2026-11018: Insufficient policy enforcement in Actor.
       Reported by Google.
     - CVE-2026-11019: Inappropriate implementation in Payments.
       Reported by Google.
     - CVE-2026-11020: Inappropriate implementation in Extensions.
       Reported by Google.
     - CVE-2026-11021: Insufficient validation of untrusted input in GPU.
       Reported by Google.
     - CVE-2026-11022: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-11023: Insufficient validation of untrusted input
       in WebAppInstalls. Reported by Google.
     - CVE-2026-11024: Stack buffer overflow in Skia. Reported by Google.
     - CVE-2026-11025: Insufficient policy enforcement in Navigation.
       Reported by Google.
     - CVE-2026-11026: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-11027: Insufficient validation of untrusted input in Glic.
       Reported by Google.
     - CVE-2026-11028: Use after free in Media. Reported by Google.
     - CVE-2026-11029: Insufficient validation of untrusted input
       in Drag and Drop. Reported by Google.
     - CVE-2026-11030: Use after free in Network. Reported by Google.
     - CVE-2026-11031: Insufficient validation of untrusted input
       in Password Manager. Reported by Google.
     - CVE-2026-11032: Insufficient data validation in Password Manager.
       Reported by Google.
     - CVE-2026-11033: Uninitialized Use in WebML. Reported by Google.
     - CVE-2026-11034: Insufficient validation of untrusted input
       in Tab Group Sync. Reported by Google.
     - CVE-2026-11035: Insufficient validation of untrusted input
       in Custom Tabs. Reported by Google.
     - CVE-2026-11036: Inappropriate implementation in DOM. Reported by Google
     - CVE-2026-11037: Out of bounds write in Codecs. Reported by Google.
     - CVE-2026-11038: Insufficient validation of untrusted input
       in Subresource Integrity. Reported by Google.
     - CVE-2026-11039: Uninitialized Use in Skia. Reported by Google.
     - CVE-2026-11040: Use after free in ANGLE. Reported by Google.
     - CVE-2026-11041: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-11042: Use after free in Views. Reported by Google.
     - CVE-2026-11043: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-11044: Integer overflow in ANGLE. Reported by Google.
     - CVE-2026-11045: Insufficient validation of untrusted input in GPU.
       Reported by Google.
     - CVE-2026-11046: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-11047: Insufficient validation of untrusted input in Base.
       Reported by Google.
     - CVE-2026-11048: Inappropriate implementation in Extensions.
       Reported by Google.
     - CVE-2026-11049: Use after free in Password Manager. Reported by Google.
     - CVE-2026-11050: Use after free in V8. Reported by Google.
     - CVE-2026-11051: Out of bounds read in ANGLE.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-11052: Type Confusion in GPU. Reported by Google.
     - CVE-2026-11053: VULNERABILITY in WebRTC. Reported by Google.
     - CVE-2026-11054: Use after free in WebRTC. Reported by Google.
     - CVE-2026-11055: Use after free in ANGLE. Reported by Google.
     - CVE-2026-11056: Insufficient validation of untrusted input
       in SiteIsolation. Reported by Google.
     - CVE-2026-11057: Uninitialized Use in Skia. Reported by Google.
     - CVE-2026-11058: Integer overflow in CredentialProvider.
       Reported by Google.
     - CVE-2026-11059: Use after free in Blink. Reported by Google.
     - CVE-2026-11060: Use after free in Media. Reported by Google.
     - CVE-2026-11061: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-11062: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-11063: Insufficient validation of untrusted input in WebNN.
       Reported by Google.
     - CVE-2026-11064: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-11065: Use after free in ANGLE. Reported by Google.
     - CVE-2026-11066: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-11067: Uninitialized Use in Dawn. Reported by Google.
     - CVE-2026-11068: Use after free in WebSockets. Reported by Google.
     - CVE-2026-11069: Insufficient validation of untrusted input in Cast.
       Reported by Google.
     - CVE-2026-11070: Insufficient validation of untrusted input in Chromoting
       Reported by Google.
     - CVE-2026-11071: Use after free in Base. Reported by Google.
     - CVE-2026-11072: Use after free in WebView. Reported by Google.
     - CVE-2026-11073: Use after free in WebGL. Reported by Google.
     - CVE-2026-11074: Use after free in WebRTC.
       Reported by boboliverfrancishoward@gmail.com.
     - CVE-2026-11075: Out of bounds read in V8.
       Reported by JunYoung Park(@candymate) of KAIST Hacking Lab.
     - CVE-2026-11076: Type Confusion in CSS. Reported by Google.
     - CVE-2026-11077: Out of bounds read in Dawn. Reported by Anonymous.
     - CVE-2026-11078: Insufficient validation of untrusted input
       in FileSystem. Reported by Eran Rom of Palo Alto Networks.
     - CVE-2026-11079: Insufficient validation of untrusted input in Codecs.
       Reported by Google.
     - CVE-2026-11080: Use after free in WebView. Reported by Google.
     - CVE-2026-11081: Policy bypass in Canvas. Reported by Google.
     - CVE-2026-11082: Use after free in GPU. Reported by Google.
     - CVE-2026-11083: Inappropriate implementation in Password Manager.
       Reported by Google.
     - CVE-2026-11084: Inappropriate implementation in Password Manager.
       Reported by Google.
     - CVE-2026-11085: Integer overflow in GPU. Reported by Google.
     - CVE-2026-11086: Insufficient validation of untrusted input in Dawn.
       Reported by Google.
     - CVE-2026-11087: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11088: Integer overflow in ANGLE. Reported by Google.
     - CVE-2026-11089: Uninitialized Use in Media. Reported by Google.
     - CVE-2026-11090: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11091: Inappropriate implementation in Dawn. Reported by Google
     - CVE-2026-11092: Insufficient policy enforcement in DevTools.
       Reported by Google.
     - CVE-2026-11093: Insufficient validation of untrusted input in Printing.
       Reported by Google.
     - CVE-2026-11094: Use after free in Codecs. Reported by Google.
     - CVE-2026-11095: Insufficient validation of untrusted input in Codecs.
       Reported by Google.
     - CVE-2026-11096: Out of bounds read in WebRTC. Reported by Google.
     - CVE-2026-11097: Inappropriate implementation in WebView.
       Reported by Google.
     - CVE-2026-11098: Insufficient validation of untrusted input in GPU.
       Reported by Google.
     - CVE-2026-11099: Vulnerability in Skia. Reported by Google.
     - CVE-2026-11100: Use after free in File Input. Reported by Google.
     - CVE-2026-11101: Uninitialized Use in Dawn. Reported by Google.
     - CVE-2026-11102: Inappropriate implementation in Isolated Web Apps.
       Reported by Google.
     - CVE-2026-11103: Inappropriate implementation in Installer.
       Reported by Google.
     - CVE-2026-11104: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11105: Insufficient validation of untrusted input in WebUI.
       Reported by Google.
     - CVE-2026-11106: Inappropriate implementation in Media.
       Reported by Google.
     - CVE-2026-11107: Inappropriate implementation in Downloads.
       Reported by Google.
     - CVE-2026-11108: Inappropriate implementation in NFC. Reported by Google
     - CVE-2026-11109: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11110: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11111: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-11112: Insufficient validation of untrusted input
       in Chromoting. Reported by Google.
     - CVE-2026-11113: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-11114: Use after free in Device Trust. Reported by Google.
     - CVE-2026-11115: Use after free in Updater. Reported by Google.
     - CVE-2026-11116: Use after free in Chromoting. Reported by Google.
     - CVE-2026-11117: Use after free in Views. Reported by Google.
     - CVE-2026-11118: Use after free in WebRTC. Reported by Google.
     - CVE-2026-11119: Insufficient validation of untrusted input in GPU.
       Reported by Google.
     - CVE-2026-11120: Insufficient validation of untrusted input
       in Enterprise Reporting. Reported by Google.
     - CVE-2026-11121: Insufficient validation of untrusted input in Skia.
       Reported by Google.
     - CVE-2026-11122: Inappropriate implementation in Keyboard.
       Reported by Google.
     - CVE-2026-11123: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11124: Heap buffer overflow in Skia. Reported by Google.
     - CVE-2026-11125: Use after free in Compositing. Reported by Google.
     - CVE-2026-11126: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-11127: Inappropriate implementation in WebAPKs.
       Reported by Google.
     - CVE-2026-11128: Insufficient validation of untrusted input
       in Web Share. Reported by Google.
     - CVE-2026-11129: Inappropriate implementation in Extensions.
       Reported by Google.
     - CVE-2026-11130: Use after free in Media. Reported by Google.
     - CVE-2026-11131: Use after free in Autofill. Reported by Google.
     - CVE-2026-11132: Policy bypass in Paint. Reported by Google.
     - CVE-2026-11133: Insufficient policy enforcement in Paint.
       Reported by Google.
     - CVE-2026-11134: Insufficient data validation in Media.
       Reported by Google.
     - CVE-2026-11135: Insufficient policy enforcement in Autofill.
       Reported by Google.
     - CVE-2026-11136: Use after free in Canvas.
       Reported by Jungwoo Lee (@physicube) and Wongi Lee (@_qwerty_po).
     - CVE-2026-11137: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11138: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11139: Policy bypass in Paint. Reported by Google.
     - CVE-2026-11140: Insufficient validation of untrusted input
       in Chromecast. Reported by Google.
     - CVE-2026-11141: Uninitialized Use in Audio. Reported by Google.
     - CVE-2026-11142: Policy bypass in Paint. Reported by Google.
     - CVE-2026-11143: Heap buffer overflow in Extensions. Reported by Google.
     - CVE-2026-11144: Use after free in Media. Reported by Google.
     - CVE-2026-11145: Race in Geolocation. Reported by Google.
     - CVE-2026-11146: Insufficient validation of untrusted input
       in Chromoting. Reported by Google.
     - CVE-2026-11147: Use after free in WebML. Reported by Google.
     - CVE-2026-11148: Inappropriate implementation in Payments.
       Reported by Google.
     - CVE-2026-11149: Insufficient validation of untrusted input
       in Extensions. Reported by Google.
     - CVE-2026-11150: Inappropriate implementation in XML. Reported by Google
     - CVE-2026-11151: Insufficient validation of untrusted input
       in Password Manager. Reported by Google.
     - CVE-2026-11152: Object lifecycle issue in Dawn. Reported by Google.
     - CVE-2026-11153: Side-channel information leakage in Forms.
       Reported by Google.
     - CVE-2026-11154: Use after free in Dawn. Reported by Google.
     - CVE-2026-11155: Insufficient policy enforcement in CSS.
       Reported by Google.
     - CVE-2026-11156: Inappropriate implementation in CSS. Reported by Google
     - CVE-2026-11157: Script injection in Accessibility. Reported by Google.
     - CVE-2026-11158: Insufficient validation of untrusted input in
       Downloads. Reported by Google.
     - CVE-2026-11159: Uninitialized Use in Skia. Reported by Google.
     - CVE-2026-11160: Out of bounds read in Input. Reported by Google.
     - CVE-2026-11161: Insufficient data validation in DataTransfer.
       Reported by Google.
     - CVE-2026-11162: Insufficient policy enforcement in CSS.
       Reported by Google.
     - CVE-2026-11163: Use after free in Messages. Reported by Google.
     - CVE-2026-11164: Use after free in Blink. Reported by Google.
     - CVE-2026-11165: Use after free in WebMIDI. Reported by Google.
     - CVE-2026-11166: Inappropriate implementation in SVG. Reported by Google
     - CVE-2026-11167: Inappropriate implementation in WebView.
       Reported by Google.
     - CVE-2026-11168: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-11169: Inappropriate implementation in XML. Reported by Google
     - CVE-2026-11170: Inappropriate implementation in Chromoting.
       Reported by Google.
     - CVE-2026-11171: Integer overflow in Blink. Reported by Google.
     - CVE-2026-11172: Incorrect security UI in Contact Picker.
       Reported by mochazril.ti@gmail.com.
     - CVE-2026-11173: Out of bounds write in V8. Reported by Google.
     - CVE-2026-11174: Insufficient policy enforcement in Site Isolation.
       Reported by Google.
     - CVE-2026-11175: Incorrect security UI in Messages. Reported by Google.
     - CVE-2026-11176: Inappropriate implementation in Media.
       Reported by Google.
     - CVE-2026-11177: Use after free in Omnibox. Reported by gevakun.
     - CVE-2026-11178: Policy bypass in WebView. Reported by Google.
     - CVE-2026-11179: Inappropriate implementation in ORB. Reported by Google
     - CVE-2026-11180: Policy bypass in SVG. Reported by Google.
     - CVE-2026-11181: Inappropriate implementation in Media Session.
       Reported by Google.
     - CVE-2026-11182: Inappropriate implementation in SVG. Reported by Google
     - CVE-2026-11183: Out of bounds read in GWP-ASan. Reported by Google.
     - CVE-2026-11184: Insufficient policy enforcement in Actor.
       Reported by Google.
     - CVE-2026-11185: Use after free in V8. Reported by Google.
     - CVE-2026-11186: Inappropriate implementation in CSS. Reported by Google
     - CVE-2026-11187: Insufficient policy enforcement in Glic.
       Reported by Google.
     - CVE-2026-11188: Use after free in USB. Reported by Google.
     - CVE-2026-11189: Insufficient validation of untrusted input in DevTools.
       Reported by lebr0nli of National Yang Ming Chiao Tung University,
       Dept. of CS, Security and Systems Lab.
     - CVE-2026-11190: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-11191: Out of bounds memory access in ANGLE.
       Reported by Google.
     - CVE-2026-11192: Insufficient validation of untrusted input
       in Password Manager. Reported by Google.
     - CVE-2026-11193: Insufficient policy enforcement in Password Manager.
       Reported by Google.
     - CVE-2026-11194: Inappropriate implementation in Network.
       Reported by Google.
     - CVE-2026-11195: Inappropriate implementation in MHTML.
       Reported by Google.
     - CVE-2026-11196: Type Confusion in XML. Reported by Google.
     - CVE-2026-11197: Insufficient policy enforcement in Workers.
       Reported by VEZEKA.
     - CVE-2026-11198: Insufficient validation of untrusted input in Codecs.
       Reported by Google.
     - CVE-2026-11199: Insufficient validation of untrusted input in WebRTC.
       Reported by Google.
     - CVE-2026-11200: Inappropriate implementation in WebRTC.
       Reported by Google.
     - CVE-2026-11201: Use after free in ServiceWorker.
       Reported by Weipeng Jiang (@Krace) of VRI.
     - CVE-2026-11202: Insufficient validation of untrusted input
       in Chrome for iOS. Reported by Google.
     - CVE-2026-11203: Policy bypass in GPU. Reported by Google.
     - CVE-2026-11204: Inappropriate implementation in Signin.
       Reported by Google.
     - CVE-2026-11205: Insufficient validation of untrusted input
       in Chrome for iOS. Reported by Google.
     - CVE-2026-11206: Policy bypass in ServiceWorker.
       Reported by David Bors, Catalin Iovita.
     - CVE-2026-11207: Insufficient validation of untrusted input in Autofill.
       Reported by Google.
     - CVE-2026-11208: Use after free in Codecs. Reported by Google.
     - CVE-2026-11209: Insufficient policy enforcement in Passwords.
       Reported by Google.
     - CVE-2026-11210: Insufficient policy enforcement in Safe Browsing.
       Reported by Google.
     - CVE-2026-11211: Integer overflow in V8. Reported by Google.
     - CVE-2026-11212: Insufficient policy enforcement in DevTools.
       Reported by Google.
     - CVE-2026-11213: Insufficient validation of untrusted input
       in Reading Mode. Reported by Google.
     - CVE-2026-11214: Inappropriate implementation in Chrome for iOS.
       Reported by Google.
     - CVE-2026-11215: Inappropriate implementation in Cronet.
       Reported by Google.
     - CVE-2026-11216: Incorrect security UI in File Input.
       Reported by Azza Tegar Naufal Ataullah.
     - CVE-2026-11217: Insufficient policy enforcement in Fenced Frames.
       Reported by Tianyi Hu.
     - CVE-2026-11218: Inappropriate implementation in PlatformIntegration.
       Reported by Han Liu (Xi’an Jiaotong University, School of
       Cyber Science and Engineering).
     - CVE-2026-11219: Insufficient data validation in Navigation.
       Reported by Bharat (mrnoob) .
     - CVE-2026-11220: Insufficient validation of untrusted input in
       Navigation. Reported by Tianyi Hu.
     - CVE-2026-11221: Insufficient validation of untrusted input
       in PointerLock. Reported by mihalis.haatainen@bountyy.fi.
     - CVE-2026-11222: Incorrect security UI in Tab Strip. Reported by Hafiizh
     - CVE-2026-11223: Insufficient validation of untrusted input in Network.
       Reported by Tianyi Hu.
     - CVE-2026-11224: Use after free in Chromoting.
       Reported by David Bors, Catalin Iovita.
     - CVE-2026-11225: Incorrect security UI in WebUI.
       Reported by Tareq Ahamed - itztrq.
     - CVE-2026-11226: Insufficient policy enforcement in PreviewTab.
       Reported by Google.
     - CVE-2026-11227: Incorrect security UI in Tab Hover Cards.
       Reported by Hafiizh.
     - CVE-2026-11228: Incorrect security UI in File Input.
       Reported by Umar Farooq .
     - CVE-2026-11229: Insufficient policy enforcement in Enterprise.
       Reported by Povcfe of Tencent Security Xuanwu Lab.
     - CVE-2026-11230: Use after free in Extensions. Reported by Google.
     - CVE-2026-11231: Inappropriate implementation in Safe Browsing.
       Reported by Google.
     - CVE-2026-11232: Inappropriate implementation in TabGroups.
       Reported by Google.
     - CVE-2026-11233: Insufficient validation of untrusted input in
       FoldableAPIs. Reported by Google.
     - CVE-2026-11234: Insufficient policy enforcement in FoldableAPIs.
       Reported by Google.
     - CVE-2026-11235: Insufficient validation of untrusted input
       in Compositing. Reported by Google.
     - CVE-2026-11236: Insufficient policy enforcement in Web Bluetooth.
       Reported by Google.
     - CVE-2026-11237: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-11238: Inappropriate implementation in DevTools.
       Reported by Google.
     - CVE-2026-11239: Insufficient validation of untrusted input in
       Extensions. Reported by Google.
     - CVE-2026-11240: Insufficient validation of untrusted input in Loader.
       Reported by Google.
     - CVE-2026-11241: Insufficient validation of untrusted input in Cast.
       Reported by Google.
     - CVE-2026-11242: Insufficient validation of untrusted input in Plugins.
       Reported by Google.
     - CVE-2026-11243: Incorrect security UI in Downloads. Reported by Google.
     - CVE-2026-11244: Insufficient validation of untrusted input in
       WebAuthentication. Reported by Google.
     - CVE-2026-11245: Inappropriate implementation in Payments.
       Reported by Google.
     - CVE-2026-11246: Insufficient validation of untrusted input in
       IndexedDB. Reported by Google.
     - CVE-2026-11247: Insufficient policy enforcement in CustomTabs.
       Reported by Google.
     - CVE-2026-11248: Policy bypass in Google Lens. Reported by Google.
     - CVE-2026-11249: Use after free in Network. Reported by Google.
     - CVE-2026-11250: Inappropriate implementation in DevTools.
       Reported by Google.
     - CVE-2026-11251: Insufficient validation of untrusted input in
       Password Manager. Reported by Google.
     - CVE-2026-11252: Policy bypass in Content Settings. Reported by Google.
     - CVE-2026-11253: Race in Permissions. Reported by Google.
     - CVE-2026-11254: Inappropriate implementation in Permissions.
       Reported by Google.
     - CVE-2026-11255: Insufficient validation of untrusted input in
       Storage Access API. Reported by Google.
     - CVE-2026-11256: Out of bounds read in GPU. Reported by Google.
     - CVE-2026-11257: Inappropriate implementation in Browser.
       Reported by Google.
     - CVE-2026-11258: Inappropriate implementation in File System Access.
       Reported by Google.
     - CVE-2026-11259: Insufficient validation of untrusted input in Cast.
       Reported by Google.
     - CVE-2026-11260: Policy bypass in Permissions. Reported by Google.
     - CVE-2026-11261: Insufficient validation of untrusted input in PDF.
       Reported by Google.
     - CVE-2026-11262: Use after free in TabStrip. Reported by Google.
     - CVE-2026-11263: Insufficient policy enforcement in WebAuthentication.
       Reported by Google.
     - CVE-2026-11264: Policy bypass in Content Security Policy.
       Reported by Google.
     - CVE-2026-11265: Insufficient data validation in Autofill.
       Reported by Google.
     - CVE-2026-11266: Policy bypass in SafeBrowsing. Reported by Google.
     - CVE-2026-11267: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-11268: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-11269: Inappropriate implementation in Extensions.
       Reported by Google.
     - CVE-2026-11270: Inappropriate implementation in UI. Reported by Google.
     - CVE-2026-11271: Incorrect security UI in Passwords. Reported by Google.
     - CVE-2026-11272: Insufficient validation of untrusted input in
       Reading List. Reported by Google.
     - CVE-2026-11273: Insufficient validation of untrusted input in Omnibox.
       Reported by Google.
     - CVE-2026-11274: Inappropriate implementation in DOM Distiller.
       Reported by Google.
     - CVE-2026-11275: Insufficient policy enforcement in Page Info.
       Reported by Google.
     - CVE-2026-11276: Inappropriate implementation in Cast. Reported by Google
     - CVE-2026-11277: Insufficient policy enforcement in Chrome for iOS.
       Reported by Google.
     - CVE-2026-11278: Inappropriate implementation in CustomTabs.
       Reported by Google.
     - CVE-2026-11279: Out of bounds read in DevTools. Reported by Google.
     - CVE-2026-11280: Insufficient validation of untrusted input in Signin.
       Reported by Google.
     - CVE-2026-11281: Integer overflow in Chromoting. Reported by Google.
     - CVE-2026-11282: Policy bypass in Sandbox. Reported by Google.
     - CVE-2026-11283: Policy bypass in Shortcuts. Reported by Google.
     - CVE-2026-11284: Side-channel information leakage in PerformanceAPIs.
       Reported by Google.
     - CVE-2026-11285: Insufficient policy enforcement in Chrome for iOS.
       Reported by Google.
     - CVE-2026-11286: Insufficient validation of untrusted input in Wallet.
       Reported by Google.
     - CVE-2026-11287: Insufficient validation of untrusted input in
       Navigation. Reported by Google.
     - CVE-2026-11288: Policy bypass in CSS. Reported by Google.
     - CVE-2026-11289: Side-channel information leakage in Paint.
       Reported by Google.
     - CVE-2026-11290: Integer overflow in WebView. Reported by Google.
     - CVE-2026-11291: Policy bypass in Android Autofill. Reported by Google.
     - CVE-2026-11292: Policy bypass in Blink. Reported by Google.
     - CVE-2026-11293: Use after free in Input.
       Reported by Weipeng Jiang (@Krace) of VRI.
     - CVE-2026-11294: Inappropriate implementation in Passwords.
       Reported by Google.
     - CVE-2026-11295: Inappropriate implementation in WebView.
       Reported by Google.
     - CVE-2026-11296: Inappropriate implementation in ImageCapture.
       Reported by Google.
     - CVE-2026-11297: Insufficient validation of untrusted input in
       Reader Mode. Reported by Google.
     - CVE-2026-11298: Insufficient policy enforcement in Chrome for iOS.
       Reported by Google.
     - CVE-2026-11299: Out of bounds read in Fonts.
       Reported by sharadboni@gmail.com.
     - CVE-2026-11300: Inappropriate implementation in Permissions.
       Reported by Google.
     - CVE-2026-11301: Out of bounds read in LiveCaption. Reported by Google.
     - CVE-2026-11302: Insufficient policy enforcement in Chrome for iOS.
       Reported by Google.
     - CVE-2026-11303: Use after free in PDFium. Reported by Google.
     - CVE-2026-11304: Use after free in PDFium. Reported by Google.
     - CVE-2026-11305: Use after free in PDFium. Reported by Google.
     - CVE-2026-11306: Use after free in PDFium. Reported by Google.
     - CVE-2026-11307: Use after free in PDFium. Reported by Google.
     - CVE-2026-11308: Inappropriate implementation in Extensions.
       Reported by Google.
     - CVE-2026-11309: Insufficient policy enforcement in History.
       Reported by Google.
   * d/patches:
     - upstream/turboshaft.patch: drop, merged upstream.
     - fixes/enable-widevine-on-arm64-linux-platform.patch: drop, merged
       upstream.
     - debianization/clang-version.patch: refresh.
     - fixes/armhf-icf.patch: refresh.
     - disable/catapult.patch: refresh.
     - llvm-19/clang19.patch: add more bits to drop unsupported warning and
       diagnostic flags.
     - trixie/gn-inputs.patch: drop portion of patch due to upstream changes.
     - trixie/gn-inputs2.patch: refresh.
     - bookworm/bindgen.patch: drop due to upgraded bindgen [sid, trixie].
     - bookworm/gn-allowlist.patch: drop due to upgraded generate-ninja [sid,
       trixie].
     - llvm-22/ignore-for-ubsan.patch: update for upstream reworking.
     - ungoogled/disable-ai.patch: sync from u-c.
     - ungoogled/disable-privacy-sandbox.patch: sync from u-c.
     - ungoogled/remove-navigation-source-param.patch: sync from u-c.
     - trixie/gn-expand-dir-allowlist.patch: add new patch to work around
       older generate-ninja.
     - fixes/libcpp-headers.patch: update for upstream changes reworking how
       this was done.
     - disable/libei.patch: add patch to fix build failure due to libei
       removal.
     - llvm-19/value-or.patch: add another clang-19 build workaround.
     - llvm-19/const-profile.patch: add patch to work around const-related
       clang-19 build failure.
     - rust-1.85/file_as_c_str.patch: rework patch due to upstream changes
       [trixie, bookworm].
     - rust-1.85/zip8.patch: refresh [trixie, bookworm].
     - bookworm/dav1d-drop-hdr.patch: refresh [bookworm].
   * d/copyright: properly delete harfbuzz (due to harfbuzz-ng rename).
 .
   [ Daniel Richard G. ]
   * d/patches:
     - bookworm/bindgen.patch: Refresh [bookworm].
     - bookworm/gn-absl.patch: Update absl_source_set("no_destructor") with
       visibility directive, and refresh [bookworm].
     - rust-1.85/mojo-features.patch: Add feature to new Rust source file
       [trixie, bookworm].
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0002-third_party-libvpx-Remove-bad-ppc64-config.patch:
       refresh for upstream changes
     - third_party/0002-regenerate-xnn-buildgn.patch: refresh for upstream
       changes
     - third_party/0005-blink-add-audio-vector-support.patch: refresh for
       upstream changes
     - libaom/0001-Add-pregenerated-config-for-libaom-on-ppc64.patch: regenerate
     - third_party/0003-third_party-libvpx-Add-ppc64-generated-config.patch:
       regenerate
     - third_party/0001-third_party-libvpx-Disable-vsx-on-ppc64.patch: ensure
       VSX is disabled until VP9 artifacting can be fixed upstream
 .
   [ Jianfeng Liu ]
   * d/patches:
     - upstream/0001-Fix-build-for-CPU-yield-on-LoongArch.patch: This is a
       patch aleady merged to v150 to fix build on loongarch64.
     - loongarch64/0024-fix-libyuv-lsx.patch: Upstream has bumped the version
       of libyuv and it has broken build with lsx enabled on loongarch64. Add
       a patch to fix the build first.
chromium (148.0.7778.215-2) unstable; urgency=high
 .
   [ Juan Manuel Méndez Rey ]
   * Team upload.
   * d/patches/fixes/bytemuck.patch: select bytemuck's core::simd impls by rust
     version rather than date, fixing FTBFS with rustc 1.95 (which removed
     core::simd::LaneCount) while still building on rust < 1.95
     (trixie/bookworm). Affects the default chromium build too.
chromium (148.0.7778.215-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-9872: Out of bounds write in GPU. Reported by cinzinga.
     - CVE-2026-9873: Use after free in Network. Reported by cinzinga.
     - CVE-2026-9874: Use after free in Dawn. Reported by Anonymous.
     - CVE-2026-9875: Out of bounds read in WebGL. Reported by Anonymous.
     - CVE-2026-9876: Use after free in WebGL. Reported by happy2me.
     - CVE-2026-9877: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9878: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9879: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-9880: Insufficient validation of untrusted input in WebGL.
       Reported by Google.
     - CVE-2026-9881: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-9882: Integer overflow in ANGLE. Reported by Google.
     - CVE-2026-9883: Use after free in Base. Reported by Google.
     - CVE-2026-9884: Use after free in Browser. Reported by Google.
     - CVE-2026-9885: Insufficient validation of untrusted input in UI.
       Reported by Google.
     - CVE-2026-9886: Use after free in Base. Reported by Google.
     - CVE-2026-9887: Use after free in Proxy. Reported by Google.
     - CVE-2026-9888: Use after free in WebView. Reported by Google.
     - CVE-2026-9889: Out of bounds read and write in Dawn. Reported by Google.
     - CVE-2026-9890: Use after free in XR. Reported by Google.
     - CVE-2026-9891: Use after free in Extensions. Reported by Google.
     - CVE-2026-9892: Inappropriate implementation in Skia. Reported by Google.
     - CVE-2026-9893: Use after free in Skia. Reported by Google.
     - CVE-2026-9894: Use after free in GPU. Reported by tohafrit.
     - CVE-2026-9895: Out of bounds read in GPU.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-9896: Out of bounds write in V8. Reported by 303f06e3.
     - CVE-2026-9897: Use after free in DOM. Reported by Google.
     - CVE-2026-9898: Insufficient validation of untrusted input in GPU.
       Reported by Google.
     - CVE-2026-9899: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9900: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-9901: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9902: Use after free in Accessibility. Reported by Google.
     - CVE-2026-9903: Insufficient validation of untrusted input in
       Site Isolation. Reported by Google.
     - CVE-2026-9904: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9905: Use after free in Accessibility. Reported by Google.
     - CVE-2026-9906: Out of bounds write in GPU. Reported by Google.
     - CVE-2026-9907: Out of bounds read in Dawn. Reported by Google.
     - CVE-2026-9908: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-9909: Integer overflow in Skia. Reported by Google.
     - CVE-2026-9910: Out of bounds memory access in ANGLE. Reported by Google.
     - CVE-2026-9911: Integer overflow in ANGLE. Reported by Google.
     - CVE-2026-9912: Inappropriate implementation in GPU. Reported by Google.
     - CVE-2026-9913: Inappropriate implementation in ANGLE. Reported by Google
     - CVE-2026-9914: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-9915: Heap buffer overflow in ANGLE. Reported by Google.
     - CVE-2026-9916: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-9917: Uninitialized Use in WebGL. Reported by Google.
     - CVE-2026-9918: Inappropriate implementation in Tint. Reported by Google.
     - CVE-2026-9919: Out of bounds read in WebGL. Reported by Google.
     - CVE-2026-9920: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-9921: Uninitialized Use in WebGL. Reported by Google.
     - CVE-2026-9922: Use after free in GPU. Reported by Google.
     - CVE-2026-9923: Use after free in Skia. Reported by Google.
     - CVE-2026-9924: Heap buffer overflow in ANGLE. Reported by Google.
     - CVE-2026-9925: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9926: Heap buffer overflow in ANGLE. Reported by Google.
     - CVE-2026-9927: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9928: Out of bounds read in ANGLE.
       Reported by Jeff Muizelaar - Mozilla.
     - CVE-2026-9929: Inappropriate implementation in WebGL. Reported by Google
     - CVE-2026-9930: Out of bounds write in Dawn. Reported by Google.
     - CVE-2026-9931: Use after free in GPU. Reported by Google.
     - CVE-2026-9932: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9933: Use after free in Input. Reported by Google.
     - CVE-2026-9934: Use after free in Aura. Reported by Google.
     - CVE-2026-9935: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-9936: Use after free in GFX. Reported by Google.
     - CVE-2026-9937: Use after free in UI. Reported by Google.
     - CVE-2026-9938: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-9939: Heap buffer overflow in WebCodecs. Reported by Google.
     - CVE-2026-9940: Heap buffer overflow in ANGLE. Reported by Google.
     - CVE-2026-9941: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9942: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-9943: Out of bounds read in WebGL. Reported by Google.
     - CVE-2026-9944: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-9945: Use after free in Media. Reported by Google.
     - CVE-2026-9946: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9947: Use after free in XML. Reported by Google.
     - CVE-2026-9948: Use after free in Views. Reported by Google.
     - CVE-2026-9949: Use after free in Core. Reported by Google.
     - CVE-2026-9950: Insufficient validation of untrusted input in iOS.
       Reported by Google.
     - CVE-2026-9951: Use after free in UI. Reported by Google.
     - CVE-2026-9952: Use after free in WebAudio. Reported by Google.
     - CVE-2026-9953: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-9954: Use after free in TabStrip.
       Reported by yueliu of Microsoft.
     - CVE-2026-9955: Inappropriate implementation in iOS. Reported by Google.
     - CVE-2026-9956: Use after free in iOS. Reported by Google.
     - CVE-2026-9957: Use after free in PDF. Reported by Google.
     - CVE-2026-9958: Use after free in PDFium. Reported by Google.
     - CVE-2026-9959: Race in WebRTC. Reported by Google.
     - CVE-2026-9960: Integer overflow in PDFium. Reported by Google.
     - CVE-2026-9961: Use after free in SurfaceCapture. Reported by Google.
     - CVE-2026-9962: Use after free in WebRTC. Reported by Google.
     - CVE-2026-9963: Uninitialized Use in iOS. Reported by Google.
     - CVE-2026-9964: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-9965: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-9966: Integer overflow in XML. Reported by Google.
     - CVE-2026-9967: Out of bounds write in GPU. Reported by Google.
     - CVE-2026-9968: Integer overflow in V8. Reported by Google.
     - CVE-2026-9969: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-9970: Use after free in WebGL. Reported by TFGC.
     - CVE-2026-9971: Inappropriate implementation in iOS. Reported by Google.
     - CVE-2026-9972: Uninitialized Use in Gamepad. Reported by Google.
     - CVE-2026-9973: Out of bounds write in V8. Reported by amyb of OpenAI.
     - CVE-2026-9974: Out of bounds write in GPU. Reported by Google.
     - CVE-2026-9975: Out of bounds read and write in ANGLE. Reported by Google
     - CVE-2026-9976: Inappropriate implementation in USB. Reported by Google.
     - CVE-2026-9977: Insufficient validation of untrusted input in WebShare.
       Reported by Google.
     - CVE-2026-9978: Use after free in Glic. Reported by Google.
     - CVE-2026-9979: Insufficient validation of untrusted input in Input.
       Reported by Google.
     - CVE-2026-9980: Insufficient validation of untrusted input in Printing.
       Reported by Google.
     - CVE-2026-9981: Inappropriate implementation in Skia. Reported by Google.
     - CVE-2026-9982: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-9983: Type Confusion in Skia. Reported by Google.
     - CVE-2026-9984: Use after free in UI. Reported by Google.
     - CVE-2026-9985: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-9986: Insufficient validation of untrusted input in
       OptimizationGuide. Reported by Google.
     - CVE-2026-9987: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Google.
     - CVE-2026-9988: Use after free in WebRTC. Reported by Google.
     - CVE-2026-9989: Inappropriate implementation in Media. Reported by Google
     - CVE-2026-9990: Use after free in WebAppInstalls. Reported by Google.
     - CVE-2026-9991: Inappropriate implementation in Media. Reported by Google
     - CVE-2026-9992: Use after free in Network. Reported by Google.
     - CVE-2026-9993: Use after free in Views. Reported by Google.
     - CVE-2026-9994: Use after free in Core. Reported by Google.
     - CVE-2026-9995: Use after free in WebXR. Reported by Google.
     - CVE-2026-9996: Out of bounds read in WebRTC. Reported by Google.
     - CVE-2026-9997: Use after free in Input. Reported by Google.
     - CVE-2026-9998: Integer overflow in Skia. Reported by Google.
     - CVE-2026-9999: Inappropriate implementation in ANGLE. Reported by Google
     - CVE-2026-10000: Use after free in Passwords. Reported by Google.
     - CVE-2026-10001: Use after free in PerformanceManager. Reported by Google
     - CVE-2026-10002: Use after free in PDFium. Reported by Google.
     - CVE-2026-10003: Use after free in Views. Reported by Google.
     - CVE-2026-10004: Insufficient validation of untrusted input in Passwords.
       Reported by Google.
     - CVE-2026-10005: Use after free in WebAppInstalls. Reported by Google.
     - CVE-2026-10006: Race in WebAudio. Reported by Google.
     - CVE-2026-10007: Use after free in SVG. Reported by Google.
     - CVE-2026-10008: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-10009: Integer overflow in Skia. Reported by Google.
     - CVE-2026-10010: Inappropriate implementation in Input.
       Reported by Google.
     - CVE-2026-10011: Inappropriate implementation in Skia. Reported by Google
     - CVE-2026-10012: Use after free in Skia. Reported by Google.
     - CVE-2026-10013: Use after free in WebCodecs. Reported by Google.
     - CVE-2026-10014: Use after free in WebMIDI. Reported by Google.
     - CVE-2026-10015: Integer overflow in WTF. Reported by Google.
     - CVE-2026-10016: Use after free in DOM. Reported by pwn2addr.
     - CVE-2026-10017: Out of bounds read in Headless.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-10018: Integer overflow in ANGLE. Reported by Rahul Raj.
     - CVE-2026-10019: Integer overflow in ANGLE.
       Reported by Mufeed VH from Winfunc Research (winfunc.com).
     - CVE-2026-10020: Insufficient validation of untrusted input in Skia.
       Reported by Google.
     - CVE-2026-10021: Insufficient validation of untrusted input in USB.
       Reported by Google.
     - CVE-2026-10022: Type Confusion in V8. Reported by ggwhyp.
chromium (148.0.7778.215-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-9872: Out of bounds write in GPU. Reported by cinzinga.
     - CVE-2026-9873: Use after free in Network. Reported by cinzinga.
     - CVE-2026-9874: Use after free in Dawn. Reported by Anonymous.
     - CVE-2026-9875: Out of bounds read in WebGL. Reported by Anonymous.
     - CVE-2026-9876: Use after free in WebGL. Reported by happy2me.
     - CVE-2026-9877: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9878: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9879: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-9880: Insufficient validation of untrusted input in WebGL.
       Reported by Google.
     - CVE-2026-9881: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-9882: Integer overflow in ANGLE. Reported by Google.
     - CVE-2026-9883: Use after free in Base. Reported by Google.
     - CVE-2026-9884: Use after free in Browser. Reported by Google.
     - CVE-2026-9885: Insufficient validation of untrusted input in UI.
       Reported by Google.
     - CVE-2026-9886: Use after free in Base. Reported by Google.
     - CVE-2026-9887: Use after free in Proxy. Reported by Google.
     - CVE-2026-9888: Use after free in WebView. Reported by Google.
     - CVE-2026-9889: Out of bounds read and write in Dawn. Reported by Google.
     - CVE-2026-9890: Use after free in XR. Reported by Google.
     - CVE-2026-9891: Use after free in Extensions. Reported by Google.
     - CVE-2026-9892: Inappropriate implementation in Skia. Reported by Google.
     - CVE-2026-9893: Use after free in Skia. Reported by Google.
     - CVE-2026-9894: Use after free in GPU. Reported by tohafrit.
     - CVE-2026-9895: Out of bounds read in GPU.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-9896: Out of bounds write in V8. Reported by 303f06e3.
     - CVE-2026-9897: Use after free in DOM. Reported by Google.
     - CVE-2026-9898: Insufficient validation of untrusted input in GPU.
       Reported by Google.
     - CVE-2026-9899: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9900: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-9901: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9902: Use after free in Accessibility. Reported by Google.
     - CVE-2026-9903: Insufficient validation of untrusted input in
       Site Isolation. Reported by Google.
     - CVE-2026-9904: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9905: Use after free in Accessibility. Reported by Google.
     - CVE-2026-9906: Out of bounds write in GPU. Reported by Google.
     - CVE-2026-9907: Out of bounds read in Dawn. Reported by Google.
     - CVE-2026-9908: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-9909: Integer overflow in Skia. Reported by Google.
     - CVE-2026-9910: Out of bounds memory access in ANGLE. Reported by Google.
     - CVE-2026-9911: Integer overflow in ANGLE. Reported by Google.
     - CVE-2026-9912: Inappropriate implementation in GPU. Reported by Google.
     - CVE-2026-9913: Inappropriate implementation in ANGLE. Reported by Google
     - CVE-2026-9914: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-9915: Heap buffer overflow in ANGLE. Reported by Google.
     - CVE-2026-9916: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-9917: Uninitialized Use in WebGL. Reported by Google.
     - CVE-2026-9918: Inappropriate implementation in Tint. Reported by Google.
     - CVE-2026-9919: Out of bounds read in WebGL. Reported by Google.
     - CVE-2026-9920: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-9921: Uninitialized Use in WebGL. Reported by Google.
     - CVE-2026-9922: Use after free in GPU. Reported by Google.
     - CVE-2026-9923: Use after free in Skia. Reported by Google.
     - CVE-2026-9924: Heap buffer overflow in ANGLE. Reported by Google.
     - CVE-2026-9925: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9926: Heap buffer overflow in ANGLE. Reported by Google.
     - CVE-2026-9927: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9928: Out of bounds read in ANGLE.
       Reported by Jeff Muizelaar - Mozilla.
     - CVE-2026-9929: Inappropriate implementation in WebGL. Reported by Google
     - CVE-2026-9930: Out of bounds write in Dawn. Reported by Google.
     - CVE-2026-9931: Use after free in GPU. Reported by Google.
     - CVE-2026-9932: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9933: Use after free in Input. Reported by Google.
     - CVE-2026-9934: Use after free in Aura. Reported by Google.
     - CVE-2026-9935: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-9936: Use after free in GFX. Reported by Google.
     - CVE-2026-9937: Use after free in UI. Reported by Google.
     - CVE-2026-9938: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-9939: Heap buffer overflow in WebCodecs. Reported by Google.
     - CVE-2026-9940: Heap buffer overflow in ANGLE. Reported by Google.
     - CVE-2026-9941: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9942: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-9943: Out of bounds read in WebGL. Reported by Google.
     - CVE-2026-9944: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-9945: Use after free in Media. Reported by Google.
     - CVE-2026-9946: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9947: Use after free in XML. Reported by Google.
     - CVE-2026-9948: Use after free in Views. Reported by Google.
     - CVE-2026-9949: Use after free in Core. Reported by Google.
     - CVE-2026-9950: Insufficient validation of untrusted input in iOS.
       Reported by Google.
     - CVE-2026-9951: Use after free in UI. Reported by Google.
     - CVE-2026-9952: Use after free in WebAudio. Reported by Google.
     - CVE-2026-9953: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-9954: Use after free in TabStrip.
       Reported by yueliu of Microsoft.
     - CVE-2026-9955: Inappropriate implementation in iOS. Reported by Google.
     - CVE-2026-9956: Use after free in iOS. Reported by Google.
     - CVE-2026-9957: Use after free in PDF. Reported by Google.
     - CVE-2026-9958: Use after free in PDFium. Reported by Google.
     - CVE-2026-9959: Race in WebRTC. Reported by Google.
     - CVE-2026-9960: Integer overflow in PDFium. Reported by Google.
     - CVE-2026-9961: Use after free in SurfaceCapture. Reported by Google.
     - CVE-2026-9962: Use after free in WebRTC. Reported by Google.
     - CVE-2026-9963: Uninitialized Use in iOS. Reported by Google.
     - CVE-2026-9964: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-9965: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-9966: Integer overflow in XML. Reported by Google.
     - CVE-2026-9967: Out of bounds write in GPU. Reported by Google.
     - CVE-2026-9968: Integer overflow in V8. Reported by Google.
     - CVE-2026-9969: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-9970: Use after free in WebGL. Reported by TFGC.
     - CVE-2026-9971: Inappropriate implementation in iOS. Reported by Google.
     - CVE-2026-9972: Uninitialized Use in Gamepad. Reported by Google.
     - CVE-2026-9973: Out of bounds write in V8. Reported by amyb of OpenAI.
     - CVE-2026-9974: Out of bounds write in GPU. Reported by Google.
     - CVE-2026-9975: Out of bounds read and write in ANGLE. Reported by Google
     - CVE-2026-9976: Inappropriate implementation in USB. Reported by Google.
     - CVE-2026-9977: Insufficient validation of untrusted input in WebShare.
       Reported by Google.
     - CVE-2026-9978: Use after free in Glic. Reported by Google.
     - CVE-2026-9979: Insufficient validation of untrusted input in Input.
       Reported by Google.
     - CVE-2026-9980: Insufficient validation of untrusted input in Printing.
       Reported by Google.
     - CVE-2026-9981: Inappropriate implementation in Skia. Reported by Google.
     - CVE-2026-9982: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-9983: Type Confusion in Skia. Reported by Google.
     - CVE-2026-9984: Use after free in UI. Reported by Google.
     - CVE-2026-9985: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-9986: Insufficient validation of untrusted input in
       OptimizationGuide. Reported by Google.
     - CVE-2026-9987: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Google.
     - CVE-2026-9988: Use after free in WebRTC. Reported by Google.
     - CVE-2026-9989: Inappropriate implementation in Media. Reported by Google
     - CVE-2026-9990: Use after free in WebAppInstalls. Reported by Google.
     - CVE-2026-9991: Inappropriate implementation in Media. Reported by Google
     - CVE-2026-9992: Use after free in Network. Reported by Google.
     - CVE-2026-9993: Use after free in Views. Reported by Google.
     - CVE-2026-9994: Use after free in Core. Reported by Google.
     - CVE-2026-9995: Use after free in WebXR. Reported by Google.
     - CVE-2026-9996: Out of bounds read in WebRTC. Reported by Google.
     - CVE-2026-9997: Use after free in Input. Reported by Google.
     - CVE-2026-9998: Integer overflow in Skia. Reported by Google.
     - CVE-2026-9999: Inappropriate implementation in ANGLE. Reported by Google
     - CVE-2026-10000: Use after free in Passwords. Reported by Google.
     - CVE-2026-10001: Use after free in PerformanceManager. Reported by Google
     - CVE-2026-10002: Use after free in PDFium. Reported by Google.
     - CVE-2026-10003: Use after free in Views. Reported by Google.
     - CVE-2026-10004: Insufficient validation of untrusted input in Passwords.
       Reported by Google.
     - CVE-2026-10005: Use after free in WebAppInstalls. Reported by Google.
     - CVE-2026-10006: Race in WebAudio. Reported by Google.
     - CVE-2026-10007: Use after free in SVG. Reported by Google.
     - CVE-2026-10008: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-10009: Integer overflow in Skia. Reported by Google.
     - CVE-2026-10010: Inappropriate implementation in Input.
       Reported by Google.
     - CVE-2026-10011: Inappropriate implementation in Skia. Reported by Google
     - CVE-2026-10012: Use after free in Skia. Reported by Google.
     - CVE-2026-10013: Use after free in WebCodecs. Reported by Google.
     - CVE-2026-10014: Use after free in WebMIDI. Reported by Google.
     - CVE-2026-10015: Integer overflow in WTF. Reported by Google.
     - CVE-2026-10016: Use after free in DOM. Reported by pwn2addr.
     - CVE-2026-10017: Out of bounds read in Headless.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-10018: Integer overflow in ANGLE. Reported by Rahul Raj.
     - CVE-2026-10019: Integer overflow in ANGLE.
       Reported by Mufeed VH from Winfunc Research (winfunc.com).
     - CVE-2026-10020: Insufficient validation of untrusted input in Skia.
       Reported by Google.
     - CVE-2026-10021: Insufficient validation of untrusted input in USB.
       Reported by Google.
     - CVE-2026-10022: Type Confusion in V8. Reported by ggwhyp.
chromium (148.0.7778.215-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-9872: Out of bounds write in GPU. Reported by cinzinga.
     - CVE-2026-9873: Use after free in Network. Reported by cinzinga.
     - CVE-2026-9874: Use after free in Dawn. Reported by Anonymous.
     - CVE-2026-9875: Out of bounds read in WebGL. Reported by Anonymous.
     - CVE-2026-9876: Use after free in WebGL. Reported by happy2me.
     - CVE-2026-9877: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9878: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9879: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-9880: Insufficient validation of untrusted input in WebGL.
       Reported by Google.
     - CVE-2026-9881: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-9882: Integer overflow in ANGLE. Reported by Google.
     - CVE-2026-9883: Use after free in Base. Reported by Google.
     - CVE-2026-9884: Use after free in Browser. Reported by Google.
     - CVE-2026-9885: Insufficient validation of untrusted input in UI.
       Reported by Google.
     - CVE-2026-9886: Use after free in Base. Reported by Google.
     - CVE-2026-9887: Use after free in Proxy. Reported by Google.
     - CVE-2026-9888: Use after free in WebView. Reported by Google.
     - CVE-2026-9889: Out of bounds read and write in Dawn. Reported by Google.
     - CVE-2026-9890: Use after free in XR. Reported by Google.
     - CVE-2026-9891: Use after free in Extensions. Reported by Google.
     - CVE-2026-9892: Inappropriate implementation in Skia. Reported by Google.
     - CVE-2026-9893: Use after free in Skia. Reported by Google.
     - CVE-2026-9894: Use after free in GPU. Reported by tohafrit.
     - CVE-2026-9895: Out of bounds read in GPU.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-9896: Out of bounds write in V8. Reported by 303f06e3.
     - CVE-2026-9897: Use after free in DOM. Reported by Google.
     - CVE-2026-9898: Insufficient validation of untrusted input in GPU.
       Reported by Google.
     - CVE-2026-9899: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9900: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-9901: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9902: Use after free in Accessibility. Reported by Google.
     - CVE-2026-9903: Insufficient validation of untrusted input in
       Site Isolation. Reported by Google.
     - CVE-2026-9904: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9905: Use after free in Accessibility. Reported by Google.
     - CVE-2026-9906: Out of bounds write in GPU. Reported by Google.
     - CVE-2026-9907: Out of bounds read in Dawn. Reported by Google.
     - CVE-2026-9908: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-9909: Integer overflow in Skia. Reported by Google.
     - CVE-2026-9910: Out of bounds memory access in ANGLE. Reported by Google.
     - CVE-2026-9911: Integer overflow in ANGLE. Reported by Google.
     - CVE-2026-9912: Inappropriate implementation in GPU. Reported by Google.
     - CVE-2026-9913: Inappropriate implementation in ANGLE. Reported by Google
     - CVE-2026-9914: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-9915: Heap buffer overflow in ANGLE. Reported by Google.
     - CVE-2026-9916: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-9917: Uninitialized Use in WebGL. Reported by Google.
     - CVE-2026-9918: Inappropriate implementation in Tint. Reported by Google.
     - CVE-2026-9919: Out of bounds read in WebGL. Reported by Google.
     - CVE-2026-9920: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-9921: Uninitialized Use in WebGL. Reported by Google.
     - CVE-2026-9922: Use after free in GPU. Reported by Google.
     - CVE-2026-9923: Use after free in Skia. Reported by Google.
     - CVE-2026-9924: Heap buffer overflow in ANGLE. Reported by Google.
     - CVE-2026-9925: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9926: Heap buffer overflow in ANGLE. Reported by Google.
     - CVE-2026-9927: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9928: Out of bounds read in ANGLE.
       Reported by Jeff Muizelaar - Mozilla.
     - CVE-2026-9929: Inappropriate implementation in WebGL. Reported by Google
     - CVE-2026-9930: Out of bounds write in Dawn. Reported by Google.
     - CVE-2026-9931: Use after free in GPU. Reported by Google.
     - CVE-2026-9932: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9933: Use after free in Input. Reported by Google.
     - CVE-2026-9934: Use after free in Aura. Reported by Google.
     - CVE-2026-9935: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-9936: Use after free in GFX. Reported by Google.
     - CVE-2026-9937: Use after free in UI. Reported by Google.
     - CVE-2026-9938: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-9939: Heap buffer overflow in WebCodecs. Reported by Google.
     - CVE-2026-9940: Heap buffer overflow in ANGLE. Reported by Google.
     - CVE-2026-9941: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9942: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-9943: Out of bounds read in WebGL. Reported by Google.
     - CVE-2026-9944: Uninitialized Use in ANGLE. Reported by Google.
     - CVE-2026-9945: Use after free in Media. Reported by Google.
     - CVE-2026-9946: Use after free in ANGLE. Reported by Google.
     - CVE-2026-9947: Use after free in XML. Reported by Google.
     - CVE-2026-9948: Use after free in Views. Reported by Google.
     - CVE-2026-9949: Use after free in Core. Reported by Google.
     - CVE-2026-9950: Insufficient validation of untrusted input in iOS.
       Reported by Google.
     - CVE-2026-9951: Use after free in UI. Reported by Google.
     - CVE-2026-9952: Use after free in WebAudio. Reported by Google.
     - CVE-2026-9953: Out of bounds read in ANGLE. Reported by Google.
     - CVE-2026-9954: Use after free in TabStrip.
       Reported by yueliu of Microsoft.
     - CVE-2026-9955: Inappropriate implementation in iOS. Reported by Google.
     - CVE-2026-9956: Use after free in iOS. Reported by Google.
     - CVE-2026-9957: Use after free in PDF. Reported by Google.
     - CVE-2026-9958: Use after free in PDFium. Reported by Google.
     - CVE-2026-9959: Race in WebRTC. Reported by Google.
     - CVE-2026-9960: Integer overflow in PDFium. Reported by Google.
     - CVE-2026-9961: Use after free in SurfaceCapture. Reported by Google.
     - CVE-2026-9962: Use after free in WebRTC. Reported by Google.
     - CVE-2026-9963: Uninitialized Use in iOS. Reported by Google.
     - CVE-2026-9964: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-9965: Out of bounds write in ANGLE. Reported by Google.
     - CVE-2026-9966: Integer overflow in XML. Reported by Google.
     - CVE-2026-9967: Out of bounds write in GPU. Reported by Google.
     - CVE-2026-9968: Integer overflow in V8. Reported by Google.
     - CVE-2026-9969: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-9970: Use after free in WebGL. Reported by TFGC.
     - CVE-2026-9971: Inappropriate implementation in iOS. Reported by Google.
     - CVE-2026-9972: Uninitialized Use in Gamepad. Reported by Google.
     - CVE-2026-9973: Out of bounds write in V8. Reported by amyb of OpenAI.
     - CVE-2026-9974: Out of bounds write in GPU. Reported by Google.
     - CVE-2026-9975: Out of bounds read and write in ANGLE. Reported by Google
     - CVE-2026-9976: Inappropriate implementation in USB. Reported by Google.
     - CVE-2026-9977: Insufficient validation of untrusted input in WebShare.
       Reported by Google.
     - CVE-2026-9978: Use after free in Glic. Reported by Google.
     - CVE-2026-9979: Insufficient validation of untrusted input in Input.
       Reported by Google.
     - CVE-2026-9980: Insufficient validation of untrusted input in Printing.
       Reported by Google.
     - CVE-2026-9981: Inappropriate implementation in Skia. Reported by Google.
     - CVE-2026-9982: Insufficient validation of untrusted input in ANGLE.
       Reported by Google.
     - CVE-2026-9983: Type Confusion in Skia. Reported by Google.
     - CVE-2026-9984: Use after free in UI. Reported by Google.
     - CVE-2026-9985: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-9986: Insufficient validation of untrusted input in
       OptimizationGuide. Reported by Google.
     - CVE-2026-9987: Insufficient validation of untrusted input in
       WebAppInstalls. Reported by Google.
     - CVE-2026-9988: Use after free in WebRTC. Reported by Google.
     - CVE-2026-9989: Inappropriate implementation in Media. Reported by Google
     - CVE-2026-9990: Use after free in WebAppInstalls. Reported by Google.
     - CVE-2026-9991: Inappropriate implementation in Media. Reported by Google
     - CVE-2026-9992: Use after free in Network. Reported by Google.
     - CVE-2026-9993: Use after free in Views. Reported by Google.
     - CVE-2026-9994: Use after free in Core. Reported by Google.
     - CVE-2026-9995: Use after free in WebXR. Reported by Google.
     - CVE-2026-9996: Out of bounds read in WebRTC. Reported by Google.
     - CVE-2026-9997: Use after free in Input. Reported by Google.
     - CVE-2026-9998: Integer overflow in Skia. Reported by Google.
     - CVE-2026-9999: Inappropriate implementation in ANGLE. Reported by Google
     - CVE-2026-10000: Use after free in Passwords. Reported by Google.
     - CVE-2026-10001: Use after free in PerformanceManager. Reported by Google
     - CVE-2026-10002: Use after free in PDFium. Reported by Google.
     - CVE-2026-10003: Use after free in Views. Reported by Google.
     - CVE-2026-10004: Insufficient validation of untrusted input in Passwords.
       Reported by Google.
     - CVE-2026-10005: Use after free in WebAppInstalls. Reported by Google.
     - CVE-2026-10006: Race in WebAudio. Reported by Google.
     - CVE-2026-10007: Use after free in SVG. Reported by Google.
     - CVE-2026-10008: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-10009: Integer overflow in Skia. Reported by Google.
     - CVE-2026-10010: Inappropriate implementation in Input.
       Reported by Google.
     - CVE-2026-10011: Inappropriate implementation in Skia. Reported by Google
     - CVE-2026-10012: Use after free in Skia. Reported by Google.
     - CVE-2026-10013: Use after free in WebCodecs. Reported by Google.
     - CVE-2026-10014: Use after free in WebMIDI. Reported by Google.
     - CVE-2026-10015: Integer overflow in WTF. Reported by Google.
     - CVE-2026-10016: Use after free in DOM. Reported by pwn2addr.
     - CVE-2026-10017: Out of bounds read in Headless.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-10018: Integer overflow in ANGLE. Reported by Rahul Raj.
     - CVE-2026-10019: Integer overflow in ANGLE.
       Reported by Mufeed VH from Winfunc Research (winfunc.com).
     - CVE-2026-10020: Insufficient validation of untrusted input in Skia.
       Reported by Google.
     - CVE-2026-10021: Insufficient validation of untrusted input in USB.
       Reported by Google.
     - CVE-2026-10022: Type Confusion in V8. Reported by ggwhyp.
chromium (148.0.7778.178-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
chromium (148.0.7778.178-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-9111: Use after free in WebRTC. Reported by Google.
     - CVE-2026-9110: Inappropriate implementation in UI. Reported by Google.
     - CVE-2026-9112: Use after free in GPU.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-9113: Out of bounds read in GPU.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-9114: Use after free in QUIC. Reported by Google.
     - CVE-2026-9115: Insufficient policy enforcement in Service Worker.
       Reported by Google.
     - CVE-2026-9116: Insufficient policy enforcement in ServiceWorker.
       Reported by Google.
     - CVE-2026-9117: Type Confusion in GFX. Reported by Google.
     - CVE-2026-9118: Use after free in XR. Reported by Google.
     - CVE-2026-9119: Heap buffer overflow in WebRTC. Reported by Google.
     - CVE-2026-9120: Use after free in WebRTC. Reported by Google.
     - CVE-2026-9126: Use after free in DOM. Reported by Google.
     - CVE-2026-9121: Out of bounds read in GPU.
       Reported by David Korczynski (Adalogics) .
     - CVE-2026-9122: Out of bounds read in GPU.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-9123: Heap buffer overflow in Chromecast. Reported by Google.
     - CVE-2026-9124: Insufficient validation of untrusted input in Input.
       Reported by Google.
chromium (148.0.7778.178-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-9111: Use after free in WebRTC. Reported by Google.
     - CVE-2026-9110: Inappropriate implementation in UI. Reported by Google.
     - CVE-2026-9112: Use after free in GPU.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-9113: Out of bounds read in GPU.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-9114: Use after free in QUIC. Reported by Google.
     - CVE-2026-9115: Insufficient policy enforcement in Service Worker.
       Reported by Google.
     - CVE-2026-9116: Insufficient policy enforcement in ServiceWorker.
       Reported by Google.
     - CVE-2026-9117: Type Confusion in GFX. Reported by Google.
     - CVE-2026-9118: Use after free in XR. Reported by Google.
     - CVE-2026-9119: Heap buffer overflow in WebRTC. Reported by Google.
     - CVE-2026-9120: Use after free in WebRTC. Reported by Google.
     - CVE-2026-9126: Use after free in DOM. Reported by Google.
     - CVE-2026-9121: Out of bounds read in GPU.
       Reported by David Korczynski (Adalogics) .
     - CVE-2026-9122: Out of bounds read in GPU.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-9123: Heap buffer overflow in Chromecast. Reported by Google.
     - CVE-2026-9124: Insufficient validation of untrusted input in Input.
       Reported by Google.
chromium (148.0.7778.167-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-8509: Heap buffer overflow in WebML.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-8510: Integer overflow in Skia. Reported by q@calif.io.
     - CVE-2026-8511: Use after free in UI. Reported by Google.
     - CVE-2026-8512: Use after free in FileSystem. Reported by Google.
     - CVE-2026-8513: Use after free in Input. Reported by Google.
     - CVE-2026-8514: Use after free in Aura. Reported by Google.
     - CVE-2026-8515: Use after free in HID. Reported by Google.
     - CVE-2026-8516: Insufficient validation of untrusted input in
       DataTransfer. Reported by Google.
     - CVE-2026-8517: Object lifecycle issue in WebShare. Reported by Google.
     - CVE-2026-8518: Use after free in Blink. Reported by Google.
     - CVE-2026-8519: Integer overflow in ANGLE. Reported by Google.
     - CVE-2026-8520: Race in Payments. Reported by Google.
     - CVE-2026-8521: Use after free in Tab Groups. Reported by Google.
     - CVE-2026-8522: Use after free in Downloads. Reported by Google.
     - CVE-2026-8523: Use after free in Mojo.
       Reported by Paul Seekamp / nullenc0de.
     - CVE-2026-8558: Out of bounds write in Fonts. Reported by Matej Smycka.
     - CVE-2026-8524: Out of bounds write in WebAudio.
       Reported by Brendan Dolan-Gavitt, XBOW.
     - CVE-2026-8525: Heap buffer overflow in ANGLE.
       Reported by Nathaniel Oh (@calysteon).
     - CVE-2026-8526: Out of bounds write in WebRTC.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-8527: Insufficient validation of untrusted input in Downloads.
       Reported by rachmat.abdul.ro.
     - CVE-2026-8528: Insufficient validation of untrusted input in
       SiteIsolation. Reported by Google.
     - CVE-2026-8529: Heap buffer overflow in Codecs. Reported by Google.
     - CVE-2026-8530: Use after free in Network. Reported by Google.
     - CVE-2026-8531: Heap buffer overflow in WebML. Reported by Syn4pse.
     - CVE-2026-8532: Integer overflow in XML. Reported by Google.
     - CVE-2026-8533: Use after free in Accessibility. Reported by Google.
     - CVE-2026-8534: Integer overflow in GPU. Reported by Google.
     - CVE-2026-8535: Out of bounds read in Media. Reported by Google.
     - CVE-2026-8536: Insufficient validation of untrusted input in
       ReadingMode. Reported by Google.
     - CVE-2026-8537: Insufficient policy enforcement in ViewTransitions.
       Reported by Google.
     - CVE-2026-8538: Insufficient validation of untrusted input in GPU.
       Reported by Google.
     - CVE-2026-8539: Script injection in SanitizerAPI.
       Reported by Jungwoo Lee (@physicube) and Wongi Lee (@_qwerty_po).
     - CVE-2026-8540: Type Confusion in V8. Reported by Google.
     - CVE-2026-8541: Out of bounds read in UI. Reported by Google.
     - CVE-2026-8542: Use after free in Core. Reported by Google.
     - CVE-2026-8543: Out of bounds read in FileSystem. Reported by Google.
     - CVE-2026-8544: Use after free in Media. Reported by Google.
     - CVE-2026-8545: Object corruption in Compositing. Reported by Google.
     - CVE-2026-8546: Out of bounds read in GPU. Reported by Google.
     - CVE-2026-8547: Insufficient policy enforcement in Passwords.
       Reported by Google.
     - CVE-2026-8548: Out of bounds write in Media. Reported by Google.
     - CVE-2026-8549: Use after free in Media. Reported by Google.
     - CVE-2026-8550: Use after free in Google Lens. Reported by Google.
     - CVE-2026-8551: Use after free in Downloads. Reported by Google.
     - CVE-2026-8552: Heap buffer overflow in GPU. Reported by Google.
     - CVE-2026-8553: Use after free in GPU. Reported by Google.
     - CVE-2026-8554: Type Confusion in ANGLE. Reported by Google.
     - CVE-2026-8555: Use after free in GTK. Reported by Google.
     - CVE-2026-8556: Inappropriate implementation in ANGLE. Reported by Google
     - CVE-2026-8557: Use after free in Accessibility. Reported by Google.
     - CVE-2026-8559: Integer overflow in Internationalization.
       Reported by Google.
     - CVE-2026-8560: Heap buffer overflow in SwiftShader.
       Reported by Cassidy Kim(@cassidy6564).
     - CVE-2026-8561: Incorrect security UI in Fullscreen. Reported by
       Wolfgang Ettlinger (aff. Certitude Consulting GmbH) Alexander Hurbean
       (aff. Certitude Consulting GmbH).
     - CVE-2026-8562: Side-channel information leakage in Navigation.
       Reported by Google.
     - CVE-2026-8563: Insufficient policy enforcement in IFrame Sandbox.
       Reported by Luan Herrera (@lbherrera_).
     - CVE-2026-8564: Incorrect security UI in Downloads.
       Reported by Alesandro Ortiz https://AlesandroOrtiz.com.
     - CVE-2026-8565: Inappropriate implementation in Downloads.
       Reported by Farras Givari.
     - CVE-2026-8566: Insufficient policy enforcement in Payments.
       Reported by Jorian Woltjer.
     - CVE-2026-8567: Integer overflow in ANGLE. Reported by cinzinga.
     - CVE-2026-8568: Insufficient policy enforcement in AI.
       Reported by Tianyi Hu.
     - CVE-2026-8569: Out of bounds write in Codecs. Reported by Google.
     - CVE-2026-8570: Type Confusion in V8. Reported by Google.
     - CVE-2026-8571: Insufficient policy enforcement in GPU.
       Reported by Mark Blaszczyk.
     - CVE-2026-8572: Insufficient policy enforcement in Network.
       Reported by Google.
     - CVE-2026-8573: Integer overflow in Codecs. Reported by Google.
     - CVE-2026-8574: Use after free in Core. Reported by Google.
     - CVE-2026-8575: Use after free in UI. Reported by Google.
     - CVE-2026-8576: Inappropriate implementation in CORS. Reported by Google
     - CVE-2026-8577: Integer overflow in Fonts. Reported by Google.
     - CVE-2026-8578: Out of bounds read in GPU. Reported by Google.
     - CVE-2026-8579: Insufficient validation of untrusted input in Skia.
       Reported by Google.
     - CVE-2026-8580: Use after free in Mojo. Reported by Google.
     - CVE-2026-8581: Use after free in GPU. Reported by Google.
     - CVE-2026-8582: Object lifecycle issue in Dawn. Reported by Google.
     - CVE-2026-8583: Insufficient policy enforcement in WebXR.
       Reported by Google.
     - CVE-2026-8584: Inappropriate implementation in Views. Reported by Google
     - CVE-2026-8585: Inappropriate implementation in Media. Reported by Google
     - CVE-2026-8586: Inappropriate implementation in Chromoting.
       Reported by Google.
     - CVE-2026-8587: Use after free in Extensions.
       Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab.
   * rust-1.85/file_as_c_str.patch: fix build on non-x86 archs, as char*
     signed-ness is apparently different there versus arm & ppc64 [trixie,
     bookworm].
chromium (148.0.7778.167-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-8509: Heap buffer overflow in WebML.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-8510: Integer overflow in Skia. Reported by q@calif.io.
     - CVE-2026-8511: Use after free in UI. Reported by Google.
     - CVE-2026-8512: Use after free in FileSystem. Reported by Google.
     - CVE-2026-8513: Use after free in Input. Reported by Google.
     - CVE-2026-8514: Use after free in Aura. Reported by Google.
     - CVE-2026-8515: Use after free in HID. Reported by Google.
     - CVE-2026-8516: Insufficient validation of untrusted input in
       DataTransfer. Reported by Google.
     - CVE-2026-8517: Object lifecycle issue in WebShare. Reported by Google.
     - CVE-2026-8518: Use after free in Blink. Reported by Google.
     - CVE-2026-8519: Integer overflow in ANGLE. Reported by Google.
     - CVE-2026-8520: Race in Payments. Reported by Google.
     - CVE-2026-8521: Use after free in Tab Groups. Reported by Google.
     - CVE-2026-8522: Use after free in Downloads. Reported by Google.
     - CVE-2026-8523: Use after free in Mojo.
       Reported by Paul Seekamp / nullenc0de.
     - CVE-2026-8558: Out of bounds write in Fonts. Reported by Matej Smycka.
     - CVE-2026-8524: Out of bounds write in WebAudio.
       Reported by Brendan Dolan-Gavitt, XBOW.
     - CVE-2026-8525: Heap buffer overflow in ANGLE.
       Reported by Nathaniel Oh (@calysteon).
     - CVE-2026-8526: Out of bounds write in WebRTC.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-8527: Insufficient validation of untrusted input in Downloads.
       Reported by rachmat.abdul.ro.
     - CVE-2026-8528: Insufficient validation of untrusted input in
       SiteIsolation. Reported by Google.
     - CVE-2026-8529: Heap buffer overflow in Codecs. Reported by Google.
     - CVE-2026-8530: Use after free in Network. Reported by Google.
     - CVE-2026-8531: Heap buffer overflow in WebML. Reported by Syn4pse.
     - CVE-2026-8532: Integer overflow in XML. Reported by Google.
     - CVE-2026-8533: Use after free in Accessibility. Reported by Google.
     - CVE-2026-8534: Integer overflow in GPU. Reported by Google.
     - CVE-2026-8535: Out of bounds read in Media. Reported by Google.
     - CVE-2026-8536: Insufficient validation of untrusted input in
       ReadingMode. Reported by Google.
     - CVE-2026-8537: Insufficient policy enforcement in ViewTransitions.
       Reported by Google.
     - CVE-2026-8538: Insufficient validation of untrusted input in GPU.
       Reported by Google.
     - CVE-2026-8539: Script injection in SanitizerAPI.
       Reported by Jungwoo Lee (@physicube) and Wongi Lee (@_qwerty_po).
     - CVE-2026-8540: Type Confusion in V8. Reported by Google.
     - CVE-2026-8541: Out of bounds read in UI. Reported by Google.
     - CVE-2026-8542: Use after free in Core. Reported by Google.
     - CVE-2026-8543: Out of bounds read in FileSystem. Reported by Google.
     - CVE-2026-8544: Use after free in Media. Reported by Google.
     - CVE-2026-8545: Object corruption in Compositing. Reported by Google.
     - CVE-2026-8546: Out of bounds read in GPU. Reported by Google.
     - CVE-2026-8547: Insufficient policy enforcement in Passwords.
       Reported by Google.
     - CVE-2026-8548: Out of bounds write in Media. Reported by Google.
     - CVE-2026-8549: Use after free in Media. Reported by Google.
     - CVE-2026-8550: Use after free in Google Lens. Reported by Google.
     - CVE-2026-8551: Use after free in Downloads. Reported by Google.
     - CVE-2026-8552: Heap buffer overflow in GPU. Reported by Google.
     - CVE-2026-8553: Use after free in GPU. Reported by Google.
     - CVE-2026-8554: Type Confusion in ANGLE. Reported by Google.
     - CVE-2026-8555: Use after free in GTK. Reported by Google.
     - CVE-2026-8556: Inappropriate implementation in ANGLE. Reported by Google
     - CVE-2026-8557: Use after free in Accessibility. Reported by Google.
     - CVE-2026-8559: Integer overflow in Internationalization.
       Reported by Google.
     - CVE-2026-8560: Heap buffer overflow in SwiftShader.
       Reported by Cassidy Kim(@cassidy6564).
     - CVE-2026-8561: Incorrect security UI in Fullscreen. Reported by
       Wolfgang Ettlinger (aff. Certitude Consulting GmbH) Alexander Hurbean
       (aff. Certitude Consulting GmbH).
     - CVE-2026-8562: Side-channel information leakage in Navigation.
       Reported by Google.
     - CVE-2026-8563: Insufficient policy enforcement in IFrame Sandbox.
       Reported by Luan Herrera (@lbherrera_).
     - CVE-2026-8564: Incorrect security UI in Downloads.
       Reported by Alesandro Ortiz https://AlesandroOrtiz.com.
     - CVE-2026-8565: Inappropriate implementation in Downloads.
       Reported by Farras Givari.
     - CVE-2026-8566: Insufficient policy enforcement in Payments.
       Reported by Jorian Woltjer.
     - CVE-2026-8567: Integer overflow in ANGLE. Reported by cinzinga.
     - CVE-2026-8568: Insufficient policy enforcement in AI.
       Reported by Tianyi Hu.
     - CVE-2026-8569: Out of bounds write in Codecs. Reported by Google.
     - CVE-2026-8570: Type Confusion in V8. Reported by Google.
     - CVE-2026-8571: Insufficient policy enforcement in GPU.
       Reported by Mark Blaszczyk.
     - CVE-2026-8572: Insufficient policy enforcement in Network.
       Reported by Google.
     - CVE-2026-8573: Integer overflow in Codecs. Reported by Google.
     - CVE-2026-8574: Use after free in Core. Reported by Google.
     - CVE-2026-8575: Use after free in UI. Reported by Google.
     - CVE-2026-8576: Inappropriate implementation in CORS. Reported by Google
     - CVE-2026-8577: Integer overflow in Fonts. Reported by Google.
     - CVE-2026-8578: Out of bounds read in GPU. Reported by Google.
     - CVE-2026-8579: Insufficient validation of untrusted input in Skia.
       Reported by Google.
     - CVE-2026-8580: Use after free in Mojo. Reported by Google.
     - CVE-2026-8581: Use after free in GPU. Reported by Google.
     - CVE-2026-8582: Object lifecycle issue in Dawn. Reported by Google.
     - CVE-2026-8583: Insufficient policy enforcement in WebXR.
       Reported by Google.
     - CVE-2026-8584: Inappropriate implementation in Views. Reported by Google
     - CVE-2026-8585: Inappropriate implementation in Media. Reported by Google
     - CVE-2026-8586: Inappropriate implementation in Chromoting.
       Reported by Google.
     - CVE-2026-8587: Use after free in Extensions.
       Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab.
   * rust-1.85/file_as_c_str.patch: fix build on non-x86 archs, as char*
     signed-ness is apparently different there versus arm & ppc64 [trixie,
     bookworm].
chromium (148.0.7778.167-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-8509: Heap buffer overflow in WebML.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-8510: Integer overflow in Skia. Reported by q@calif.io.
     - CVE-2026-8511: Use after free in UI. Reported by Google.
     - CVE-2026-8512: Use after free in FileSystem. Reported by Google.
     - CVE-2026-8513: Use after free in Input. Reported by Google.
     - CVE-2026-8514: Use after free in Aura. Reported by Google.
     - CVE-2026-8515: Use after free in HID. Reported by Google.
     - CVE-2026-8516: Insufficient validation of untrusted input in
       DataTransfer. Reported by Google.
     - CVE-2026-8517: Object lifecycle issue in WebShare. Reported by Google.
     - CVE-2026-8518: Use after free in Blink. Reported by Google.
     - CVE-2026-8519: Integer overflow in ANGLE. Reported by Google.
     - CVE-2026-8520: Race in Payments. Reported by Google.
     - CVE-2026-8521: Use after free in Tab Groups. Reported by Google.
     - CVE-2026-8522: Use after free in Downloads. Reported by Google.
     - CVE-2026-8523: Use after free in Mojo.
       Reported by Paul Seekamp / nullenc0de.
     - CVE-2026-8558: Out of bounds write in Fonts. Reported by Matej Smycka.
     - CVE-2026-8524: Out of bounds write in WebAudio.
       Reported by Brendan Dolan-Gavitt, XBOW.
     - CVE-2026-8525: Heap buffer overflow in ANGLE.
       Reported by Nathaniel Oh (@calysteon).
     - CVE-2026-8526: Out of bounds write in WebRTC.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-8527: Insufficient validation of untrusted input in Downloads.
       Reported by rachmat.abdul.ro.
     - CVE-2026-8528: Insufficient validation of untrusted input in
       SiteIsolation. Reported by Google.
     - CVE-2026-8529: Heap buffer overflow in Codecs. Reported by Google.
     - CVE-2026-8530: Use after free in Network. Reported by Google.
     - CVE-2026-8531: Heap buffer overflow in WebML. Reported by Syn4pse.
     - CVE-2026-8532: Integer overflow in XML. Reported by Google.
     - CVE-2026-8533: Use after free in Accessibility. Reported by Google.
     - CVE-2026-8534: Integer overflow in GPU. Reported by Google.
     - CVE-2026-8535: Out of bounds read in Media. Reported by Google.
     - CVE-2026-8536: Insufficient validation of untrusted input in
       ReadingMode. Reported by Google.
     - CVE-2026-8537: Insufficient policy enforcement in ViewTransitions.
       Reported by Google.
     - CVE-2026-8538: Insufficient validation of untrusted input in GPU.
       Reported by Google.
     - CVE-2026-8539: Script injection in SanitizerAPI.
       Reported by Jungwoo Lee (@physicube) and Wongi Lee (@_qwerty_po).
     - CVE-2026-8540: Type Confusion in V8. Reported by Google.
     - CVE-2026-8541: Out of bounds read in UI. Reported by Google.
     - CVE-2026-8542: Use after free in Core. Reported by Google.
     - CVE-2026-8543: Out of bounds read in FileSystem. Reported by Google.
     - CVE-2026-8544: Use after free in Media. Reported by Google.
     - CVE-2026-8545: Object corruption in Compositing. Reported by Google.
     - CVE-2026-8546: Out of bounds read in GPU. Reported by Google.
     - CVE-2026-8547: Insufficient policy enforcement in Passwords.
       Reported by Google.
     - CVE-2026-8548: Out of bounds write in Media. Reported by Google.
     - CVE-2026-8549: Use after free in Media. Reported by Google.
     - CVE-2026-8550: Use after free in Google Lens. Reported by Google.
     - CVE-2026-8551: Use after free in Downloads. Reported by Google.
     - CVE-2026-8552: Heap buffer overflow in GPU. Reported by Google.
     - CVE-2026-8553: Use after free in GPU. Reported by Google.
     - CVE-2026-8554: Type Confusion in ANGLE. Reported by Google.
     - CVE-2026-8555: Use after free in GTK. Reported by Google.
     - CVE-2026-8556: Inappropriate implementation in ANGLE. Reported by Google
     - CVE-2026-8557: Use after free in Accessibility. Reported by Google.
     - CVE-2026-8559: Integer overflow in Internationalization.
       Reported by Google.
     - CVE-2026-8560: Heap buffer overflow in SwiftShader.
       Reported by Cassidy Kim(@cassidy6564).
     - CVE-2026-8561: Incorrect security UI in Fullscreen. Reported by
       Wolfgang Ettlinger (aff. Certitude Consulting GmbH) Alexander Hurbean
       (aff. Certitude Consulting GmbH).
     - CVE-2026-8562: Side-channel information leakage in Navigation.
       Reported by Google.
     - CVE-2026-8563: Insufficient policy enforcement in IFrame Sandbox.
       Reported by Luan Herrera (@lbherrera_).
     - CVE-2026-8564: Incorrect security UI in Downloads.
       Reported by Alesandro Ortiz https://AlesandroOrtiz.com.
     - CVE-2026-8565: Inappropriate implementation in Downloads.
       Reported by Farras Givari.
     - CVE-2026-8566: Insufficient policy enforcement in Payments.
       Reported by Jorian Woltjer.
     - CVE-2026-8567: Integer overflow in ANGLE. Reported by cinzinga.
     - CVE-2026-8568: Insufficient policy enforcement in AI.
       Reported by Tianyi Hu.
     - CVE-2026-8569: Out of bounds write in Codecs. Reported by Google.
     - CVE-2026-8570: Type Confusion in V8. Reported by Google.
     - CVE-2026-8571: Insufficient policy enforcement in GPU.
       Reported by Mark Blaszczyk.
     - CVE-2026-8572: Insufficient policy enforcement in Network.
       Reported by Google.
     - CVE-2026-8573: Integer overflow in Codecs. Reported by Google.
     - CVE-2026-8574: Use after free in Core. Reported by Google.
     - CVE-2026-8575: Use after free in UI. Reported by Google.
     - CVE-2026-8576: Inappropriate implementation in CORS. Reported by Google
     - CVE-2026-8577: Integer overflow in Fonts. Reported by Google.
     - CVE-2026-8578: Out of bounds read in GPU. Reported by Google.
     - CVE-2026-8579: Insufficient validation of untrusted input in Skia.
       Reported by Google.
     - CVE-2026-8580: Use after free in Mojo. Reported by Google.
     - CVE-2026-8581: Use after free in GPU. Reported by Google.
     - CVE-2026-8582: Object lifecycle issue in Dawn. Reported by Google.
     - CVE-2026-8583: Insufficient policy enforcement in WebXR.
       Reported by Google.
     - CVE-2026-8584: Inappropriate implementation in Views. Reported by Google
     - CVE-2026-8585: Inappropriate implementation in Media. Reported by Google
     - CVE-2026-8586: Inappropriate implementation in Chromoting.
       Reported by Google.
     - CVE-2026-8587: Use after free in Extensions.
       Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab.
   * rust-1.85/file_as_c_str.patch: fix build on non-x86 archs, as char*
     signed-ness is apparently different there versus arm & ppc64 [trixie,
     bookworm].
chromium (148.0.7778.96-3) unstable; urgency=high
 .
   [ Andres Salomon ]
   * d/control: switch to hardcoding esbuild-wasm build-dep, since buildds
     aren't smart enough to handle OR build-deps.
chromium (148.0.7778.96-2) unstable; urgency=high
 .
   [ Andres Salomon ]
   * d/rules: update for new script path in debian's esbuild package
     (maintaining backwards compatibility with older esbuild packages).
   * d/control: add build-dep on esbuild-wasm for sid but not older
     distributions.
chromium (148.0.7778.96-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream stable release.
     - CVE-2026-7896: Integer overflow in Blink.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-7897: Use after free in Mobile. Reported by Google.
     - CVE-2026-7898: Use after free in Chromoting. Reported by Google.
     - CVE-2026-7899: Out of bounds read and write in V8.
       Reported by Project WhatForLunch (@pjwhatforlunch).
     - CVE-2026-7900: Heap buffer overflow in ANGLE. Reported by Anonymous.
     - CVE-2026-7901: Use after free in ANGLE. Reported by Syn4pse (@ret2happy)
     - CVE-2026-7902: Out of bounds memory access in V8.
       Reported by JunYoung Park(@candymate) of KAIST Hacking Lab.
     - CVE-2026-7903: Integer overflow in ANGLE. Reported by heesun.
     - CVE-2026-7904: Out of bounds read in Fonts.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-7905: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-7906: Use after free in SVG. Reported by Google.
     - CVE-2026-7907: Use after free in DOM. Reported by Google.
     - CVE-2026-7908: Use after free in Fullscreen. Reported by Google.
     - CVE-2026-7909: Inappropriate implementation in ServiceWorker.
       Reported by Google.
     - CVE-2026-7910: Use after free in Views. Reported by Google.
     - CVE-2026-7911: Use after free in Aura. Reported by Google.
     - CVE-2026-7912: Integer overflow in GPU. Reported by Google.
     - CVE-2026-7913: Insufficient policy enforcement in DevTools.
       Reported by Google.
     - CVE-2026-7914: Type Confusion in Accessibility. Reported by Google.
     - CVE-2026-7915: Insufficient data validation in DevTools.
       Reported by Google.
     - CVE-2026-7916: Insufficient data validation in InterestGroups.
       Reported by Google.
     - CVE-2026-7917: Use after free in Fullscreen. Reported by Google.
     - CVE-2026-7918: Use after free in GPU. Reported by Google.
     - CVE-2026-7919: Use after free in Aura. Reported by Google.
     - CVE-2026-7920: Use after free in Skia. Reported by Google.
     - CVE-2026-7921: Use after free in Passwords. Reported by Google.
     - CVE-2026-7922: Use after free in ServiceWorker. Reported by Google.
     - CVE-2026-7923: Out of bounds write in Skia. Reported by Google.
     - CVE-2026-7924: Uninitialized Use in Dawn. Reported by Google.
     - CVE-2026-7925: Use after free in Chromoting. Reported by Google.
     - CVE-2026-7926: Use after free in PresentationAPI. Reported by anonymous
     - CVE-2026-7927: Type Confusion in Runtime. Reported by Google.
     - CVE-2026-7928: Use after free in WebRTC. Reported by Google.
     - CVE-2026-7929: Use after free in MediaRecording. Reported by Google.
     - CVE-2026-7930: Insufficient validation of untrusted input in Cookies.
       Reported by Satoki.
     - CVE-2026-7931: Insufficient validation of untrusted input in iOS.
       Reported by Qadhafy Muhammad Tera.
     - CVE-2026-7932: Insufficient policy enforcement in Downloads.
       Reported by Povcfe of Tencent Security Xuanwu Lab.
     - CVE-2026-7933: Out of bounds read in WebCodecs.
       Reported by heapracer (@heapracer).
     - CVE-2026-7934: Insufficient validation of untrusted input in
       Popup Blocker. Reported by Google.
     - CVE-2026-7935: Inappropriate implementation in Speech.
       Reported by Qadhafy Muhammad Tera.
     - CVE-2026-7936: Object lifecycle issue in V8. Reported by Christian Holler.
     - CVE-2026-7937: Insufficient policy enforcement in DevTools. Reported by
       lebr0nli of National Yang Ming Chiao Tung University, Dept. of CS,
       Security and Systems Lab.
     - CVE-2026-7938: Use after free in CSS.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-7939: Inappropriate implementation in SanitizerAPI.
       Reported by s3zer0.
     - CVE-2026-7940: Use after free in V8. Reported by sakana.
     - CVE-2026-7941: Insufficient validation of untrusted input in Mobile.
       Reported by Adithya Kotian.
     - CVE-2026-7942: Integer overflow in ANGLE. Reported by Google.
     - CVE-2026-7943: Insufficient validation of untrusted input in ANGLE.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-7944: Insufficient validation of untrusted input
       in Persistent Cache. Reported by Google.
     - CVE-2026-7945: Insufficient validation of untrusted input in COOP.
       Reported by Google.
     - CVE-2026-7946: Insufficient policy enforcement in WebUI.
       Reported by Google.
     - CVE-2026-7947: Insufficient validation of untrusted input in Network.
       Reported by Google.
     - CVE-2026-7948: Race in Chromoting. Reported by Google.
     - CVE-2026-7949: Out of bounds read in Skia. Reported by Google.
     - CVE-2026-7950: Out of bounds read and write in GFX. Reported by Google.
     - CVE-2026-7951: Out of bounds write in WebRTC.
       Reported by soft.connect.fr.
     - CVE-2026-7952: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-7953: Insufficient validation of untrusted input in Omnibox.
       Reported by Google.
     - CVE-2026-7954: Race in Shared Storage. Reported by Google.
     - CVE-2026-7955: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-7956: Use after free in Navigation. Reported by Google.
     - CVE-2026-7957: Out of bounds write in Media. Reported by Google.
     - CVE-2026-7958: Inappropriate implementation in ServiceWorker.
       Reported by Google.
     - CVE-2026-7959: Inappropriate implementation in Navigation.
       Reported by Google.
     - CVE-2026-7960: Race in Speech. Reported by Google.
     - CVE-2026-7961: Insufficient validation of untrusted input in Permissions
       Reported by Google.
     - CVE-2026-7962: Insufficient policy enforcement in DirectSockets.
       Reported by Google.
     - CVE-2026-7963: Inappropriate implementation in ServiceWorker.
       Reported by Google.
     - CVE-2026-7964: Insufficient validation of untrusted input in FileSystem.
       Reported by Google.
     - CVE-2026-7965: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-7966: Insufficient validation of untrusted input
       in SiteIsolation. Reported by Google.
     - CVE-2026-7967: Insufficient validation of untrusted input in Navigation.
       Reported by Google.
     - CVE-2026-7968: Insufficient validation of untrusted input in CORS.
       Reported by Google.
     - CVE-2026-7969: Integer overflow in Network. Reported by Google.
     - CVE-2026-7970: Use after free in TopChrome. Reported by Google.
     - CVE-2026-7971: Inappropriate implementation in ORB. Reported by Google.
     - CVE-2026-7972: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-7973: Integer overflow in Dawn. Reported by Google.
     - CVE-2026-7974: Use after free in Blink. Reported by Google.
     - CVE-2026-7975: Use after free in DevTools. Reported by Google.
     - CVE-2026-7976: Use after free in Views. Reported by Google.
     - CVE-2026-7977: Inappropriate implementation in Canvas.
       Reported by Google.
     - CVE-2026-7978: Inappropriate implementation in Companion.
       Reported by Google.
     - CVE-2026-7979: Inappropriate implementation in Media. Reported by Google
     - CVE-2026-7980: Use after free in WebAudio. Reported by Google.
     - CVE-2026-7981: Out of bounds read in Codecs. Reported by Google.
     - CVE-2026-7982: Uninitialized Use in WebCodecs. Reported by Google.
     - CVE-2026-7983: Out of bounds read in Dawn. Reported by Google.
     - CVE-2026-7984: Use after free in ReadingMode. Reported by Google.
     - CVE-2026-7985: Use after free in GPU. Reported by Google.
     - CVE-2026-7986: Insufficient policy enforcement in Autofill.
       Reported by Google.
     - CVE-2026-7987: Use after free in WebRTC. Reported by Google.
     - CVE-2026-7988: Type Confusion in WebRTC. Reported by Google.
     - CVE-2026-7989: Insufficient data validation in DataTransfer.
       Reported by Google.
     - CVE-2026-7990: Insufficient validation of untrusted input in Updater.
       Reported by Google.
     - CVE-2026-7991: Use after free in UI. Reported by Google.
     - CVE-2026-7992: Insufficient validation of untrusted input in UI.
       Reported by Google.
     - CVE-2026-7993: Insufficient validation of untrusted input in Payments.
       Reported by Google.
     - CVE-2026-7994: Inappropriate implementation in Chromoting.
       Reported by Google.
     - CVE-2026-7995: Out of bounds read in AdFilter. Reported by Google.
     - CVE-2026-7996: Insufficient validation of untrusted input in SSL.
       Reported by heesun.
     - CVE-2026-7997: Insufficient validation of untrusted input in Updater.
       Reported by ochkofficial.
     - CVE-2026-7998: Insufficient validation of untrusted input in Dialog.
       Reported by Tianyi Hu.
     - CVE-2026-7999: Inappropriate implementation in V8.
       Reported by Taisic Yun (@taisic) of Theori.
     - CVE-2026-8000: Insufficient validation of untrusted input
       in ChromeDriver. Reported by Ryan Jupp - HAAO.
     - CVE-2026-8001: Use after free in Printing.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-8002: Use after free in Audio. Reported by Google.
     - CVE-2026-8003: Insufficient validation of untrusted input in TabGroups.
       Reported by Google.
     - CVE-2026-8004: Insufficient policy enforcement in DevTools.
       Reported by Google.
     - CVE-2026-8005: Insufficient validation of untrusted input in Cast.
       Reported by Google.
     - CVE-2026-8006: Insufficient policy enforcement in DevTools.
       Reported by Google.
     - CVE-2026-8007: Insufficient validation of untrusted input in Cast.
       Reported by Google.
     - CVE-2026-8008: Inappropriate implementation in DevTools.
       Reported by Google.
     - CVE-2026-8009: Inappropriate implementation in Cast. Reported by Google.
     - CVE-2026-8010: Insufficient validation of untrusted input
       in SiteIsolation. Reported by Google.
     - CVE-2026-8011: Insufficient policy enforcement in Search.
       Reported by Google.
     - CVE-2026-8012: Inappropriate implementation in MHTML. Reported by Google
     - CVE-2026-8013: Insufficient validation of untrusted input in FedCM.
       Reported by Google.
     - CVE-2026-8014: Inappropriate implementation in Preload.
       Reported by Google.
     - CVE-2026-8015: Inappropriate implementation in Media. Reported by Google
     - CVE-2026-8016: Use after free in WebRTC. Reported by Google.
     - CVE-2026-8017: Side-channel information leakage in Media.
       Reported by Google.
     - CVE-2026-8018: Insufficient policy enforcement in DevTools.
       Reported by Google.
     - CVE-2026-8019: Insufficient policy enforcement in WebApp.
       Reported by Google.
     - CVE-2026-8020: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-8021: Script injection in UI. Reported by Google.
     - CVE-2026-8022: Inappropriate implementation in MHTML. Reported by Google
   * d/copyright:
     - drop gperf binary that upstream now includes.
     - update for dropping of "khronos" from opengl paths.
   * d/rules:
     - copy gperf binary from /usr/bin into build tree.
     - set webnn_use_litert=false.
   * d/clean:
     - update for harfbuzz-ng to harfbuzz rename.
   * d/patches:
     - upstream/Fix-GL-native-pixmap-import-support-reset-in-GpuInit.patch:
       drop, merged upstream.
     - disable/lint.patch: refresh.
     - trixie/nodejs-set-intersection.patch: refresh for file rename.
     - ungoogled/disable-ai.patch: sync from u-c.
     - trixie/gn-inputs.patch, trixie/gn-inputs2.patch: add patches to
       revert gn "inputs" usage, which isn't supported by our older
       generate-ninja package.
     - llvm-22/ignore-for-ubsan.patch: add another bit to remove the same
       unsupported compiler flag.
     - llvm-19/iota.patch: add build fix for missing std::ranges::iota().
     - upstream/turboshaft.patch: add build fix pulled from (v8) upstream
       for value_or() type ambiguity.
     - trixie/revert-v8-sanitize.patch: add patch to revert v8 gn-related
       changes that cause the build to fail w/ older gn.
     - llvm-19/raw-ref-map-find.patch: add patch to work around older
       clang-19 std::map::find() limitation.
     - rust-1.85/jxl-features.patch: refresh for new version [trixie,
       bookworm].
     - rust-1.85/jxl-simd-avx512.patch: refresh for new version, and also
       drop large portions of this patch that add unsafe{} to macro calls
       (since I already added an unsafe block in the macro definition).
       And mark more functions as unsafe [trixie, bookworm].
     - trixie/adler1.patch: refresh [trixie, bookworm].
     - trixie/rust-is-multiple-of.patch: refresh & move to rust-1.85/
       directory [trixie, bookworm].
     - rust-1.85/file_as_c_str.patch: add patch to work around lack of
       std::panic::file_as_c_str() [trixie, bookworm].
     - rust-1.85/mojo-features.patch: add patch to enable some newer
       rust features in mojom parser [trixie, bookworm].
     - rust-1.85/zip8.patch: add patch to enable some newer rust features
       in zip [trixie, bookworm].
     - bookworm/constexpr.patch: refresh for moved file [bookworm].
     - bookworm/dav1d-drop-hdr.patch: refresh [bookworm].
     - bookworm/eslint.patch: drop, no longer needed [bookworm].
     - ungoogled/remove-navigation-source-param.patch: add patch from u-c
       to drop the "&source=chrome.ob" that shows up when you search for
       something via omnibox.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0002-regenerate-xnn-buildgn.patch refresh for upstream
       changes
     - third_party/skia-vsx-instructions.patch: refresh for upstream changes
     - fixes/fix-different-data-layouts.patch: refresh for upstream changes
 .
   [ Jianfeng Liu ]
   * d/patches/loongarch64:
     - 0004-loong64-sandbox-sandbox-linux-Update-syscall-helpers.patch: Refresh
       for upstream changes
     - 0024-disable-BROTLI_MODEL-macro-for-some-targets.patch: Drop, merged
       upstream
 .
   [ Daniel Richard G. ]
   * d/patches/llvm-19/clang19.patch: Also drop -Wlifetime-safety-permissive
     flag from v8 build, as clang-19 (and 20) doesn't recognize it.
chromium (148.0.7778.96-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream stable release.
     - CVE-2026-7896: Integer overflow in Blink.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-7897: Use after free in Mobile. Reported by Google.
     - CVE-2026-7898: Use after free in Chromoting. Reported by Google.
     - CVE-2026-7899: Out of bounds read and write in V8.
       Reported by Project WhatForLunch (@pjwhatforlunch).
     - CVE-2026-7900: Heap buffer overflow in ANGLE. Reported by Anonymous.
     - CVE-2026-7901: Use after free in ANGLE. Reported by Syn4pse (@ret2happy)
     - CVE-2026-7902: Out of bounds memory access in V8.
       Reported by JunYoung Park(@candymate) of KAIST Hacking Lab.
     - CVE-2026-7903: Integer overflow in ANGLE. Reported by heesun.
     - CVE-2026-7904: Out of bounds read in Fonts.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-7905: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-7906: Use after free in SVG. Reported by Google.
     - CVE-2026-7907: Use after free in DOM. Reported by Google.
     - CVE-2026-7908: Use after free in Fullscreen. Reported by Google.
     - CVE-2026-7909: Inappropriate implementation in ServiceWorker.
       Reported by Google.
     - CVE-2026-7910: Use after free in Views. Reported by Google.
     - CVE-2026-7911: Use after free in Aura. Reported by Google.
     - CVE-2026-7912: Integer overflow in GPU. Reported by Google.
     - CVE-2026-7913: Insufficient policy enforcement in DevTools.
       Reported by Google.
     - CVE-2026-7914: Type Confusion in Accessibility. Reported by Google.
     - CVE-2026-7915: Insufficient data validation in DevTools.
       Reported by Google.
     - CVE-2026-7916: Insufficient data validation in InterestGroups.
       Reported by Google.
     - CVE-2026-7917: Use after free in Fullscreen. Reported by Google.
     - CVE-2026-7918: Use after free in GPU. Reported by Google.
     - CVE-2026-7919: Use after free in Aura. Reported by Google.
     - CVE-2026-7920: Use after free in Skia. Reported by Google.
     - CVE-2026-7921: Use after free in Passwords. Reported by Google.
     - CVE-2026-7922: Use after free in ServiceWorker. Reported by Google.
     - CVE-2026-7923: Out of bounds write in Skia. Reported by Google.
     - CVE-2026-7924: Uninitialized Use in Dawn. Reported by Google.
     - CVE-2026-7925: Use after free in Chromoting. Reported by Google.
     - CVE-2026-7926: Use after free in PresentationAPI. Reported by anonymous
     - CVE-2026-7927: Type Confusion in Runtime. Reported by Google.
     - CVE-2026-7928: Use after free in WebRTC. Reported by Google.
     - CVE-2026-7929: Use after free in MediaRecording. Reported by Google.
     - CVE-2026-7930: Insufficient validation of untrusted input in Cookies.
       Reported by Satoki.
     - CVE-2026-7931: Insufficient validation of untrusted input in iOS.
       Reported by Qadhafy Muhammad Tera.
     - CVE-2026-7932: Insufficient policy enforcement in Downloads.
       Reported by Povcfe of Tencent Security Xuanwu Lab.
     - CVE-2026-7933: Out of bounds read in WebCodecs.
       Reported by heapracer (@heapracer).
     - CVE-2026-7934: Insufficient validation of untrusted input in
       Popup Blocker. Reported by Google.
     - CVE-2026-7935: Inappropriate implementation in Speech.
       Reported by Qadhafy Muhammad Tera.
     - CVE-2026-7936: Object lifecycle issue in V8. Reported by Christian Holler.
     - CVE-2026-7937: Insufficient policy enforcement in DevTools. Reported by
       lebr0nli of National Yang Ming Chiao Tung University, Dept. of CS,
       Security and Systems Lab.
     - CVE-2026-7938: Use after free in CSS.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-7939: Inappropriate implementation in SanitizerAPI.
       Reported by s3zer0.
     - CVE-2026-7940: Use after free in V8. Reported by sakana.
     - CVE-2026-7941: Insufficient validation of untrusted input in Mobile.
       Reported by Adithya Kotian.
     - CVE-2026-7942: Integer overflow in ANGLE. Reported by Google.
     - CVE-2026-7943: Insufficient validation of untrusted input in ANGLE.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-7944: Insufficient validation of untrusted input
       in Persistent Cache. Reported by Google.
     - CVE-2026-7945: Insufficient validation of untrusted input in COOP.
       Reported by Google.
     - CVE-2026-7946: Insufficient policy enforcement in WebUI.
       Reported by Google.
     - CVE-2026-7947: Insufficient validation of untrusted input in Network.
       Reported by Google.
     - CVE-2026-7948: Race in Chromoting. Reported by Google.
     - CVE-2026-7949: Out of bounds read in Skia. Reported by Google.
     - CVE-2026-7950: Out of bounds read and write in GFX. Reported by Google.
     - CVE-2026-7951: Out of bounds write in WebRTC.
       Reported by soft.connect.fr.
     - CVE-2026-7952: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-7953: Insufficient validation of untrusted input in Omnibox.
       Reported by Google.
     - CVE-2026-7954: Race in Shared Storage. Reported by Google.
     - CVE-2026-7955: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-7956: Use after free in Navigation. Reported by Google.
     - CVE-2026-7957: Out of bounds write in Media. Reported by Google.
     - CVE-2026-7958: Inappropriate implementation in ServiceWorker.
       Reported by Google.
     - CVE-2026-7959: Inappropriate implementation in Navigation.
       Reported by Google.
     - CVE-2026-7960: Race in Speech. Reported by Google.
     - CVE-2026-7961: Insufficient validation of untrusted input in Permissions
       Reported by Google.
     - CVE-2026-7962: Insufficient policy enforcement in DirectSockets.
       Reported by Google.
     - CVE-2026-7963: Inappropriate implementation in ServiceWorker.
       Reported by Google.
     - CVE-2026-7964: Insufficient validation of untrusted input in FileSystem.
       Reported by Google.
     - CVE-2026-7965: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-7966: Insufficient validation of untrusted input
       in SiteIsolation. Reported by Google.
     - CVE-2026-7967: Insufficient validation of untrusted input in Navigation.
       Reported by Google.
     - CVE-2026-7968: Insufficient validation of untrusted input in CORS.
       Reported by Google.
     - CVE-2026-7969: Integer overflow in Network. Reported by Google.
     - CVE-2026-7970: Use after free in TopChrome. Reported by Google.
     - CVE-2026-7971: Inappropriate implementation in ORB. Reported by Google.
     - CVE-2026-7972: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-7973: Integer overflow in Dawn. Reported by Google.
     - CVE-2026-7974: Use after free in Blink. Reported by Google.
     - CVE-2026-7975: Use after free in DevTools. Reported by Google.
     - CVE-2026-7976: Use after free in Views. Reported by Google.
     - CVE-2026-7977: Inappropriate implementation in Canvas.
       Reported by Google.
     - CVE-2026-7978: Inappropriate implementation in Companion.
       Reported by Google.
     - CVE-2026-7979: Inappropriate implementation in Media. Reported by Google
     - CVE-2026-7980: Use after free in WebAudio. Reported by Google.
     - CVE-2026-7981: Out of bounds read in Codecs. Reported by Google.
     - CVE-2026-7982: Uninitialized Use in WebCodecs. Reported by Google.
     - CVE-2026-7983: Out of bounds read in Dawn. Reported by Google.
     - CVE-2026-7984: Use after free in ReadingMode. Reported by Google.
     - CVE-2026-7985: Use after free in GPU. Reported by Google.
     - CVE-2026-7986: Insufficient policy enforcement in Autofill.
       Reported by Google.
     - CVE-2026-7987: Use after free in WebRTC. Reported by Google.
     - CVE-2026-7988: Type Confusion in WebRTC. Reported by Google.
     - CVE-2026-7989: Insufficient data validation in DataTransfer.
       Reported by Google.
     - CVE-2026-7990: Insufficient validation of untrusted input in Updater.
       Reported by Google.
     - CVE-2026-7991: Use after free in UI. Reported by Google.
     - CVE-2026-7992: Insufficient validation of untrusted input in UI.
       Reported by Google.
     - CVE-2026-7993: Insufficient validation of untrusted input in Payments.
       Reported by Google.
     - CVE-2026-7994: Inappropriate implementation in Chromoting.
       Reported by Google.
     - CVE-2026-7995: Out of bounds read in AdFilter. Reported by Google.
     - CVE-2026-7996: Insufficient validation of untrusted input in SSL.
       Reported by heesun.
     - CVE-2026-7997: Insufficient validation of untrusted input in Updater.
       Reported by ochkofficial.
     - CVE-2026-7998: Insufficient validation of untrusted input in Dialog.
       Reported by Tianyi Hu.
     - CVE-2026-7999: Inappropriate implementation in V8.
       Reported by Taisic Yun (@taisic) of Theori.
     - CVE-2026-8000: Insufficient validation of untrusted input
       in ChromeDriver. Reported by Ryan Jupp - HAAO.
     - CVE-2026-8001: Use after free in Printing.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-8002: Use after free in Audio. Reported by Google.
     - CVE-2026-8003: Insufficient validation of untrusted input in TabGroups.
       Reported by Google.
     - CVE-2026-8004: Insufficient policy enforcement in DevTools.
       Reported by Google.
     - CVE-2026-8005: Insufficient validation of untrusted input in Cast.
       Reported by Google.
     - CVE-2026-8006: Insufficient policy enforcement in DevTools.
       Reported by Google.
     - CVE-2026-8007: Insufficient validation of untrusted input in Cast.
       Reported by Google.
     - CVE-2026-8008: Inappropriate implementation in DevTools.
       Reported by Google.
     - CVE-2026-8009: Inappropriate implementation in Cast. Reported by Google.
     - CVE-2026-8010: Insufficient validation of untrusted input
       in SiteIsolation. Reported by Google.
     - CVE-2026-8011: Insufficient policy enforcement in Search.
       Reported by Google.
     - CVE-2026-8012: Inappropriate implementation in MHTML. Reported by Google
     - CVE-2026-8013: Insufficient validation of untrusted input in FedCM.
       Reported by Google.
     - CVE-2026-8014: Inappropriate implementation in Preload.
       Reported by Google.
     - CVE-2026-8015: Inappropriate implementation in Media. Reported by Google
     - CVE-2026-8016: Use after free in WebRTC. Reported by Google.
     - CVE-2026-8017: Side-channel information leakage in Media.
       Reported by Google.
     - CVE-2026-8018: Insufficient policy enforcement in DevTools.
       Reported by Google.
     - CVE-2026-8019: Insufficient policy enforcement in WebApp.
       Reported by Google.
     - CVE-2026-8020: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-8021: Script injection in UI. Reported by Google.
     - CVE-2026-8022: Inappropriate implementation in MHTML. Reported by Google
   * d/copyright:
     - drop gperf binary that upstream now includes.
     - update for dropping of "khronos" from opengl paths.
   * d/rules:
     - copy gperf binary from /usr/bin into build tree.
     - set webnn_use_litert=false.
   * d/clean:
     - update for harfbuzz-ng to harfbuzz rename.
   * d/patches:
     - upstream/Fix-GL-native-pixmap-import-support-reset-in-GpuInit.patch:
       drop, merged upstream.
     - disable/lint.patch: refresh.
     - trixie/nodejs-set-intersection.patch: refresh for file rename.
     - ungoogled/disable-ai.patch: sync from u-c.
     - trixie/gn-inputs.patch, trixie/gn-inputs2.patch: add patches to
       revert gn "inputs" usage, which isn't supported by our older
       generate-ninja package.
     - llvm-22/ignore-for-ubsan.patch: add another bit to remove the same
       unsupported compiler flag.
     - llvm-19/iota.patch: add build fix for missing std::ranges::iota().
     - upstream/turboshaft.patch: add build fix pulled from (v8) upstream
       for value_or() type ambiguity.
     - trixie/revert-v8-sanitize.patch: add patch to revert v8 gn-related
       changes that cause the build to fail w/ older gn.
     - llvm-19/raw-ref-map-find.patch: add patch to work around older
       clang-19 std::map::find() limitation.
     - rust-1.85/jxl-features.patch: refresh for new version [trixie,
       bookworm].
     - rust-1.85/jxl-simd-avx512.patch: refresh for new version, and also
       drop large portions of this patch that add unsafe{} to macro calls
       (since I already added an unsafe block in the macro definition).
       And mark more functions as unsafe [trixie, bookworm].
     - trixie/adler1.patch: refresh [trixie, bookworm].
     - trixie/rust-is-multiple-of.patch: refresh & move to rust-1.85/
       directory [trixie, bookworm].
     - rust-1.85/file_as_c_str.patch: add patch to work around lack of
       std::panic::file_as_c_str() [trixie, bookworm].
     - rust-1.85/mojo-features.patch: add patch to enable some newer
       rust features in mojom parser [trixie, bookworm].
     - rust-1.85/zip8.patch: add patch to enable some newer rust features
       in zip [trixie, bookworm].
     - bookworm/constexpr.patch: refresh for moved file [bookworm].
     - bookworm/dav1d-drop-hdr.patch: refresh [bookworm].
     - bookworm/eslint.patch: drop, no longer needed [bookworm].
     - ungoogled/remove-navigation-source-param.patch: add patch from u-c
       to drop the "&source=chrome.ob" that shows up when you search for
       something via omnibox.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0002-regenerate-xnn-buildgn.patch refresh for upstream
       changes
     - third_party/skia-vsx-instructions.patch: refresh for upstream changes
     - fixes/fix-different-data-layouts.patch: refresh for upstream changes
 .
   [ Jianfeng Liu ]
   * d/patches/loongarch64:
     - 0004-loong64-sandbox-sandbox-linux-Update-syscall-helpers.patch: Refresh
       for upstream changes
     - 0024-disable-BROTLI_MODEL-macro-for-some-targets.patch: Drop, merged
       upstream
 .
   [ Daniel Richard G. ]
   * d/patches/llvm-19/clang19.patch: Also drop -Wlifetime-safety-permissive
     flag from v8 build, as clang-19 (and 20) doesn't recognize it.
chromium (148.0.7778.96-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream stable release.
     - CVE-2026-7896: Integer overflow in Blink.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-7897: Use after free in Mobile. Reported by Google.
     - CVE-2026-7898: Use after free in Chromoting. Reported by Google.
     - CVE-2026-7899: Out of bounds read and write in V8.
       Reported by Project WhatForLunch (@pjwhatforlunch).
     - CVE-2026-7900: Heap buffer overflow in ANGLE. Reported by Anonymous.
     - CVE-2026-7901: Use after free in ANGLE. Reported by Syn4pse (@ret2happy)
     - CVE-2026-7902: Out of bounds memory access in V8.
       Reported by JunYoung Park(@candymate) of KAIST Hacking Lab.
     - CVE-2026-7903: Integer overflow in ANGLE. Reported by heesun.
     - CVE-2026-7904: Out of bounds read in Fonts.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-7905: Insufficient validation of untrusted input in Media.
       Reported by Google.
     - CVE-2026-7906: Use after free in SVG. Reported by Google.
     - CVE-2026-7907: Use after free in DOM. Reported by Google.
     - CVE-2026-7908: Use after free in Fullscreen. Reported by Google.
     - CVE-2026-7909: Inappropriate implementation in ServiceWorker.
       Reported by Google.
     - CVE-2026-7910: Use after free in Views. Reported by Google.
     - CVE-2026-7911: Use after free in Aura. Reported by Google.
     - CVE-2026-7912: Integer overflow in GPU. Reported by Google.
     - CVE-2026-7913: Insufficient policy enforcement in DevTools.
       Reported by Google.
     - CVE-2026-7914: Type Confusion in Accessibility. Reported by Google.
     - CVE-2026-7915: Insufficient data validation in DevTools.
       Reported by Google.
     - CVE-2026-7916: Insufficient data validation in InterestGroups.
       Reported by Google.
     - CVE-2026-7917: Use after free in Fullscreen. Reported by Google.
     - CVE-2026-7918: Use after free in GPU. Reported by Google.
     - CVE-2026-7919: Use after free in Aura. Reported by Google.
     - CVE-2026-7920: Use after free in Skia. Reported by Google.
     - CVE-2026-7921: Use after free in Passwords. Reported by Google.
     - CVE-2026-7922: Use after free in ServiceWorker. Reported by Google.
     - CVE-2026-7923: Out of bounds write in Skia. Reported by Google.
     - CVE-2026-7924: Uninitialized Use in Dawn. Reported by Google.
     - CVE-2026-7925: Use after free in Chromoting. Reported by Google.
     - CVE-2026-7926: Use after free in PresentationAPI. Reported by anonymous
     - CVE-2026-7927: Type Confusion in Runtime. Reported by Google.
     - CVE-2026-7928: Use after free in WebRTC. Reported by Google.
     - CVE-2026-7929: Use after free in MediaRecording. Reported by Google.
     - CVE-2026-7930: Insufficient validation of untrusted input in Cookies.
       Reported by Satoki.
     - CVE-2026-7931: Insufficient validation of untrusted input in iOS.
       Reported by Qadhafy Muhammad Tera.
     - CVE-2026-7932: Insufficient policy enforcement in Downloads.
       Reported by Povcfe of Tencent Security Xuanwu Lab.
     - CVE-2026-7933: Out of bounds read in WebCodecs.
       Reported by heapracer (@heapracer).
     - CVE-2026-7934: Insufficient validation of untrusted input in
       Popup Blocker. Reported by Google.
     - CVE-2026-7935: Inappropriate implementation in Speech.
       Reported by Qadhafy Muhammad Tera.
     - CVE-2026-7936: Object lifecycle issue in V8. Reported by Christian Holler.
     - CVE-2026-7937: Insufficient policy enforcement in DevTools. Reported by
       lebr0nli of National Yang Ming Chiao Tung University, Dept. of CS,
       Security and Systems Lab.
     - CVE-2026-7938: Use after free in CSS.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-7939: Inappropriate implementation in SanitizerAPI.
       Reported by s3zer0.
     - CVE-2026-7940: Use after free in V8. Reported by sakana.
     - CVE-2026-7941: Insufficient validation of untrusted input in Mobile.
       Reported by Adithya Kotian.
     - CVE-2026-7942: Integer overflow in ANGLE. Reported by Google.
     - CVE-2026-7943: Insufficient validation of untrusted input in ANGLE.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-7944: Insufficient validation of untrusted input
       in Persistent Cache. Reported by Google.
     - CVE-2026-7945: Insufficient validation of untrusted input in COOP.
       Reported by Google.
     - CVE-2026-7946: Insufficient policy enforcement in WebUI.
       Reported by Google.
     - CVE-2026-7947: Insufficient validation of untrusted input in Network.
       Reported by Google.
     - CVE-2026-7948: Race in Chromoting. Reported by Google.
     - CVE-2026-7949: Out of bounds read in Skia. Reported by Google.
     - CVE-2026-7950: Out of bounds read and write in GFX. Reported by Google.
     - CVE-2026-7951: Out of bounds write in WebRTC.
       Reported by soft.connect.fr.
     - CVE-2026-7952: Insufficient policy enforcement in Extensions.
       Reported by Google.
     - CVE-2026-7953: Insufficient validation of untrusted input in Omnibox.
       Reported by Google.
     - CVE-2026-7954: Race in Shared Storage. Reported by Google.
     - CVE-2026-7955: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-7956: Use after free in Navigation. Reported by Google.
     - CVE-2026-7957: Out of bounds write in Media. Reported by Google.
     - CVE-2026-7958: Inappropriate implementation in ServiceWorker.
       Reported by Google.
     - CVE-2026-7959: Inappropriate implementation in Navigation.
       Reported by Google.
     - CVE-2026-7960: Race in Speech. Reported by Google.
     - CVE-2026-7961: Insufficient validation of untrusted input in Permissions
       Reported by Google.
     - CVE-2026-7962: Insufficient policy enforcement in DirectSockets.
       Reported by Google.
     - CVE-2026-7963: Inappropriate implementation in ServiceWorker.
       Reported by Google.
     - CVE-2026-7964: Insufficient validation of untrusted input in FileSystem.
       Reported by Google.
     - CVE-2026-7965: Insufficient validation of untrusted input in DevTools.
       Reported by Google.
     - CVE-2026-7966: Insufficient validation of untrusted input
       in SiteIsolation. Reported by Google.
     - CVE-2026-7967: Insufficient validation of untrusted input in Navigation.
       Reported by Google.
     - CVE-2026-7968: Insufficient validation of untrusted input in CORS.
       Reported by Google.
     - CVE-2026-7969: Integer overflow in Network. Reported by Google.
     - CVE-2026-7970: Use after free in TopChrome. Reported by Google.
     - CVE-2026-7971: Inappropriate implementation in ORB. Reported by Google.
     - CVE-2026-7972: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-7973: Integer overflow in Dawn. Reported by Google.
     - CVE-2026-7974: Use after free in Blink. Reported by Google.
     - CVE-2026-7975: Use after free in DevTools. Reported by Google.
     - CVE-2026-7976: Use after free in Views. Reported by Google.
     - CVE-2026-7977: Inappropriate implementation in Canvas.
       Reported by Google.
     - CVE-2026-7978: Inappropriate implementation in Companion.
       Reported by Google.
     - CVE-2026-7979: Inappropriate implementation in Media. Reported by Google
     - CVE-2026-7980: Use after free in WebAudio. Reported by Google.
     - CVE-2026-7981: Out of bounds read in Codecs. Reported by Google.
     - CVE-2026-7982: Uninitialized Use in WebCodecs. Reported by Google.
     - CVE-2026-7983: Out of bounds read in Dawn. Reported by Google.
     - CVE-2026-7984: Use after free in ReadingMode. Reported by Google.
     - CVE-2026-7985: Use after free in GPU. Reported by Google.
     - CVE-2026-7986: Insufficient policy enforcement in Autofill.
       Reported by Google.
     - CVE-2026-7987: Use after free in WebRTC. Reported by Google.
     - CVE-2026-7988: Type Confusion in WebRTC. Reported by Google.
     - CVE-2026-7989: Insufficient data validation in DataTransfer.
       Reported by Google.
     - CVE-2026-7990: Insufficient validation of untrusted input in Updater.
       Reported by Google.
     - CVE-2026-7991: Use after free in UI. Reported by Google.
     - CVE-2026-7992: Insufficient validation of untrusted input in UI.
       Reported by Google.
     - CVE-2026-7993: Insufficient validation of untrusted input in Payments.
       Reported by Google.
     - CVE-2026-7994: Inappropriate implementation in Chromoting.
       Reported by Google.
     - CVE-2026-7995: Out of bounds read in AdFilter. Reported by Google.
     - CVE-2026-7996: Insufficient validation of untrusted input in SSL.
       Reported by heesun.
     - CVE-2026-7997: Insufficient validation of untrusted input in Updater.
       Reported by ochkofficial.
     - CVE-2026-7998: Insufficient validation of untrusted input in Dialog.
       Reported by Tianyi Hu.
     - CVE-2026-7999: Inappropriate implementation in V8.
       Reported by Taisic Yun (@taisic) of Theori.
     - CVE-2026-8000: Insufficient validation of untrusted input
       in ChromeDriver. Reported by Ryan Jupp - HAAO.
     - CVE-2026-8001: Use after free in Printing.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-8002: Use after free in Audio. Reported by Google.
     - CVE-2026-8003: Insufficient validation of untrusted input in TabGroups.
       Reported by Google.
     - CVE-2026-8004: Insufficient policy enforcement in DevTools.
       Reported by Google.
     - CVE-2026-8005: Insufficient validation of untrusted input in Cast.
       Reported by Google.
     - CVE-2026-8006: Insufficient policy enforcement in DevTools.
       Reported by Google.
     - CVE-2026-8007: Insufficient validation of untrusted input in Cast.
       Reported by Google.
     - CVE-2026-8008: Inappropriate implementation in DevTools.
       Reported by Google.
     - CVE-2026-8009: Inappropriate implementation in Cast. Reported by Google.
     - CVE-2026-8010: Insufficient validation of untrusted input
       in SiteIsolation. Reported by Google.
     - CVE-2026-8011: Insufficient policy enforcement in Search.
       Reported by Google.
     - CVE-2026-8012: Inappropriate implementation in MHTML. Reported by Google
     - CVE-2026-8013: Insufficient validation of untrusted input in FedCM.
       Reported by Google.
     - CVE-2026-8014: Inappropriate implementation in Preload.
       Reported by Google.
     - CVE-2026-8015: Inappropriate implementation in Media. Reported by Google
     - CVE-2026-8016: Use after free in WebRTC. Reported by Google.
     - CVE-2026-8017: Side-channel information leakage in Media.
       Reported by Google.
     - CVE-2026-8018: Insufficient policy enforcement in DevTools.
       Reported by Google.
     - CVE-2026-8019: Insufficient policy enforcement in WebApp.
       Reported by Google.
     - CVE-2026-8020: Uninitialized Use in GPU. Reported by Google.
     - CVE-2026-8021: Script injection in UI. Reported by Google.
     - CVE-2026-8022: Inappropriate implementation in MHTML. Reported by Google
   * d/copyright:
     - drop gperf binary that upstream now includes.
     - update for dropping of "khronos" from opengl paths.
   * d/rules:
     - copy gperf binary from /usr/bin into build tree.
     - set webnn_use_litert=false.
   * d/clean:
     - update for harfbuzz-ng to harfbuzz rename.
   * d/patches:
     - upstream/Fix-GL-native-pixmap-import-support-reset-in-GpuInit.patch:
       drop, merged upstream.
     - disable/lint.patch: refresh.
     - trixie/nodejs-set-intersection.patch: refresh for file rename.
     - ungoogled/disable-ai.patch: sync from u-c.
     - trixie/gn-inputs.patch, trixie/gn-inputs2.patch: add patches to
       revert gn "inputs" usage, which isn't supported by our older
       generate-ninja package.
     - llvm-22/ignore-for-ubsan.patch: add another bit to remove the same
       unsupported compiler flag.
     - llvm-19/iota.patch: add build fix for missing std::ranges::iota().
     - upstream/turboshaft.patch: add build fix pulled from (v8) upstream
       for value_or() type ambiguity.
     - trixie/revert-v8-sanitize.patch: add patch to revert v8 gn-related
       changes that cause the build to fail w/ older gn.
     - llvm-19/raw-ref-map-find.patch: add patch to work around older
       clang-19 std::map::find() limitation.
     - rust-1.85/jxl-features.patch: refresh for new version [trixie,
       bookworm].
     - rust-1.85/jxl-simd-avx512.patch: refresh for new version, and also
       drop large portions of this patch that add unsafe{} to macro calls
       (since I already added an unsafe block in the macro definition).
       And mark more functions as unsafe [trixie, bookworm].
     - trixie/adler1.patch: refresh [trixie, bookworm].
     - trixie/rust-is-multiple-of.patch: refresh & move to rust-1.85/
       directory [trixie, bookworm].
     - rust-1.85/file_as_c_str.patch: add patch to work around lack of
       std::panic::file_as_c_str() [trixie, bookworm].
     - rust-1.85/mojo-features.patch: add patch to enable some newer
       rust features in mojom parser [trixie, bookworm].
     - rust-1.85/zip8.patch: add patch to enable some newer rust features
       in zip [trixie, bookworm].
     - bookworm/constexpr.patch: refresh for moved file [bookworm].
     - bookworm/dav1d-drop-hdr.patch: refresh [bookworm].
     - bookworm/eslint.patch: drop, no longer needed [bookworm].
     - ungoogled/remove-navigation-source-param.patch: add patch from u-c
       to drop the "&source=chrome.ob" that shows up when you search for
       something via omnibox.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0002-regenerate-xnn-buildgn.patch refresh for upstream
       changes
     - third_party/skia-vsx-instructions.patch: refresh for upstream changes
     - fixes/fix-different-data-layouts.patch: refresh for upstream changes
 .
   [ Jianfeng Liu ]
   * d/patches/loongarch64:
     - 0004-loong64-sandbox-sandbox-linux-Update-syscall-helpers.patch: Refresh
       for upstream changes
     - 0024-disable-BROTLI_MODEL-macro-for-some-targets.patch: Drop, merged
       upstream
 .
   [ Daniel Richard G. ]
   * d/patches/llvm-19/clang19.patch: Also drop -Wlifetime-safety-permissive
     flag from v8 build, as clang-19 (and 20) doesn't recognize it.
chromium (147.0.7727.137-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-7363: Use after free in Canvas. Reported by heapracer.
     - CVE-2026-7361: Use after free in iOS. Reported by Google.
     - CVE-2026-7344: Use after free in Accessibility. Reported by Google.
     - CVE-2026-7343: Use after free in Views. Reported by Google.
     - CVE-2026-7333: Use after free in GPU.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-7360: Insufficient validation of untrusted input in Compositing.
       Reported by Google.
     - CVE-2026-7359: Use after free in ANGLE. Reported by Google.
     - CVE-2026-7358: Use after free in Animation. Reported by Google.
     - CVE-2026-7334: Use after free in Views. Reported by Batuhan Eşref KOÇ.
     - CVE-2026-7357: Use after free in GPU. Reported by Google.
     - CVE-2026-7356: Use after free in Navigation. Reported by Google.
     - CVE-2026-7354: Out of bounds read and write in Angle. Reported by Google.
     - CVE-2026-7353: Heap buffer overflow in Skia. Reported by Google.
     - CVE-2026-7352: Use after free in Media. Reported by Google.
     - CVE-2026-7351: Race in MHTML. Reported by Google.
     - CVE-2026-7350: Use after free in WebMIDI. Reported by Google.
     - CVE-2026-7349: Use after free in Cast. Reported by Google.
     - CVE-2026-7348: Use after free in Codecs. Reported by Google.
     - CVE-2026-7335: Use after free in media.
       Reported by Jungwoo Lee (@physicube) and Wongi Lee (@_qwerty_po).
     - CVE-2026-7336: Use after free in WebRTC. Reported by Mozilla.
     - CVE-2026-7337: Type Confusion in V8. Reported by q@calif.io.
     - CVE-2026-7347: Use after free in Chromoting. Reported by Google.
     - CVE-2026-7346: Inappropriate implementation in Tint. Reported by Google.
     - CVE-2026-7345: Insufficient validation of untrusted input in Feedback.
       Reported by Google.
     - CVE-2026-7338: Use after free in Cast. Reported by Krace.
     - CVE-2026-7342: Use after free in WebView. Reported by Google.
     - CVE-2026-7341: Use after free in WebRTC. Reported by Google.
     - CVE-2026-7339: Heap buffer overflow in WebRTC.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-7340: Integer overflow in ANGLE.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-7355: Use after free in Media. Reported by Google.
 .
   [ Jianfeng Liu ]
   * d/patches:
     - upstream/Fix-GL-native-pixmap-import-support-reset-in-GpuInit.patch:
       Fixes upstream issue https://crbug.com/501115509. This issue is
       introduced in v147, and unfortunately the fix won't get into v147. This
       issue affects both vaapi and v4l2 decoding under ozone wayland.
     - fixes/enable-widevine-on-arm64-linux-platform.patch: Enable widevine
       support on arm64. There is no official support for widevine on arm64
       linux while there are libwidevine binaries extracted from chromeos,
       which can work on linux (closes: #1052440).

chrony (4.6.1-3+deb13u2) trixie; urgency=medium
 .
   * debian/chrony.if-{post-down,up}:
     - Adjust the if-up and if-down hook scripts so that they always exit
     successfully. (Closes: #1011533)

ckermit (416~beta12-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
 .
   [ John Goerzen ]
   * CVE-2025-68920: Block remote control of the local kermit by default.
     Closes: #1123025
   * Permanently disable OpenSSL version check.  Closes: #1118629.

composer (2.8.8-1+deb13u3) trixie; urgency=medium
 .
   * Fix regexp to support new GitHub installation tokens format
     (GHSA-f9f8-rm49-7jv2) [CVE-2026-45793]

courier (1.4.1-3+deb13u2) trixie; urgency=medium
 .
   * Add debian/patches/adjust-webadmin-scripts.patch, thanks Jean Louis
     <bugs@gnu.support> (closes: #1132026).

curl (8.14.1-2+deb13u4) trixie; urgency=medium
 .
   * Import upstream patches for 13 CVE fixes:
     - CVE-2025-14524
     - CVE-2025-14819
     - CVE-2026-1965
     - CVE-2026-3783
     - CVE-2026-3784
     - CVE-2026-3805
     - CVE-2026-4873
     - CVE-2026-5545
     - CVE-2026-5773
     - CVE-2026-6253
     - CVE-2026-6276
     - CVE-2026-6429
     - CVE-2026-7168
   * d/p/CVE-2025-10148.patch: drop format-patch artefacts
   * d/p/CVE-2025-13034.patch: refresh after gbp pq round-trip
   * d/p: refresh patch series after gbp pq round-trip

cyborg (14.0.0-3+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2026-40213: Cyborg uses rule:allow (check_str='@') as the default
     policy for multiple API endpoints. This unconditionally authorizes any
     request carrying a valid Keystone token regardless of roles, project
     membership, or scope. An authenticated user with zero role assignments can
     complete various actions such as reprogramming FPGA bitstreams on arbitrary
     compute nodes via agent RPC.
     CVE-2026-40214: The Accelerator Request (ARQ) API does not enforce project
     ownership at any layer. The project_id column in the database is never
     populated (NULL for every ARQ), database queries have no project filtering,
     and policy checks are self-referential (the authorize_wsgi decorator
     compares the caller's project_id with itself rather than the target
     resource). Any authenticated non-admin user can complete various actions
     such as deleting ARQs bound to other projects' instances, aka cross-tenant
     denial of service.
     Applied upstream patches:
     - Use_common_checks.check_policy_json_from_oslo.upgradecheck.patch
     - Fix_cyborg-status_upgrade_check_tests.patch
     - Fix_rule-allow_policy_bypass_on_device_deployable_attribute_APIs.patch
     - Set_project_id_on_ARQ_creation_and_binding.patch
     - Refactor_session_handling_and_align_test_contexts.patch
     - Add_project_id_backfill_for_existing_ARQs.patch
     - Enforce_project-scoped_access_for_ARQs.patch
     - Require_service_token_for_bound_ARQ_operations.patch
     (Closes: #1136006).

dcmtk (3.6.9-5+deb13u2) trixie; urgency=medium
 .
   * Team upload.
   * CVE-2026-12805.patch: new: fix CVE-2026-12805.
     This patch fixes a risk of buffer overflow by ensuring negative error
     codes in XMLNode::parseFile are properly handled, as well a NULL
     values. (Closes: #1140562)
 .
 dcmtk (3.6.9-5+deb13u1) trixie; urgency=medium
 .
   * Team upload
   * d/patches/*-CVE-2025-9732.patch: new.
     These changes pulled from dcmtk upstream address CVE-2025-9732.
     (Closes: #1113993)
   * 0015-CVE-2025-14607.patch: new: fix CVE-2025-14607. (Closes: #1122926)
   * 0016-CVE-2026-5663.patch: new: fix CVE-2026-5663. (Closes: #1133001)
   * 0017-CVE-2025-14841.patch: new: fix CVE-2025-14841. (Closes: #1123584)
   * 0018-CVE-2026-10194.patch: new: fix CVE-2026-10194. (Closes: #1139181)
dcmtk (3.6.9-5+deb13u1) trixie; urgency=medium
 .
   * Team upload
   * d/patches/*-CVE-2025-9732.patch: new.
     These changes pulled from dcmtk upstream address CVE-2025-9732.
     (Closes: #1113993)
   * 0015-CVE-2025-14607.patch: new: fix CVE-2025-14607. (Closes: #1122926)
   * 0016-CVE-2026-5663.patch: new: fix CVE-2026-5663. (Closes: #1133001)
   * 0017-CVE-2025-14841.patch: new: fix CVE-2025-14841. (Closes: #1123584)
   * 0018-CVE-2026-10194.patch: new: fix CVE-2026-10194. (Closes: #1139181)

debian-installer (20250803+deb13u6) trixie; urgency=medium
 .
   * Bump Linux kernel ABI to 6.12.94+deb13.
   * Adjust linux-image build-deps accordingly.

debian-installer-netboot-images (20250803+deb13u6) trixie; urgency=medium
 .
   * Update to 20250803+deb13u6, from trixie-proposed-updates.

debusine (0.11.3+deb13u1) trixie; urgency=medium
 .
   * Security update for stable:
     - Enforce permissions on the file body upload endpoint.
     - CVE-2026-11852: Restrict artifact relation creation and deletion.
     - Sbuild task: harden against shell injection.
     - CVE-2026-11853: Reject .dsc/.changes checksum filenames with multiple
       path components.

deepdiff (8.1.1-4+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2025-58367: Class Pollution in Delta class
   * CVE-2026-33155: Memory Exhaustion DoS through SAFE_TO_IMPORT
     (Closes: #1131472)

dhcpcd (1:10.1.0-11+deb13u3) trixie; urgency=medium
 .
   * [patches] (Closes: #1140767)
     + Cherry-pick upstream fix for CVE-2025-70102 (commit 117742d).
     + Cherry-pick upstream fix for CVE-2026-56113 (commit 5733d3c).
     + Cherry-pick upstream fix for CVE-2026-56114 (commit 2f00c7b).
     + Cherry-pick upstream fix for CVE-2026-56116 (commit 708b4a5).
     + Cherry-pick upstream fix for CVE-2026-56117 (commit 78ea09e).

dnsdist (1.9.15-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 1.9.15, fixing security issues
     CVE-2026-40011, CVE-2026-42004, CVE-2026-42005, CVE-2026-40208,
     CVE-2026-40209, CVE-2026-40210, CVE-2026-40211

dolphin (4:25.04.3-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-41525: Sandbox escape

dovecot (1:2.4.1+dfsg1-6+deb13u6) trixie-security; urgency=medium
 .
   * Security update (Closes: #1136444)
   * [76ceed4] CVE-2026-27851: lib-var-expand: Reset safe state when
     transfer is unset
   * [4af6fb3] CVE-2026-40016: lib-sieve: Enforce CPU time limit within
     :contains and :matches matcher loops
   * [366ef61] CVE-2026-33603: login-common: Only accept base64 in sasl
   * [26bd41e] CVE-2026-40020: IMAP folders can be shared-spammed to
     everyone.
   * [b6f5bac] CVE-2026-42006: imap-login: Excessive memory usage DoS

errands (46.2.8-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2025-71063: TLS certificates for CalDAV servers were not verified
     (Closes: #1123738)

evince (48.1-3+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * shell: quote strings in arguments used when calling ev_spawn
     (CVE-2026-46529)

execnet (2.1.1-1+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * Mark several tests as flaky. Closes: #854494.

exim4 (4.98.2-1+deb13u3) trixie-security; urgency=high
 .
   * Cherry-pick fix for EXIM-Security-2026-05-19.1 from 4.99.4.
     Security: PROXYv2 parser: reject PROXY frames whose declared payload
     length is too short for the claimed address family (12 bytes for
     TCPv4/0x11, 36 bytes for TCPv6/0x21).  Previously a frame with
     family=0x21 and len=0 caused 16 bytes of uninitialized stack to be
     formatted as the sender's IPv6 address and disclosed in the SMTP
     greeting banner.  Affects configurations with SUPPORT_PROXY and
     `hosts_proxy` set.  Reported by Warisjeet Singh (sin99xx).

fastnetmon (1.2.9-0+deb13u1) trixie-security; urgency=high
 .
   * New upstream release.
     - This release fixes various security issues: CVE-2026-48689,
       CVE-2026-48688, CVE-2026-48696, CVE-2026-48695, CVE-2026-48694,
       CVE-2026-48691, CVE-2026-48690, CVE-2026-48687, CVE-2026-48686,
       CVE-2026-48685, CVE-2026-48684 and CVE-2026-48683.
       Closes: #1138646
   * Revert for trixie: Remove dh_movetousr sequence and manually set the
     systemd servicedir.
fastnetmon (1.2.8+git20250911-2) unstable; urgency=medium
 .
   * Bump Standards-Version to 4.7.3 (Remove priority field).
   * Remove dh_movetousr sequence and manually set the systemd servicedir.
     Closes: #1122752
   * Update years in debian/copyright.
   * Remove Rules-Requires-Root control field.
   * Update debian/watch to version 5.
   * Remove libboost-system-dev Build-Depends.
     Closes: #1127190
fastnetmon (1.2.8+git20250911-1) unstable; urgency=medium
 .
   * New upstream git snapshot.
     - Fixes build with mongo-c-driver 2.0.
       Closes: #1111777, #1110574, #1112881
     - Remove merged patch 01-spelling-error.
   * Bump Standards-Version to 4.7.2.
   * Merge 1.2.4-2+deb12u1 changelog.
   * Fix old-fsf-address-in-copyright-file.

ffmpeg (7:7.1.5-0+deb13u1) trixie-security; urgency=high
 .
   * New upstream version 7.1.5
     - Fixes CVE-2026-8461
ffmpeg (7:7.1.4-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 7.1.4
   * debian/libavfilter10.symbols.in: Add new symbol
ffmpeg (7:7.1.3-1) unstable; urgency=medium
 .
   * New upstream version 7.1.3
   * debian/patches: Unbreak build with glslang 16 (Closes: #1120579)

firefox-esr (140.12.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-58, also known as:
     CVE-2026-12289, CVE-2026-12290, CVE-2026-12291, CVE-2026-12292,
     CVE-2026-12294, CVE-2026-12295, CVE-2026-12298, CVE-2026-12296,
     CVE-2026-12297, CVE-2026-12299, CVE-2026-12329, CVE-2026-12302,
     CVE-2026-12304, CVE-2026-12305, CVE-2026-12306, CVE-2026-12307,
     CVE-2026-12308, CVE-2026-12309, CVE-2026-12310, CVE-2026-12311,
     CVE-2026-12312, CVE-2026-12313, CVE-2026-12314, CVE-2026-12315,
     CVE-2026-12330, CVE-2026-12324, CVE-2026-12325, CVE-2026-12327,
     CVE-2026-12328.
firefox-esr (140.12.0esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-58, also known as:
     CVE-2026-12289, CVE-2026-12290, CVE-2026-12291, CVE-2026-12292,
     CVE-2026-12294, CVE-2026-12295, CVE-2026-12298, CVE-2026-12296,
     CVE-2026-12297, CVE-2026-12299, CVE-2026-12329, CVE-2026-12302,
     CVE-2026-12304, CVE-2026-12305, CVE-2026-12306, CVE-2026-12307,
     CVE-2026-12308, CVE-2026-12309, CVE-2026-12310, CVE-2026-12311,
     CVE-2026-12312, CVE-2026-12313, CVE-2026-12314, CVE-2026-12315,
     CVE-2026-12330, CVE-2026-12324, CVE-2026-12325, CVE-2026-12327,
     CVE-2026-12328.
firefox-esr (140.11.0esr-1) unstable; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-48, also known as:
     CVE-2026-8946, CVE-2026-8388, CVE-2026-8947, CVE-2026-8391,
     CVE-2026-8401, CVE-2026-8950, CVE-2026-8953, CVE-2026-8954,
     CVE-2026-8955, CVE-2026-8956, CVE-2026-8957, CVE-2026-8958,
     CVE-2026-8961, CVE-2026-8962, CVE-2026-8968, CVE-2026-8970,
     CVE-2026-8974, CVE-2026-8975.
firefox-esr (140.11.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-48, also known as:
     CVE-2026-8946, CVE-2026-8388, CVE-2026-8947, CVE-2026-8391,
     CVE-2026-8401, CVE-2026-8950, CVE-2026-8953, CVE-2026-8954,
     CVE-2026-8955, CVE-2026-8956, CVE-2026-8957, CVE-2026-8958,
     CVE-2026-8961, CVE-2026-8962, CVE-2026-8968, CVE-2026-8970,
     CVE-2026-8974, CVE-2026-8975.
firefox-esr (140.11.0esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-48, also known as:
     CVE-2026-8946, CVE-2026-8388, CVE-2026-8947, CVE-2026-8391,
     CVE-2026-8401, CVE-2026-8950, CVE-2026-8953, CVE-2026-8954,
     CVE-2026-8955, CVE-2026-8956, CVE-2026-8957, CVE-2026-8958,
     CVE-2026-8961, CVE-2026-8962, CVE-2026-8968, CVE-2026-8970,
     CVE-2026-8974, CVE-2026-8975.
firefox-esr (140.10.2esr-1) unstable; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-41, also known as:
     CVE-2026-8090, CVE-2026-8094, CVE-2026-8092.

fldigi (4.2.06-1+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * Force LC_NUMERIC=C.UTF-8 to use proper decimal separator in API and ADIF
     log files. (Closes: #1114613)

freecad (1.0.0+dfsg-8+deb13u2) trixie; urgency=medium
 .
   * Maintaner approvided upload.
   * Backport patch 1040-fix-cmake-race.patch to fix FTBFS on arm64.
freecad (1.0.0+dfsg-8+deb13u1) trixie; urgency=medium
 .
   * Maintaner approvided upload.
   * Get fanuc post processor working (Closes: #1117850).

frr (10.3-3+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Backport upstream fixes for several BGP/OSPF parsing vulnerabilities:
     - CVE-2026-37457: off-by-one out-of-bounds write in the BGP FlowSpec
       operator decoder (bgp_flowspec_op_decode).
     - CVE-2026-28532: out-of-bounds read in OSPF TE/SR Opaque LSA TLV parsing
       caused by a truncated uint16_t length accumulator.
     - CVE-2026-5107: missing length validation when parsing EVPN Type-2/3/4
       and ENCAP/VNC NLRIs.
     - CVE-2026-37458: missing martian next-hop validation in MP_REACH_NLRI.
     - CVE-2025-61099, CVE-2025-61100, CVE-2025-61101, CVE-2025-61102,
       CVE-2025-61103, CVE-2025-61104, CVE-2025-61105, CVE-2025-61106,
       CVE-2025-61107: NULL pointer dereference in ospfd when dumping Opaque
       LSAs while OSPF packet debugging is enabled.

fwupd (2.0.20-1~deb13u1) stable-updates; urgency=medium
 .
   * Release to stable updates to enable updating UEFI CA. (Closes: #1138871)
   * Note: Fix deploying the thunderbolt controller on the X280 is now part of
     the upstream release and the patch is dropped.
fwupd (2.0.20-1~deb12u2) bookworm; urgency=medium
 .
   * No change rebuild for source upload.
fwupd (2.0.20-1~deb12u1) bookworm; urgency=medium
 .
   * Release to oldstable updates to enable updating UEFI CA.
   * d/control: Refresh b-d against bookworm
   * d/rules: disable modem manager
   * d/patches: Add patches to allow building on bookworm
fwupd (2.0.20-1~bpo13+1) trixie-backports; urgency=medium
 .
   * Backport to trixie
   * Disable passim support
fwupd (2.0.19-1) unstable; urgency=medium
 .
   * New upstream version (2.0.19)
fwupd (2.0.18-1) unstable; urgency=medium
 .
   * New upstream version (2.0.18)
   * Drop upstream patches
fwupd (2.0.17-6) unstable; urgency=medium
 .
   * Backport a patch to fix x86 32 bit installed tests
fwupd (2.0.17-5) unstable; urgency=medium
 .
   * d/tests/control: depends on fwupd-tests instead of fwupd
fwupd (2.0.17-4) unstable; urgency=medium
 .
   * d/t/control: Explicitly add fwupd to depends
fwupd (2.0.17-3) unstable; urgency=medium
 .
   * d/t/control: Add missing depends for autopkgtest
fwupd (2.0.17-2) unstable; urgency=medium
 .
   * Backport a fix for installed tests failures with mtdram
fwupd (2.0.17-1) unstable; urgency=medium
 .
   * New upstream version (2.0.17)
fwupd (2.0.16-4) unstable; urgency=medium
 .
   * Enable passim support in Debian (disabled in Ubuntu right now).
fwupd (2.0.16-3) unstable; urgency=medium
 .
   * d/rules: Explicitly set efi_os_dir
     (Closes: #1105176) (Closes: #1112464)
   * d/control: Drop b-d on python3-typogrify
     (Closes: #1105777)
   * Changes for build-dependency on libgirepository1.0-dev
     (Closes: #1118817)
   * Backport a patch to fix a segfault with flashrom (Closes: #1118449)
fwupd (2.0.16-2) unstable; urgency=medium
 .
   * Backport a patch from upstream to drop python3-toml b-d
   * d/copyright, d/control: refresh against dependencies.xml (Closes: #1110022)
fwupd (2.0.16-1) unstable; urgency=medium
 .
   * New upstream version (2.0.16)
fwupd (2.0.15-1) unstable; urgency=medium
 .
   * New upstream version (2.0.15)
fwupd (2.0.14-1) unstable; urgency=medium
 .
   * New upstream version (2.0.14)
fwupd (2.0.13-2) unstable; urgency=medium
 .
   * Upload to unstable
fwupd (2.0.13-1) experimental; urgency=medium
 .
   * New upstream version.
fwupd (2.0.12-1) experimental; urgency=medium
 .
   * New upstream version.
fwupd (2.0.10-1) experimental; urgency=medium
 .
   * New upstream version.
   * d/control: Update my email
fwupd (2.0.9-1) experimental; urgency=medium
 .
   * New upstream version (2.0.9)
     - Drop all upstream patches.

gambas3 (3.20.2-1+deb13u1) trixie; urgency=medium
 .
   * Team upload
   * Fix qt6 component trying to load non-existing qt5 dependency
     (Closes: #1136260)

gdown (5.2.0+dfsg-2+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-40491: Arbitrary File Write via Path Traversal

geoip (1.6.12-11.2~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie.
 .
 geoip (1.6.12-11.2) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * Restore the generator scripts for geoip-database.

geoip-database (20250401+really20191224-0+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Revert to the last version before the license change.
     (Closes: #1134158)
   * Build depend on geoip with support for the old version restored.

giflib (5.2.2-1+deb13u1) trixie; urgency=medium
 .
   * CVE-2026-23868 (Closes: #1130495)
   * CVE-2026-26740 (Closes: #1131368)

gimp (3.0.4-3+deb13u9) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-4154: XPM parsing integer overflow
   * CVE-2026-40915: FITS parsing integer overflow

gnustep-sqlclient (1.9.0-6+deb13u1) trixie; urgency=medium
 .
   * debian/control (libsqlclient-dev): Remove "Multi-Arch: same" field to
     avoid file conflicts (Closes: #1133733).

gnutls28 (3.8.9-3+deb13u4) trixie-security; urgency=high
 .
   * Add 3.8.13 patchset from CentOS 10 security release.
     Fixes
     CVE-2026-33846
     CVE-2026-42009
     CVE-2026-33845
     CVE-2026-42010
     CVE-2026-3833
     CVE-2026-42011
     CVE-2026-42012
     CVE-2026-42013
     CVE-2026-42014
     CVE-2026-5260
     CVE-2026-42015
     CVE-2026-3832
     CVE-2026-5419
     and also adds a couple of fixes for issues without CVEs assigned.
     (For Debian base64-encode a testfile, quilt does not support git binary
     patches.)
     Closes: #1135319
   * Drop patches irrelevant for 3.8.9 from the CentOS patchset.
     The PKCS#11 [provider] feature was only added in 3.8.10.
   * Cherry-pick another patch to add a mising declaration.

graphite2 (1.3.14-2+deb13u1) trixie; urgency=medium
 .
   * debian/patches/ad78c6b7319909e1540c1b134e115ced03417866.patch:
     fix CVE-2026-50593

gsasl (2.2.2-1.1+deb13u2) trixie-security; urgency=medium
 .
   * NTLM client: Avoid use-of-unitialized-value inside libntlm
gsasl (2.2.2-1.1+deb13u1) trixie-security; urgency=medium
 .
   * Fix NULL pointer dereference in DIGEST-MD5 parser

gst-libav1.0 (1.26.2-1+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2026-52717

gst-plugins-bad1.0 (1.26.2-3+deb13u2) trixie-security; urgency=medium
 .
   * CVE-2026-52718
   * CVE-2026-52719
   * CVE-2026-53701

gst-plugins-good1.0 (1.26.2-1+deb13u2) trixie-security; urgency=medium
 .
   * CVE-2026-39043
   * CVE-2026-39044
   * CVE-2026-1940
   * CVE-2026-3083
   * CVE-2026-3085
gst-plugins-good1.0 (1.26.2-1+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2026-5056
   * CVE-2026-46469
   * CVE-2026-46470

haproxy (3.0.11-1+deb13u3) trixie-security; urgency=high
 .
   [ Salvatore Bonaccorso ]
   * BUG/MAJOR: h3: check body size with content-length on empty FIN
     (CVE-2026-33555)
 .
   [ Vincent Bernat ]
   * BUG/MAJOR: mux-h2: detect incomplete transfers on HEADERS frames as
     well
   * BUG/MAJOR: http-htx: Store new host in a chunk for scheme-based
     normalization
   * BUG/MAJOR: mux-h1: Deal with true 64-bits integer to emit chunks size
   * BUG/MAJOR: mux-h2: preset MSGF_BODY_CL on H2_SF_DATA_CLEN in
     h2c_dec_hdrs()
   * BUG/MAJOR: slz: always make sure to limit fixed output to less than
     worst case literals
   * BUG/MAJOR: http: forbid comma character in authority value
   * BUG/MEDIUM: h1: Skip all h2c values from Upgrade headers during
     parsing

haveged (1.9.19-12+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Fix privilege escalation via command socket (CVE-2026-41054)
     (Closes: #1137096)
   * Check peer credentials before reading command (CVE-2026-41054)

horizon (3:25.3.0-3+deb13u1) trixie; urgency=medium
 .
   * OSSN-0097: Horizon RC file generation does not escape special characters in
     project. Applied upstream patch: "Escape $ character in shellfilter, and
     use it consistently" (Closes: #1138845).

imagemagick (8:7.1.1.43+dfsg1-1+deb13u10) trixie-security; urgency=high
 .
   * Fix CVE-2026-48724:
     When using an image with mask the Floyd-Steinberg dithering
     method it will cause a negative heap buffer over-write
   * Fix CVE-2026-48734:
     A crafted MVG file could result in a stack overflow due to a missing depth
     or visited-set check
   * Fix CVE-2026-48994:
     A missing check of a return value could lead to a heap buffer over-write in the MAT
     decoder on 32-bit systems.
   * Fix CVE-2026-49218:
     A missing check in the DCM decoder could result in an image with invalid dimensions
     and that could cause crashes in other operation.
   * Fix CVE-2026-49219:
     An incorrect parsing of the filename can result in a policy bypass and read files
     disallowed by a security policy using a symlink
   * Backport policy from 7.1.2.25
   * Fix CVE-2026-53460:
     A missing check for maximum memory request in AcquireAlignedMemory
     could trigger an out-of-Memory condition.
   * Fix CVE-2026-53461:
     An incorrect loop in the ICON decoder can result in an out of
     bounds heap write resulting in a crash.
   * Fix CVE-2026-53463:
     When passing incorrect arguments in the distort operation a
     null pointer deference will occur.
   * Fix CVE-2026-53464:
     When providing invalid options to the wand option parser
     a small memory leak will occur.
   * Harden debian policy in case of custom recompilation (Closes: #1140176)
imagemagick (8:7.1.1.43+dfsg1-1+deb13u9) trixie-security; urgency=high
 .
   * Fix CVE-2026-33901 regression:
     Previous fix breaks rendering of some MVG files.
   * Fix CVE-2026-42050:
     A malicious MIFF file could trigger an overflow when a user opens it
     in the he display tool and right-clicks a tile to invoke the
     Load/Update menu item.
   * Fix CVE-2026-42326:
     Heap Buffer Over-Read in IPTC encoder
   * Fix CVE-2026-45031:
     Policy Bypass in PSD decoder. Due to a missing check in the
     PSD decoder it would be possible to bypass the list-length
     resource policy when decoding a PSD image. Other security
     limits would still apply.
   * Fix CVE-2026-45358:
     Heap Buffer Over-Read of a single byte in meta encoder.
     An of by one in the meta encoder could result in an out
     of bounds read of a single byte in the meta encoder.
   * Fix CVE-2026-45359:
     Heap Buffer Over-Read in connected components when the user
     supplies an invalid keep-top define.
     An invalid connected-components:keep-top value could result
     in a heap buffer over-read when performing the connected components
     operation.
   * Fix CVE-2026-45624:
     Heap Buffer Over-Read of 24 bytes in distort operation.
     When performing a polynomial distortion an out of bounds over-read of
     24 bytes can occur when specifying specific arguments.
   * Fix CVE-2026-45664:
     Policy Bypass in MNG decoder
     Because of a missing check in the MNG coder it would be possible
     to read more images than the list limit policy would allow
     resulting in excessive resource use.
   * Fix CVE-2026-46520:
     Heap Buffer Over-Write in IPL decoder when reading multiple
     images of different dimensions
     When reading multiple images with different dimensions an out of
     bounds heap write can occur.
   * Fix CVE-2026-46521:
     Heap Buffer Over-Write in MIFF encoder when using LZMA compression.
     When using LZMA compression in the MIFF encoder an out of bounds
     write can occur due to a missing check
   * Fix CVE-2026-46522:
     Infinite Loop in the MIFF decoder can lead to CPU exhaustion.
     Due to a missing check in the MIFF decoder a crafted file could
     cause an infinite loop resulting in CPU exhaustion.
   * Fix CVE-2026-46523:
     Use-After-Free in MSL decoder.
     A crafted MSL image can trigger a heap-use-after-free.
   * Fix CVE-2026-46557:
     Stack overflow in fx operation.
     Due to a missing depth check a stack overflow can occur in the
     fx operation by passing a crafted argument.
   * Fix CVE-2026-46559:
     Heap Buffer Over-Write of a single byte in the JP2 encoder.
     An incorrect check in the JP2 will result in an heap buffer over
     write of a single byte when specifying certain options.
   * Fix CVE-2026-46692:
     Heap Buffer Over-Write in distributed pixel cache server
     An attacker who can connect to a magick -distribute-cache
     service can cause a heap buffer over-write in the server process.
   * Fix CVE-2026-46693:
     Race Condition in distributed pixel cache server can result
     in file descriptor hijacking
     An attacker who can connect to a magick -distribute-cache service can
     hijack a file descriptor in the server process when a race condition is met.
   * Fix CVE-2026-47165:
     Information Disclosure in distributed pixel cache server because it is
     not using a challenge–response authentication model.
     The distributed pixel cache was originally designed to operate without a
     challenge–response authentication model. However, given today’s heightened
     security expectations, we have changed our implementation.
   * Fix CVE-2026-47166:
     Heap Buffer Over-Read in distributed pixel cache server.
     An attacker who can connect to a magick -distribute-cache service
     can cause a heap buffer over-read in the server process.

incus (6.0.4-2+deb13u8) trixie-security; urgency=high
 .
   * Cherry-pick fixes for the following security issues:
     - CVE-2026-48749 / GHSA-2q3f-q5pq-g8wv
     - CVE-2026-48750 / GHSA-73hr-m85f-64v9
     - CVE-2026-48751 / GHSA-48q5-w887-33wv
     - CVE-2026-48752 / GHSA-vxp5-584q-c479
     - CVE-2026-48755 / GHSA-v6mj-8pf4-hhw4
     - CVE-2026-48756 / GHSA-xhqx-mgh3-3h7q
     - CVE-2026-48769 / GHSA-f6m5-xw2g-xc4x
     - CVE-2026-55621 / GHSA-64f3-v33m-w89f
     - CVE-2026-55622 / GHSA-c9f5-j9c3-mhrg

ironic (1:29.0.5-0+deb13u2) trixie-security; urgency=medium
 .
   * CVE-2026-44917: Ironic does not validate the location of
     node.driver_info[pxe_template], allowing a user who can set it to expose
     arbitrary files on an internal Ironic network, such as the servicing,
     provisioning, or cleaning networks. Applied upstream patch:
     - CVE-2026-44917_disable-driver_info-level-pxe_template-override.patch
   * CVE-2026-46447: A user with access to add or modify node.driver_info or
     node.instance_info can create a crafted value to enable iPXE script
     execution during the boot process. Applied upstream patch:
     - CVE-2026-46447_Sanitize-kernel_append_parms.patch
   * CVE-2026-48681: A maliciously crafted ISO image can cause Ironic to perform
     path traversal and overwrite files on a conductor's disk.  Applied upstream
     patch:
     - CVE-2026-48681-directory_transversal_ISO9660_support.patch
     (Closes: #1138842)
ironic (1:29.0.5-0+deb13u1) trixie; urgency=medium
 .
   * New upstream release. Include fix for:
     - CVE-2026-42997 / OSSA-2026-010: Credential Forwarding to Arbitrary
       Endpoints via Ironic’s idrac Configuration molds Feature
       (Closes: #1135898).
     - CVE-2026-42510 / OSSA-2026-008: Command Injection in Ironic IPMI Console
       Implementations. Applied upstream patch: "Shell-quote console command
       passed to socat" (Closes: #1135255).
   * CVE-2026-44916: instance_info['ks_template'] is rendered without
     sandboxing. An attacker with sufficient access, an ironic deployment with
     the anaconda deploy interface, a node with the anaconda deployment
     interface set by an admin, and a malicious template could result in
     conductor internal data being rendered and if the infrastucture operator is
     allowing traffic egress for the provisioning network, could have sensitive
     internal data exfiled out of the environment. Applied upstream patch:
     - CVE-2026-44916_Use_sandbox_rendering_for_jinja2.patch
     (Closes: #1136005).
   * CVE-2026-44919: during image handling, an infinite loop in checksum
     calculations can occur via the file:///dev/zero URL. Add upstream patch:
     move_file_url_validation_up_into_deploy_utils_main_path.patch.
     (Closes: #1136655).

isc-kea (2.6.3-1+deb13u1) trixie; urgency=medium
 .
   * CVE-2026-3608

isenkram (0.69+deb13u1) trixie; urgency=medium
 .
   * Adjusted update-fw-list to handle / -> /usr migration
     (Closes: #1133426).
   * Updated generated firmware lists.

jackson-core (2.14.1-2~deb13u1) trixie-security; urgency=medium
 .
   * Team upload.
   * Backport 2.14.1 to trixie.
   * Fix CVE-2025-52999 and CVE-2025-49128.
jackson-core (2.14.1-2~deb12u1) bookworm-security; urgency=medium
 .
   * Team upload.
   * Backport 2.14.1 to bookworm.
   * Fix CVE-2025-52999 and CVE-2025-49128.

jackson-databind (2.14.0+ds-1+deb13u1) trixie-security; urgency=medium
 .
   [ Otto Kekäläinen ]
   * Enable Salsa CI to help avoid testable regressions before upload to Debian
   * Fix broken Homepage link and add current upstream metadata.  The site
     wiki.fasterxml.com no longer exists. Replace it with link to the current
     wiki location. Also add a metadata file following DEP-12, so it is easier
     for both maintainers to find the correct upstream websites, as well as for
     `git-buildpackage --add-upstreamvcs` feature to work.
   * Define Debian packaging repository conventions in gbp.conf.
     Add a git-buildpackage config file to show explicitly what conventions this
     Debian source package repository uses. This way it is easier for current
     maintainer to do e.g. new upstream version imports, as there are less
     arguments that need to be passed to `gbp` commands, and also for any future
     maintainer/contributor there is less guesswork.
 .
   [ Markus Koschany ]
   * Add CVE-2025-52999.patch and fix a FBTFS due to changes in jackson-core.
     (Closes: #1135410)

jackson-dataformat-smile (2.7.8-5+deb13u1) trixie-security; urgency=medium
 .
   * Team upload.
   * Fix FTBFS with jackson-core and restore the compatibility.
jackson-dataformat-smile (2.7.8-5+deb12u1) bookworm-security; urgency=medium
 .
   * Team upload.
   * Fix FTBFS with jackson-core and restore the compatibility.

jpeg-xl (0.11.2-0.1~deb13u2) trixie-security; urgency=medium
 .
   * CVE-2025-70103 (Closes: #1138575)

kdenlive (24.12.3-2+deb13u1) trixie-security; urgency=high
 .
   * Add patch 02-CVE-2026-45184: Dangerous proxy parameters, when an
     attacker-controlled project file is used.
     Closes: #1136172

keystone (2:27.0.0-3+deb13u4) trixie-security; urgency=medium
 .
   * Multiple vulnerabilities in Keystone's delegated authentication allow an
     authenticated user to escalate privileges to cloud admin. The most severe
     (CVE-2026-42999) requires only a valid token:
     - CVE-2026-42999: An attacker can inject RBAC policy targets via the JSON
       request body, bypassing authorization on any policy-protected  endpoint.
       Allows reading all credential secrets, creating credentials for arbitrary
       users, and granting admin across domains. (LP#2148398, reported by Boris
       Bobrov, SAP SE).
     - CVE-2026-42998: Application credential authentication does not verify the
       caller owns the credential, allowing user impersonation within a shared
       project. (LP#2148477, reported by Boris Bobrov, SAP SE).
     -  CVE-2026-43000: The impersonation from CVE-2026-42998 can be chained
        with trusts to escalate from member to admin. The resulting trust
        persists independently of the original credential. (LP#2148477, reported
        by Boris Bobrov, SAP SE)
     -  CVE-2026-43001: Application credentials scoped to one project can create
        EC2 credentials for a different project. A fix for the creation-time
        path is already merged; this patch extends the check to the auth-time
        path. (LP#2149775, reported by Tim Shepherd, roiai.ca)
     -  CVE-2026-44394: Federated users can maintain access indefinitely by
        repeatedly rescoping tokens before expiry. Each rescope issues a fresh
        full-TTL token instead of inheriting the original expiry. Only
        SAML2/OIDC deployments are affected. (LP#2150379, reported by Erichen,
        Institute of Computing Technology, Chinese Academy of Sciences).
     .
     The patch also addresses three related issues found during investigation:
     trust-scoped tokens accessing credentials outside the delegated project
     (LP#2149789), trust-scoped tokens creating persistent application
     credentials for impersonated users (LP#2150089), and a latent query-string
     parameter injection in policy enforcement and lack of scope boundary
     enforcement in the delegated token logic (LP#2150089). These were reported
     by Tim Shepherd (roiai.ca) and Artem Goncharov (SysEleven GmbH).
     .
     Applied the proposed upstream patches:
     - 0001-Add-tests-for-restricted-app-cred-guard.patch
     - 0002-Block-restricted-app-creds-from-creating-EC2-credent.patch
     - 0003-Block-app-cred-tokens-from-authorizing-OAuth1-reques.patch
     - 0004-Enforce-app-cred-project-boundary-on-EC2-credential-.patch
     - CVE-2026-43001-keystone-backport-stable-2025.1.patch
     .
     Please also note that the fix for CVE-2026-42999 (LP#2148398) modifies the
     trust policy structure. If this policy is customized by the provider,
     failure to update it may result in issues with image upload, heat service
     functionality and potentially more.
   * Note that all the above CVE are combined into this one: CVE-2026-43001.
     (Closes: #1135645).
keystone (2:27.0.0-3+deb13u3) trixie; urgency=medium
 .
   * CVE-2026-40683 / OSSA-2026-007: LDAP identity backend does not convert
     enabled attribute to boolean. When the user_enabled_invert configuration
     option was False (the default), Keystone did not correctly interpret the
     LDAP enabled attribute, causing users disabled in LDAP to be treated as
     enabled and allowed to authenticate. Deployments using the LDAP identity
     backend without user_enabled_invert=True or user_enabled_emulation are
     affected. Applied upstream patch:
     - OSSA-2026-007-fix_ldap_enabled_setting_not_interpreted_as_boolean.patch
     (Closes: #1133884).
   * CVE-2026-33551 / OSSA-2026-005: Restricted application credentials can
     create EC2 credentials. Applied upstream patch "Prevent unauthorized EC2
     credential creation and deletion" (Closes: #1133118).

kitty (0.41.1-2+deb13u1) trixie-security; urgency=medium
 .
   * Add patches to fix CVE-2026-33642 and CVE-2026-33633
     Closes: #1137210

krb5 (1.21.3-5+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Fix two NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356)
     (Closes: #1135317)

libapache-session-browseable-perl (1.3.16-1+deb13u1) trixie; urgency=medium
 .
   * Improve Apache::Session::Generate::SHA256 entropy (Closes: CVE-2026-8503)

libass (1:0.17.3-1+deb13u1) trixie; urgency=medium
 .
   [ Oneric ]
   * Backport security fixes from 0.15.5 to 0.17.3
     - Out-of-bounds read and write in wrap_lines_measure (GHSA-pjjp-65r7-ppgm)

libbytes-random-secure-perl (0.29-4~deb13u1) trixie; urgency=medium
 .
   * Rebuild for trixie
 .
 libbytes-random-secure-perl (0.29-4) unstable; urgency=medium
 .
   * Team upload.
   * Fix incorrect usage of seed in PRNG (CVE-2026-11625)
libbytes-random-secure-perl (0.29-4~deb13u1~deb12u1) bookworm; urgency=medium
 .
   * Rebuild for bookworm
 .
 libbytes-random-secure-perl (0.29-4~deb13u1) trixie; urgency=medium
 .
   * Rebuild for trixie
 .
 libbytes-random-secure-perl (0.29-4) unstable; urgency=medium
 .
   * Team upload.
   * Fix incorrect usage of seed in PRNG (CVE-2026-11625)

libcaca (0.99.beta20-5+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Prevent undefined behaviour in overflow check (CVE-2026-42046)
     (Closes: #1136952)

libconfig-inifiles-perl (3.000003-3+deb13u1) trixie-security; urgency=high
 .
   * Team upload.
   * Add fix for CVE-2026-11527 (uses 2-arg open() in _make_filehandle)

libcrypt-pbkdf2-perl (0.261630-1~deb13u1) trixie; urgency=medium
 .
   * Rebuild for trixie
   * Revert "Annotate test-only build dependencies with <!nocheck>."
   * Revert "Remove «Priority: optional», which is the current default."
   * Revert "Declare compliance with Debian Policy 4.7.4."
 .
 libcrypt-pbkdf2-perl (0.261630-1) unstable; urgency=medium
 .
   * Team upload.
   * Import upstream version 0.261630.
     - Change the default hash algorithm to HMAC-SHA256, and increase the
       default number of iterations to 600,000 (CVE-2026-9641).
     - Generate salts using Crypt::URandom instead of perl's builtin `rand()`
       (CVE-2026-9638).
     - Use a constant-time comparison in `validate` to avoid timing attacks
       (CVE-2017-20240).
     Closes: #1139867
   * Update debian/upstream/metadata.
   * Update years of upstream copyright.
   * debian/control: update build/test/runtime dependencies.
   * Declare compliance with Debian Policy 4.7.4.
   * Remove «Priority: optional», which is the current default.
   * Annotate test-only build dependencies with <!nocheck>.
libcrypt-pbkdf2-perl (0.261630-1~deb13u1~deb12u1) bookworm; urgency=medium
 .
   * Rebuild for bookworm
 .
 libcrypt-pbkdf2-perl (0.261630-1~deb13u1) trixie; urgency=medium
 .
   * Rebuild for trixie
   * Revert "Annotate test-only build dependencies with <!nocheck>."
   * Revert "Remove «Priority: optional», which is the current default."
   * Revert "Declare compliance with Debian Policy 4.7.4."
 .
 libcrypt-pbkdf2-perl (0.261630-1) unstable; urgency=medium
 .
   * Team upload.
   * Import upstream version 0.261630.
     - Change the default hash algorithm to HMAC-SHA256, and increase the
       default number of iterations to 600,000 (CVE-2026-9641).
     - Generate salts using Crypt::URandom instead of perl's builtin `rand()`
       (CVE-2026-9638).
     - Use a constant-time comparison in `validate` to avoid timing attacks
       (CVE-2017-20240).
     Closes: #1139867
   * Update debian/upstream/metadata.
   * Update years of upstream copyright.
   * debian/control: update build/test/runtime dependencies.
   * Declare compliance with Debian Policy 4.7.4.
   * Remove «Priority: optional», which is the current default.
   * Annotate test-only build dependencies with <!nocheck>.

libcrypt-urandom-perl (0.54-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-2474: heap buffer overflow in crypt_urandom_getrandom()

libdbi-perl (1.647-1+deb13u1) trixie-security; urgency=high
 .
   * Team upload.
   * Fix possible stack overflow (CVE-2026-9698)
   * Replacing `?` with `:p#` in `preparse ()` with more than 9 `?` causes
     buffer overflow (CVE-2026-10879)

libgcrypt20 (1.11.0-7+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * cipher:ecc: Fix decoding a point on Montgomery curve. (CVE-2026-41989)

libgd-perl (2.78-1+deb13u1) trixie-security; urgency=high
 .
   * Team upload.
   * Fix CVE-2026-11526: command injection via 2-arg open() in _make_filehandle

libhtml-parser-perl (3.83-2~deb13u1) trixie; urgency=medium
 .
   * Rebuild for trixie
 .
 libhtml-parser-perl (3.83-2) unstable; urgency=medium
 .
   * Fix heap-use-after-free in _decode_entities (CVE-2026-8829)

libhttp-daemon-perl (6.16-1+deb13u1) trixie-security; urgency=high
 .
   * Team upload.
   * Fix CVE-2026-8450: send_file() honoured 2-arg open() shell-magic
     (Closes: #1138050)
   * Add regression test for send_file() shell-magic refusal
libhttp-daemon-perl (6.16-1+deb13u1~deb12u1) bookworm-security; urgency=high
 .
   * Team upload.
   * Rebuild for bookworm-security
 .
 libhttp-daemon-perl (6.16-1+deb13u1) trixie-security; urgency=high
 .
   * Team upload.
   * Fix CVE-2026-8450: send_file() honoured 2-arg open() shell-magic
     (Closes: #1138050)
   * Add regression test for send_file() shell-magic refusal

libinput (1.28.1-1+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * util: don't call function in macro argument
   * util: sanitize control characters in str_sanitize()
   * libinput-device-group: sanitize phys before printing it (CVE-2026-50292)

libnet-cidr-lite-perl (0.22-3~deb13u2) trixie; urgency=medium
 .
   * Team upload.
   * CVE-2026-45190: Reject Unicode digits and trailing newlines in parsers
   * CVE-2026-45190: Add tests
   * CVE-2026-45191: Reject zero-padded CIDR masks
   * CVE-2026-45191: Add tests

librabbitmq (0.15.0-1+deb13u1) trixie-security; urgency=medium
 .
   * [b57bf8d] d/patches/CVE-2026-44235.patch: added from upstream.
     Fix out-of-bounds read via undersized frames in amqp_handle_input
     (GHSA-9mmv-r8g3-qp46, CVE-2026-44235)
   * [890d6c5] d/patches/CVE-2026-44236.patch: added from upstream.
     Fix client crash when server negotiates frame_max below the AMQP
     protocol minimum (GHSA-jh48-qjf5-fx5v, CVE-2026-44236)

libreoffice (4:25.2.3-2+deb13u6) trixie; urgency=medium
 .
   * debian/patches/check-for-hb_shape_full-failure.diff: add patch from
     libreoffice-26-2 branch to gracefully handle hb_shape_full failure,
     as can happen after the fix for CVE-2026-50593 in graphite2
libreoffice (4:25.2.3-2+deb13u5) trixie-security; urgency=medium
 .
   * debian/patches/CVE-2026-*.diff: fix
     - CVE-2026-6039 DXF heap-buffer-overflow in DrawLWPolyLineEntity
     - CVE-2026-6040 ODT use-after-free in lcl_InsertBlankWidthChars
     - CVE-2026-6045 EMF+ Heap-buffer-overflow in EMFPBrush::Read
     - CVE-2026-8356 ANT-2026-01882: Stack Buffer Overflow in
       `SdrEscherImport::RecolorGraphic()`
     - CVE-2026-8357 ANT-2026-03093: Off-by-one heap-buffer-overflow in
       LibreOffice Calc formula compiler
     - CVE-2026-8358 ANT-2026-03238: Heap-buffer-overflow in LibreOffice
       Calc FODS tracked-changes importer via duplicate action ID
libreoffice (4:25.2.3-2+deb13u5~bpo12+1) bookworm-backports; urgency=medium
 .
   * rebuild for bookworm-backports
 .
   * revert t64 rename for bookworm-backports
 .
   * debian/source/include-binaries, tarballs/*: include
     tarballs/frozen-1.2.0.tar.gz
     tarballs/mdds-2.1.1.tar.xz
     tarballs/liborcus-0.19.2.tar.xz
     tarballs/libcmis-0.6.2.tar.xz
 .
 libreoffice (4:25.2.3-2+deb13u5) trixie-security; urgency=medium
 .
   * debian/patches/CVE-2026-*.diff: fix
     - CVE-2026-6039 DXF heap-buffer-overflow in DrawLWPolyLineEntity
     - CVE-2026-6040 ODT use-after-free in lcl_InsertBlankWidthChars
     - CVE-2026-6045 EMF+ Heap-buffer-overflow in EMFPBrush::Read
     - CVE-2026-8356 ANT-2026-01882: Stack Buffer Overflow in
       `SdrEscherImport::RecolorGraphic()`
     - CVE-2026-8357 ANT-2026-03093: Off-by-one heap-buffer-overflow in
       LibreOffice Calc formula compiler
     - CVE-2026-8358 ANT-2026-03238: Heap-buffer-overflow in LibreOffice
       Calc FODS tracked-changes importer via duplicate action ID
 .
 libreoffice (4:25.2.3-2+deb13u4) trixie-security; urgency=medium
 .
   * debian/patches/Conform-AlignEngine-parsing-to-spec.diff: as name says;
     from libreoffice-26-2 branch; fixes CVE-2026-4430

libslirp (4.8.0-1+deb13u1) trixie; urgency=medium
 .
   * d/gbp.conf: switch to debian/trixie branch
   * oob-cap-urgent-data-to-what-is-available-CVE-2026-9539.patch
     patch from upstream to fix CVE-2026-9539 (oob heap read and integer
     underflow allowing reading sensitive host-process memory)

libssh2 (1.11.1-1+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2026-7598 (Closes: #1135647)
   * CVE-2025-15661 / CVE-2026-55199 / CVE-2026-55200 (Closes: #1140401)

libtasn1-6 (4.20.0-2+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2025-13151: Stack-based buffer overflow in asn1_expand_octet_string()
     (Closes: #1125063)

libvncserver (0.9.15+dfsg-1+deb13u2) trixie; urgency=medium
 .
   * Team upload.
   * debian/patches:
     + CVE-2026-44988: Add 0003_CVE-2026-44988.patch fixing Tight gradient
       decoding overflow (Closes: #1138174).
     + CVE-2026-50538: Add 0004_CVE-2026-50538.patch fixing attacker-controlled
       heap out-of-bounds write (Closes: #1138253).

libxml-libxml-perl (2.0207+dfsg+really+2.0134-5+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * fix: replace domParseChar with xmlValidateName to prevent OOB UTF-8 read
     (CVE-2026-8177) (Closes: #1136300)

libxml2 (2.12.7+dfsg+really2.9.14-2.1+deb13u3) trixie; urgency=high
 .
   * Non-maintainer upload.
   * Fix CVE-2026-0989: Specially crafted or overly complex schemas can cause
     excessive recursion during parsing, which may lead to stack exhaustion and
     application crashes. The parser now enforces a limit on inclusion depth
     when resolving nested `<include>` directives; the limit defaults to 1000
     and can be modified at runtime with the env variable `RNG_INCLUDE_LIMIT`.
     (Closes: #1125691)
   * Fix CVE-2026-0990: `xmlCatalogXMLResolveURI()` will recurse infinitely if
     a catalog has a URI delegate referencing itself, eventually resulting in a
     call stack overflow. (Closes: #1125695)
   * Fix CVE-2026-0992: Denial of Service vulnerability due to uncontrolled
     resource consumption when processing XML catalogs containing repeated
     `<nextCatalog>` elements pointing to the same downstream catalog.
     (Closes: #1125696)
   * Fix CVE-2025-8732: When a catalog file contains a CATALOG directive
     pointing to itself, `xmlExpandCatalog()` and `xmlParseSGMLCatalog()`
     recursively call each other without bounds until stack overflow.
   * Fix CVE-2026-1757: Memory leak issue in the command parsing logic of the
     xmllint interactive shell.
   * Fix unit tests for CVE-2025-49794 and -49796.
   * Backport some more upstream changes from v2.15.2:
     + Fix memory leak of prefix in `xmlTextWriterStartElementNS()`.
     + Mitigate use-after-free issue in `xmlRelaxNGValidateValue()`.
     + Fix memory leak in `xmlTextWriterStartAttributeNS()`.
     + Schematron: Fix additional memory leaks on error paths.
     + Catalog: Fix stack overflow from self-referencing SGML CATALOG entries.
   * Add d/salsa-ci.yml for Salsa CI.

libxpm (1:3.5.17-1+deb13u1) trixie; urgency=medium
 .
   * CVE-2026-4367 (Closes: #1134690)

linux (6.12.94-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.91
     - io_uring/kbuf: use mem_is_zero()
     - blk-cgroup: wait for blkcg cleanup before initializing new disk
     - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START
     - fs/mbcache: cancel shrink work before destroying the cache
     - md/raid1: fix the comparing region of interval tree
     - drbd: Balance RCU calls in drbd_adm_dump_devices()
     - loop: fix partition scan race between udev and loop_reread_partitions()
     - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()
     - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()
     - pstore/ram: fix resource leak when ioremap() fails
     - md: wake raid456 reshape waiters before suspend
     - btrfs: pass struct btrfs_inode to clone_copy_inline_extent()
     - btrfs: fix deadlock between reflink and transaction commit when using
       flushoncommit
     - [amd64] ACPI: x86: cmos_rtc: Clean up address space handler driver
     - [amd64] ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver
     - devres: fix missing node debug info in devm_krealloc()
     - thermal/drivers/spear: Fix error condition for reading st,thermal-flags
     - debugfs: check for NULL pointer in debugfs_create_str()
     - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str()
     - soundwire: debugfs: initialize firmware_file to empty string
     - PCI: use generic driver_override infrastructure
     - platform/wmi: use generic driver_override infrastructure
     - [s390x] cio: use generic driver_override infrastructure
     - bus: fsl-mc: use generic driver_override infrastructure
     - irqchip/irq-pic32-evic: Address warning related to wrong printf()
       formatter
     - hrtimers: Update the return type of enqueue_hrtimer()
     - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns()
     - hrtimer: Reduce trace noise in hrtimer_start()
     - locking: Fix rwlock support in <linux/spinlock_up.h>
     - firmware: dmi: Correct an indexing error in dmi.h
     - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt()
     - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished
       irq_prepare_bcn_tasklet
     - bpf: test_run: Fix the null pointer dereference issue in
       bpf_lwt_xmit_push_encap
     - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH
     - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n
     - [s390x] bpf: Zero-extend bpf prog return values and kfunc arguments
     - params: Replace __modinit with __init_or_module
     - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n
     - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in
       mt76_connac2_tx_check_aggr()
     - wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control
     - wifi: mt76: mt7615: fix use_cts_prot support
     - wifi: mt76: mt7915: fix use_cts_prot support
     - wifi: mt76: mt7925: prevent NULL pointer dereference in
       mt7925_tx_check_aggr()
     - wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi
     - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor
     - wifi: mt76: mt7921: Place upper limit on station AID
     - [arm64] cpufeature: Make PMUVer and PerfMon unsigned
     - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event
     - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()
     - wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()
     - wifi: mt76: mt7921: fix 6GHz regulatory update on connection
     - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path
     - bpf: Fix variable length stack write over spilled pointers
     - bpf,arc_jit: Fix missing newline in pr_err messages
     - wifi: rtw89: phy: fix uninitialized variable access in
       rtw89_phy_cfo_set_crystal_cap()
     - r8152: fix incorrect register write to USB_UPHY_XTAL
     - [powerpc*] crash: fix backup region offset update to elfcorehdr
     - [powerpc*] crash: Update backup region offset in elfcorehdr on memory
       hotplug
     - macvlan: annotate data-races around port->bc_queue_len_used
     - bpf: fix end-of-list detection in cgroup_storage_get_next_key()
     - bpf: Fix stale offload->prog pointer after constant blinding
     - wifi: brcmfmac: Fix error pointer dereference
     - wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode()
     - bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks
     - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()
     - wifi: ath10k: fix station lookup failure during disconnect
     - ACPI: AGDI: fix missing newline in error message
     - [arm64] kexec: Remove duplicate allocation for trans_pgd
     - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
     - net: bcmgenet: add bcmgenet_has_* helpers
     - net: bcmgenet: move DESC_INDEX flow to ring 0
     - net: bcmgenet: support reclaiming unsent Tx packets
     - net: bcmgenet: switch to use 64bit statistics
     - net: bcmgenet: fix racing timeout handler
     - eth: fbnic: Use wake instead of start
     - netfilter: xt_socket: enable defrag after all other checks
     - netfilter: nft_fwd_netdev: check ttl/hl before forwarding
     - bpf: fix mm lifecycle in open-coded task_vma iterator
     - bpf: switch task_vma iterator from mmap_lock to per-VMA locks
     - bpf: return VMA snapshot from task_vma iterator
     - bpf: Fix RCU stall in bpf_fd_array_map_clear()
     - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf
     - bpf: Relax scalar id equivalence for state pruning
     - bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars
     - net/sched: act_ct: Only release RCU read lock after ct_ft
     - net: airoha: Implement BQL support
     - net: airoha: Add missing RX_CPU_IDX() configuration in
       airoha_qdma_cleanup_rx_queue()
     - bpf: Allow instructions with arena source and non-arena dest registers
     - net/rds: Optimize rds_ib_laddr_check
     - net/rds: Restrict use of RDS/IB to the initial network namespace
     - bpf: Fix OOB in pcpu_init_value
     - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
     - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG
     - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+
     - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110
     - net: phy: fix a return path in get_phy_c45_ids()
     - net/mlx5e: Fix features not applied during netdev registration
     - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic()
     - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb
     - Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU
     - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error
     - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
     - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
     - Bluetooth: SCO: check for codecs->num_codecs == 1 before assigning to
       sco_pi(sk)->codec
     - net: phy: qcom: at803x: Use the correct bit to disable extended next page
     - ipv4: udp: fix typos in comments
     - ipv6: udp: fix typos in comments
     - udp: Force compute_score to always inline
     - tcp: Don't set treq->req_usec_ts in cookie_tcp_reqsk_init().
     - sctp: fix missing encap_port propagation for GSO fragments
     - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master
     - drm/komeda: fix integer overflow in AFBC framebuffer size check
     - ASoC: SOF: ipc3: Use standard dev_dbg API
     - ASoC: add symmetric_ prefix for dai->rate/channels/sample_bits
     - ASoC: soc-compress: use function to clear symmetric params
     - drm/sun4i: backend: fix error pointer dereference
     - ASoC: sti: Return errors from regmap_field_alloc()
     - ASoC: sti: use managed regmap_field allocations
     - dm cache: fix null-deref with concurrent writes in passthrough mode
     - dm cache: fix write path cache coherency in passthrough mode
     - dm cache: fix write hang in passthrough mode
     - dm cache policy smq: fix missing locks in invalidating cache blocks
     - dm cache: fix concurrent write failure in passthrough mode
     - dm cache: support shrinking the origin device
     - dm cache: fix dirty mapping checking in passthrough mode switching
     - platform/chrome: chromeos_tbmc: Drop wakeup source on remove
     - PCI: endpoint: Align pci_epc_set_msix(), pci_epc_ops::set_msix() nr_irqs
       encoding
     - PCI: dwc: ep: Fix MSI-X Table Size configuration in dw_pcie_ep_set_msix()
     - PCI: dwc: Invoke post_init in dw_pcie_resume_noirq()
     - PCI: dwc: Perform cleanup in the error path of dw_pcie_resume_noirq()
     - dm cache metadata: fix memory leak on metadata abort retry
     - dm log: fix out-of-bounds write due to region_count overflow
     - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in
       atomic_enable()
     - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to
       drm_bridge_funcs
     - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge
       atomic check
     - spi: spi-nxp-fspi: enable runtime pm for fspi
     - spi: nxp-fspi: Use reinit_completion() for repeated operations
     - spi: fsl-qspi: Use reinit_completion() for repeated operations
     - media: i2c: og01a1b: Replace client->dev usage
     - media: i2c: og01a1b: Fix V4L2 subdevice data initialization on probe
     - drm/v3d: Handle error from drm_sched_entity_init()
     - drm/sun4i: Fix resource leaks
     - drm/amdgpu: Add default case in DVI mode validation
     - dm init: ensure device probing has finished in dm-mod.waitfor=
     - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build
       break
     - crypto: tegra - finalize crypto req on error
     - crypto: tegra - Transfer HASH init function to crypto engine
     - crypto: tegra - Reserve keyslots to allocate dynamically
     - crypto: tegra - Disable softirqs before finalizing request
     - crypto: atmel - Use unregister_{aeads,ahashes,skciphers}
     - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs
     - padata: Remove cpu online check from cpu add and removal
     - padata: Put CPU offline callback in ONLINE section to allow failure
     - PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the
       documentation
     - drm/amdgpu/gfx10: look at the right prop for gfx queue priority
     - drm/amdgpu/gfx11: look at the right prop for gfx queue priority
     - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo
     - drm/imagination: Switch reset_reason fields from enum to u32
     - iommu/tegra241-cmdqv: Set supports_cmd op in tegra241_vcmdq_hw_init()
     - [arm64] drm/msm/dpu: fix mismatch between power and frequency
     - [arm64] drm/msm/dsi: add the missing parameter description
     - [arm64] drm/msm/dsi: fix bits_per_pclk
     - [arm64] drm/msm/dsi: fix hdisplay calculation for CMD mode panel
     - [arm64] drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0
     - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first
     - drm/panel: simple: Correct G190EAN01 prepare timing
     - PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion
       support
     - ALSA: core: Validate compress device numbers without dynamic minors
     - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled
     - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs
     - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock
     - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0
     - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels
     - drm/amd/pm/ci: Fill DW8 fields from SMC
     - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board
     - drm/amdgpu: add amdgpu_device reference in ip block
     - drm/amdgpu: update the handle ptr in dump_ip_state
     - drm/amdgpu: update the handle ptr in early_init
     - drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled
     - hwmon: Switch back to struct platform_driver::remove()
     - hwmon: (aspeed-g6-pwm-tach): remove redundant driver remove callback
     - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace
       '}')
     - [amd64] ASoC: SOF: Intel: hda: Place check before dereference
     - [arm64] drm/msm/a6xx: Fix HLSQ register dumping
     - [arm64] drm/msm/shrinker: Fix can_block() logic
     - [arm64] drm/msm/a6xx: Fix dumping A650+ debugbus blocks
     - [arm64] drm/msm/a6xx: Use barriers while updating HFI Q headers
     - pmdomain: ti: omap_prm: Fix a reference leak on device node
     - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe()
     - PM: domains: De-constify fields in struct dev_pm_domain_attach_data
     - ASoC: fsl_micfil: Add access property for "VAD Detected"
     - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable()
     - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode()
     - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state()
     - ASoC: fsl_micfil: Fix event generation in micfil_quality_set()
     - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put()
     - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put()
     - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits()
     - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits()
     - ASoC: fsl_easrc: Change the type for iec958 channel status controls
     - [amd64] iommu/amd: Remove protection_domain.dev_cnt variable
     - [amd64] iommu/amd: xarray to track protection_domain->iommu list
     - [amd64] iommu/amd: Do not detach devices in domain free path
     - [amd64] iommu/amd: Reduce domain lock scope in attach device path
     - [amd64] iommu/amd: Rearrange attach device code
     - [amd64] iommu/amd: Convert dev_data lock from spinlock to mutex
     - [amd64] iommu/amd: Introduce helper function to update 256-bit DTE
     - [amd64] iommu/amd: Introduce helper function get_dte256()
     - [amd64] iommu/amd: Fix clone_alias() to use the original device's devid
     - [arm64] ASoC: qcom: qdsp6: topology: check widget type before accessing
       data
     - crypto: qat - introduce fuse array
     - crypto: qat - disable 4xxx AE cluster when lead engine is fused off
     - crypto: qat - disable 420xx AE cluster when lead engine is fused off
     - crypto: qat - fix type mismatch in RAS sysfs show functions
     - crypto: qat - use swab32 macro
     - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]
     - PCI: Enable AtomicOps only if Root Port supports them
     - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found
     - Documentation: fix a hugetlbfs reservation statement
     - ALSA: scarlett2: Add missing sentinel initializer field
     - ASoC: SOF: compress: return the configured codec from get_params
     - PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports
     - PCI: tegra194: Fix polling delay for L2 state
     - PCI: tegra194: Increase LTSSM poll time on surprise link down
     - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link
       down
     - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in
       tegra_pcie_downstream_dev_to_D0()
     - PCI: tegra194: Don't force the device into the D0 state before L2
     - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode
     - PCI: tegra194: Use devm_gpiod_get_optional() to parse
       "nvidia,refclk-select"
     - PCI: tegra194: Disable direct speed change for Endpoint mode
     - PCI: tegra194: Set LTR message request before PCIe link up in Endpoint
       mode
     - PCI: tegra194: Allow system suspend when the Endpoint link is not up
     - PCI: tegra194: Free up Endpoint resources during remove()
     - PCI: tegra194: Use DWC IP core version
     - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well
     - PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on
     - spi: mtk-snfi: unregister ECC engine on probe failure and remove()
       callback
     - ALSA: sc6000: Keep the programmed board state in card-private data
     - dm cache: fix missing return in invalidate_committed's error path
     - crypto: jitterentropy - replace long-held spinlock with mutex
     - ALSA: hda/realtek - fixed speaker no sound update
     - gfs2: Call unlock_new_inode before d_instantiate
     - net/socket.c: switch to CLASS(fd)
     - fdget(), trivial conversions
     - fanotify: call fanotify_events_supported() before path_permission() and
       security_path_notify()
     - quota: Fix race of dquot_scan_active() with quota deactivation
     - gfs2: add some missing log locking
     - gfs2: prevent NULL pointer dereference during unmount
     - efi/capsule-loader: fix incorrect sizeof in phys array reallocation
     - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine
     - [arm64] dts: mediatek: mt8365: Describe infracfg-nao as a pure syscon
     - memory: tegra124-emc: Fix dll_change check
     - memory: tegra30-emc: Fix dll_change check
     - [arm64] dts: imx8-apalis: Fix LEDs name collision
     - [arm64] dts: rockchip: Make Jaguar PCIe-refclk pin use pull-up config
     - [arm64] dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO
       (M.2 W_DISABLE1)
     - iommufd: vfio compatibility extension check for noiommu mode
     - [arm64] dts: mediatek: mt6795: Fix gpio-ranges pin count
     - [arm64] dts: mediatek: mt7981b: Fix gpio-ranges pin count
     - [arm64] dts: mediatek: mt7986a: Fix gpio-ranges pin count
     - [arm64] dts: qcom: msm8953-xiaomi-vince: correct wled ovp value
     - [arm64] dts: qcom: msm8953-xiaomi-daisy: fix backlight
     - [arm64] dts: rockchip: Fix Bluetooth stability on LCKFB TaiShan Pi
     - [arm64] dts: rockchip: Correct Fan Supply for Gameforce Ace
     - [arm64] dts: rockchip: Correct Joystick Axes on Gameforce Ace
     - [arm64] soc: qcom: ocmem: make the core clock optional
     - [arm64] soc: qcom: ocmem: register reasons for probe deferrals
     - [arm64] soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available
     - bus: rifsc: fix RIF configuration check for peripherals
     - [arm64] dts: qcom: sm8450: Fix GIC_ITS range length
     - [arm64] dts: qcom: sm8550: Fix GIC_ITS range length
     - [arm64] dts: qcom: sm8650: Fix GIC_ITS range length
     - [arm64] dts: qcom: sm8550: Fix xo clock supply of platform SD host
       controller
     - [arm64] dts: qcom: sm8650: Fix xo clock supply of SD host controller
     - [arm64] dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes
     - [arm64] dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes
     - [arm64] dts: qcom: sm8650: Enable UHS-I SDR50 and SDR104 SD card modes
     - [arm64] dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl
     - [arm64] dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered
       during boot
     - [arm64] dts: ti: k3-am62p5-sk: Disable MMC1 internal pulls on data pins
     - [arm64] dts: ti: k3-am62-lp-sk: Enable internal pulls for MMC0 data pins
     - [arm64] dts: ti: k3-am62-verdin: Fix SPI_1 GPIO CS pinctrl label
     - [arm64] dts: freescale: imx8mp-tqma8mpql-mba8mp-ras314: fix UART1 RTS/CTS
       muxing
     - [arm64] dts: lx2160a: change i2c0 (iic1) pinmux mask to one bit
     - [arm64] dts: lx2160a: remove duplicate pinmux nodes
     - [arm64] dts: lx2160a: rename pinmux nodes for readability
     - [arm64] dts: lx2160a: add sda gpio references for i2c bus recovery
     - [arm64] dts: lx2160a: change zeros to hexadecimal in pinmux nodes
     - [arm64] dts: lx2160a: complete pinmux for rcwsr12 configuration word
     - [arm64] dts: imx8qm-mek: switch Type-C connector power-role to dual
     - [arm64] dts: imx8qxp-mek: switch Type-C connector power-role to dual
     - soc/tegra: cbb: Set ERD on resume for err interrupt
     - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure
     - ocfs2/dlm: validate qr_numregions in dlm_match_regions()
     - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
     - soc: qcom: llcc: fix v1 SB syndrome register offset
     - [arm64] soc: qcom: aoss: compare against normalized cooling state
     - [arm64] dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP
     - [arm64] xor: fix conflicting attributes for xor_block_template
     - firmware: arm_ffa: Use the correct buffer size during RXTX_MAP
     - ocfs2: fix listxattr handling when the buffer is full
     - ocfs2: validate bg_bits during freefrag scan
     - ocfs2: validate group add input before caching
     - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void
       function
     - soundwire: bus: demote UNATTACHED state warnings to dev_dbg()
     - dmaengine: mxs-dma: Fix missing return value from
       of_dma_controller_register()
     - soundwire: cadence: Clear message complete before signaling waiting thread
     - tracing: Rebuild full_name on each hist_field_name() call
     - hte: tegra194: remove Kconfig dependency on Tegra194 SoC
     - remoteproc: xlnx: Fix sram property parsing
     - ima: check return value of crypto_shash_final() in boot aggregate
     - HID: asus: make asus_resume adhere to linux kernel coding standards
     - HID: asus: do not abort probe when not necessary
     - mtd: physmap_of_gemini: Fix disabled pinctrl state check
     - ima_fs: don't bother with removal of files in directory we'll be removing
     - ima_fs: get rid of lookup-by-dentry stuff
     - ima_fs: Correctly create securityfs files for unsupported hash algos
     - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range
     - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations
     - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook
     - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook
     - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation
     - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask
     - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path
     - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions
     - cxl/pci: Check memdev driver binding status in cxl_reset_done()
     - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob
     - HID: usbhid: fix deadlock in hid_post_reset()
     - ext4: fix possible null-ptr-deref in mbt_kunit_exit()
     - [arm64] bpf, arm64: Fix off-by-one in check_imm signed range check
     - bpf, sockmap: Fix af_unix iter deadlock
     - bpf, sockmap: Fix af_unix null-ptr-deref in proto update
     - bpf, sockmap: Take state lock for af_unix iter
     - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check
     - bpf: Fix NULL deref in map_kptr_match_type for scalar regs
     - bpf: allow UTF-8 literals in bpf_bprintf_prepare()
     - bpf: Validate node_id in arena_alloc_pages()
     - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT
     - pinctrl: pinctrl-pic32: Fix resource leak
     - pinctrl: cy8c95x0: remove duplicate error message
     - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe()
     - pinctrl: cy8c95x0: Avoid returning positive values to user space
     - perf branch: Avoid incrementing NULL
     - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace
     - pinctrl: realtek: Fix function signature for config argument
     - pinctrl: abx500: Fix type of 'argument' variable
     - pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT} registers
     - perf lock: Fix option value type in parse_max_stack
     - perf stat: Fix opt->value type for parse_cache_level
     - perf tools: Fix module symbol resolution for non-zero .text sh_addr
     - perf expr: Return -EINVAL for syntax error in expr__find_ids()
     - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure
     - ipmi: ssif_bmc: fix message desynchronization after truncated response
     - ipmi: ssif_bmc: change log level to dbg in irq callback
     - perf evsel: Add alternate_hw_config and use in evsel__match
     - perf tool_pmu: Factor tool events into their own PMU
     - perf python: Add parse_events function
     - perf cgroup: Update metric leader in evlist__expand_cgroup
     - perf maps: Fix copy_from that can break sorted by name order
     - perf util: Kill die() prototype, dead for a long time
     - reset: replace boolean parameters with flags parameter
     - reset: Add devres helpers to request pre-deasserted reset controls
     - i3c: master: dw-i3c: Fix missing reset assertion in remove() callback
     - i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers()
     - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status
     - backlight: sky81452-backlight: Check return value of
       devm_gpiod_get_optional() in sky81452_bl_parse_dt()
     - platform/surface: surfacepro3_button: Drop wakeup source on remove
     - leds: lgm-sso: Remove duplicate assignments for priv->mmap
     - tty: hvc_iucv: fix off-by-one in number of supported devices
     - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup
     - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata()
     - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist()
     - [amd64] platform/x86: asus-wmi: adjust screenpad power/brightness handling
     - [amd64] platform/x86: asus-wmi: fix screenpad brightness range
     - tty: serial: ip22zilog: Fix section mispatch warning
     - fs/ntfs3: terminate the cached volume label after UTF-8 conversion
     - [amd64] platform/x86: dell_rbu: avoid uninit value usage in
       packet_size_write()
     - [amd64] platform/x86: dell-wmi-sysman: bound enumeration string
       aggregation
     - RDMA/core: Prefer NLA_NUL_STRING
     - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source
     - scsi: sg: Fix sysctl sg-big-buff register during sg_init()
     - scsi: sg: Resolve soft lockup issue when opening /dev/sgX
     - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from
       byte_div_clk_src dividers
     - clk: qcom: dispcc-sm4450: Fix DSI byte clock rate setting
     - scsi: target: core: Fix integer overflow in UNMAP bounds check
     - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs
     - clk: qcom: gcc-sc8180x: Add missing GDSCs
     - clk: qcom: gcc-sc8180x: Use retention for USB power domains
     - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains
     - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk
     - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks
     - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed()
     - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels()
     - clk: imx8mq: Correct the CSI PHY sels
     - [amd64] x86/um/vdso: Drop VDSO64-y from Makefile
     - clk: qoriq: avoid format string warning
     - clk: xgene: Fix mapping leak in xgene_pllclk_init()
     - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets
     - clk: qcom: dispcc-sc7180: Add missing MDSS resets
     - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug()
     - clk: qcom: gcc-x1e80100: Keep GCC USB QTB clock always ON
     - clk: visconti: pll: initialize clk_init_data to zero
     - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()
     - [amd64] drm/i915: Relocate the SKL wm sanitation code
     - [amd64] drm/i915/wm: Verify the correct plane DDB entry
     - crypto: sa2ul - Fix AEAD fallback algorithm names
     - crypto: ccp - copy IV using skcipher ivsize
     - erofs: add encoded extent on-disk definition
     - erofs: do sanity check on m->type in z_erofs_load_compact_lcluster()
     - erofs: avoid infinite loops due to corrupted subpage compact indexes
       (CVE-2025-68251)
     - erofs: unify lcn as u64 for 32-bit platforms
     - [arm64] dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mp-navqp: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT
     - PCMCIA: Fix garbled log messages for KERN_CONT
     - [arm64] dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT
     - [arm64] dts: marvell: armada-37xx: use 'usb2-phy' in USB3 controller's
       phy-names
     - net/sched: act_mirred: fix wrong device for mac_header_xmit check in
       tcf_blockcast_redir
     - macvlan: fix macvlan_get_size() not reserving space for
       IFLA_MACVLAN_BC_CUTOFF
     - net/sched: sch_cake: fix NAT destination port not being updated in
       cake_update_flowkeys
     - nexthop: fix IPv6 route referencing IPv4 nexthop
     - net/sched: taprio: fix use-after-free in advance_sched() on schedule
       switch
     - tcp: add data-race annotations around tp->data_segs_out and
       tp->total_retrans
     - tcp: add data-race annotations for TCP_NLA_SNDQ_SIZE
     - tcp: annotate data-races around tp->bytes_sent
     - tcp: annotate data-races around tp->bytes_retrans
     - tcp: annotate data-races around tp->dsack_dups
     - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt)
     - tcp: annotate data-races around tp->plb_rehash
     - ice: update PCS latency settings for E825 10G/25Gb modes
     - ice: Remove jumbo_remove step from TX path
     - ice: fix double-free of tx_buf skb
     - ice: fix ICE_AQ_LINK_SPEED_M for 200G
     - i40e: don't advertise IFF_SUPP_NOFCS
     - e1000e: Unroll PTP in probe error handling
     - ipv6: fix possible UAF in icmpv6_rcv()
     - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
     - pppoe: drop PFC frames
     - net/mlx5: Fix HCA caps leak on notifier init failure
     - openvswitch: cap upcall PID array size and pre-size vport replies
     - netfilter: nft_osf: restrict it to ipv4
     - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
     - netfilter: conntrack: remove sprintf usage
     - netfilter: xtables: restrict several matches to inet family
     - ipvs: fix MTU check for GSO packets in tunnel mode
     - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
     - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
     - slip: reject VJ receive packets on instances with no rstate array
     - slip: bound decode() reads against the compressed packet length
     - [arm64] dts: meson-gxl-p230: fix ethernet PHY interrupt number
     - pwm: atmel-tcb: Cache clock rates and mark chip as atomic
     - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy()
     - ksmbd: destroy async_ida in ksmbd_conn_free()
     - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open
     - ksmbd: scope conn->binding slowpath to bound sessions only
     - net/rds: zero per-item info buffer before handing it to visitors
     - ice: fix timestamp interrupt configuration for E825C
     - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g
     - net_sched: sch_hhf: annotate data-races in hhf_dump_stats()
     - net/sched: sch_pie: annotate data-races in pie_dump_stats()
     - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats()
     - net/sched: sch_red: annotate data-races in red_dump_stats()
     - net/sched: sch_sfb: annotate data-races in sfb_dump_stats()
     - net: dsa: realtek: rtl8365mb: fix mode mask calculation
     - net: airoha: Move ndesc initialization at end of
       airoha_qdma_init_rx_queue()
     - virtio_net: Split struct virtio_net_rss_config
     - virtio_net: Fix endian with virtio_net_ctrl_rss
     - virtio_net: Use new RSS config structs
     - virtio_net: sync rss_trailer.max_tx_vq on queue_pairs change via
       VQ_PAIRS_SET
     - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls
     - tipc: fix double-free in tipc_buf_append()
     - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()
     - fs/adfs: validate nzones in adfs_validate_bblk()
     - rtc: abx80x: Disable alarm feature if no interrupt attached
     - kbuild: builddeb - avoid recompiles for non-cross-compiles
     - fbdev: offb: fix PCI device reference leak on probe failure
     - mailbox: mtk-cmdq: Fix CURR and END addr for task insert case
     - mailbox: mailbox-test: free channels on probe error
     - cgroup/rdma: fix integer overflow in rdmacg_try_charge()
     - mailbox: add sanity check for channel array
     - mailbox: mailbox-test: don't free the reused channel
     - mailbox: mailbox-test: initialize struct earlier
     - mailbox: mailbox-test: make data_ready a per-instance variable
     - fsnotify: fix inode reference leak in fsnotify_recalc_mask()
     - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent()
     - cgroup: Increment nr_dying_subsys_* from rmdir context
     - tracing: branch: Fix inverted check on stat tracer registration
     - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
     - netfilter: arp_tables: fix IEEE1394 ARP payload parsing
     - nvme-pci: fix missed admin queue sq doorbell write
     - drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM
     - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG
     - drm/amdgpu: fix spelling typos
     - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated
     - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2)
     - netfilter: xt_policy: fix strict mode inbound policy matching
     - netfilter: nf_conntrack_sip: don't use simple_strtoul
     - [amd64] ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED
     - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ
     - drm/sysfb: ofdrm: fix PCI device reference leaks
     - arm64/scs: Fix potential sign extension issue of advance_loc4
     - cdrom, scsi: sr: propagate read-only status to block layer via
       set_disk_ro()
     - netdevsim: zero initialize struct iphdr in dummy sk_buff
     - net/sched: netem: fix probability gaps in 4-state loss model
     - net/sched: netem: fix queue limit check to include reordered packets
     - net/sched: netem: only reseed PRNG when seed is explicitly provided
     - net/sched: netem: validate slot configuration
     - net/sched: netem: fix slot delay calculation overflow
     - net/sched: netem: check for negative latency and jitter
     - net/sched: sch_choke: annotate data-races in choke_dump_stats()
     - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats()
     - vrf: Fix a potential NPD when removing a port from a VRF
     - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
     - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit
     - NFC: trf7970a: Ignore antenna noise when checking for RF field
     - net/sched: taprio: fix NULL pointer dereference in class dump
     - neigh: let neigh_xmit take skb ownership
     - tcp: make probe0 timer handle expired user timeout
     - net, treewide: define and use MAC_ADDR_STR_LEN
     - netconsole: allow selection of egress interface via MAC address
     - netpoll: Extract carrier wait function
     - netpoll: extract IPv4 address retrieval into helper function
     - netpoll: fix IPv6 local-address corruption
     - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams
     - sched/fair: Clear rel_deadline when initializing forked entities
     - net: mctp i2c: check length before marking flow active
     - net: phy: dp83869: fix setting CLK_O_SEL field.
     - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings
     - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings
     - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings
     - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring
     - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring
     - drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring
     - ASoC: codecs: ab8500: Fix casting of private data
     - netfilter: skip recording stale or retransmitted INIT
     - sctp: discard stale INIT after handshake completion
     - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()
     - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V)
     - netconsole: propagate device name truncation in dev_name_store()
     - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87
     - ALSA: hda/conexant: Fix missing error check for jack detection
     - ALSA: hda: cs35l56: Fix uninitialized value in cs35l56_hda_read_acpi()
     - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup
     - drm/amd/display: Allow DCE link encoder without AUX registers
     - drm/amd/display: Read EDID from VBIOS embedded panel info
     - drm/xe/debugfs: Correct printing of register whitelist ranges
     - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()
     - drm/xe/gsc: Fix BO leak on error in query_compatibility_version()
     - page_pool: Set `dma_sync` to false for devmem memory provider
     - net: page_pool: create hooks for custom memory providers
     - page_pool: fix memory-provider leak in page_pool_create_percpu() error
       path
     - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING
     - iavf: stop removing VLAN filters from PF on interface down
     - iavf: wait for PF confirmation before removing VLAN filters
     - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler
     - ice: fix NULL pointer dereference in ice_reset_all_vfs()
     - net: tls: fix strparser anchor skb leak on offload RX setup failure
     - sfc: fix error code in efx_devlink_info_running_versions()
     - net/sched: cls_flower: revert unintended changes
     - [arm64] Reserve an extra page for early kernel mapping
     - smb: client: correctly handle ErrorContextData as a flexible array
     - smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)
     - LoongArch: KVM: Compile switch.S directly into the kernel
     - ntfs: ->d_compare() must not block
     - PCI: Initialize temporary device in new_id_store()
     - net: bcmgenet: Initialize u64 stats seq counter
     - net: bcmgenet: fix leaking free_bds
     - [amd64] iommu/amd: Reorder attach device code
     - [amd64] iommu/amd: Put list_add/del(dev_data) back under the domain->lock
     - perf tool_pmu: Fix aggregation on duration_time
     - net/sched: sch_pie: annotate more data-races in pie_dump_stats()
     - netpoll: Extract IPv6 address retrieval function
     - netpoll: pass buffer size to egress_dev() to avoid MAC truncation
     - page_pool: fix incorrect mp_ops error handling
     - crypto: af_alg - Cap AEAD AD length to 0x80000000
     - i40e: Cleanup PTP pins on probe failure
     - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path
     - netfilter: nf_conntrack_sip: get helper before allocating expectation
     - audit: fix incorrect inheritable capability in CAPSET records
     - Revert "ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to
       warn"
     - netfilter: nft_ct: fix missing expect put in obj eval
     - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled
     - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV
     - KVM: Reject wrapped offset in kvm_reset_dirty_gfn()
     - [s390x] KVM: s390: pci: fix GAIT table indexing due to double-scaling
       pointer arithmetic
     - [amd64] KVM: x86: Fix Xen hypercall tracepoint argument assignment
     - netfilter: nf_tables: unconditionally bump set->nelems before insertion
       (CVE-2026-23272)
     - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands
     - smb/client: fix possible infinite loop and oob read in symlink_data()
     - [amd64] drm/i915/dp: Fix VSC dynamic range signaling for RGB formats
     - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans
     - ALSA: usb-audio: Bound MIDI endpoint descriptor scans
     - ceph: fix a buffer leak in __ceph_setxattr()
     - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size
     - io-wq: check that the predecessor is hashed in io_wq_remove_pending()
     - [powerpc*] warp: Fix error handling in pika_dtm_thread
     - netfs: fix error handling in netfs_extract_user_iter()
     - irqchip/riscv-imsic: Clear interrupt move state during CPU offlining
     - libceph: Fix potential out-of-bounds access in osdmap_decode()
     - libceph: Fix potential null-ptr-deref in decode_choose_args()
     - libceph: Fix potential out-of-bounds access in crush_decode()
     - libceph: handle rbtree insertion error in decode_choose_args()
     - [amd64] iommu/vt-d: Disable DMAR for Intel Q35 IGFX
     - [amd64] drm/i915: skip __i915_request_skip() for already signaled requests
     - drm/panfrost: Fix wait_bo ioctl leaking positive return from
       dma_resv_wait_timeout()
     - drm/xe/dma-buf: handle empty bo and UAF races
     - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup
     - drm/gma500/oaktrail_lvds: fix hang on init failure
     - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init
     - iommufd: Fix return value of iommufd_fault_fops_write()
     - eventfs: Use list_add_tail_rcu() for SRCU-protected children list
     - drm/v3d: Reject empty multisync extension to prevent infinite loop
     - btrfs: use inode already stored in local variable at btrfs_rmdir()
     - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of
       BTRFS_I()
     - btrfs: fix missing last_unlink_trans update when removing a directory
     - smb: client: Use FullSessionKey for AES-256 encryption key derivation
     - btrfs: do not mark inode incompressible after inline attempt fails
     - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
     - sched_ext: Guard scx_dsq_move() against NULL kit->dsq after failed
       iter_new
     - mptcp: pm: prio: skip closed subflows
     - mptcp: drop __mptcp_fastopen_gen_msk_ackseq()
     - mptcp: fix rx timestamp corruption on fastopen
     - f2fs: fix incorrect file address mapping when inline inode is unwritten
     - f2fs: fix false alarm of lockdep on cp_global_sem lock
     - spi: sifive: Simplify clock handling with devm_clk_get_enabled()
     - spi: sifive: fix controller deregistration
     - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0
     - mptcp: pm: ADD_ADDR rtx: fix potential data-race
     - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker
     - netfs: Fix potential uninitialised var in netfs_extract_user_iter()
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.92
     - mptcp: sync the msk->sndbuf at accept() time
     - mptcp: pm: ADD_ADDR rtx: allow ID 0
     - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (CVE-2026-46158)
     - mptcp: pm: ADD_ADDR rtx: free sk if last (CVE-2026-46170)
     - ksmbd: validate owner of durable handle on reconnect (CVE-2026-31717)
     - drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status()
       (CVE-2026-46216)
     - [s390x] debug: Reject zero-length input before trimming a newline
     - Revert "perf cgroup: Update metric leader in evlist__expand_cgroup"
     - Revert "perf tool_pmu: Fix aggregation on duration_time"
     - Revert "perf python: Add parse_events function"
     - Revert "perf tool_pmu: Factor tool events into their own PMU"
     - bridge: mrp: reject zero test interval to avoid OOM panic (CVE-2026-31420)
     - spi: spi-dw-dma: fix print error log when wait finish transaction
       (CVE-2026-31560)
     - Revert "x86/vdso: Fix output operand size of RDPID"
     - sched/deadline: Less agressive dl_server handling
     - sched/deadline: Fix dl_server_stopped()
     - sched/deadline: Fix dl_server getting stuck
     - sched/deadline: Fix dl_server behaviour
     - sched/deadline: Stop dl_server before CPU goes offline
     - ksmbd: close durable scavenger races against m_fp_list lookups
     - af_unix: Give up GC if MSG_PEEK intervened. (CVE-2026-23394)
     - drm/imagination: Synchronize interrupts before suspending the GPU
       (CVE-2026-23469)
     - ata: libata-scsi: improve readability of ata_scsi_qc_issue()
     - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT
     - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS
     - ata: libata-scsi: do not needlessly defer commands when using PMP with FBS
     - perf parse-events: Expose/rename config_term_name
     - Revert "ice: fix double-free of tx_buf skb"
     - Revert "ice: Remove jumbo_remove step from TX path"
     - tracing: Fix the bug where bpf_get_stackid returns -EFAULT on the ARM64
     - net/mlx5e: Trigger neighbor resolution for unresolved destinations
     - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init
     - [amd64] x86/fgraph: Fix return_to_handler regs.rsp value
     - [amd64] iommu/vt-d: Draining PRQ in sva unbind path when FPD bit set
     - [riscv64] fgraph: Select HAVE_FUNCTION_GRAPH_TRACER depends on
       HAVE_DYNAMIC_FTRACE_WITH_ARGS
     - [riscv64] fgraph: Fix stack layout to match __arch_ftrace_regs argument of
       ftrace_return_to_handler (CVE-2025-22069)
     - hwmon: (pmbus/core) Protect regulator operations with mutex
     - [arm64] Kconfig: Remove selecting replaced HAVE_FUNCTION_GRAPH_RETVAL
     - sysfs: don't remove existing directory on update failure
     - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()
     - ksmbd: fix null pointer dereference in compare_guid_key()
     - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow
     - ksmbd: validate SID in parent security descriptor during ACL inheritance
     - smb: client: require net admin for CIFS SWN netlink
     - smb: client: protect tc_count increment in
       smb2_find_smb_sess_tcon_unlocked()
     - smb: client: use data_len for SMB2 READ encrypted folioq copy
     - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close
     - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX
     - ALSA: ua101: Reject too-short USB descriptors
     - ALSA: pcm: Don't setup bogus iov_iter for silencing
     - ALSA: asihpi: Fix potential OOB array access at reading cache
     - efi: Allocate runtime workqueue before ACPI init
     - io_uring/waitid: clear waitid info before copying it to userspace
     - drivers/base/memory: fix memory block reference leak in poison accounting
     - ipv6: ioam: refresh hdr pointer before ioam6_event()
     - mm/memory_hotplug: fix memory block reference leak on remove
     - net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
     - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
     - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START
     - Bluetooth: bnep: Fix UAF read of dev->name
     - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths
     - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer
     - Bluetooth: MGMT: validate Add Extended Advertising Data length
     - Bluetooth: serialize accept_q access
     - phonet/pep: disable BH around forwarded sk_receive_skb()
     - net: bcmgenet: keep RBUF EEE/PM disabled
     - net: ifb: report ethtool stats over num_tx_queues
     - net: pse-pd: fix sign on -ENOENT check in of_load_pse_pis()
     - netfilter: ip6t_hbh: reject oversized option lists
     - netfilter: nf_queue: hold bridge skb->dev while queued
     - netfilter: ipset: stop hash:* range iteration at end
     - netfilter: nft_inner: Fix IPv6 inner_thoff desync
     - sched_ext: Fix missing warning in scx_set_task_state() default case
     - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path
     - cgroup/cpuset: Reset DL migration state on can_attach() failure
     - fs/ntfs3: handle attr_set_size() errors when truncating files
     - l2tp: use list_del_rcu in l2tp_session_unhash
     - qed: fix double free in qed_cxt_tables_alloc()
     - ring-buffer: Fix reporting of missed events in iterator
     - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
     - vsock/vmci: fix UAF when peer resets connection during handshake
     - vsock/virtio: reset connection on receiving queue overflow
     - wifi: ath11k: clear shared SRNG pointer state on restart
     - ipv4: raw: reject IP_HDRINCL packets with ihl < 5
     - ixgbevf: fix use-after-free in VEPA multicast source pruning
     - rbd: eliminate a race in lock_dwork draining on unmap
     - lsm: hold cred_guard_mutex for lsm_set_self_attr()
     - [arm64] octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
     - ice: fix setting promisc mode while adding VID filter
     - ice: restore PTP Rx timestamp config after ethtool set-channels
     - wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
     - af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
     - wifi: mac80211: consume only present negotiated TTLM maps
     - cifs: Fix busy dentry used after unmounting
     - tracing: Do not call map->ops->elt_free() if elt_alloc() fails
     - [arm64] probes: Handle probes on hinted conditional branch instructions
     - [arm64] KVM: arm64: vgic-its: Reject restored DTE with out-of-range
       num_eventid_bits
     - [arm64] KVM: arm64: vgic: Free private_irqs when init fails after
       allocation
     - [riscv64] kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem() when
       OOM
     - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe
     - spi: qup: fix error pointer deref after DMA setup failure
     - [arm64] phy: tegra: xusb: Fix per-pad high-speed termination calibration
     - scsi: isci: Fix use-after-free in device removal path
     - spi: ep93xx: fix error pointer deref after DMA setup failure
     - spi: sprd: fix error pointer deref after DMA setup failure
     - spi: ti-qspi: fix use-after-free after DMA setup failure
     - RDMA/siw: Reject MPA FPDU length underflow before signed receive math
     - device property: set fwnode->secondary to NULL in fwnode_init()
     - drm/virtio: use uninterruptible resv lock for plane updates
     - drm/amdgpu/vpe: Force collaborate sync after TRAP
     - drm/bridge: it66121: acquire reset GPIO in probe
     - drm/bridge: megachips: remove bridge when irq request fails
     - drm/amd/display: Fix integer overflow in bios_get_image()
     - drm/amd/display: Validate GPIO pin LUT table size before iterating
     - drm/amd/display: Validate payload length and link_index in
       dc_process_dmub_aux_transfer_async
     - batman-adv: mcast: fix use-after-free in orig_node RCU release
     - batman-adv: clear current gateway during teardown
     - batman-adv: dat: handle forward allocation error
     - batman-adv: fix fragment reassembly length accounting
     - batman-adv: fix tp_meter counter underflow during shutdown
     - batman-adv: frag: disallow unicast fragment in fragment
     - batman-adv: bla: fix report_work leak on backbone_gw purge
     - batman-adv: tp_meter: avoid use of uninit sender vars
     - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown
     - batman-adv: tp_meter: fix race condition in send error reporting
     - batman-adv: tt: fix negative last_changeset_len
     - batman-adv: tt: fix negative tt_buff_len
     - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
     - hwmon: (pmbus/adm1266) reject implausible blackbox record_count
     - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer
     - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized
       buffer
     - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR
     - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in
       get_multiple
     - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()
     - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()
     - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO
       accessors
     - [arm64] pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset for
       high pins during suspend/resume
     - HID: uclogic: Fix regression of input name assignment
     - [riscv64] mm: Fixup no5lvl failure when vaddr is invalid
     - [arm64] pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for
       sm8150
     - ALSA: hda: cs35l56: Put ACPI device after setting companion
     - ALSA: hda: cs35l41: Put ACPI device on missing physical node
     - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()
     - netfilter: x_tables: unregister the templates first
     - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist()
     - tcp: Fix imbalanced icsk_accept_queue count.
     - ice: fix setting RSS VSI hash for E830
     - ice: fix locking in ice_dcb_rebuild()
     - net: lan966x: avoid unregistering netdev on register failure
     - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register
       access
     - NFSD: Fix infinite loop in layout state revocation
     - irqchip/ath79-cpu: Remove unused function
     - ublk: reject max_sectors smaller than PAGE_SECTORS in parameter validation
     - nsfs: fix wrong error code returned for pidns ioctls
     - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
     - zonefs: handle integer overflow in zonefs_fname_to_fno
     - tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().
     - [powerpc*] fix dead default for GUEST_STATE_BUFFER_TEST
     - netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call
     - netfs: Fix overrun check in netfs_extract_user_iter()
     - netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone
     - netfs: Defer the emission of trace_netfs_folio()
     - netfs: Fix streaming write being overwritten
     - netfs: Fix potential deadlock in write-through mode
     - netfs: Fix write streaming disablement if fd open O_RDWR
     - netfs: Fix early put of sink folio in netfs_read_gaps()
     - netfs: Fix partial invalidation of streaming-write folio
     - netfs: Fix a few minor bugs in netfs_page_mkwrite()
     - netfs: Remove unnecessary references to pages
     - netfs: Fix folio->private handling in netfs_perform_write()
     - net: ethernet: cortina: Make RX SKB per-port
     - net: ethernet: cortina: Drop half-assembled SKB
     - net: ethernet: cortina: Carry over frag counter
     - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference
     - wifi: ath11k: fix error path leaks in some WMI WOW calls
     - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
     - wifi: ath10k: skip WMI and beacon transmission when device is wedged
     - blk-integrity: remove seed for user mapped buffers
     - block: don't overwrite bip_vcnt in bio_integrity_copy_user()
     - block: recompute nr_integrity_segments in blk_insert_cloned_request
     - HID: quirks: really enable the intended work around for appledisplay
     - block: modify bio_integrity_map_user to accept iov_iter as argument
     - block: drop direction param from bio_integrity_copy_user()
     - blk-integrity: use simpler alignment check
     - blk-integrity: enable p2p source and destination
     - block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()
     - accel/qaic: Add overflow check to remap_pfn_range during mmap
     - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint
     - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
     - [arm64] drm/msm/dsi: don't dump registers past the mapped region
     - [arm64] drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN
     - [powerpc*] time: Remove redundant preempt_disable|enable() calls from
       arch_irq_work_raise()
     - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
     - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
     - net: tls: prevent chain-after-chain in plain text SG
     - net: phy: DP83TC811: add reading of abilities
     - [amd64] x86/xen: Fix xen_e820_swap_entry_with_ram()
     - tls: Preserve sk_err across recvmsg() when data has been copied
     - net/mlx5: Do not restore destination-less TC rules
     - scsi: sd: Fix return code handling in sd_spinup_disk()
     - ALSA: scarlett2: Add missing error check when initialise Autogain Status
     - io_uring/net: punt IORING_OP_BIND async if it needs file create
     - btrfs: fix squota accounting during enable generation
     - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
     - [arm64] drm/msm/snapshot: fix dumping of the unaligned regions
     - drm/xe/gsc: Fix double-free of managed BO in error path
     - drm/xe/vf: Fix signature of print functions
     - drm/xe/pf: Fix CFI failure in debugfs access
     - wifi: ath11k: fix peer resolution on rx path when peer_id=0
     - ice: ptp: serialize E825 PHY timer start with PTP lock
     - [amd64] drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP
     - [arm64] net: dsa: mt7530: fix FDB entries not aging out with short timeout
     - [arm64] net: dsa: mt7530: preserve VLAN tags on trapped link-local frames
     - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
     - platform/surface: aggregator_registry: omit battery & AC nodes on Surface
       Laptop 7
     - [amd64] platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
     - [amd64] platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
     - [amd64] platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
     - [amd64] platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
     - RDMA/rtrs: Fix use-after-free in path file creation cleanup
     - net: bridge: Flush multicast groups when snooping is disabled
     - bridge: mcast: Fix a possible use-after-free when removing a bridge port
     - pds_core: fix error handling in pdsc_devcmd_wait
     - pds_core: fix debugfs_lookup dentry leak and error handling
     - wifi: mac80211: fix MLE defragmentation
     - ALSA: seq: Serialize UMP output teardown with event_input
     - tracing: Avoid NULL return from hist_field_name() on truncation
     - Bluetooth: btmtk: fix urb->setup_packet leak in error paths
     - net: ag71xx: check error for platform_get_irq
     - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
     - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n)
     - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed
     - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
     - drm/xe/oa: Fix exec_queue leak on width check in stream open
     - [arm64] octeontx2-af: npc: Fix allmulticast skip logic for LBK and SDP VFs
     - net: mana: validate rx_req_idx to prevent out-of-bounds array access
     - pds_core: ensure null-termination for firmware version strings
     - net: gro: don't merge zcopy skbs
     - landlock: Fix TCP handling of short AF_UNSPEC addresses
     - block: make bio_integrity_map_user() static inline
     - security/keys: fix missed RCU read section on lookup
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.93
     - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
     - [arm64] drm/v3d: Fix use-after-free of CPU job query arrays on error path
     - [arm64] drm/v3d: Release indirect CSD GEM reference on CPU job free
     - net/sched: cls_fw: fix NULL dereference of "old" filters before change()
     - net: mctp: ensure our nlmsg responses are initialised (CVE-2026-45930)
     - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
     - net/sched: sch_sfb: Replace direct dequeue call with peek and
       qdisc_dequeue_peeked
     - bcache: fix uninitialized closure object
     - net: cpsw_new: Fix potential unregister of netdev that has not been
       registered yet (CVE-2026-43219)
     - [arm64] Introduce esr_is_ubsan_brk()
     - [arm64] debug: clean up single_step_handler logic
     - [arm64] refactor aarch32_break_handler()
     - [arm64] debug: call software breakpoint handlers statically
     - [arm64] debug: call step handlers statically
     - [arm64] debug: remove break/step handler registration infrastructure
     - [arm64] entry: Add entry and exit functions for debug exceptions
     - [arm64] debug: split hardware breakpoint exception entry
     - [arm64] debug: refactor reinstall_suspended_bps()
     - [arm64] debug: split single stepping exception entry
     - [arm64] debug: split hardware watchpoint exception entry
     - [arm64] debug: split brk64 exception entry
     - [arm64] debug: split bkpt32 exception entry
     - [arm64] debug: remove debug exception registration infrastructure
     - [arm64] debug: always unmask interrupts in el0_softstp()
     - nfc: llcp: Fix use-after-free in llcp_sock_release()
     - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
     - xfrm: Check for underflow in xfrm_state_mtu
     - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
     - netfilter: synproxy: refresh tcphdr after skb_ensure_writable
     - netfilter: xt_cpu: prefer raw_smp_processor_id
     - netfilter: ebtables: fix OOB read in compat_mtw_from_user
     - tun: free page on short-frame rejection in tun_xdp_one() (CVE-2026-46321)
     - tun: free page on build_skb failure in tun_xdp_one() (CVE-2026-46322)
     - vsock: keep poll shutdown state consistent
     - net: netlink: fix sending unassigned nsid after assigned one
     - net: netlink: don't set nsid on local notifications
     - net/smc: Do not re-initialize smc hashtables
     - [s390x] net/iucv: fix locking in .getsockopt
     - scsi: core: Run queues for all non-SDEV_DEL devices from
       scsi_run_host_queues
     - ipv4: free net->ipv4.sysctl_local_reserved_ports after
       unregister_net_sysctl_table()
     - ALSA: pcm: oss: Fix setup list UAF on proc write error
     - [amd64] ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
     - net: hsr: fix potential OOB access in supervision frame handling
     - [amd64] accel/ivpu: prevent uninitialized data bug in debugfs
     - gpio: mxc: fix irq_high handling
     - net: Avoid checksumming unreadable skb tail on trim
     - ethtool: rss: fix hkey leak when indir_size is 0
     - ethtool: module: avoid leaking a netdev ref on module flash errors
     - ethtool: module: check fw_flash_in_progress under rtnl_lock
     - ethtool: module: fix cleanup if socket used for flashing multiple devices
     - ethtool: cmis: require exact CDB reply length
     - ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
     - net: ethtool: Add new parameters and a function to support EPL
     - net: ethtool: Add support for writing firmware blocks using EPL payload
     - ethtool: cmis: validate start_cmd_payload_size from module
     - ethtool: cmis: validate fw->size against start_cmd_payload_size
     - tunnels: load network headers after skb_cow() in
       iptunnel_pmtud_build_icmp[v6]()
     - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
     - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
     - ASoC: codecs: simple-mux: Fix enum control bounds check
     - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
     - bonding: refuse to enslave CAN devices
     - ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES
     - ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup
       error
     - ethtool: pse-pd: fix missing ethnl_ops_complete()
     - ethtool: strset: fix header attribute index in ethnl_req_get_phydev()
     - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during
       fallback
     - ethtool: eeprom: add more safeties to EEPROM Netlink fallback
     - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
     - net/sched: Revert "net/sched: Restrict conditions for adding duplicating
       netems to qdisc tree"
     - net/sched: fix packet loop on netem when duplicate is on
     - net/sched: act_mirred: Move the recursion counter struct netdev_xmit
     - net/sched: act_mirred: add loop detection
     - net: Introduce skb tc depth field to track packet loops
     - net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop
     - net/sched: act_mirred: Fix return code in early mirred redirect error
       paths
     - net/handshake: Use spin_lock_bh for hn_lock
     - nvme-tcp: store negative errno in queue->tls_err
     - net/handshake: Pass negative errno through handshake_complete()
     - remove pointless includes of <linux/fdtable.h>
     - net/handshake: Take a long-lived file reference at submit
     - net/handshake: Drain pending requests at net namespace exit
     - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
     - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
     - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
     - [arm64,armhf] gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
     - [amd64,arm64] net: mana: Add NULL guards in teardown path to prevent panic
       on attach failure
     - sctp: fix race between sctp_wait_for_connect and peeloff
     - ipv6: fix possible infinite loop in rt6_fill_node()
     - ipv6: fix possible infinite loop in fib6_select_path()
     - net: skbuff: fix pskb_carve leaking zcopy pages
     - perf: Fix dangling cgroup pointer in cpuctx
     - batman-adv: v: stop OGMv2 on disabled interface
     - batman-adv: tvlv: abort OGM send on tvlv append failure
     - batman-adv: tt: reject oversized local TVLV buffers
     - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
     - batman-adv: tvlv: reject oversized TVLV packets
     - batman-adv: iv: recover OGM scheduling after forward packet error
     - batman-adv: tp_meter: avoid role confusion in tp_list
     - [s390x] cio: Restore GFP_DMA for CHSC allocation
     - batman-adv: tp_meter: directly shut down timer on cleanup
     - batman-adv: tt: fix TOCTOU race for reported vlans
     - batman-adv: tt: avoid empty VLAN responses
     - batman-adv: bla: avoid double decrement of bla.num_requests
     - mm/page_alloc: clear page->private in free_pages_prepare()
       (CVE-2026-43303)
     - media: rc: fix race between unregister and urb/irq callbacks
     - media: rc: ttusbir: fix inverted error logic
     - inet: frags: add inet_frag_queue_flush()
     - inet: frags: flush pending skbs in fqdir_pre_exit() (CVE-2025-68768)
     - HID: core: Add printk_ratelimited variants to hid_warn() etc
     - HID: pass the buffer size to hid_report_raw_event
     - HID: core: introduce hid_safe_input_report()
     - HID: core: Fix size_t specifier in hid_report_raw_event()
     - [amd64] drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD
       register
     - [amd64] drm/i915/psr: Read Intel DPCD workaround register
     - drm/dp: Add eDP 1.5 bit definition
     - [amd64] drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line
       used
     - [arm64] io: Rename ioremap_prot() to __ioremap_prot()
     - [arm64] io: Extract user memory type in ioremap_prot() (CVE-2026-23346)
     - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X
     - batman-adv: tt: prevent TVLV entry number overflow
     - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
     - usb: typec: ucsi: ccg: reject firmware images without a ':' record header
     - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
     - usb: typec: tcpm: bound altmode_desc[] per iteration in
       svdm_consume_modes()
     - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO
     - usb: typec: altmodes/displayport: validate count before reading Status
       Update VDO
     - usb: typec: wcove: don't write past struct pd_message in
       wcove_read_rx_buffer()
     - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT
     - usb: typec: ucsi: validate connector number in ucsi_connector_change()
     - USB: serial: safe_serial: fix memory corruption with small endpoint
     - media: rc: igorplugusb: fix control request setup packet
     - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()
     - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
     - Bluetooth: btusb: Allow firmware re-download when version matches
     - hpfs: fix a crash if hpfs_map_dnode_bitmap fails
     - ipc: limit next_id allocation to the valid ID range
     - auxdisplay: line-display: fix OOB read on zero-length message_store()
     - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
     - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
     - Bluetooth: HIDP: fix missing length checks in hidp_input_report()
     - Bluetooth: ISO: fix UAF in iso_recv_frame
     - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
     - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
     - Input: xpad - fix out-of-bounds access for Share button
     - parport: Fix race between port and client registration (Closes: #1130365)
     - USB: cdc-acm: Fix bit overlap and move quirk definitions to header
     - [arm64] KVM: arm64: PMU: Preserve AArch32 counter low bits
     - [amd64] KVM: SVM: Flush the current TLB when transitioning from xAVIC =>
       x2AVIC
     - [amd64] KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
     - [amd64] KVM: SEV: Use the size of the PSC header as the minimum size for
       PSC requests
     - [amd64] KVM: SEV: WARN if KVM attempts to setup scratch area with
       min_len==0
     - [amd64] KVM: SEV: Compute the correct max length of the in-GHCB scratch
       area
     - [amd64] KVM: SEV: Check PSC request indices against the actual size of the
       buffer
     - [amd64] KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC
       buffer
     - [amd64] KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
     - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux
     - iio: adc: npcm: fix unbalanced clk_disable_unprepare()
     - iio: dac: max5821: fix return value check in powerdown sync
     - iio: dac: ad5686: fix input raw value check
     - iio: dac: ad5686: acquire lock when doing powerdown control
     - iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
     - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
     - iio: gyro: itg3200: fix i2c read into the wrong stack location
     - iio: gyro: adis16260: fix division by zero in write_raw
     - iio: ssp_sensors: cancel delayed work_refresh on remove
     - iio: temperature: tsys01: fix broken PROM checksum validation
     - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL
     - iio: light: cm3323: fix reg_conf not being initialized correctly
     - iio: buffer: hw-consumer: fix use-after-free in error path
     - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
     - USB: serial: omninet: fix memory corruption with small endpoint
     - usb: cdns3: gadget: fix request skipping after clearing halt
     - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy
       acquisition failure
     - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently
       leaks the runtime PM usage counter across bind/unbind cycles
     - usb: dwc2: Fix use after free in debug code
     - Input: elan_i2c - validate firmware size before use
     - wireguard: send: append trailer after expanding head
     - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
     - macsec: fix replay protection at XPN lower-PN wrap
     - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
     - [arm64] ASoC: qcom: q6asm-dai: fix error handling in prepare and
       set_params
     - ipv6: exthdrs: refresh nh after handling HAO option
     - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
     - ipv6: validate extension header length before copying to cmsg
     - xfrm: input: hold netns during deferred transport reinjection
     - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
     - ip6: vti: Use ip6_tnl.net in vti6_changelink().
     - net: skbuff: fix missing zerocopy reference in pskb_carve helpers
     - HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
     - nfc: hci: fix out-of-bounds read in HCP header parsing
     - xfrm: route MIGRATE notifications to caller's netns
     - xfrm: ah: use skb_to_full_sk in async output callbacks
     - ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417
     - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without
       direction check
     - [arm64] ASoC: qcom: q6asm-dai: close stream only when running
     - [arm64] ASoC: qcom: q6asm-dai: do not set stream state in event and
       trigger callbacks
     - xfrm: esp: restore combined single-frag length gate
     - Input: xpad - add "Nova 2 Lite" from GameSir
     - Input: xpad - add support for ASUS ROG RAIKIRI II
     - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops
     - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
     - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490
     - [amd64] comedi: comedi_test: fix check for valid scan_begin_src in
       waveform_ai_cmdtest()
     - [amd64] comedi: comedi_test: Fix limiting of convert_arg in
       waveform_ai_cmdtest()
     - counter: Fix refcount leak in counter_alloc() error path
     - tty: serial: pch_uart: add check for dma_alloc_coherent()
     - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
     - usb: chipidea: core: convert ci_role_switch to local variable
     - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval
     - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub
       controllers
     - usb: storage: Add quirks for PNY Elite Portable SSD
     - usbip: vudc: Fix use after free bug in vudc_remove due to race condition
     - usb: usbtmc: check URB actual_length for interrupt-IN notifications
     - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
     - usb: typec: tcpm: improve handling of DISCOVER_MODES failures
     - USB: serial: option: add MeiG SRM813Q
     - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL
     - USB: serial: belkin_sa: validate interrupt status length
     - USB: serial: cypress_m8: validate interrupt packet headers
     - USB: serial: keyspan: fix missing indat transfer sanity check
     - USB: serial: mxuport: fix memory corruption with small endpoint
     - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
     - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind
     - usb: gadget: net2280: Fix double free in probe error path
     - usb: gadget: f_hid: fix device reference leak in hidg_alloc()
     - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
     - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports
     - usb: gadget: f_fs: copy only received bytes on short ep0 read
     - usb: gadget: f_fs: serialize DMABUF cancel against request completion
     - [amd64] thunderbolt: property: Reject u32 wrap in
       tb_property_entry_valid()
     - [amd64] thunderbolt: property: Reject dir_len < 4 to prevent size_t
       underflow
     - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
     - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
     - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
     - scsi: target: iscsi: Validate CHAP_R length before base64 decode
     - drm/hyperv: validate resolution_count and fix WIN8 fallback
     - drm/hyperv: validate VMBus packet size in receive callback
     - [amd64] drm/i915: Fix potential UAF in TTM object purge
     - drm/amd/pm/si: Disregard vblank time when no displays are connected
     - serial: altera_jtaguart: handle uart_add_one_port() failures
     - serial: qcom-geni: fix UART_RX_PAR_EN bit position
     - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion
       IRQ
     - serial: sh-sci: fix memory region release in error path
     - serial: zs: Fix swapped RI/DSR modem line transition counting
     - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma
     - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
     - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger
     - drm/amdkfd: Check for pdd drm file first in CRIU restore path
     - serial: dz: Fix bootconsole message clobbering at chip reset
     - serial: dz: Fix bootconsole handover lockup
     - serial: dz: Convert to use a platform device
     - serial: zs: Fix bootconsole handover lockup
     - serial: zs: Switch to using channel reset
     - serial: zs: Convert to use a platform device
     - USB: serial: cypress_m8: fix memory corruption with small endpoint
     - USB: serial: digi_acceleport: fix memory corruption with small endpoints
     - xhci: tegra: Fix ghost USB device on dual-role port unplug
     - iommu: Skip PASID validation for devices without PASID capability
     - [amd64] x86/boot: Disable stack protector for early boot code
     - [amd64] x86/kexec: Disable KCOV instrumentation after load_segments()
       (CVE-2026-43331)
     - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg
     - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer
     - serdev: Provide a bustype shutdown function
     - Bluetooth: hci_qca: Migrate to serdev specific shutdown function
     - Bluetooth: hci_qca: Convert timeout from jiffies to ms
     - ALSA: scarlett2: Return ENOSPC for out-of-bounds flash writes
     - ALSA: scarlett2: Allow flash writes ending at segment boundary
     - mm/memory: fix spurious warning when unmapping device-private/exclusive
       pages
     - [amd64] platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error
       recovery
     - net: hsr: defer node table free until after RCU readers
     - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient
     - ice: fix VF queue configuration with low MTU values
     - ring-buffer: Flush and stop persistent ring buffer on panic
     - mptcp: cleanup fallback dummy mapping generation
     - mptcp: reset rcv wnd on disconnect
     - [arm64] tlb: Flush walk cache when unsharing PMD tables
     - [arm64] octeontx2-pf: avoid double free of pool->stack on AQ init failure
     - mptcp: introduce the mptcp_init_skb helper
     - mptcp: handle first subflow closing consistently
     - mptcp: do not drop partial packets
     - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
     - iio: chemical: scd30: Use guard(mutex) to allow early returns
     - iio: chemical: scd30: fix division by zero in write_raw
     - iio: dac: ad5686: fix ref bit initialization for single-channel parts
     - ALSA: firewire-motu: Protect register DSP event queue positions
     - [arm64] usb: dwc3: xilinx: fix error handling in zynqmp init error paths
     - usb: musb: omap2430: Fix use-after-free in omap2430_probe()
     - usb: typec: ucsi: Check if power role change actually happened before
       handling
     - [amd64] thunderbolt: property: Cap recursion depth in
       __tb_property_parse_dir()
     - scsi: target: iscsi: Fix CRC overread and double-free in
       iscsit_handle_text_cmd()
     - usb: typec: ucsi: Don't update power_supply on power role change if not
       connected
     - [amd64] x86/alternatives: Rename 'apply_relocation()' to
       'text_poke_apply_relocation()'
     - [amd64] x86/ftrace: Relocate %rip-relative percpu refs in dynamic
       trampolines
     - hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with
       pmbus_lock
     - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock
     - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock
     - mm: perform all memfd seal checks in a single place
     - mm/memfd: fix spelling and grammatical issues
     - memfd: deny writeable mappings when implying SEAL_WRITE
     - usb: core: Fix SuperSpeed root hub wMaxPacketSize
     - ethtool: cmis_cdb: Fix incorrect read / write length extension
     - net/sched: act_mirred: Fix blockcast recursion bypass leading to stack
       overflow
     - [arm64] KVM: arm64: vgic-its: Drop the translation cache reference only
       for the erased entry (CVE-2026-46316)
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.94
     - bpf: Free reuseport cBPF prog after RCU grace period. (CVE-2026-52910)
     - USB: serial: mct_u232: fix memory corruption with small endpoint
     - [armhf] group is_permission_fault() with is_translation_fault()
     - [armhf] allow __do_kernel_fault() to report execution of memory faults
     - [armhf] fix hash_name() fault
     - [armhf] fix branch predictor hardening
     - net: phy: micrel: fix LAN8814 QSGMII soft reset
     - wifi: remove zero-length arrays
     - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
     - ipv6: mcast: Fix use-after-free when processing MLD queries
     - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS
     - [arm64] tee: optee: prevent use-after-free when the client exits before
       the supplicant
     - [arm64]soc: qcom: ice: Return -ENODEV if the ICE platform device is not
       found
     - erofs: add sysfs node to drop internal caches
     - erofs: tidy up synchronous decompression
     - erofs: fix use-after-free on sbi->sync_decompress
     - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
     - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id
     - ipvs: clear the svc scheduler ptr early on edit
     - netfilter: synproxy: add mutex to guard hook reference counting
     - netfilter: conntrack_irc: fix possible out-of-bounds read
     - netfilter: nft_ct: bail out on template ct in get eval
     - netfilter: bridge: make ebt_snat ARP rewrite writable
     - dm cache policy smq: check allocation under invalidate lock
     - net/sched: act_api: use RCU with deferred freeing for action lifecycle
     - 6lowpan: fix off-by-one in multicast context address compression
     - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
     - devlink: Release nested relation on devlink free
     - [arm64] drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
     - wifi: mac80211: limit injected antenna index in
       ieee80211_parse_tx_radiotap
     - pcnet32: stop holding device spin lock during napi_complete_done
     - net: Annotate sk->sk_write_space() for UDP SOCKMAP.
     - hsr: Remove WARN_ONCE() in hsr_addr_is_self().
     - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
     - net: lan743x: permit VLAN-tagged packets up to configured MTU
     - net: fec: fix pinctrl default state restore order on resume
     - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
     - Bluetooth: MGMT: validate advertising TLV before type checks
     - Bluetooth: RFCOMM: validate skb length in MCC handlers
     - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension
       handling
     - Bluetooth: bnep: reject short frames before parsing
     - Bluetooth: fix memory leak in error path of hci_alloc_dev()
     - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync
     - Bluetooth: ISO: Fix not using bc_sid as advertisement SID
     - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls
     - Bluetooth: MGMT: Fix backward compatibility with userspace
     - [arm64] octeontx2-pf: Fix NDC sync operation errors
     - [arm64] octeontx2-af: Fix initialization of mcam's entry2target_pffunc
       field
     - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
     - ptp: vclock: Switch from RCU to SRCU
     - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
     - net_sched: act_pedit: use RCU in tcf_pedit_dump()
     - net/sched: fix pedit partial COW leading to page cache corruption
       (CVE-2026-46331)
     - [arm64] octeontx2-af: npc: Fix CPT channel mask in npc_install_flow
     - vxlan: vnifilter: send notification on VNI add
     - vxlan: vnifilter: fix spurious notification on VNI update
     - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
     - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
     - sctp: purge outqueue on stale COOKIE-ECHO handling
     - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp
     - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
     - time: Fix off-by-one in settimeofday() usec validation
     - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked
       streams
     - ALSA: seq: dummy: fix UMP event stack overread
     - ima: kexec: skip IMA segment validation after kexec soft reboot
     - ima: kexec: move IMA log copy from kexec load to execute
     - spi: cadence-quadspi: fix unclocked access on unbind (CVE-2026-46203)
     - tools/rv: Fix cleanup after failed trace setup
     - tap: free page on error paths in tap_get_user_xdp() (CVE-2026-46320)
     - [arm64] tlb: Allow XZR argument to TLBI ops
     - [arm64] tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI
     - iomap: don't revert iov_iter on partially completed buffered writes
     - dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device
     - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
     - netlabel: validate unlabeled address and mask attribute lengths
     - gpio: mvebu: fix NULL pointer dereference in suspend/resume
     - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls
     - tcp: restrict SO_ATTACH_FILTER to priv users
     - net: add pskb_may_pull() to skb_gro_receive_list()
     - net/mlx4: avoid GCC 10 __bad_copy_from() false positive
     - net: ibm: emac: Fix use-after-free during device removal
     - netdev: fix double-free in netdev_nl_bind_rx_doit()
     - net: phy: clean the sfp upstream if phy probing fails
     - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
     - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
     - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure
     - net/mlx5: Use effective affinity mask for IRQ selection
     - ipv6: sit: reload inner IPv6 header after GSO offloads
     - net: openvswitch: fix possible kfree_skb of ERR_PTR
     - r8152: handle the return value of usb_reset_device()
     - gpio: zynq: fix runtime PM leak on remove
     - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
     - net: guard timestamp cmsgs to real error queue skbs
     - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic
       completion
     - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
     - rds: mark snapshot pages dirty in rds_info_getsockopt()
     - netfilter: revalidate bridge ports
     - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister
     - netfilter: x_tables: avoid leaking percpu counter pointers
     - netfilter: nf_log: validate MAC header was set before dumping it
     - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
     - [arm64,armhf] net: mvpp2: sync RX data at the hardware packet offset
     - [arm64,armhf] net: mvpp2: limit XDP frame size to the RX buffer
     - [arm64,armhf] net: mvpp2: Add metadata support for xdp mode
     - [arm64,armhf] net: mvpp2: refill RX buffers before XDP or skb use
     - [arm64,armhf] net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
     - ipv6: Fix a potential NPD in cleanup_prefix_route()
     - netfilter: ctnetlink: ensure safe access to master conntrack
       (CVE-2026-43116)
     - writeback: Avoid contention on wb->list_lock when switching inodes
     - writeback: Fix use after free in inode_switch_wbs_work_fn()
     - xfrm: hold device only for the asynchronous decryption
     - xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
     - [amd64] KVM: VMX: Update SVI during runtime APICv activation
     - [arm64] clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from
       getting parked
     - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs
     - [arm64] clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration
       time
     - drm/virtio: Fix driver removal with disabled KMS
     - [arm64,armhf] drm/vc4: fix krealloc() memory leak
     - drm/xe: fix refcount leak in xe_range_fence_insert()
     - netfilter: nft_tunnel: fix use-after-free on object destroy
     - [arm64] tee: shm: fix shm leak in register_shm_helper()
     - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend
     - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
     - [arm64] soc: qcom: ice: Fix race between qcom_ice_probe() and
       of_qcom_ice_get()
     - [amd64] accel/ivpu: Add bounds checks for firmware log indices
     - [amd64] accel/ivpu: Add buffer overflow check in MS get_info_ioctl
     - [amd64] accel/ivpu: Fix signed integer truncation in IPC receive
     - tracing/probes: Point the error offset correctly for eprobe argument error
     - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation
     - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying
     - [amd64] KVM: SEV: Decouple the need to sync the GHCB SA from the need to
       free the SA
     - [amd64] drm/i915/gem: Fix phys BO pread/pwrite with offset
     - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init
     - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
     - xfrm: espintcp: do not reuse an in-progress partial send
     - USB: serial: io_ti: fix heap overflow in get_manuf_info()
     - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
     - USB: serial: option: add usb-id for Dell Wireless DW5826e-m
     - USB: serial: kl5kusb105: fix bulk-out buffer overflow
     - ALSA: timer: Forcibly close timer instances at closing
     - ALSA: timer: Fix UAF at snd_timer_user_params()
     - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries
     - drm/virtio: fix dma_fence refcount leak on error in
       virtio_gpu_dma_fence_wait()
     - drm/amd/display: Reject gpio_bitshift >= 32 in
       bios_parser_get_gpio_pin_info()
     - mm/huge_memory: update file PMD counter before folio_put()
     - mm/damon/ops-common: call folio_test_lru() after folio_get()
     - RDMA/srp: bound SRP_RSP sense copy by the received length
     - zram: fix use-after-free in zram_bvec_write_partial()
     - udp: clear skb->dev before running a sockmap verdict
     - mptcp: fix retransmission loop when csum is enabled
     - mptcp: close TOCTOU race while computing rcv_wnd
     - mptcp: allow subflow rcv wnd to shrink
     - mptcp: sockopt: check timestamping ret value
     - mptcp: add-addr: always drop other suboptions
     - wifi: nl80211: reject oversized EMA RNR lists
     - vsock/vmci: fix sk_ack_backlog leak on failed handshake
     - timers/migration: Fix livelock in tmigr_handle_remote_up()
     - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write
     - bnxt_en: Fix NULL pointer dereference
     - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
     - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
     - pidfd: refuse access to tasks that have started exiting harder
     - fs/qnx6: fix pointer arithmetic in directory iteration
     - fuse: reject fuse_notify() pagecache ops on directories
     - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
     - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
     - i2c: tegra: Fix NOIRQ suspend/resume
     - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
     - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
     - ipc/shm: serialize orphan cleanup with shm_nattch updates
     - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
     - misc: fastrpc: fix use-after-free race in fastrpc_map_create
     - misc: fastrpc: fix DMA address corruption due to find_vma misuse
     - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
     - net/mlx5: Reorder completion before putting command entry in
       cmd_work_handler
     - net: bonding: fix NULL pointer dereference in bond_do_ioctl()
     - net: mv643xx: fix OF node refcount
     - net: rds: clear i_sends on setup unwind
     - nvmem: core: fix use-after-free bugs in error paths
     - nvmem: layouts: onie-tlv: fix hang on unknown types
     - [arm64] octeontx2-af: fix memory leak in rvu_setup_hw_resources()
     - io_uring/kbuf: don't truncate end buffer for bundles
     - io_uring/wait: fix min_timeout behavior
     - mm/hugetlb: restore reservation on error in hugetlb folio copy paths
     - mmc: core: Fix host controller programming for fixed driver type
     - mmc: dw_mmc-rockchip: Add missing private data for very old controllers
     - mmc: litex_mmc: Set mandatory idle clocks before CMD0
     - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC
     - mmc: sdhci: add signal voltage switch in sdhci_resume_host
     - pmdomain: imx: fix OF node refcount
     - rtase: Avoid sleeping in get_stats64()
     - rtase: Reset TX subqueue when clearing TX ring
     - sctp: diag: reject stale associations in dump_one path
     - sctp: stream: fully roll back denied add-stream state
     - [amd64] thunderbolt: Reject zero-length property entries in validator
     - [amd64] thunderbolt: Bound root directory content to block size
     - [amd64] thunderbolt: Clamp XDomain response data copy to allocation size
     - [amd64] thunderbolt: Validate XDomain request packet size before type cast
     - [amd64] thunderbolt: Limit XDomain response copy to actual frame size
     - [arm64] slimbus: qcom-ngd-ctrl: fix OF node refcount
     - [arm64] slimbus: qcom-ngd-ctrl: Fix up platform_driver registration
     - [arm64] slimbus: qcom-ngd-ctrl: Fix probe error path ordering
     - [arm64] slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
     - [arm64] slimbus: qcom-ngd-ctrl: Initialize controller resources in
       controller
     - [arm64] slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
     - [arm64] slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD
     - [arm64] slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
     - drm/amdkfd: fix NULL dereference in get_queue_ids()
     - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
     - drm/xe: Clear pending_disable before signaling suspend fence
     - [arm64,armhf] drm/v3d: Fix vaddr leak when indirect CSD has zeroed
       workgroups
     - drm/amdgpu: restart the CS if some parts of the VM are still invalidated
     - drm/amd/pm: fix smu13 power limit default/cap calculation
     - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2
     - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in
       set_soft_freq_limited_range
     - drm/amd/display: Bound VBIOS record-chain walk loops
     - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
     - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
     - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs
     - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
     - drm/amd/display: Use krealloc_array() in dal_vector_reserve()
     - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
     - driver core: reject devices with unregistered buses
     - mailbox: Fix NULL message support in mbox_send_message()
     - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
     - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()
     - netfilter: nft_fib: fix stale stack leak via the OIFNAME register
     - mm/memory-failure: fix hugetlb_lock AA deadlock in
       get_huge_page_for_hwpoison
     - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper
     - RDMA/umem: Move umem dmabuf revoke logic into helper function
     - RDMA/umem: Add helpers for umem dmabuf revoke lock
     - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
     - RDMA/umem: fix kernel-doc warnings
     - RDMA: Move DMA block iterator logic into dedicated files
     - RDMA/umem: Fix truncation for block sizes >= 4G
     - mm/hugetlb: avoid false positive lockdep assertion
     - mptcp: fix missing wakeups in edge scenarios
     - ipmi:ssif: Remove unnecessary indention
     - ipmi:ssif: NULL thread on error
     - ipvs: skip ipv6 extension headers for csum checks (CVE-2026-45850)
     - vsock/virtio: fix potential unbounded skb queue
     - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc
     - block: fix handling of dead zone write plugs
     - [arm64] cputype: Add NVIDIA Olympus definitions
     - [arm64] cputype: Add C1-Ultra definitions
     - [arm64] cputype: Add C1-Premium definitions
     - [arm64] errata: Mitigate TLBI errata on various Arm CPUs
     - [arm64] errata: Mitigate TLBI errata on NVIDIA Olympus CPU
     - [arm64] errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
     - net: introduce EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL()
     - tcp: use EXPORT_IPV6_MOD[_GPL]()
     - tcp: secure_seq: add back ports to TS offset (CVE-2026-23247)
     - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation
     - vsock/virtio: fix skb overhead overflow on 32-bit builds
     - netfilter: require Ethernet MAC header before using eth_hdr()
 .
   [ Salvatore Bonaccorso ]
   * [rt] Refresh "ARM: enable irq in translation/section permission fault"
   * ip6_vti: set netns_immutable on the fallback device. (CVE-2026-52909)
linux (6.12.94-1~bpo12+1) bookworm-backports; urgency=medium
 .
   * Rebuild for bookworm-backports
 .
 linux (6.12.94-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.91
     - io_uring/kbuf: use mem_is_zero()
     - blk-cgroup: wait for blkcg cleanup before initializing new disk
     - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START
     - fs/mbcache: cancel shrink work before destroying the cache
     - md/raid1: fix the comparing region of interval tree
     - drbd: Balance RCU calls in drbd_adm_dump_devices()
     - loop: fix partition scan race between udev and loop_reread_partitions()
     - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()
     - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()
     - pstore/ram: fix resource leak when ioremap() fails
     - md: wake raid456 reshape waiters before suspend
     - btrfs: pass struct btrfs_inode to clone_copy_inline_extent()
     - btrfs: fix deadlock between reflink and transaction commit when using
       flushoncommit
     - [amd64] ACPI: x86: cmos_rtc: Clean up address space handler driver
     - [amd64] ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver
     - devres: fix missing node debug info in devm_krealloc()
     - thermal/drivers/spear: Fix error condition for reading st,thermal-flags
     - debugfs: check for NULL pointer in debugfs_create_str()
     - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str()
     - soundwire: debugfs: initialize firmware_file to empty string
     - PCI: use generic driver_override infrastructure
     - platform/wmi: use generic driver_override infrastructure
     - [s390x] cio: use generic driver_override infrastructure
     - bus: fsl-mc: use generic driver_override infrastructure
     - irqchip/irq-pic32-evic: Address warning related to wrong printf()
       formatter
     - hrtimers: Update the return type of enqueue_hrtimer()
     - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns()
     - hrtimer: Reduce trace noise in hrtimer_start()
     - locking: Fix rwlock support in <linux/spinlock_up.h>
     - firmware: dmi: Correct an indexing error in dmi.h
     - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt()
     - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished
       irq_prepare_bcn_tasklet
     - bpf: test_run: Fix the null pointer dereference issue in
       bpf_lwt_xmit_push_encap
     - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH
     - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n
     - [s390x] bpf: Zero-extend bpf prog return values and kfunc arguments
     - params: Replace __modinit with __init_or_module
     - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n
     - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in
       mt76_connac2_tx_check_aggr()
     - wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control
     - wifi: mt76: mt7615: fix use_cts_prot support
     - wifi: mt76: mt7915: fix use_cts_prot support
     - wifi: mt76: mt7925: prevent NULL pointer dereference in
       mt7925_tx_check_aggr()
     - wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi
     - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor
     - wifi: mt76: mt7921: Place upper limit on station AID
     - [arm64] cpufeature: Make PMUVer and PerfMon unsigned
     - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event
     - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()
     - wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()
     - wifi: mt76: mt7921: fix 6GHz regulatory update on connection
     - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path
     - bpf: Fix variable length stack write over spilled pointers
     - bpf,arc_jit: Fix missing newline in pr_err messages
     - wifi: rtw89: phy: fix uninitialized variable access in
       rtw89_phy_cfo_set_crystal_cap()
     - r8152: fix incorrect register write to USB_UPHY_XTAL
     - [powerpc*] crash: fix backup region offset update to elfcorehdr
     - [powerpc*] crash: Update backup region offset in elfcorehdr on memory
       hotplug
     - macvlan: annotate data-races around port->bc_queue_len_used
     - bpf: fix end-of-list detection in cgroup_storage_get_next_key()
     - bpf: Fix stale offload->prog pointer after constant blinding
     - wifi: brcmfmac: Fix error pointer dereference
     - wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode()
     - bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks
     - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()
     - wifi: ath10k: fix station lookup failure during disconnect
     - ACPI: AGDI: fix missing newline in error message
     - [arm64] kexec: Remove duplicate allocation for trans_pgd
     - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
     - net: bcmgenet: add bcmgenet_has_* helpers
     - net: bcmgenet: move DESC_INDEX flow to ring 0
     - net: bcmgenet: support reclaiming unsent Tx packets
     - net: bcmgenet: switch to use 64bit statistics
     - net: bcmgenet: fix racing timeout handler
     - eth: fbnic: Use wake instead of start
     - netfilter: xt_socket: enable defrag after all other checks
     - netfilter: nft_fwd_netdev: check ttl/hl before forwarding
     - bpf: fix mm lifecycle in open-coded task_vma iterator
     - bpf: switch task_vma iterator from mmap_lock to per-VMA locks
     - bpf: return VMA snapshot from task_vma iterator
     - bpf: Fix RCU stall in bpf_fd_array_map_clear()
     - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf
     - bpf: Relax scalar id equivalence for state pruning
     - bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars
     - net/sched: act_ct: Only release RCU read lock after ct_ft
     - net: airoha: Implement BQL support
     - net: airoha: Add missing RX_CPU_IDX() configuration in
       airoha_qdma_cleanup_rx_queue()
     - bpf: Allow instructions with arena source and non-arena dest registers
     - net/rds: Optimize rds_ib_laddr_check
     - net/rds: Restrict use of RDS/IB to the initial network namespace
     - bpf: Fix OOB in pcpu_init_value
     - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
     - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG
     - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+
     - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110
     - net: phy: fix a return path in get_phy_c45_ids()
     - net/mlx5e: Fix features not applied during netdev registration
     - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic()
     - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb
     - Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU
     - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error
     - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
     - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
     - Bluetooth: SCO: check for codecs->num_codecs == 1 before assigning to
       sco_pi(sk)->codec
     - net: phy: qcom: at803x: Use the correct bit to disable extended next page
     - ipv4: udp: fix typos in comments
     - ipv6: udp: fix typos in comments
     - udp: Force compute_score to always inline
     - tcp: Don't set treq->req_usec_ts in cookie_tcp_reqsk_init().
     - sctp: fix missing encap_port propagation for GSO fragments
     - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master
     - drm/komeda: fix integer overflow in AFBC framebuffer size check
     - ASoC: SOF: ipc3: Use standard dev_dbg API
     - ASoC: add symmetric_ prefix for dai->rate/channels/sample_bits
     - ASoC: soc-compress: use function to clear symmetric params
     - drm/sun4i: backend: fix error pointer dereference
     - ASoC: sti: Return errors from regmap_field_alloc()
     - ASoC: sti: use managed regmap_field allocations
     - dm cache: fix null-deref with concurrent writes in passthrough mode
     - dm cache: fix write path cache coherency in passthrough mode
     - dm cache: fix write hang in passthrough mode
     - dm cache policy smq: fix missing locks in invalidating cache blocks
     - dm cache: fix concurrent write failure in passthrough mode
     - dm cache: support shrinking the origin device
     - dm cache: fix dirty mapping checking in passthrough mode switching
     - platform/chrome: chromeos_tbmc: Drop wakeup source on remove
     - PCI: endpoint: Align pci_epc_set_msix(), pci_epc_ops::set_msix() nr_irqs
       encoding
     - PCI: dwc: ep: Fix MSI-X Table Size configuration in dw_pcie_ep_set_msix()
     - PCI: dwc: Invoke post_init in dw_pcie_resume_noirq()
     - PCI: dwc: Perform cleanup in the error path of dw_pcie_resume_noirq()
     - dm cache metadata: fix memory leak on metadata abort retry
     - dm log: fix out-of-bounds write due to region_count overflow
     - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in
       atomic_enable()
     - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to
       drm_bridge_funcs
     - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge
       atomic check
     - spi: spi-nxp-fspi: enable runtime pm for fspi
     - spi: nxp-fspi: Use reinit_completion() for repeated operations
     - spi: fsl-qspi: Use reinit_completion() for repeated operations
     - media: i2c: og01a1b: Replace client->dev usage
     - media: i2c: og01a1b: Fix V4L2 subdevice data initialization on probe
     - drm/v3d: Handle error from drm_sched_entity_init()
     - drm/sun4i: Fix resource leaks
     - drm/amdgpu: Add default case in DVI mode validation
     - dm init: ensure device probing has finished in dm-mod.waitfor=
     - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build
       break
     - crypto: tegra - finalize crypto req on error
     - crypto: tegra - Transfer HASH init function to crypto engine
     - crypto: tegra - Reserve keyslots to allocate dynamically
     - crypto: tegra - Disable softirqs before finalizing request
     - crypto: atmel - Use unregister_{aeads,ahashes,skciphers}
     - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs
     - padata: Remove cpu online check from cpu add and removal
     - padata: Put CPU offline callback in ONLINE section to allow failure
     - PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the
       documentation
     - drm/amdgpu/gfx10: look at the right prop for gfx queue priority
     - drm/amdgpu/gfx11: look at the right prop for gfx queue priority
     - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo
     - drm/imagination: Switch reset_reason fields from enum to u32
     - iommu/tegra241-cmdqv: Set supports_cmd op in tegra241_vcmdq_hw_init()
     - [arm64] drm/msm/dpu: fix mismatch between power and frequency
     - [arm64] drm/msm/dsi: add the missing parameter description
     - [arm64] drm/msm/dsi: fix bits_per_pclk
     - [arm64] drm/msm/dsi: fix hdisplay calculation for CMD mode panel
     - [arm64] drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0
     - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first
     - drm/panel: simple: Correct G190EAN01 prepare timing
     - PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion
       support
     - ALSA: core: Validate compress device numbers without dynamic minors
     - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled
     - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs
     - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock
     - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0
     - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels
     - drm/amd/pm/ci: Fill DW8 fields from SMC
     - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board
     - drm/amdgpu: add amdgpu_device reference in ip block
     - drm/amdgpu: update the handle ptr in dump_ip_state
     - drm/amdgpu: update the handle ptr in early_init
     - drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled
     - hwmon: Switch back to struct platform_driver::remove()
     - hwmon: (aspeed-g6-pwm-tach): remove redundant driver remove callback
     - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace
       '}')
     - [amd64] ASoC: SOF: Intel: hda: Place check before dereference
     - [arm64] drm/msm/a6xx: Fix HLSQ register dumping
     - [arm64] drm/msm/shrinker: Fix can_block() logic
     - [arm64] drm/msm/a6xx: Fix dumping A650+ debugbus blocks
     - [arm64] drm/msm/a6xx: Use barriers while updating HFI Q headers
     - pmdomain: ti: omap_prm: Fix a reference leak on device node
     - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe()
     - PM: domains: De-constify fields in struct dev_pm_domain_attach_data
     - ASoC: fsl_micfil: Add access property for "VAD Detected"
     - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable()
     - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode()
     - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state()
     - ASoC: fsl_micfil: Fix event generation in micfil_quality_set()
     - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put()
     - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put()
     - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits()
     - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits()
     - ASoC: fsl_easrc: Change the type for iec958 channel status controls
     - [amd64] iommu/amd: Remove protection_domain.dev_cnt variable
     - [amd64] iommu/amd: xarray to track protection_domain->iommu list
     - [amd64] iommu/amd: Do not detach devices in domain free path
     - [amd64] iommu/amd: Reduce domain lock scope in attach device path
     - [amd64] iommu/amd: Rearrange attach device code
     - [amd64] iommu/amd: Convert dev_data lock from spinlock to mutex
     - [amd64] iommu/amd: Introduce helper function to update 256-bit DTE
     - [amd64] iommu/amd: Introduce helper function get_dte256()
     - [amd64] iommu/amd: Fix clone_alias() to use the original device's devid
     - [arm64] ASoC: qcom: qdsp6: topology: check widget type before accessing
       data
     - crypto: qat - introduce fuse array
     - crypto: qat - disable 4xxx AE cluster when lead engine is fused off
     - crypto: qat - disable 420xx AE cluster when lead engine is fused off
     - crypto: qat - fix type mismatch in RAS sysfs show functions
     - crypto: qat - use swab32 macro
     - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]
     - PCI: Enable AtomicOps only if Root Port supports them
     - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found
     - Documentation: fix a hugetlbfs reservation statement
     - ALSA: scarlett2: Add missing sentinel initializer field
     - ASoC: SOF: compress: return the configured codec from get_params
     - PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports
     - PCI: tegra194: Fix polling delay for L2 state
     - PCI: tegra194: Increase LTSSM poll time on surprise link down
     - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link
       down
     - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in
       tegra_pcie_downstream_dev_to_D0()
     - PCI: tegra194: Don't force the device into the D0 state before L2
     - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode
     - PCI: tegra194: Use devm_gpiod_get_optional() to parse
       "nvidia,refclk-select"
     - PCI: tegra194: Disable direct speed change for Endpoint mode
     - PCI: tegra194: Set LTR message request before PCIe link up in Endpoint
       mode
     - PCI: tegra194: Allow system suspend when the Endpoint link is not up
     - PCI: tegra194: Free up Endpoint resources during remove()
     - PCI: tegra194: Use DWC IP core version
     - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well
     - PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on
     - spi: mtk-snfi: unregister ECC engine on probe failure and remove()
       callback
     - ALSA: sc6000: Keep the programmed board state in card-private data
     - dm cache: fix missing return in invalidate_committed's error path
     - crypto: jitterentropy - replace long-held spinlock with mutex
     - ALSA: hda/realtek - fixed speaker no sound update
     - gfs2: Call unlock_new_inode before d_instantiate
     - net/socket.c: switch to CLASS(fd)
     - fdget(), trivial conversions
     - fanotify: call fanotify_events_supported() before path_permission() and
       security_path_notify()
     - quota: Fix race of dquot_scan_active() with quota deactivation
     - gfs2: add some missing log locking
     - gfs2: prevent NULL pointer dereference during unmount
     - efi/capsule-loader: fix incorrect sizeof in phys array reallocation
     - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine
     - [arm64] dts: mediatek: mt8365: Describe infracfg-nao as a pure syscon
     - memory: tegra124-emc: Fix dll_change check
     - memory: tegra30-emc: Fix dll_change check
     - [arm64] dts: imx8-apalis: Fix LEDs name collision
     - [arm64] dts: rockchip: Make Jaguar PCIe-refclk pin use pull-up config
     - [arm64] dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO
       (M.2 W_DISABLE1)
     - iommufd: vfio compatibility extension check for noiommu mode
     - [arm64] dts: mediatek: mt6795: Fix gpio-ranges pin count
     - [arm64] dts: mediatek: mt7981b: Fix gpio-ranges pin count
     - [arm64] dts: mediatek: mt7986a: Fix gpio-ranges pin count
     - [arm64] dts: qcom: msm8953-xiaomi-vince: correct wled ovp value
     - [arm64] dts: qcom: msm8953-xiaomi-daisy: fix backlight
     - [arm64] dts: rockchip: Fix Bluetooth stability on LCKFB TaiShan Pi
     - [arm64] dts: rockchip: Correct Fan Supply for Gameforce Ace
     - [arm64] dts: rockchip: Correct Joystick Axes on Gameforce Ace
     - [arm64] soc: qcom: ocmem: make the core clock optional
     - [arm64] soc: qcom: ocmem: register reasons for probe deferrals
     - [arm64] soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available
     - bus: rifsc: fix RIF configuration check for peripherals
     - [arm64] dts: qcom: sm8450: Fix GIC_ITS range length
     - [arm64] dts: qcom: sm8550: Fix GIC_ITS range length
     - [arm64] dts: qcom: sm8650: Fix GIC_ITS range length
     - [arm64] dts: qcom: sm8550: Fix xo clock supply of platform SD host
       controller
     - [arm64] dts: qcom: sm8650: Fix xo clock supply of SD host controller
     - [arm64] dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes
     - [arm64] dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes
     - [arm64] dts: qcom: sm8650: Enable UHS-I SDR50 and SDR104 SD card modes
     - [arm64] dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl
     - [arm64] dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered
       during boot
     - [arm64] dts: ti: k3-am62p5-sk: Disable MMC1 internal pulls on data pins
     - [arm64] dts: ti: k3-am62-lp-sk: Enable internal pulls for MMC0 data pins
     - [arm64] dts: ti: k3-am62-verdin: Fix SPI_1 GPIO CS pinctrl label
     - [arm64] dts: freescale: imx8mp-tqma8mpql-mba8mp-ras314: fix UART1 RTS/CTS
       muxing
     - [arm64] dts: lx2160a: change i2c0 (iic1) pinmux mask to one bit
     - [arm64] dts: lx2160a: remove duplicate pinmux nodes
     - [arm64] dts: lx2160a: rename pinmux nodes for readability
     - [arm64] dts: lx2160a: add sda gpio references for i2c bus recovery
     - [arm64] dts: lx2160a: change zeros to hexadecimal in pinmux nodes
     - [arm64] dts: lx2160a: complete pinmux for rcwsr12 configuration word
     - [arm64] dts: imx8qm-mek: switch Type-C connector power-role to dual
     - [arm64] dts: imx8qxp-mek: switch Type-C connector power-role to dual
     - soc/tegra: cbb: Set ERD on resume for err interrupt
     - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure
     - ocfs2/dlm: validate qr_numregions in dlm_match_regions()
     - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
     - soc: qcom: llcc: fix v1 SB syndrome register offset
     - [arm64] soc: qcom: aoss: compare against normalized cooling state
     - [arm64] dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP
     - [arm64] xor: fix conflicting attributes for xor_block_template
     - firmware: arm_ffa: Use the correct buffer size during RXTX_MAP
     - ocfs2: fix listxattr handling when the buffer is full
     - ocfs2: validate bg_bits during freefrag scan
     - ocfs2: validate group add input before caching
     - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void
       function
     - soundwire: bus: demote UNATTACHED state warnings to dev_dbg()
     - dmaengine: mxs-dma: Fix missing return value from
       of_dma_controller_register()
     - soundwire: cadence: Clear message complete before signaling waiting thread
     - tracing: Rebuild full_name on each hist_field_name() call
     - hte: tegra194: remove Kconfig dependency on Tegra194 SoC
     - remoteproc: xlnx: Fix sram property parsing
     - ima: check return value of crypto_shash_final() in boot aggregate
     - HID: asus: make asus_resume adhere to linux kernel coding standards
     - HID: asus: do not abort probe when not necessary
     - mtd: physmap_of_gemini: Fix disabled pinctrl state check
     - ima_fs: don't bother with removal of files in directory we'll be removing
     - ima_fs: get rid of lookup-by-dentry stuff
     - ima_fs: Correctly create securityfs files for unsupported hash algos
     - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range
     - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations
     - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook
     - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook
     - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation
     - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask
     - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path
     - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions
     - cxl/pci: Check memdev driver binding status in cxl_reset_done()
     - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob
     - HID: usbhid: fix deadlock in hid_post_reset()
     - ext4: fix possible null-ptr-deref in mbt_kunit_exit()
     - [arm64] bpf, arm64: Fix off-by-one in check_imm signed range check
     - bpf, sockmap: Fix af_unix iter deadlock
     - bpf, sockmap: Fix af_unix null-ptr-deref in proto update
     - bpf, sockmap: Take state lock for af_unix iter
     - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check
     - bpf: Fix NULL deref in map_kptr_match_type for scalar regs
     - bpf: allow UTF-8 literals in bpf_bprintf_prepare()
     - bpf: Validate node_id in arena_alloc_pages()
     - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT
     - pinctrl: pinctrl-pic32: Fix resource leak
     - pinctrl: cy8c95x0: remove duplicate error message
     - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe()
     - pinctrl: cy8c95x0: Avoid returning positive values to user space
     - perf branch: Avoid incrementing NULL
     - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace
     - pinctrl: realtek: Fix function signature for config argument
     - pinctrl: abx500: Fix type of 'argument' variable
     - pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT} registers
     - perf lock: Fix option value type in parse_max_stack
     - perf stat: Fix opt->value type for parse_cache_level
     - perf tools: Fix module symbol resolution for non-zero .text sh_addr
     - perf expr: Return -EINVAL for syntax error in expr__find_ids()
     - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure
     - ipmi: ssif_bmc: fix message desynchronization after truncated response
     - ipmi: ssif_bmc: change log level to dbg in irq callback
     - perf evsel: Add alternate_hw_config and use in evsel__match
     - perf tool_pmu: Factor tool events into their own PMU
     - perf python: Add parse_events function
     - perf cgroup: Update metric leader in evlist__expand_cgroup
     - perf maps: Fix copy_from that can break sorted by name order
     - perf util: Kill die() prototype, dead for a long time
     - reset: replace boolean parameters with flags parameter
     - reset: Add devres helpers to request pre-deasserted reset controls
     - i3c: master: dw-i3c: Fix missing reset assertion in remove() callback
     - i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers()
     - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status
     - backlight: sky81452-backlight: Check return value of
       devm_gpiod_get_optional() in sky81452_bl_parse_dt()
     - platform/surface: surfacepro3_button: Drop wakeup source on remove
     - leds: lgm-sso: Remove duplicate assignments for priv->mmap
     - tty: hvc_iucv: fix off-by-one in number of supported devices
     - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup
     - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata()
     - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist()
     - [amd64] platform/x86: asus-wmi: adjust screenpad power/brightness handling
     - [amd64] platform/x86: asus-wmi: fix screenpad brightness range
     - tty: serial: ip22zilog: Fix section mispatch warning
     - fs/ntfs3: terminate the cached volume label after UTF-8 conversion
     - [amd64] platform/x86: dell_rbu: avoid uninit value usage in
       packet_size_write()
     - [amd64] platform/x86: dell-wmi-sysman: bound enumeration string
       aggregation
     - RDMA/core: Prefer NLA_NUL_STRING
     - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source
     - scsi: sg: Fix sysctl sg-big-buff register during sg_init()
     - scsi: sg: Resolve soft lockup issue when opening /dev/sgX
     - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from
       byte_div_clk_src dividers
     - clk: qcom: dispcc-sm4450: Fix DSI byte clock rate setting
     - scsi: target: core: Fix integer overflow in UNMAP bounds check
     - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs
     - clk: qcom: gcc-sc8180x: Add missing GDSCs
     - clk: qcom: gcc-sc8180x: Use retention for USB power domains
     - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains
     - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk
     - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks
     - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed()
     - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels()
     - clk: imx8mq: Correct the CSI PHY sels
     - [amd64] x86/um/vdso: Drop VDSO64-y from Makefile
     - clk: qoriq: avoid format string warning
     - clk: xgene: Fix mapping leak in xgene_pllclk_init()
     - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets
     - clk: qcom: dispcc-sc7180: Add missing MDSS resets
     - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug()
     - clk: qcom: gcc-x1e80100: Keep GCC USB QTB clock always ON
     - clk: visconti: pll: initialize clk_init_data to zero
     - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()
     - [amd64] drm/i915: Relocate the SKL wm sanitation code
     - [amd64] drm/i915/wm: Verify the correct plane DDB entry
     - crypto: sa2ul - Fix AEAD fallback algorithm names
     - crypto: ccp - copy IV using skcipher ivsize
     - erofs: add encoded extent on-disk definition
     - erofs: do sanity check on m->type in z_erofs_load_compact_lcluster()
     - erofs: avoid infinite loops due to corrupted subpage compact indexes
       (CVE-2025-68251)
     - erofs: unify lcn as u64 for 32-bit platforms
     - [arm64] dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mp-navqp: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT
     - PCMCIA: Fix garbled log messages for KERN_CONT
     - [arm64] dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT
     - [arm64] dts: marvell: armada-37xx: use 'usb2-phy' in USB3 controller's
       phy-names
     - net/sched: act_mirred: fix wrong device for mac_header_xmit check in
       tcf_blockcast_redir
     - macvlan: fix macvlan_get_size() not reserving space for
       IFLA_MACVLAN_BC_CUTOFF
     - net/sched: sch_cake: fix NAT destination port not being updated in
       cake_update_flowkeys
     - nexthop: fix IPv6 route referencing IPv4 nexthop
     - net/sched: taprio: fix use-after-free in advance_sched() on schedule
       switch
     - tcp: add data-race annotations around tp->data_segs_out and
       tp->total_retrans
     - tcp: add data-race annotations for TCP_NLA_SNDQ_SIZE
     - tcp: annotate data-races around tp->bytes_sent
     - tcp: annotate data-races around tp->bytes_retrans
     - tcp: annotate data-races around tp->dsack_dups
     - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt)
     - tcp: annotate data-races around tp->plb_rehash
     - ice: update PCS latency settings for E825 10G/25Gb modes
     - ice: Remove jumbo_remove step from TX path
     - ice: fix double-free of tx_buf skb
     - ice: fix ICE_AQ_LINK_SPEED_M for 200G
     - i40e: don't advertise IFF_SUPP_NOFCS
     - e1000e: Unroll PTP in probe error handling
     - ipv6: fix possible UAF in icmpv6_rcv()
     - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
     - pppoe: drop PFC frames
     - net/mlx5: Fix HCA caps leak on notifier init failure
     - openvswitch: cap upcall PID array size and pre-size vport replies
     - netfilter: nft_osf: restrict it to ipv4
     - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
     - netfilter: conntrack: remove sprintf usage
     - netfilter: xtables: restrict several matches to inet family
     - ipvs: fix MTU check for GSO packets in tunnel mode
     - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
     - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
     - slip: reject VJ receive packets on instances with no rstate array
     - slip: bound decode() reads against the compressed packet length
     - [arm64] dts: meson-gxl-p230: fix ethernet PHY interrupt number
     - pwm: atmel-tcb: Cache clock rates and mark chip as atomic
     - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy()
     - ksmbd: destroy async_ida in ksmbd_conn_free()
     - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open
     - ksmbd: scope conn->binding slowpath to bound sessions only
     - net/rds: zero per-item info buffer before handing it to visitors
     - ice: fix timestamp interrupt configuration for E825C
     - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g
     - net_sched: sch_hhf: annotate data-races in hhf_dump_stats()
     - net/sched: sch_pie: annotate data-races in pie_dump_stats()
     - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats()
     - net/sched: sch_red: annotate data-races in red_dump_stats()
     - net/sched: sch_sfb: annotate data-races in sfb_dump_stats()
     - net: dsa: realtek: rtl8365mb: fix mode mask calculation
     - net: airoha: Move ndesc initialization at end of
       airoha_qdma_init_rx_queue()
     - virtio_net: Split struct virtio_net_rss_config
     - virtio_net: Fix endian with virtio_net_ctrl_rss
     - virtio_net: Use new RSS config structs
     - virtio_net: sync rss_trailer.max_tx_vq on queue_pairs change via
       VQ_PAIRS_SET
     - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls
     - tipc: fix double-free in tipc_buf_append()
     - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()
     - fs/adfs: validate nzones in adfs_validate_bblk()
     - rtc: abx80x: Disable alarm feature if no interrupt attached
     - kbuild: builddeb - avoid recompiles for non-cross-compiles
     - fbdev: offb: fix PCI device reference leak on probe failure
     - mailbox: mtk-cmdq: Fix CURR and END addr for task insert case
     - mailbox: mailbox-test: free channels on probe error
     - cgroup/rdma: fix integer overflow in rdmacg_try_charge()
     - mailbox: add sanity check for channel array
     - mailbox: mailbox-test: don't free the reused channel
     - mailbox: mailbox-test: initialize struct earlier
     - mailbox: mailbox-test: make data_ready a per-instance variable
     - fsnotify: fix inode reference leak in fsnotify_recalc_mask()
     - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent()
     - cgroup: Increment nr_dying_subsys_* from rmdir context
     - tracing: branch: Fix inverted check on stat tracer registration
     - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
     - netfilter: arp_tables: fix IEEE1394 ARP payload parsing
     - nvme-pci: fix missed admin queue sq doorbell write
     - drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM
     - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG
     - drm/amdgpu: fix spelling typos
     - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated
     - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2)
     - netfilter: xt_policy: fix strict mode inbound policy matching
     - netfilter: nf_conntrack_sip: don't use simple_strtoul
     - [amd64] ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED
     - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ
     - drm/sysfb: ofdrm: fix PCI device reference leaks
     - arm64/scs: Fix potential sign extension issue of advance_loc4
     - cdrom, scsi: sr: propagate read-only status to block layer via
       set_disk_ro()
     - netdevsim: zero initialize struct iphdr in dummy sk_buff
     - net/sched: netem: fix probability gaps in 4-state loss model
     - net/sched: netem: fix queue limit check to include reordered packets
     - net/sched: netem: only reseed PRNG when seed is explicitly provided
     - net/sched: netem: validate slot configuration
     - net/sched: netem: fix slot delay calculation overflow
     - net/sched: netem: check for negative latency and jitter
     - net/sched: sch_choke: annotate data-races in choke_dump_stats()
     - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats()
     - vrf: Fix a potential NPD when removing a port from a VRF
     - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
     - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit
     - NFC: trf7970a: Ignore antenna noise when checking for RF field
     - net/sched: taprio: fix NULL pointer dereference in class dump
     - neigh: let neigh_xmit take skb ownership
     - tcp: make probe0 timer handle expired user timeout
     - net, treewide: define and use MAC_ADDR_STR_LEN
     - netconsole: allow selection of egress interface via MAC address
     - netpoll: Extract carrier wait function
     - netpoll: extract IPv4 address retrieval into helper function
     - netpoll: fix IPv6 local-address corruption
     - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams
     - sched/fair: Clear rel_deadline when initializing forked entities
     - net: mctp i2c: check length before marking flow active
     - net: phy: dp83869: fix setting CLK_O_SEL field.
     - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings
     - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings
     - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings
     - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring
     - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring
     - drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring
     - ASoC: codecs: ab8500: Fix casting of private data
     - netfilter: skip recording stale or retransmitted INIT
     - sctp: discard stale INIT after handshake completion
     - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()
     - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V)
     - netconsole: propagate device name truncation in dev_name_store()
     - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87
     - ALSA: hda/conexant: Fix missing error check for jack detection
     - ALSA: hda: cs35l56: Fix uninitialized value in cs35l56_hda_read_acpi()
     - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup
     - drm/amd/display: Allow DCE link encoder without AUX registers
     - drm/amd/display: Read EDID from VBIOS embedded panel info
     - drm/xe/debugfs: Correct printing of register whitelist ranges
     - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()
     - drm/xe/gsc: Fix BO leak on error in query_compatibility_version()
     - page_pool: Set `dma_sync` to false for devmem memory provider
     - net: page_pool: create hooks for custom memory providers
     - page_pool: fix memory-provider leak in page_pool_create_percpu() error
       path
     - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING
     - iavf: stop removing VLAN filters from PF on interface down
     - iavf: wait for PF confirmation before removing VLAN filters
     - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler
     - ice: fix NULL pointer dereference in ice_reset_all_vfs()
     - net: tls: fix strparser anchor skb leak on offload RX setup failure
     - sfc: fix error code in efx_devlink_info_running_versions()
     - net/sched: cls_flower: revert unintended changes
     - [arm64] Reserve an extra page for early kernel mapping
     - smb: client: correctly handle ErrorContextData as a flexible array
     - smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)
     - LoongArch: KVM: Compile switch.S directly into the kernel
     - ntfs: ->d_compare() must not block
     - PCI: Initialize temporary device in new_id_store()
     - net: bcmgenet: Initialize u64 stats seq counter
     - net: bcmgenet: fix leaking free_bds
     - [amd64] iommu/amd: Reorder attach device code
     - [amd64] iommu/amd: Put list_add/del(dev_data) back under the domain->lock
     - perf tool_pmu: Fix aggregation on duration_time
     - net/sched: sch_pie: annotate more data-races in pie_dump_stats()
     - netpoll: Extract IPv6 address retrieval function
     - netpoll: pass buffer size to egress_dev() to avoid MAC truncation
     - page_pool: fix incorrect mp_ops error handling
     - crypto: af_alg - Cap AEAD AD length to 0x80000000
     - i40e: Cleanup PTP pins on probe failure
     - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path
     - netfilter: nf_conntrack_sip: get helper before allocating expectation
     - audit: fix incorrect inheritable capability in CAPSET records
     - Revert "ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to
       warn"
     - netfilter: nft_ct: fix missing expect put in obj eval
     - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled
     - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV
     - KVM: Reject wrapped offset in kvm_reset_dirty_gfn()
     - [s390x] KVM: s390: pci: fix GAIT table indexing due to double-scaling
       pointer arithmetic
     - [amd64] KVM: x86: Fix Xen hypercall tracepoint argument assignment
     - netfilter: nf_tables: unconditionally bump set->nelems before insertion
       (CVE-2026-23272)
     - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands
     - smb/client: fix possible infinite loop and oob read in symlink_data()
     - [amd64] drm/i915/dp: Fix VSC dynamic range signaling for RGB formats
     - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans
     - ALSA: usb-audio: Bound MIDI endpoint descriptor scans
     - ceph: fix a buffer leak in __ceph_setxattr()
     - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size
     - io-wq: check that the predecessor is hashed in io_wq_remove_pending()
     - [powerpc*] warp: Fix error handling in pika_dtm_thread
     - netfs: fix error handling in netfs_extract_user_iter()
     - irqchip/riscv-imsic: Clear interrupt move state during CPU offlining
     - libceph: Fix potential out-of-bounds access in osdmap_decode()
     - libceph: Fix potential null-ptr-deref in decode_choose_args()
     - libceph: Fix potential out-of-bounds access in crush_decode()
     - libceph: handle rbtree insertion error in decode_choose_args()
     - [amd64] iommu/vt-d: Disable DMAR for Intel Q35 IGFX
     - [amd64] drm/i915: skip __i915_request_skip() for already signaled requests
     - drm/panfrost: Fix wait_bo ioctl leaking positive return from
       dma_resv_wait_timeout()
     - drm/xe/dma-buf: handle empty bo and UAF races
     - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup
     - drm/gma500/oaktrail_lvds: fix hang on init failure
     - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init
     - iommufd: Fix return value of iommufd_fault_fops_write()
     - eventfs: Use list_add_tail_rcu() for SRCU-protected children list
     - drm/v3d: Reject empty multisync extension to prevent infinite loop
     - btrfs: use inode already stored in local variable at btrfs_rmdir()
     - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of
       BTRFS_I()
     - btrfs: fix missing last_unlink_trans update when removing a directory
     - smb: client: Use FullSessionKey for AES-256 encryption key derivation
     - btrfs: do not mark inode incompressible after inline attempt fails
     - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
     - sched_ext: Guard scx_dsq_move() against NULL kit->dsq after failed
       iter_new
     - mptcp: pm: prio: skip closed subflows
     - mptcp: drop __mptcp_fastopen_gen_msk_ackseq()
     - mptcp: fix rx timestamp corruption on fastopen
     - f2fs: fix incorrect file address mapping when inline inode is unwritten
     - f2fs: fix false alarm of lockdep on cp_global_sem lock
     - spi: sifive: Simplify clock handling with devm_clk_get_enabled()
     - spi: sifive: fix controller deregistration
     - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0
     - mptcp: pm: ADD_ADDR rtx: fix potential data-race
     - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker
     - netfs: Fix potential uninitialised var in netfs_extract_user_iter()
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.92
     - mptcp: sync the msk->sndbuf at accept() time
     - mptcp: pm: ADD_ADDR rtx: allow ID 0
     - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (CVE-2026-46158)
     - mptcp: pm: ADD_ADDR rtx: free sk if last (CVE-2026-46170)
     - ksmbd: validate owner of durable handle on reconnect (CVE-2026-31717)
     - drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status()
       (CVE-2026-46216)
     - [s390x] debug: Reject zero-length input before trimming a newline
     - Revert "perf cgroup: Update metric leader in evlist__expand_cgroup"
     - Revert "perf tool_pmu: Fix aggregation on duration_time"
     - Revert "perf python: Add parse_events function"
     - Revert "perf tool_pmu: Factor tool events into their own PMU"
     - bridge: mrp: reject zero test interval to avoid OOM panic (CVE-2026-31420)
     - spi: spi-dw-dma: fix print error log when wait finish transaction
       (CVE-2026-31560)
     - Revert "x86/vdso: Fix output operand size of RDPID"
     - sched/deadline: Less agressive dl_server handling
     - sched/deadline: Fix dl_server_stopped()
     - sched/deadline: Fix dl_server getting stuck
     - sched/deadline: Fix dl_server behaviour
     - sched/deadline: Stop dl_server before CPU goes offline
     - ksmbd: close durable scavenger races against m_fp_list lookups
     - af_unix: Give up GC if MSG_PEEK intervened. (CVE-2026-23394)
     - drm/imagination: Synchronize interrupts before suspending the GPU
       (CVE-2026-23469)
     - ata: libata-scsi: improve readability of ata_scsi_qc_issue()
     - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT
     - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS
     - ata: libata-scsi: do not needlessly defer commands when using PMP with FBS
     - perf parse-events: Expose/rename config_term_name
     - Revert "ice: fix double-free of tx_buf skb"
     - Revert "ice: Remove jumbo_remove step from TX path"
     - tracing: Fix the bug where bpf_get_stackid returns -EFAULT on the ARM64
     - net/mlx5e: Trigger neighbor resolution for unresolved destinations
     - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init
     - [amd64] x86/fgraph: Fix return_to_handler regs.rsp value
     - [amd64] iommu/vt-d: Draining PRQ in sva unbind path when FPD bit set
     - [riscv64] fgraph: Select HAVE_FUNCTION_GRAPH_TRACER depends on
       HAVE_DYNAMIC_FTRACE_WITH_ARGS
     - [riscv64] fgraph: Fix stack layout to match __arch_ftrace_regs argument of
       ftrace_return_to_handler (CVE-2025-22069)
     - hwmon: (pmbus/core) Protect regulator operations with mutex
     - [arm64] Kconfig: Remove selecting replaced HAVE_FUNCTION_GRAPH_RETVAL
     - sysfs: don't remove existing directory on update failure
     - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()
     - ksmbd: fix null pointer dereference in compare_guid_key()
     - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow
     - ksmbd: validate SID in parent security descriptor during ACL inheritance
     - smb: client: require net admin for CIFS SWN netlink
     - smb: client: protect tc_count increment in
       smb2_find_smb_sess_tcon_unlocked()
     - smb: client: use data_len for SMB2 READ encrypted folioq copy
     - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close
     - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX
     - ALSA: ua101: Reject too-short USB descriptors
     - ALSA: pcm: Don't setup bogus iov_iter for silencing
     - ALSA: asihpi: Fix potential OOB array access at reading cache
     - efi: Allocate runtime workqueue before ACPI init
     - io_uring/waitid: clear waitid info before copying it to userspace
     - drivers/base/memory: fix memory block reference leak in poison accounting
     - ipv6: ioam: refresh hdr pointer before ioam6_event()
     - mm/memory_hotplug: fix memory block reference leak on remove
     - net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
     - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
     - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START
     - Bluetooth: bnep: Fix UAF read of dev->name
     - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths
     - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer
     - Bluetooth: MGMT: validate Add Extended Advertising Data length
     - Bluetooth: serialize accept_q access
     - phonet/pep: disable BH around forwarded sk_receive_skb()
     - net: bcmgenet: keep RBUF EEE/PM disabled
     - net: ifb: report ethtool stats over num_tx_queues
     - net: pse-pd: fix sign on -ENOENT check in of_load_pse_pis()
     - netfilter: ip6t_hbh: reject oversized option lists
     - netfilter: nf_queue: hold bridge skb->dev while queued
     - netfilter: ipset: stop hash:* range iteration at end
     - netfilter: nft_inner: Fix IPv6 inner_thoff desync
     - sched_ext: Fix missing warning in scx_set_task_state() default case
     - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path
     - cgroup/cpuset: Reset DL migration state on can_attach() failure
     - fs/ntfs3: handle attr_set_size() errors when truncating files
     - l2tp: use list_del_rcu in l2tp_session_unhash
     - qed: fix double free in qed_cxt_tables_alloc()
     - ring-buffer: Fix reporting of missed events in iterator
     - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
     - vsock/vmci: fix UAF when peer resets connection during handshake
     - vsock/virtio: reset connection on receiving queue overflow
     - wifi: ath11k: clear shared SRNG pointer state on restart
     - ipv4: raw: reject IP_HDRINCL packets with ihl < 5
     - ixgbevf: fix use-after-free in VEPA multicast source pruning
     - rbd: eliminate a race in lock_dwork draining on unmap
     - lsm: hold cred_guard_mutex for lsm_set_self_attr()
     - [arm64] octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
     - ice: fix setting promisc mode while adding VID filter
     - ice: restore PTP Rx timestamp config after ethtool set-channels
     - wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
     - af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
     - wifi: mac80211: consume only present negotiated TTLM maps
     - cifs: Fix busy dentry used after unmounting
     - tracing: Do not call map->ops->elt_free() if elt_alloc() fails
     - [arm64] probes: Handle probes on hinted conditional branch instructions
     - [arm64] KVM: arm64: vgic-its: Reject restored DTE with out-of-range
       num_eventid_bits
     - [arm64] KVM: arm64: vgic: Free private_irqs when init fails after
       allocation
     - [riscv64] kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem() when
       OOM
     - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe
     - spi: qup: fix error pointer deref after DMA setup failure
     - [arm64] phy: tegra: xusb: Fix per-pad high-speed termination calibration
     - scsi: isci: Fix use-after-free in device removal path
     - spi: ep93xx: fix error pointer deref after DMA setup failure
     - spi: sprd: fix error pointer deref after DMA setup failure
     - spi: ti-qspi: fix use-after-free after DMA setup failure
     - RDMA/siw: Reject MPA FPDU length underflow before signed receive math
     - device property: set fwnode->secondary to NULL in fwnode_init()
     - drm/virtio: use uninterruptible resv lock for plane updates
     - drm/amdgpu/vpe: Force collaborate sync after TRAP
     - drm/bridge: it66121: acquire reset GPIO in probe
     - drm/bridge: megachips: remove bridge when irq request fails
     - drm/amd/display: Fix integer overflow in bios_get_image()
     - drm/amd/display: Validate GPIO pin LUT table size before iterating
     - drm/amd/display: Validate payload length and link_index in
       dc_process_dmub_aux_transfer_async
     - batman-adv: mcast: fix use-after-free in orig_node RCU release
     - batman-adv: clear current gateway during teardown
     - batman-adv: dat: handle forward allocation error
     - batman-adv: fix fragment reassembly length accounting
     - batman-adv: fix tp_meter counter underflow during shutdown
     - batman-adv: frag: disallow unicast fragment in fragment
     - batman-adv: bla: fix report_work leak on backbone_gw purge
     - batman-adv: tp_meter: avoid use of uninit sender vars
     - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown
     - batman-adv: tp_meter: fix race condition in send error reporting
     - batman-adv: tt: fix negative last_changeset_len
     - batman-adv: tt: fix negative tt_buff_len
     - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
     - hwmon: (pmbus/adm1266) reject implausible blackbox record_count
     - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer
     - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized
       buffer
     - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR
     - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in
       get_multiple
     - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()
     - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()
     - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO
       accessors
     - [arm64] pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset for
       high pins during suspend/resume
     - HID: uclogic: Fix regression of input name assignment
     - [riscv64] mm: Fixup no5lvl failure when vaddr is invalid
     - [arm64] pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for
       sm8150
     - ALSA: hda: cs35l56: Put ACPI device after setting companion
     - ALSA: hda: cs35l41: Put ACPI device on missing physical node
     - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()
     - netfilter: x_tables: unregister the templates first
     - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist()
     - tcp: Fix imbalanced icsk_accept_queue count.
     - ice: fix setting RSS VSI hash for E830
     - ice: fix locking in ice_dcb_rebuild()
     - net: lan966x: avoid unregistering netdev on register failure
     - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register
       access
     - NFSD: Fix infinite loop in layout state revocation
     - irqchip/ath79-cpu: Remove unused function
     - ublk: reject max_sectors smaller than PAGE_SECTORS in parameter validation
     - nsfs: fix wrong error code returned for pidns ioctls
     - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
     - zonefs: handle integer overflow in zonefs_fname_to_fno
     - tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().
     - [powerpc*] fix dead default for GUEST_STATE_BUFFER_TEST
     - netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call
     - netfs: Fix overrun check in netfs_extract_user_iter()
     - netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone
     - netfs: Defer the emission of trace_netfs_folio()
     - netfs: Fix streaming write being overwritten
     - netfs: Fix potential deadlock in write-through mode
     - netfs: Fix write streaming disablement if fd open O_RDWR
     - netfs: Fix early put of sink folio in netfs_read_gaps()
     - netfs: Fix partial invalidation of streaming-write folio
     - netfs: Fix a few minor bugs in netfs_page_mkwrite()
     - netfs: Remove unnecessary references to pages
     - netfs: Fix folio->private handling in netfs_perform_write()
     - net: ethernet: cortina: Make RX SKB per-port
     - net: ethernet: cortina: Drop half-assembled SKB
     - net: ethernet: cortina: Carry over frag counter
     - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference
     - wifi: ath11k: fix error path leaks in some WMI WOW calls
     - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
     - wifi: ath10k: skip WMI and beacon transmission when device is wedged
     - blk-integrity: remove seed for user mapped buffers
     - block: don't overwrite bip_vcnt in bio_integrity_copy_user()
     - block: recompute nr_integrity_segments in blk_insert_cloned_request
     - HID: quirks: really enable the intended work around for appledisplay
     - block: modify bio_integrity_map_user to accept iov_iter as argument
     - block: drop direction param from bio_integrity_copy_user()
     - blk-integrity: use simpler alignment check
     - blk-integrity: enable p2p source and destination
     - block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()
     - accel/qaic: Add overflow check to remap_pfn_range during mmap
     - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint
     - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
     - [arm64] drm/msm/dsi: don't dump registers past the mapped region
     - [arm64] drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN
     - [powerpc*] time: Remove redundant preempt_disable|enable() calls from
       arch_irq_work_raise()
     - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
     - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
     - net: tls: prevent chain-after-chain in plain text SG
     - net: phy: DP83TC811: add reading of abilities
     - [amd64] x86/xen: Fix xen_e820_swap_entry_with_ram()
     - tls: Preserve sk_err across recvmsg() when data has been copied
     - net/mlx5: Do not restore destination-less TC rules
     - scsi: sd: Fix return code handling in sd_spinup_disk()
     - ALSA: scarlett2: Add missing error check when initialise Autogain Status
     - io_uring/net: punt IORING_OP_BIND async if it needs file create
     - btrfs: fix squota accounting during enable generation
     - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
     - [arm64] drm/msm/snapshot: fix dumping of the unaligned regions
     - drm/xe/gsc: Fix double-free of managed BO in error path
     - drm/xe/vf: Fix signature of print functions
     - drm/xe/pf: Fix CFI failure in debugfs access
     - wifi: ath11k: fix peer resolution on rx path when peer_id=0
     - ice: ptp: serialize E825 PHY timer start with PTP lock
     - [amd64] drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP
     - [arm64] net: dsa: mt7530: fix FDB entries not aging out with short timeout
     - [arm64] net: dsa: mt7530: preserve VLAN tags on trapped link-local frames
     - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
     - platform/surface: aggregator_registry: omit battery & AC nodes on Surface
       Laptop 7
     - [amd64] platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
     - [amd64] platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
     - [amd64] platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
     - [amd64] platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
     - RDMA/rtrs: Fix use-after-free in path file creation cleanup
     - net: bridge: Flush multicast groups when snooping is disabled
     - bridge: mcast: Fix a possible use-after-free when removing a bridge port
     - pds_core: fix error handling in pdsc_devcmd_wait
     - pds_core: fix debugfs_lookup dentry leak and error handling
     - wifi: mac80211: fix MLE defragmentation
     - ALSA: seq: Serialize UMP output teardown with event_input
     - tracing: Avoid NULL return from hist_field_name() on truncation
     - Bluetooth: btmtk: fix urb->setup_packet leak in error paths
     - net: ag71xx: check error for platform_get_irq
     - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
     - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n)
     - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed
     - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
     - drm/xe/oa: Fix exec_queue leak on width check in stream open
     - [arm64] octeontx2-af: npc: Fix allmulticast skip logic for LBK and SDP VFs
     - net: mana: validate rx_req_idx to prevent out-of-bounds array access
     - pds_core: ensure null-termination for firmware version strings
     - net: gro: don't merge zcopy skbs
     - landlock: Fix TCP handling of short AF_UNSPEC addresses
     - block: make bio_integrity_map_user() static inline
     - security/keys: fix missed RCU read section on lookup
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.93
     - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
     - [arm64] drm/v3d: Fix use-after-free of CPU job query arrays on error path
     - [arm64] drm/v3d: Release indirect CSD GEM reference on CPU job free
     - net/sched: cls_fw: fix NULL dereference of "old" filters before change()
     - net: mctp: ensure our nlmsg responses are initialised (CVE-2026-45930)
     - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
     - net/sched: sch_sfb: Replace direct dequeue call with peek and
       qdisc_dequeue_peeked
     - bcache: fix uninitialized closure object
     - net: cpsw_new: Fix potential unregister of netdev that has not been
       registered yet (CVE-2026-43219)
     - [arm64] Introduce esr_is_ubsan_brk()
     - [arm64] debug: clean up single_step_handler logic
     - [arm64] refactor aarch32_break_handler()
     - [arm64] debug: call software breakpoint handlers statically
     - [arm64] debug: call step handlers statically
     - [arm64] debug: remove break/step handler registration infrastructure
     - [arm64] entry: Add entry and exit functions for debug exceptions
     - [arm64] debug: split hardware breakpoint exception entry
     - [arm64] debug: refactor reinstall_suspended_bps()
     - [arm64] debug: split single stepping exception entry
     - [arm64] debug: split hardware watchpoint exception entry
     - [arm64] debug: split brk64 exception entry
     - [arm64] debug: split bkpt32 exception entry
     - [arm64] debug: remove debug exception registration infrastructure
     - [arm64] debug: always unmask interrupts in el0_softstp()
     - nfc: llcp: Fix use-after-free in llcp_sock_release()
     - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
     - xfrm: Check for underflow in xfrm_state_mtu
     - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
     - netfilter: synproxy: refresh tcphdr after skb_ensure_writable
     - netfilter: xt_cpu: prefer raw_smp_processor_id
     - netfilter: ebtables: fix OOB read in compat_mtw_from_user
     - tun: free page on short-frame rejection in tun_xdp_one() (CVE-2026-46321)
     - tun: free page on build_skb failure in tun_xdp_one() (CVE-2026-46322)
     - vsock: keep poll shutdown state consistent
     - net: netlink: fix sending unassigned nsid after assigned one
     - net: netlink: don't set nsid on local notifications
     - net/smc: Do not re-initialize smc hashtables
     - [s390x] net/iucv: fix locking in .getsockopt
     - scsi: core: Run queues for all non-SDEV_DEL devices from
       scsi_run_host_queues
     - ipv4: free net->ipv4.sysctl_local_reserved_ports after
       unregister_net_sysctl_table()
     - ALSA: pcm: oss: Fix setup list UAF on proc write error
     - [amd64] ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
     - net: hsr: fix potential OOB access in supervision frame handling
     - [amd64] accel/ivpu: prevent uninitialized data bug in debugfs
     - gpio: mxc: fix irq_high handling
     - net: Avoid checksumming unreadable skb tail on trim
     - ethtool: rss: fix hkey leak when indir_size is 0
     - ethtool: module: avoid leaking a netdev ref on module flash errors
     - ethtool: module: check fw_flash_in_progress under rtnl_lock
     - ethtool: module: fix cleanup if socket used for flashing multiple devices
     - ethtool: cmis: require exact CDB reply length
     - ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
     - net: ethtool: Add new parameters and a function to support EPL
     - net: ethtool: Add support for writing firmware blocks using EPL payload
     - ethtool: cmis: validate start_cmd_payload_size from module
     - ethtool: cmis: validate fw->size against start_cmd_payload_size
     - tunnels: load network headers after skb_cow() in
       iptunnel_pmtud_build_icmp[v6]()
     - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
     - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
     - ASoC: codecs: simple-mux: Fix enum control bounds check
     - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
     - bonding: refuse to enslave CAN devices
     - ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES
     - ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup
       error
     - ethtool: pse-pd: fix missing ethnl_ops_complete()
     - ethtool: strset: fix header attribute index in ethnl_req_get_phydev()
     - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during
       fallback
     - ethtool: eeprom: add more safeties to EEPROM Netlink fallback
     - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
     - net/sched: Revert "net/sched: Restrict conditions for adding duplicating
       netems to qdisc tree"
     - net/sched: fix packet loop on netem when duplicate is on
     - net/sched: act_mirred: Move the recursion counter struct netdev_xmit
     - net/sched: act_mirred: add loop detection
     - net: Introduce skb tc depth field to track packet loops
     - net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop
     - net/sched: act_mirred: Fix return code in early mirred redirect error
       paths
     - net/handshake: Use spin_lock_bh for hn_lock
     - nvme-tcp: store negative errno in queue->tls_err
     - net/handshake: Pass negative errno through handshake_complete()
     - remove pointless includes of <linux/fdtable.h>
     - net/handshake: Take a long-lived file reference at submit
     - net/handshake: Drain pending requests at net namespace exit
     - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
     - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
     - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
     - [arm64,armhf] gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
     - [amd64,arm64] net: mana: Add NULL guards in teardown path to prevent panic
       on attach failure
     - sctp: fix race between sctp_wait_for_connect and peeloff
     - ipv6: fix possible infinite loop in rt6_fill_node()
     - ipv6: fix possible infinite loop in fib6_select_path()
     - net: skbuff: fix pskb_carve leaking zcopy pages
     - perf: Fix dangling cgroup pointer in cpuctx
     - batman-adv: v: stop OGMv2 on disabled interface
     - batman-adv: tvlv: abort OGM send on tvlv append failure
     - batman-adv: tt: reject oversized local TVLV buffers
     - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
     - batman-adv: tvlv: reject oversized TVLV packets
     - batman-adv: iv: recover OGM scheduling after forward packet error
     - batman-adv: tp_meter: avoid role confusion in tp_list
     - [s390x] cio: Restore GFP_DMA for CHSC allocation
     - batman-adv: tp_meter: directly shut down timer on cleanup
     - batman-adv: tt: fix TOCTOU race for reported vlans
     - batman-adv: tt: avoid empty VLAN responses
     - batman-adv: bla: avoid double decrement of bla.num_requests
     - mm/page_alloc: clear page->private in free_pages_prepare()
       (CVE-2026-43303)
     - media: rc: fix race between unregister and urb/irq callbacks
     - media: rc: ttusbir: fix inverted error logic
     - inet: frags: add inet_frag_queue_flush()
     - inet: frags: flush pending skbs in fqdir_pre_exit() (CVE-2025-68768)
     - HID: core: Add printk_ratelimited variants to hid_warn() etc
     - HID: pass the buffer size to hid_report_raw_event
     - HID: core: introduce hid_safe_input_report()
     - HID: core: Fix size_t specifier in hid_report_raw_event()
     - [amd64] drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD
       register
     - [amd64] drm/i915/psr: Read Intel DPCD workaround register
     - drm/dp: Add eDP 1.5 bit definition
     - [amd64] drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line
       used
     - [arm64] io: Rename ioremap_prot() to __ioremap_prot()
     - [arm64] io: Extract user memory type in ioremap_prot() (CVE-2026-23346)
     - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X
     - batman-adv: tt: prevent TVLV entry number overflow
     - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
     - usb: typec: ucsi: ccg: reject firmware images without a ':' record header
     - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
     - usb: typec: tcpm: bound altmode_desc[] per iteration in
       svdm_consume_modes()
     - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO
     - usb: typec: altmodes/displayport: validate count before reading Status
       Update VDO
     - usb: typec: wcove: don't write past struct pd_message in
       wcove_read_rx_buffer()
     - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT
     - usb: typec: ucsi: validate connector number in ucsi_connector_change()
     - USB: serial: safe_serial: fix memory corruption with small endpoint
     - media: rc: igorplugusb: fix control request setup packet
     - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()
     - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
     - Bluetooth: btusb: Allow firmware re-download when version matches
     - hpfs: fix a crash if hpfs_map_dnode_bitmap fails
     - ipc: limit next_id allocation to the valid ID range
     - auxdisplay: line-display: fix OOB read on zero-length message_store()
     - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
     - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
     - Bluetooth: HIDP: fix missing length checks in hidp_input_report()
     - Bluetooth: ISO: fix UAF in iso_recv_frame
     - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
     - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
     - Input: xpad - fix out-of-bounds access for Share button
     - parport: Fix race between port and client registration (Closes: #1130365)
     - USB: cdc-acm: Fix bit overlap and move quirk definitions to header
     - [arm64] KVM: arm64: PMU: Preserve AArch32 counter low bits
     - [amd64] KVM: SVM: Flush the current TLB when transitioning from xAVIC =>
       x2AVIC
     - [amd64] KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
     - [amd64] KVM: SEV: Use the size of the PSC header as the minimum size for
       PSC requests
     - [amd64] KVM: SEV: WARN if KVM attempts to setup scratch area with
       min_len==0
     - [amd64] KVM: SEV: Compute the correct max length of the in-GHCB scratch
       area
     - [amd64] KVM: SEV: Check PSC request indices against the actual size of the
       buffer
     - [amd64] KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC
       buffer
     - [amd64] KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
     - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux
     - iio: adc: npcm: fix unbalanced clk_disable_unprepare()
     - iio: dac: max5821: fix return value check in powerdown sync
     - iio: dac: ad5686: fix input raw value check
     - iio: dac: ad5686: acquire lock when doing powerdown control
     - iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
     - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
     - iio: gyro: itg3200: fix i2c read into the wrong stack location
     - iio: gyro: adis16260: fix division by zero in write_raw
     - iio: ssp_sensors: cancel delayed work_refresh on remove
     - iio: temperature: tsys01: fix broken PROM checksum validation
     - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL
     - iio: light: cm3323: fix reg_conf not being initialized correctly
     - iio: buffer: hw-consumer: fix use-after-free in error path
     - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
     - USB: serial: omninet: fix memory corruption with small endpoint
     - usb: cdns3: gadget: fix request skipping after clearing halt
     - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy
       acquisition failure
     - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently
       leaks the runtime PM usage counter across bind/unbind cycles
     - usb: dwc2: Fix use after free in debug code
     - Input: elan_i2c - validate firmware size before use
     - wireguard: send: append trailer after expanding head
     - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
     - macsec: fix replay protection at XPN lower-PN wrap
     - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
     - [arm64] ASoC: qcom: q6asm-dai: fix error handling in prepare and
       set_params
     - ipv6: exthdrs: refresh nh after handling HAO option
     - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
     - ipv6: validate extension header length before copying to cmsg
     - xfrm: input: hold netns during deferred transport reinjection
     - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
     - ip6: vti: Use ip6_tnl.net in vti6_changelink().
     - net: skbuff: fix missing zerocopy reference in pskb_carve helpers
     - HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
     - nfc: hci: fix out-of-bounds read in HCP header parsing
     - xfrm: route MIGRATE notifications to caller's netns
     - xfrm: ah: use skb_to_full_sk in async output callbacks
     - ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417
     - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without
       direction check
     - [arm64] ASoC: qcom: q6asm-dai: close stream only when running
     - [arm64] ASoC: qcom: q6asm-dai: do not set stream state in event and
       trigger callbacks
     - xfrm: esp: restore combined single-frag length gate
     - Input: xpad - add "Nova 2 Lite" from GameSir
     - Input: xpad - add support for ASUS ROG RAIKIRI II
     - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops
     - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
     - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490
     - [amd64] comedi: comedi_test: fix check for valid scan_begin_src in
       waveform_ai_cmdtest()
     - [amd64] comedi: comedi_test: Fix limiting of convert_arg in
       waveform_ai_cmdtest()
     - counter: Fix refcount leak in counter_alloc() error path
     - tty: serial: pch_uart: add check for dma_alloc_coherent()
     - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
     - usb: chipidea: core: convert ci_role_switch to local variable
     - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval
     - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub
       controllers
     - usb: storage: Add quirks for PNY Elite Portable SSD
     - usbip: vudc: Fix use after free bug in vudc_remove due to race condition
     - usb: usbtmc: check URB actual_length for interrupt-IN notifications
     - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
     - usb: typec: tcpm: improve handling of DISCOVER_MODES failures
     - USB: serial: option: add MeiG SRM813Q
     - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL
     - USB: serial: belkin_sa: validate interrupt status length
     - USB: serial: cypress_m8: validate interrupt packet headers
     - USB: serial: keyspan: fix missing indat transfer sanity check
     - USB: serial: mxuport: fix memory corruption with small endpoint
     - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
     - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind
     - usb: gadget: net2280: Fix double free in probe error path
     - usb: gadget: f_hid: fix device reference leak in hidg_alloc()
     - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
     - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports
     - usb: gadget: f_fs: copy only received bytes on short ep0 read
     - usb: gadget: f_fs: serialize DMABUF cancel against request completion
     - [amd64] thunderbolt: property: Reject u32 wrap in
       tb_property_entry_valid()
     - [amd64] thunderbolt: property: Reject dir_len < 4 to prevent size_t
       underflow
     - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
     - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
     - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
     - scsi: target: iscsi: Validate CHAP_R length before base64 decode
     - drm/hyperv: validate resolution_count and fix WIN8 fallback
     - drm/hyperv: validate VMBus packet size in receive callback
     - [amd64] drm/i915: Fix potential UAF in TTM object purge
     - drm/amd/pm/si: Disregard vblank time when no displays are connected
     - serial: altera_jtaguart: handle uart_add_one_port() failures
     - serial: qcom-geni: fix UART_RX_PAR_EN bit position
     - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion
       IRQ
     - serial: sh-sci: fix memory region release in error path
     - serial: zs: Fix swapped RI/DSR modem line transition counting
     - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma
     - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
     - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger
     - drm/amdkfd: Check for pdd drm file first in CRIU restore path
     - serial: dz: Fix bootconsole message clobbering at chip reset
     - serial: dz: Fix bootconsole handover lockup
     - serial: dz: Convert to use a platform device
     - serial: zs: Fix bootconsole handover lockup
     - serial: zs: Switch to using channel reset
     - serial: zs: Convert to use a platform device
     - USB: serial: cypress_m8: fix memory corruption with small endpoint
     - USB: serial: digi_acceleport: fix memory corruption with small endpoints
     - xhci: tegra: Fix ghost USB device on dual-role port unplug
     - iommu: Skip PASID validation for devices without PASID capability
     - [amd64] x86/boot: Disable stack protector for early boot code
     - [amd64] x86/kexec: Disable KCOV instrumentation after load_segments()
       (CVE-2026-43331)
     - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg
     - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer
     - serdev: Provide a bustype shutdown function
     - Bluetooth: hci_qca: Migrate to serdev specific shutdown function
     - Bluetooth: hci_qca: Convert timeout from jiffies to ms
     - ALSA: scarlett2: Return ENOSPC for out-of-bounds flash writes
     - ALSA: scarlett2: Allow flash writes ending at segment boundary
     - mm/memory: fix spurious warning when unmapping device-private/exclusive
       pages
     - [amd64] platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error
       recovery
     - net: hsr: defer node table free until after RCU readers
     - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient
     - ice: fix VF queue configuration with low MTU values
     - ring-buffer: Flush and stop persistent ring buffer on panic
     - mptcp: cleanup fallback dummy mapping generation
     - mptcp: reset rcv wnd on disconnect
     - [arm64] tlb: Flush walk cache when unsharing PMD tables
     - [arm64] octeontx2-pf: avoid double free of pool->stack on AQ init failure
     - mptcp: introduce the mptcp_init_skb helper
     - mptcp: handle first subflow closing consistently
     - mptcp: do not drop partial packets
     - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
     - iio: chemical: scd30: Use guard(mutex) to allow early returns
     - iio: chemical: scd30: fix division by zero in write_raw
     - iio: dac: ad5686: fix ref bit initialization for single-channel parts
     - ALSA: firewire-motu: Protect register DSP event queue positions
     - [arm64] usb: dwc3: xilinx: fix error handling in zynqmp init error paths
     - usb: musb: omap2430: Fix use-after-free in omap2430_probe()
     - usb: typec: ucsi: Check if power role change actually happened before
       handling
     - [amd64] thunderbolt: property: Cap recursion depth in
       __tb_property_parse_dir()
     - scsi: target: iscsi: Fix CRC overread and double-free in
       iscsit_handle_text_cmd()
     - usb: typec: ucsi: Don't update power_supply on power role change if not
       connected
     - [amd64] x86/alternatives: Rename 'apply_relocation()' to
       'text_poke_apply_relocation()'
     - [amd64] x86/ftrace: Relocate %rip-relative percpu refs in dynamic
       trampolines
     - hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with
       pmbus_lock
     - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock
     - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock
     - mm: perform all memfd seal checks in a single place
     - mm/memfd: fix spelling and grammatical issues
     - memfd: deny writeable mappings when implying SEAL_WRITE
     - usb: core: Fix SuperSpeed root hub wMaxPacketSize
     - ethtool: cmis_cdb: Fix incorrect read / write length extension
     - net/sched: act_mirred: Fix blockcast recursion bypass leading to stack
       overflow
     - [arm64] KVM: arm64: vgic-its: Drop the translation cache reference only
       for the erased entry (CVE-2026-46316)
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.94
     - bpf: Free reuseport cBPF prog after RCU grace period. (CVE-2026-52910)
     - USB: serial: mct_u232: fix memory corruption with small endpoint
     - [armhf] group is_permission_fault() with is_translation_fault()
     - [armhf] allow __do_kernel_fault() to report execution of memory faults
     - [armhf] fix hash_name() fault
     - [armhf] fix branch predictor hardening
     - net: phy: micrel: fix LAN8814 QSGMII soft reset
     - wifi: remove zero-length arrays
     - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
     - ipv6: mcast: Fix use-after-free when processing MLD queries
     - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS
     - [arm64] tee: optee: prevent use-after-free when the client exits before
       the supplicant
     - [arm64]soc: qcom: ice: Return -ENODEV if the ICE platform device is not
       found
     - erofs: add sysfs node to drop internal caches
     - erofs: tidy up synchronous decompression
     - erofs: fix use-after-free on sbi->sync_decompress
     - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
     - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id
     - ipvs: clear the svc scheduler ptr early on edit
     - netfilter: synproxy: add mutex to guard hook reference counting
     - netfilter: conntrack_irc: fix possible out-of-bounds read
     - netfilter: nft_ct: bail out on template ct in get eval
     - netfilter: bridge: make ebt_snat ARP rewrite writable
     - dm cache policy smq: check allocation under invalidate lock
     - net/sched: act_api: use RCU with deferred freeing for action lifecycle
     - 6lowpan: fix off-by-one in multicast context address compression
     - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
     - devlink: Release nested relation on devlink free
     - [arm64] drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
     - wifi: mac80211: limit injected antenna index in
       ieee80211_parse_tx_radiotap
     - pcnet32: stop holding device spin lock during napi_complete_done
     - net: Annotate sk->sk_write_space() for UDP SOCKMAP.
     - hsr: Remove WARN_ONCE() in hsr_addr_is_self().
     - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
     - net: lan743x: permit VLAN-tagged packets up to configured MTU
     - net: fec: fix pinctrl default state restore order on resume
     - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
     - Bluetooth: MGMT: validate advertising TLV before type checks
     - Bluetooth: RFCOMM: validate skb length in MCC handlers
     - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension
       handling
     - Bluetooth: bnep: reject short frames before parsing
     - Bluetooth: fix memory leak in error path of hci_alloc_dev()
     - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync
     - Bluetooth: ISO: Fix not using bc_sid as advertisement SID
     - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls
     - Bluetooth: MGMT: Fix backward compatibility with userspace
     - [arm64] octeontx2-pf: Fix NDC sync operation errors
     - [arm64] octeontx2-af: Fix initialization of mcam's entry2target_pffunc
       field
     - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
     - ptp: vclock: Switch from RCU to SRCU
     - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
     - net_sched: act_pedit: use RCU in tcf_pedit_dump()
     - net/sched: fix pedit partial COW leading to page cache corruption
       (CVE-2026-46331)
     - [arm64] octeontx2-af: npc: Fix CPT channel mask in npc_install_flow
     - vxlan: vnifilter: send notification on VNI add
     - vxlan: vnifilter: fix spurious notification on VNI update
     - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
     - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
     - sctp: purge outqueue on stale COOKIE-ECHO handling
     - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp
     - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
     - time: Fix off-by-one in settimeofday() usec validation
     - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked
       streams
     - ALSA: seq: dummy: fix UMP event stack overread
     - ima: kexec: skip IMA segment validation after kexec soft reboot
     - ima: kexec: move IMA log copy from kexec load to execute
     - spi: cadence-quadspi: fix unclocked access on unbind (CVE-2026-46203)
     - tools/rv: Fix cleanup after failed trace setup
     - tap: free page on error paths in tap_get_user_xdp() (CVE-2026-46320)
     - [arm64] tlb: Allow XZR argument to TLBI ops
     - [arm64] tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI
     - iomap: don't revert iov_iter on partially completed buffered writes
     - dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device
     - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
     - netlabel: validate unlabeled address and mask attribute lengths
     - gpio: mvebu: fix NULL pointer dereference in suspend/resume
     - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls
     - tcp: restrict SO_ATTACH_FILTER to priv users
     - net: add pskb_may_pull() to skb_gro_receive_list()
     - net/mlx4: avoid GCC 10 __bad_copy_from() false positive
     - net: ibm: emac: Fix use-after-free during device removal
     - netdev: fix double-free in netdev_nl_bind_rx_doit()
     - net: phy: clean the sfp upstream if phy probing fails
     - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
     - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
     - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure
     - net/mlx5: Use effective affinity mask for IRQ selection
     - ipv6: sit: reload inner IPv6 header after GSO offloads
     - net: openvswitch: fix possible kfree_skb of ERR_PTR
     - r8152: handle the return value of usb_reset_device()
     - gpio: zynq: fix runtime PM leak on remove
     - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
     - net: guard timestamp cmsgs to real error queue skbs
     - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic
       completion
     - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
     - rds: mark snapshot pages dirty in rds_info_getsockopt()
     - netfilter: revalidate bridge ports
     - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister
     - netfilter: x_tables: avoid leaking percpu counter pointers
     - netfilter: nf_log: validate MAC header was set before dumping it
     - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
     - [arm64,armhf] net: mvpp2: sync RX data at the hardware packet offset
     - [arm64,armhf] net: mvpp2: limit XDP frame size to the RX buffer
     - [arm64,armhf] net: mvpp2: Add metadata support for xdp mode
     - [arm64,armhf] net: mvpp2: refill RX buffers before XDP or skb use
     - [arm64,armhf] net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
     - ipv6: Fix a potential NPD in cleanup_prefix_route()
     - netfilter: ctnetlink: ensure safe access to master conntrack
       (CVE-2026-43116)
     - writeback: Avoid contention on wb->list_lock when switching inodes
     - writeback: Fix use after free in inode_switch_wbs_work_fn()
     - xfrm: hold device only for the asynchronous decryption
     - xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
     - [amd64] KVM: VMX: Update SVI during runtime APICv activation
     - [arm64] clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from
       getting parked
     - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs
     - [arm64] clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration
       time
     - drm/virtio: Fix driver removal with disabled KMS
     - [arm64,armhf] drm/vc4: fix krealloc() memory leak
     - drm/xe: fix refcount leak in xe_range_fence_insert()
     - netfilter: nft_tunnel: fix use-after-free on object destroy
     - [arm64] tee: shm: fix shm leak in register_shm_helper()
     - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend
     - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
     - [arm64] soc: qcom: ice: Fix race between qcom_ice_probe() and
       of_qcom_ice_get()
     - [amd64] accel/ivpu: Add bounds checks for firmware log indices
     - [amd64] accel/ivpu: Add buffer overflow check in MS get_info_ioctl
     - [amd64] accel/ivpu: Fix signed integer truncation in IPC receive
     - tracing/probes: Point the error offset correctly for eprobe argument error
     - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation
     - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying
     - [amd64] KVM: SEV: Decouple the need to sync the GHCB SA from the need to
       free the SA
     - [amd64] drm/i915/gem: Fix phys BO pread/pwrite with offset
     - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init
     - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
     - xfrm: espintcp: do not reuse an in-progress partial send
     - USB: serial: io_ti: fix heap overflow in get_manuf_info()
     - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
     - USB: serial: option: add usb-id for Dell Wireless DW5826e-m
     - USB: serial: kl5kusb105: fix bulk-out buffer overflow
     - ALSA: timer: Forcibly close timer instances at closing
     - ALSA: timer: Fix UAF at snd_timer_user_params()
     - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries
     - drm/virtio: fix dma_fence refcount leak on error in
       virtio_gpu_dma_fence_wait()
     - drm/amd/display: Reject gpio_bitshift >= 32 in
       bios_parser_get_gpio_pin_info()
     - mm/huge_memory: update file PMD counter before folio_put()
     - mm/damon/ops-common: call folio_test_lru() after folio_get()
     - RDMA/srp: bound SRP_RSP sense copy by the received length
     - zram: fix use-after-free in zram_bvec_write_partial()
     - udp: clear skb->dev before running a sockmap verdict
     - mptcp: fix retransmission loop when csum is enabled
     - mptcp: close TOCTOU race while computing rcv_wnd
     - mptcp: allow subflow rcv wnd to shrink
     - mptcp: sockopt: check timestamping ret value
     - mptcp: add-addr: always drop other suboptions
     - wifi: nl80211: reject oversized EMA RNR lists
     - vsock/vmci: fix sk_ack_backlog leak on failed handshake
     - timers/migration: Fix livelock in tmigr_handle_remote_up()
     - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write
     - bnxt_en: Fix NULL pointer dereference
     - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
     - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
     - pidfd: refuse access to tasks that have started exiting harder
     - fs/qnx6: fix pointer arithmetic in directory iteration
     - fuse: reject fuse_notify() pagecache ops on directories
     - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
     - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
     - i2c: tegra: Fix NOIRQ suspend/resume
     - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
     - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
     - ipc/shm: serialize orphan cleanup with shm_nattch updates
     - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
     - misc: fastrpc: fix use-after-free race in fastrpc_map_create
     - misc: fastrpc: fix DMA address corruption due to find_vma misuse
     - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
     - net/mlx5: Reorder completion before putting command entry in
       cmd_work_handler
     - net: bonding: fix NULL pointer dereference in bond_do_ioctl()
     - net: mv643xx: fix OF node refcount
     - net: rds: clear i_sends on setup unwind
     - nvmem: core: fix use-after-free bugs in error paths
     - nvmem: layouts: onie-tlv: fix hang on unknown types
     - [arm64] octeontx2-af: fix memory leak in rvu_setup_hw_resources()
     - io_uring/kbuf: don't truncate end buffer for bundles
     - io_uring/wait: fix min_timeout behavior
     - mm/hugetlb: restore reservation on error in hugetlb folio copy paths
     - mmc: core: Fix host controller programming for fixed driver type
     - mmc: dw_mmc-rockchip: Add missing private data for very old controllers
     - mmc: litex_mmc: Set mandatory idle clocks before CMD0
     - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC
     - mmc: sdhci: add signal voltage switch in sdhci_resume_host
     - pmdomain: imx: fix OF node refcount
     - rtase: Avoid sleeping in get_stats64()
     - rtase: Reset TX subqueue when clearing TX ring
     - sctp: diag: reject stale associations in dump_one path
     - sctp: stream: fully roll back denied add-stream state
     - [amd64] thunderbolt: Reject zero-length property entries in validator
     - [amd64] thunderbolt: Bound root directory content to block size
     - [amd64] thunderbolt: Clamp XDomain response data copy to allocation size
     - [amd64] thunderbolt: Validate XDomain request packet size before type cast
     - [amd64] thunderbolt: Limit XDomain response copy to actual frame size
     - [arm64] slimbus: qcom-ngd-ctrl: fix OF node refcount
     - [arm64] slimbus: qcom-ngd-ctrl: Fix up platform_driver registration
     - [arm64] slimbus: qcom-ngd-ctrl: Fix probe error path ordering
     - [arm64] slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
     - [arm64] slimbus: qcom-ngd-ctrl: Initialize controller resources in
       controller
     - [arm64] slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
     - [arm64] slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD
     - [arm64] slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
     - drm/amdkfd: fix NULL dereference in get_queue_ids()
     - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
     - drm/xe: Clear pending_disable before signaling suspend fence
     - [arm64,armhf] drm/v3d: Fix vaddr leak when indirect CSD has zeroed
       workgroups
     - drm/amdgpu: restart the CS if some parts of the VM are still invalidated
     - drm/amd/pm: fix smu13 power limit default/cap calculation
     - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2
     - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in
       set_soft_freq_limited_range
     - drm/amd/display: Bound VBIOS record-chain walk loops
     - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
     - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
     - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs
     - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
     - drm/amd/display: Use krealloc_array() in dal_vector_reserve()
     - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
     - driver core: reject devices with unregistered buses
     - mailbox: Fix NULL message support in mbox_send_message()
     - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
     - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()
     - netfilter: nft_fib: fix stale stack leak via the OIFNAME register
     - mm/memory-failure: fix hugetlb_lock AA deadlock in
       get_huge_page_for_hwpoison
     - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper
     - RDMA/umem: Move umem dmabuf revoke logic into helper function
     - RDMA/umem: Add helpers for umem dmabuf revoke lock
     - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
     - RDMA/umem: fix kernel-doc warnings
     - RDMA: Move DMA block iterator logic into dedicated files
     - RDMA/umem: Fix truncation for block sizes >= 4G
     - mm/hugetlb: avoid false positive lockdep assertion
     - mptcp: fix missing wakeups in edge scenarios
     - ipmi:ssif: Remove unnecessary indention
     - ipmi:ssif: NULL thread on error
     - ipvs: skip ipv6 extension headers for csum checks (CVE-2026-45850)
     - vsock/virtio: fix potential unbounded skb queue
     - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc
     - block: fix handling of dead zone write plugs
     - [arm64] cputype: Add NVIDIA Olympus definitions
     - [arm64] cputype: Add C1-Ultra definitions
     - [arm64] cputype: Add C1-Premium definitions
     - [arm64] errata: Mitigate TLBI errata on various Arm CPUs
     - [arm64] errata: Mitigate TLBI errata on NVIDIA Olympus CPU
     - [arm64] errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
     - net: introduce EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL()
     - tcp: use EXPORT_IPV6_MOD[_GPL]()
     - tcp: secure_seq: add back ports to TS offset (CVE-2026-23247)
     - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation
     - vsock/virtio: fix skb overhead overflow on 32-bit builds
     - netfilter: require Ethernet MAC header before using eth_hdr()
 .
   [ Salvatore Bonaccorso ]
   * [rt] Refresh "ARM: enable irq in translation/section permission fault"
   * ip6_vti: set netns_immutable on the fallback device. (CVE-2026-52909)
linux (6.12.90-2) trixie-security; urgency=high
 .
   * smb: client: reject userspace cifs.spnego descriptions
   * net/rds: reset op_nents when zerocopy page pin fails (CVE-2026-43494)
linux (6.12.90-2~bpo12+1) bookworm-backports; urgency=high
 .
   * Rebuild for bookworm-backports
 .
 linux (6.12.90-2) trixie-security; urgency=high
 .
   * smb: client: reject userspace cifs.spnego descriptions
   * net/rds: reset op_nents when zerocopy page pin fails (CVE-2026-43494)
linux (6.12.90-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.89
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.90
     - HID: playstation: Clamp num_touch_reports
     - media: uvcvideo: Enable VB2_DMABUF for metadata stream
     - [arm64] dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux
     - [arm64] regulator: mt6357: fix OF node reference imbalance
     - [arm64,armhf] regulator: rk808: fix OF node reference imbalance
     - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap
     - [amd64] media: intel/ipu6: fix error pointer dereference
     - media: saa7164: add ioremap return checks and cleanups
     - spi: aspeed-smc: fix controller deregistration
     - [amd64] platform/x86: hp-wmi: Ignore backlight and FnLock events
     - vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to
       copy
     - [arm64] drm/msm/gem: fix error handling in
       msm_ioctl_gem_info_get_metadata()
     - [amd64] drm/i915/psr: Init variable to avoid early exit from et alignment
       loop
     - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure
     - drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count.
     - drm/amdgpu: gate VM CPU HDP flush on reset lock
     - drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x
     - drm/amdkfd: Add upper bound check for num_of_nodes
     - drm/amdgpu: Add bounds checking to ib_{get,set}_value
     - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
     - drm/amdgpu/vce: Prevent partial address patches
     - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg
     - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
     - drm/amd/display: Change dither policy for 10 bpc output back to dithering
     - drm/gem: Fix inconsistent plane dimension calculation in
       drm_gem_fb_init_with_funcs()
     - drm/amdkfd: validate SVM ioctl nattr against buffer size
     - drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked()
     - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()
     - drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked()
     - drm/radeon: add missing revision check for CI
     - drm/amdgpu: zero-initialize GART table on allocation
     - drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds
     - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ
     - drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds
     - drm/amdkfd: Make all TLB-flushes heavy-weight
     - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
     - drm/amdgpu/pm: add missing revision check for CI
     - drm/amdgpu/pm: align Hawaii mclk workaround with radeon
     - [arm64] dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22
     - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
     - batman-adv: fix integer overflow on buff_pos
     - batman-adv: reject new tp_meter sessions during teardown
     - batman-adv: stop caching unowned originator pointers in BAT IV
     - batman-adv: bla: prevent use-after-free when deleting claims
     - batman-adv: bla: only purge non-released claims
     - batman-adv: bla: put backbone reference on failed claim hash insert
     - usb: typec: tcpm: reset internal port states on soft reset AMS
     - usb: dwc3: Move GUID programming after PHY initialization
     - ALSA: hda: cs35l56: Propagate ASP TX source control errors
     - ALSA: misc: Use guard() for spin locks
     - ALSA: core: Serialize deferred fasync state checks
     - ALSA: seq: Notify client and port info changes
     - ALSA: seq: Fix UMP group 16 filtering
     - Bluetooth: hci_conn: fix potential UAF in create_big_sync
     - [arm64,armhf] spi: tegra20-sflash: fix controller deregistration
     - [arm64,armhf] spi: tegra114: fix controller deregistration
     - mm/hugetlb_cma: round up per_node before logging it
     - block: cleanup blkdev_report_zones()
     - block: reorganize struct blk_zone_wplug
     - block: fix zone write plug removal
     - tracefs: Fix default permissions not being applied on initial mount
     - fbcon: Avoid OOB font access if console rotation fails
     - mm/damon/core: disallow time-quota setting zero esz
     - mm/damon/core: implement damon_kdamond_pid()
     - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values
     - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values
     - bonding: fix use-after-free due to enslave fail after slave array update
       (CVE-2026-23171)
     - io_uring/kbuf: support min length left for incremental buffers
     - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
     - btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type()
     - btrfs: fix double free in create_space_info_sub_group() error path
     - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to
       info-leak
     - tracing/probes: Limit size of event probe to 3K
     - batman-adv: stop tp_meter sessions during mesh teardown
     - batman-adv: tp_meter: fix tp_num leak on kmalloc failure
     - vsock: fix buffer size clamping order
     - vsock/virtio: fix length and offset in tap skb for split packets
     - vsock/virtio: fix empty payload in tap skb for non-linear buffers
     - vsock/virtio: fix accept queue count leak on transport mismatch
     - drm/amdgpu/vcn3: Avoid overflow on msg bound check
     - drm/amdgpu/vcn4: Avoid overflow on msg bound check
 .
   [ Salvatore Bonaccorso ]
   * Bluetooth: btmtk: accept too short WMT FUNC_CTRL events (Closes: #1136790)
   * net: skbuff: preserve shared-frag marker during coalescing (CVE-2026-46300)
   * net: skbuff: propagate shared-frag marker through frag-transfer helpers
linux (6.12.90-1~bpo12+1) bookworm-backports; urgency=high
 .
   * Rebuild for bookworm-backports
 .
 linux (6.12.90-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.89
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.90
     - HID: playstation: Clamp num_touch_reports
     - media: uvcvideo: Enable VB2_DMABUF for metadata stream
     - [arm64] dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux
     - [arm64] regulator: mt6357: fix OF node reference imbalance
     - [arm64,armhf] regulator: rk808: fix OF node reference imbalance
     - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap
     - [amd64] media: intel/ipu6: fix error pointer dereference
     - media: saa7164: add ioremap return checks and cleanups
     - spi: aspeed-smc: fix controller deregistration
     - [amd64] platform/x86: hp-wmi: Ignore backlight and FnLock events
     - vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to
       copy
     - [arm64] drm/msm/gem: fix error handling in
       msm_ioctl_gem_info_get_metadata()
     - [amd64] drm/i915/psr: Init variable to avoid early exit from et alignment
       loop
     - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure
     - drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count.
     - drm/amdgpu: gate VM CPU HDP flush on reset lock
     - drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x
     - drm/amdkfd: Add upper bound check for num_of_nodes
     - drm/amdgpu: Add bounds checking to ib_{get,set}_value
     - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
     - drm/amdgpu/vce: Prevent partial address patches
     - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg
     - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
     - drm/amd/display: Change dither policy for 10 bpc output back to dithering
     - drm/gem: Fix inconsistent plane dimension calculation in
       drm_gem_fb_init_with_funcs()
     - drm/amdkfd: validate SVM ioctl nattr against buffer size
     - drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked()
     - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()
     - drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked()
     - drm/radeon: add missing revision check for CI
     - drm/amdgpu: zero-initialize GART table on allocation
     - drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds
     - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ
     - drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds
     - drm/amdkfd: Make all TLB-flushes heavy-weight
     - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
     - drm/amdgpu/pm: add missing revision check for CI
     - drm/amdgpu/pm: align Hawaii mclk workaround with radeon
     - [arm64] dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22
     - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
     - batman-adv: fix integer overflow on buff_pos
     - batman-adv: reject new tp_meter sessions during teardown
     - batman-adv: stop caching unowned originator pointers in BAT IV
     - batman-adv: bla: prevent use-after-free when deleting claims
     - batman-adv: bla: only purge non-released claims
     - batman-adv: bla: put backbone reference on failed claim hash insert
     - usb: typec: tcpm: reset internal port states on soft reset AMS
     - usb: dwc3: Move GUID programming after PHY initialization
     - ALSA: hda: cs35l56: Propagate ASP TX source control errors
     - ALSA: misc: Use guard() for spin locks
     - ALSA: core: Serialize deferred fasync state checks
     - ALSA: seq: Notify client and port info changes
     - ALSA: seq: Fix UMP group 16 filtering
     - Bluetooth: hci_conn: fix potential UAF in create_big_sync
     - [arm64,armhf] spi: tegra20-sflash: fix controller deregistration
     - [arm64,armhf] spi: tegra114: fix controller deregistration
     - mm/hugetlb_cma: round up per_node before logging it
     - block: cleanup blkdev_report_zones()
     - block: reorganize struct blk_zone_wplug
     - block: fix zone write plug removal
     - tracefs: Fix default permissions not being applied on initial mount
     - fbcon: Avoid OOB font access if console rotation fails
     - mm/damon/core: disallow time-quota setting zero esz
     - mm/damon/core: implement damon_kdamond_pid()
     - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values
     - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values
     - bonding: fix use-after-free due to enslave fail after slave array update
       (CVE-2026-23171)
     - io_uring/kbuf: support min length left for incremental buffers
     - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
     - btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type()
     - btrfs: fix double free in create_space_info_sub_group() error path
     - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to
       info-leak
     - tracing/probes: Limit size of event probe to 3K
     - batman-adv: stop tp_meter sessions during mesh teardown
     - batman-adv: tp_meter: fix tp_num leak on kmalloc failure
     - vsock: fix buffer size clamping order
     - vsock/virtio: fix length and offset in tap skb for split packets
     - vsock/virtio: fix empty payload in tap skb for non-linear buffers
     - vsock/virtio: fix accept queue count leak on transport mismatch
     - drm/amdgpu/vcn3: Avoid overflow on msg bound check
     - drm/amdgpu/vcn4: Avoid overflow on msg bound check
 .
   [ Salvatore Bonaccorso ]
   * Bluetooth: btmtk: accept too short WMT FUNC_CTRL events (Closes: #1136790)
   * net: skbuff: preserve shared-frag marker during coalescing (CVE-2026-46300)
   * net: skbuff: propagate shared-frag marker through frag-transfer helpers
linux (6.12.88-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.87
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.88
     - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
     - ipmi: Add limits to event and receive message requests
     - ipmi: Check event message buffer response for bad data
     - ipmi:si: Return state to normal if message allocation fails
     - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
     - ACPI: scan: Use acpi_dev_put() in object add error paths
     - ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO
     - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug
     - ACPI: video: force native backlight on HP OMEN 16 (8A44)
     - ASoC: SOF: Don't allow pointer operations on unconfigured streams
     - spi: rockchip: fix controller deregistration
     - ksmbd: rewrite stop_sessions() with restartable iteration
     - mm: convert mm_lock_seq to a proper seqcount
     - [amd64] x86: shadow stacks: proper error handling for mmap lock
       (CVE-2026-43109)
     - [amd64] x86/shstk: Prevent deadlock during shstk sigreturn
     - [amd64] KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
     - [amd64] iommu/amd: Use atomic64_inc_return() in iommu.c
     - [amd64] iommu/amd: serialize sequence allocation under concurrent TLB
       invalidations (CVE-2026-43220) (Closes: #1135313)
     - flow_dissector: do not dissect PPPoE PFC frames
     - net: txgbe: fix RTNL assertion warning when remove module
     - net: af_key: zero aligned sockaddr tail in PF_KEY exports (CVE-2026-43088)
     - [amd64] KVM: SVM: check validity of VMCB controls when returning from SMM
     - net/sched: sch_red: Replace direct dequeue call with peek and
       qdisc_dequeue_peeked
     - Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (CVE-2026-31499)
     - exit: prevent preemption of oopsing TASK_DEAD task
     - wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr
     - wifi: mt76: mt7925: fix incorrect length field in txpower command
     - wifi: mt76: mt7921: fix a potential clc buffer length underflow
     - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work
     - wifi: b43legacy: enforce bounds check on firmware key index in RX path
     - wifi: mac80211: drop stray 'static' from fast-RX rx_result
     - wifi: rsi: fix kthread lifetime race between self-exit and external-stop
     - wifi: mac80211: use safe list iteration in radar detect work
     - wifi: ath5k: do not access array OOB (Closes: #1119093)
     - wifi: mac80211: remove station if connection prep fails
     - wifi: b43: enforce bounds check on firmware key index in b43_rx()
     - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog
       task
     - usb: usblp: fix heap leak in IEEE 1284 device ID via short response
     - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
     - ALSA: usb-audio: midi2: Restart output URBs on resume
     - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()
     - ALSA: usb-audio: Fix UAC3 cluster descriptor size check
     - USB: omap_udc: DMA: Don't enable burst 4 mode
     - USB: serial: option: add Telit Cinterion LE910Cx compositions
     - usb: ulpi: fix memory leak on ulpi_register() error paths
     - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger
     - ALSA: firewire-tascam: Do not drop unread control events
     - xfrm: provide message size for XFRM_MSG_MAPPING
     - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
     - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
     - xfrm: ah: account for ESN high bits in async callbacks
     - selinux: don't reserve xattr slot when we won't fill it
     - selinux: shrink critical section in sel_write_load()
     - selinux: prune /sys/fs/selinux/disable
     - Bluetooth: virtio_bt: clamp rx length before skb_put
     - Bluetooth: virtio_bt: validate rx pkt_type header length
     - Bluetooth: btmtk: validate WMT event SKB length before struct access
     - Bluetooth: hci_event: Fix OOB read and infinite loop in
       hci_le_create_big_complete_evt
     - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
     - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
     - [armhf] spi: sun4i: fix controller deregistration
     - [armhf] spi: ti-qspi: fix controller deregistration
     - spi: sun6i: fix controller deregistration
     - fanotify: fix false positive on permission events
     - [arm64] KVM: arm64: Fix kvm_vcpu_initialized() macro parameter
     - mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()
     - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in
       rtnl_fill_vfinfo
     - sound: ua101: fix division by zero at probe
     - net: libwx: fix VF illegal register access
     - ip6_gre: Use cached t->net in ip6erspan_changelink().
     - net/rds: handle zerocopy send cleanup before the message is queued
     - net: wwan: t7xx: validate port_count against message length in
       t7xx_port_enum_msg_handler
     - hwmon: (ltc2992) Clamp threshold writes to hardware range
     - hwmon: (ltc2992) Fix u32 overflow in power read path
     - clk: rk808: fix OF node reference imbalance
     - hwmon: (corsair-psu) Close HID device on probe errors
     - af_unix: Reject SIOCATMARK on non-stream sockets
     - block: add pgmap check to biovec_phys_mergeable
     - cifs: abort open_cached_dir if we don't request leases
     - cifs: change_conf needs to be called for session setup
     - extcon: ptn5150: handle pending IRQ events during system resume
     - gpio: of: clear OF_POPULATED on hog nodes in remove path
     - hv_sock: fix ARM64 support
     - ibmveth: Disable GSO for packets with small MSS
     - ice: fix double free in ice_sf_eth_activate() error path
     - spi: microchip-core-qspi: fix controller deregistration
     - udf: reject descriptors with oversized CRC length
     - thermal: core: Free thermal zone ID later during removal
     - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata
     - thermal/drivers/sprd: Fix raw temperature clamping in
       sprd_thm_rawdata_to_temp
     - spi: topcliff-pch: fix controller deregistration
     - spi: topcliff-pch: fix use-after-free on unbind
     - clk: imx: imx8-acm: fix flags for acm clocks
     - clk: microchip: mpfs-ccc: fix out of bounds access during output
       registration
     - cpuidle: powerpc: avoid double clear when breaking snooze
     - [amd64] ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in
       quirk table
     - [arm64] ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop
     - [arm64] ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens
     - [arm64] ASoC: qcom: q6apm: remove child devices when apm is removed
     - btrfs: fix double free in create_space_info() error path
     - dm-thin: fix metadata refcount underflow
     - dm: don't report warning when doing deferred remove
     - dm: fix a buffer overflow in ioctl processing
     - eventfs: Hold eventfs_mutex and SRCU when remount walks events
     - dm-verity-fec: correctly reject too-small FEC devices
     - dm-verity-fec: correctly reject too-small hash devices
     - isofs: validate Rock Ridge CE continuation extent against volume size
     - isofs: validate block number from NFS file handle in isofs_export_iget
     - [arm64] iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update
     - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
     - lib/scatterlist: fix length calculations in extract_kvec_to_sg
     - lib/scatterlist: fix temp buffer in extract_user_to_sg()
     - libceph: Fix slab-out-of-bounds access in auth message processing
     - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies
     - nvme-apple: drop invalid put of admin queue reference count
     - nvmet-tcp: fix race between ICReq handling and queue teardown
     - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
     - openvswitch: vport: fix self-deadlock on release of tunnel ports
     - pmdomain: core: Fix detach procedure for virtual devices in genpd
     - [arm64] RDMA/hns: Fix unlocked call to hns_roce_qp_remove()
     - [s390x] debug: Reject zero-length input in debug_input_flush_fn()
     - smb/client: fix out-of-bounds read in smb2_compound_op()
     - smb/client: fix out-of-bounds read in symlink_data()
     - smb: client: use kzalloc to zero-initialize security descriptor buffer
     - smb: client: validate dacloffset before building DACL pointers
     - [amd64] KVM: x86: check for nEPT/nNPT in slow flush hypercalls
     - mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock
     - PCI: Update saved_config_space upon resource assignment (Closes: #1131025)
     - PCI/AER: Clear only error bits in PCIe Device Status
     - PCI/AER: Stop ruling out unbound devices as error source
     - PCI/ASPM: Fix pci_clear_and_set_config_dword() usage
     - power: supply: max17042: avoid overflow when determining health
     - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss()
     - RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()
     - RDMA/mana: Validate rx_hash_key_len
     - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
     - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()
     - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
     - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads
     - RDMA/rxe: Reject unknown opcodes before ICRC processing
     - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
     - mptcp: fastclose msk when linger time is 0
     - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure
     - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure
     - mptcp: sockopt: set timestamp flags on subflow socket, not msk
     - mptcp: fix scheduling with atomic in timestamp sockopt
     - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode()
     - f2fs: fix fiemap boundary handling when read extent cache is incomplete
     - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks()
     - f2fs: fix node_cnt race between extent node destroy and writeback
     - f2fs: fix uninitialized kobject put in f2fs_init_sysfs()
     - [arm64] KVM: arm64: vgic: Fix IIDR revision field extracted from wrong
       value
     - [arm64] KVM: arm64: Fix initialisation order in __pkvm_init_finalise()
     - bpf: Fix use-after-free in arena_vm_close on fork
     - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info
     - fs: prepare for adding LSM blob to backing_file
     - dma-mapping: drop unneeded includes from dma-mapping.h
     - dma-mapping: add __dma_from_device_group_begin()/end()
     - hwmon: (powerz) Avoid cacheline sharing for DMA buffer
     - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs
     - udf: fix partition descriptor append bookkeeping
     - mtd: spinand: winbond: Declare the QE bit on W25NxxJW
     - hfsplus: fix uninit-value by validating catalog record size
     - hfsplus: fix held lock freed on hfsplus_fill_super()
     - erofs: move {in,out}pages into struct z_erofs_decompress_req
     - erofs: tidy up z_erofs_lz4_handle_overlap()
     - erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()
     - gtp: disable BH before calling udp_tunnel_xmit_skb()
     - printk: add print_hex_dump_devel()
     - crypto: caam - guard HMAC key hex dumps in hash_digest_key
     - ALSA: aloop: Fix peer runtime UAF during format-change stop
     - net: stmmac: avoid shadowing global buf_sz
     - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY()
     - net: stmmac: Prevent NULL deref when RX memory exhausted
     - wifi: mt76: mt7925: fix incorrect TLV length in CLC command
     - tracepoint: balance regfunc() on func_add() failure in
       tracepoint_add_func()
     - [arm64] KVM: arm64: Wake-up from WFI when iqrchip is in userspace
     - [amd64] x86/CPU/AMD: Prevent improper isolation of shared resources in
       Zen2's op cache
     - ksmbd: validate inherited ACE SID length
 .
   [ Salvatore Bonaccorso ]
   * ptrace: slightly saner 'get_dumpable()' logic
linux (6.12.88-1~bpo12+1) bookworm-backports; urgency=high
 .
   * Rebuild for bookworm-backports
 .
 linux (6.12.88-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.87
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.88
     - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
     - ipmi: Add limits to event and receive message requests
     - ipmi: Check event message buffer response for bad data
     - ipmi:si: Return state to normal if message allocation fails
     - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
     - ACPI: scan: Use acpi_dev_put() in object add error paths
     - ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO
     - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug
     - ACPI: video: force native backlight on HP OMEN 16 (8A44)
     - ASoC: SOF: Don't allow pointer operations on unconfigured streams
     - spi: rockchip: fix controller deregistration
     - ksmbd: rewrite stop_sessions() with restartable iteration
     - mm: convert mm_lock_seq to a proper seqcount
     - [amd64] x86: shadow stacks: proper error handling for mmap lock
       (CVE-2026-43109)
     - [amd64] x86/shstk: Prevent deadlock during shstk sigreturn
     - [amd64] KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
     - [amd64] iommu/amd: Use atomic64_inc_return() in iommu.c
     - [amd64] iommu/amd: serialize sequence allocation under concurrent TLB
       invalidations (CVE-2026-43220) (Closes: #1135313)
     - flow_dissector: do not dissect PPPoE PFC frames
     - net: txgbe: fix RTNL assertion warning when remove module
     - net: af_key: zero aligned sockaddr tail in PF_KEY exports (CVE-2026-43088)
     - [amd64] KVM: SVM: check validity of VMCB controls when returning from SMM
     - net/sched: sch_red: Replace direct dequeue call with peek and
       qdisc_dequeue_peeked
     - Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (CVE-2026-31499)
     - exit: prevent preemption of oopsing TASK_DEAD task
     - wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr
     - wifi: mt76: mt7925: fix incorrect length field in txpower command
     - wifi: mt76: mt7921: fix a potential clc buffer length underflow
     - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work
     - wifi: b43legacy: enforce bounds check on firmware key index in RX path
     - wifi: mac80211: drop stray 'static' from fast-RX rx_result
     - wifi: rsi: fix kthread lifetime race between self-exit and external-stop
     - wifi: mac80211: use safe list iteration in radar detect work
     - wifi: ath5k: do not access array OOB (Closes: #1119093)
     - wifi: mac80211: remove station if connection prep fails
     - wifi: b43: enforce bounds check on firmware key index in b43_rx()
     - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog
       task
     - usb: usblp: fix heap leak in IEEE 1284 device ID via short response
     - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
     - ALSA: usb-audio: midi2: Restart output URBs on resume
     - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()
     - ALSA: usb-audio: Fix UAC3 cluster descriptor size check
     - USB: omap_udc: DMA: Don't enable burst 4 mode
     - USB: serial: option: add Telit Cinterion LE910Cx compositions
     - usb: ulpi: fix memory leak on ulpi_register() error paths
     - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger
     - ALSA: firewire-tascam: Do not drop unread control events
     - xfrm: provide message size for XFRM_MSG_MAPPING
     - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
     - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
     - xfrm: ah: account for ESN high bits in async callbacks
     - selinux: don't reserve xattr slot when we won't fill it
     - selinux: shrink critical section in sel_write_load()
     - selinux: prune /sys/fs/selinux/disable
     - Bluetooth: virtio_bt: clamp rx length before skb_put
     - Bluetooth: virtio_bt: validate rx pkt_type header length
     - Bluetooth: btmtk: validate WMT event SKB length before struct access
     - Bluetooth: hci_event: Fix OOB read and infinite loop in
       hci_le_create_big_complete_evt
     - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
     - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
     - [armhf] spi: sun4i: fix controller deregistration
     - [armhf] spi: ti-qspi: fix controller deregistration
     - spi: sun6i: fix controller deregistration
     - fanotify: fix false positive on permission events
     - [arm64] KVM: arm64: Fix kvm_vcpu_initialized() macro parameter
     - mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()
     - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in
       rtnl_fill_vfinfo
     - sound: ua101: fix division by zero at probe
     - net: libwx: fix VF illegal register access
     - ip6_gre: Use cached t->net in ip6erspan_changelink().
     - net/rds: handle zerocopy send cleanup before the message is queued
     - net: wwan: t7xx: validate port_count against message length in
       t7xx_port_enum_msg_handler
     - hwmon: (ltc2992) Clamp threshold writes to hardware range
     - hwmon: (ltc2992) Fix u32 overflow in power read path
     - clk: rk808: fix OF node reference imbalance
     - hwmon: (corsair-psu) Close HID device on probe errors
     - af_unix: Reject SIOCATMARK on non-stream sockets
     - block: add pgmap check to biovec_phys_mergeable
     - cifs: abort open_cached_dir if we don't request leases
     - cifs: change_conf needs to be called for session setup
     - extcon: ptn5150: handle pending IRQ events during system resume
     - gpio: of: clear OF_POPULATED on hog nodes in remove path
     - hv_sock: fix ARM64 support
     - ibmveth: Disable GSO for packets with small MSS
     - ice: fix double free in ice_sf_eth_activate() error path
     - spi: microchip-core-qspi: fix controller deregistration
     - udf: reject descriptors with oversized CRC length
     - thermal: core: Free thermal zone ID later during removal
     - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata
     - thermal/drivers/sprd: Fix raw temperature clamping in
       sprd_thm_rawdata_to_temp
     - spi: topcliff-pch: fix controller deregistration
     - spi: topcliff-pch: fix use-after-free on unbind
     - clk: imx: imx8-acm: fix flags for acm clocks
     - clk: microchip: mpfs-ccc: fix out of bounds access during output
       registration
     - cpuidle: powerpc: avoid double clear when breaking snooze
     - [amd64] ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in
       quirk table
     - [arm64] ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop
     - [arm64] ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens
     - [arm64] ASoC: qcom: q6apm: remove child devices when apm is removed
     - btrfs: fix double free in create_space_info() error path
     - dm-thin: fix metadata refcount underflow
     - dm: don't report warning when doing deferred remove
     - dm: fix a buffer overflow in ioctl processing
     - eventfs: Hold eventfs_mutex and SRCU when remount walks events
     - dm-verity-fec: correctly reject too-small FEC devices
     - dm-verity-fec: correctly reject too-small hash devices
     - isofs: validate Rock Ridge CE continuation extent against volume size
     - isofs: validate block number from NFS file handle in isofs_export_iget
     - [arm64] iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update
     - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
     - lib/scatterlist: fix length calculations in extract_kvec_to_sg
     - lib/scatterlist: fix temp buffer in extract_user_to_sg()
     - libceph: Fix slab-out-of-bounds access in auth message processing
     - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies
     - nvme-apple: drop invalid put of admin queue reference count
     - nvmet-tcp: fix race between ICReq handling and queue teardown
     - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
     - openvswitch: vport: fix self-deadlock on release of tunnel ports
     - pmdomain: core: Fix detach procedure for virtual devices in genpd
     - [arm64] RDMA/hns: Fix unlocked call to hns_roce_qp_remove()
     - [s390x] debug: Reject zero-length input in debug_input_flush_fn()
     - smb/client: fix out-of-bounds read in smb2_compound_op()
     - smb/client: fix out-of-bounds read in symlink_data()
     - smb: client: use kzalloc to zero-initialize security descriptor buffer
     - smb: client: validate dacloffset before building DACL pointers
     - [amd64] KVM: x86: check for nEPT/nNPT in slow flush hypercalls
     - mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock
     - PCI: Update saved_config_space upon resource assignment (Closes: #1131025)
     - PCI/AER: Clear only error bits in PCIe Device Status
     - PCI/AER: Stop ruling out unbound devices as error source
     - PCI/ASPM: Fix pci_clear_and_set_config_dword() usage
     - power: supply: max17042: avoid overflow when determining health
     - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss()
     - RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()
     - RDMA/mana: Validate rx_hash_key_len
     - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
     - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()
     - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
     - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads
     - RDMA/rxe: Reject unknown opcodes before ICRC processing
     - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
     - mptcp: fastclose msk when linger time is 0
     - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure
     - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure
     - mptcp: sockopt: set timestamp flags on subflow socket, not msk
     - mptcp: fix scheduling with atomic in timestamp sockopt
     - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode()
     - f2fs: fix fiemap boundary handling when read extent cache is incomplete
     - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks()
     - f2fs: fix node_cnt race between extent node destroy and writeback
     - f2fs: fix uninitialized kobject put in f2fs_init_sysfs()
     - [arm64] KVM: arm64: vgic: Fix IIDR revision field extracted from wrong
       value
     - [arm64] KVM: arm64: Fix initialisation order in __pkvm_init_finalise()
     - bpf: Fix use-after-free in arena_vm_close on fork
     - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info
     - fs: prepare for adding LSM blob to backing_file
     - dma-mapping: drop unneeded includes from dma-mapping.h
     - dma-mapping: add __dma_from_device_group_begin()/end()
     - hwmon: (powerz) Avoid cacheline sharing for DMA buffer
     - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs
     - udf: fix partition descriptor append bookkeeping
     - mtd: spinand: winbond: Declare the QE bit on W25NxxJW
     - hfsplus: fix uninit-value by validating catalog record size
     - hfsplus: fix held lock freed on hfsplus_fill_super()
     - erofs: move {in,out}pages into struct z_erofs_decompress_req
     - erofs: tidy up z_erofs_lz4_handle_overlap()
     - erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()
     - gtp: disable BH before calling udp_tunnel_xmit_skb()
     - printk: add print_hex_dump_devel()
     - crypto: caam - guard HMAC key hex dumps in hash_digest_key
     - ALSA: aloop: Fix peer runtime UAF during format-change stop
     - net: stmmac: avoid shadowing global buf_sz
     - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY()
     - net: stmmac: Prevent NULL deref when RX memory exhausted
     - wifi: mt76: mt7925: fix incorrect TLV length in CLC command
     - tracepoint: balance regfunc() on func_add() failure in
       tracepoint_add_func()
     - [arm64] KVM: arm64: Wake-up from WFI when iqrchip is in userspace
     - [amd64] x86/CPU/AMD: Prevent improper isolation of shared resources in
       Zen2's op cache
     - ksmbd: validate inherited ACE SID length
 .
   [ Salvatore Bonaccorso ]
   * ptrace: slightly saner 'get_dumpable()' logic

linux-signed-amd64 (6.12.94+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.94-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.91
     - io_uring/kbuf: use mem_is_zero()
     - blk-cgroup: wait for blkcg cleanup before initializing new disk
     - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START
     - fs/mbcache: cancel shrink work before destroying the cache
     - md/raid1: fix the comparing region of interval tree
     - drbd: Balance RCU calls in drbd_adm_dump_devices()
     - loop: fix partition scan race between udev and loop_reread_partitions()
     - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()
     - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()
     - pstore/ram: fix resource leak when ioremap() fails
     - md: wake raid456 reshape waiters before suspend
     - btrfs: pass struct btrfs_inode to clone_copy_inline_extent()
     - btrfs: fix deadlock between reflink and transaction commit when using
       flushoncommit
     - [amd64] ACPI: x86: cmos_rtc: Clean up address space handler driver
     - [amd64] ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver
     - devres: fix missing node debug info in devm_krealloc()
     - thermal/drivers/spear: Fix error condition for reading st,thermal-flags
     - debugfs: check for NULL pointer in debugfs_create_str()
     - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str()
     - soundwire: debugfs: initialize firmware_file to empty string
     - PCI: use generic driver_override infrastructure
     - platform/wmi: use generic driver_override infrastructure
     - [s390x] cio: use generic driver_override infrastructure
     - bus: fsl-mc: use generic driver_override infrastructure
     - irqchip/irq-pic32-evic: Address warning related to wrong printf()
       formatter
     - hrtimers: Update the return type of enqueue_hrtimer()
     - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns()
     - hrtimer: Reduce trace noise in hrtimer_start()
     - locking: Fix rwlock support in <linux/spinlock_up.h>
     - firmware: dmi: Correct an indexing error in dmi.h
     - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt()
     - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished
       irq_prepare_bcn_tasklet
     - bpf: test_run: Fix the null pointer dereference issue in
       bpf_lwt_xmit_push_encap
     - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH
     - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n
     - [s390x] bpf: Zero-extend bpf prog return values and kfunc arguments
     - params: Replace __modinit with __init_or_module
     - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n
     - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in
       mt76_connac2_tx_check_aggr()
     - wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control
     - wifi: mt76: mt7615: fix use_cts_prot support
     - wifi: mt76: mt7915: fix use_cts_prot support
     - wifi: mt76: mt7925: prevent NULL pointer dereference in
       mt7925_tx_check_aggr()
     - wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi
     - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor
     - wifi: mt76: mt7921: Place upper limit on station AID
     - [arm64] cpufeature: Make PMUVer and PerfMon unsigned
     - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event
     - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()
     - wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()
     - wifi: mt76: mt7921: fix 6GHz regulatory update on connection
     - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path
     - bpf: Fix variable length stack write over spilled pointers
     - bpf,arc_jit: Fix missing newline in pr_err messages
     - wifi: rtw89: phy: fix uninitialized variable access in
       rtw89_phy_cfo_set_crystal_cap()
     - r8152: fix incorrect register write to USB_UPHY_XTAL
     - [powerpc*] crash: fix backup region offset update to elfcorehdr
     - [powerpc*] crash: Update backup region offset in elfcorehdr on memory
       hotplug
     - macvlan: annotate data-races around port->bc_queue_len_used
     - bpf: fix end-of-list detection in cgroup_storage_get_next_key()
     - bpf: Fix stale offload->prog pointer after constant blinding
     - wifi: brcmfmac: Fix error pointer dereference
     - wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode()
     - bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks
     - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()
     - wifi: ath10k: fix station lookup failure during disconnect
     - ACPI: AGDI: fix missing newline in error message
     - [arm64] kexec: Remove duplicate allocation for trans_pgd
     - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
     - net: bcmgenet: add bcmgenet_has_* helpers
     - net: bcmgenet: move DESC_INDEX flow to ring 0
     - net: bcmgenet: support reclaiming unsent Tx packets
     - net: bcmgenet: switch to use 64bit statistics
     - net: bcmgenet: fix racing timeout handler
     - eth: fbnic: Use wake instead of start
     - netfilter: xt_socket: enable defrag after all other checks
     - netfilter: nft_fwd_netdev: check ttl/hl before forwarding
     - bpf: fix mm lifecycle in open-coded task_vma iterator
     - bpf: switch task_vma iterator from mmap_lock to per-VMA locks
     - bpf: return VMA snapshot from task_vma iterator
     - bpf: Fix RCU stall in bpf_fd_array_map_clear()
     - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf
     - bpf: Relax scalar id equivalence for state pruning
     - bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars
     - net/sched: act_ct: Only release RCU read lock after ct_ft
     - net: airoha: Implement BQL support
     - net: airoha: Add missing RX_CPU_IDX() configuration in
       airoha_qdma_cleanup_rx_queue()
     - bpf: Allow instructions with arena source and non-arena dest registers
     - net/rds: Optimize rds_ib_laddr_check
     - net/rds: Restrict use of RDS/IB to the initial network namespace
     - bpf: Fix OOB in pcpu_init_value
     - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
     - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG
     - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+
     - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110
     - net: phy: fix a return path in get_phy_c45_ids()
     - net/mlx5e: Fix features not applied during netdev registration
     - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic()
     - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb
     - Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU
     - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error
     - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
     - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
     - Bluetooth: SCO: check for codecs->num_codecs == 1 before assigning to
       sco_pi(sk)->codec
     - net: phy: qcom: at803x: Use the correct bit to disable extended next page
     - ipv4: udp: fix typos in comments
     - ipv6: udp: fix typos in comments
     - udp: Force compute_score to always inline
     - tcp: Don't set treq->req_usec_ts in cookie_tcp_reqsk_init().
     - sctp: fix missing encap_port propagation for GSO fragments
     - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master
     - drm/komeda: fix integer overflow in AFBC framebuffer size check
     - ASoC: SOF: ipc3: Use standard dev_dbg API
     - ASoC: add symmetric_ prefix for dai->rate/channels/sample_bits
     - ASoC: soc-compress: use function to clear symmetric params
     - drm/sun4i: backend: fix error pointer dereference
     - ASoC: sti: Return errors from regmap_field_alloc()
     - ASoC: sti: use managed regmap_field allocations
     - dm cache: fix null-deref with concurrent writes in passthrough mode
     - dm cache: fix write path cache coherency in passthrough mode
     - dm cache: fix write hang in passthrough mode
     - dm cache policy smq: fix missing locks in invalidating cache blocks
     - dm cache: fix concurrent write failure in passthrough mode
     - dm cache: support shrinking the origin device
     - dm cache: fix dirty mapping checking in passthrough mode switching
     - platform/chrome: chromeos_tbmc: Drop wakeup source on remove
     - PCI: endpoint: Align pci_epc_set_msix(), pci_epc_ops::set_msix() nr_irqs
       encoding
     - PCI: dwc: ep: Fix MSI-X Table Size configuration in dw_pcie_ep_set_msix()
     - PCI: dwc: Invoke post_init in dw_pcie_resume_noirq()
     - PCI: dwc: Perform cleanup in the error path of dw_pcie_resume_noirq()
     - dm cache metadata: fix memory leak on metadata abort retry
     - dm log: fix out-of-bounds write due to region_count overflow
     - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in
       atomic_enable()
     - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to
       drm_bridge_funcs
     - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge
       atomic check
     - spi: spi-nxp-fspi: enable runtime pm for fspi
     - spi: nxp-fspi: Use reinit_completion() for repeated operations
     - spi: fsl-qspi: Use reinit_completion() for repeated operations
     - media: i2c: og01a1b: Replace client->dev usage
     - media: i2c: og01a1b: Fix V4L2 subdevice data initialization on probe
     - drm/v3d: Handle error from drm_sched_entity_init()
     - drm/sun4i: Fix resource leaks
     - drm/amdgpu: Add default case in DVI mode validation
     - dm init: ensure device probing has finished in dm-mod.waitfor=
     - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build
       break
     - crypto: tegra - finalize crypto req on error
     - crypto: tegra - Transfer HASH init function to crypto engine
     - crypto: tegra - Reserve keyslots to allocate dynamically
     - crypto: tegra - Disable softirqs before finalizing request
     - crypto: atmel - Use unregister_{aeads,ahashes,skciphers}
     - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs
     - padata: Remove cpu online check from cpu add and removal
     - padata: Put CPU offline callback in ONLINE section to allow failure
     - PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the
       documentation
     - drm/amdgpu/gfx10: look at the right prop for gfx queue priority
     - drm/amdgpu/gfx11: look at the right prop for gfx queue priority
     - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo
     - drm/imagination: Switch reset_reason fields from enum to u32
     - iommu/tegra241-cmdqv: Set supports_cmd op in tegra241_vcmdq_hw_init()
     - [arm64] drm/msm/dpu: fix mismatch between power and frequency
     - [arm64] drm/msm/dsi: add the missing parameter description
     - [arm64] drm/msm/dsi: fix bits_per_pclk
     - [arm64] drm/msm/dsi: fix hdisplay calculation for CMD mode panel
     - [arm64] drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0
     - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first
     - drm/panel: simple: Correct G190EAN01 prepare timing
     - PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion
       support
     - ALSA: core: Validate compress device numbers without dynamic minors
     - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled
     - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs
     - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock
     - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0
     - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels
     - drm/amd/pm/ci: Fill DW8 fields from SMC
     - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board
     - drm/amdgpu: add amdgpu_device reference in ip block
     - drm/amdgpu: update the handle ptr in dump_ip_state
     - drm/amdgpu: update the handle ptr in early_init
     - drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled
     - hwmon: Switch back to struct platform_driver::remove()
     - hwmon: (aspeed-g6-pwm-tach): remove redundant driver remove callback
     - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace
       '}')
     - [amd64] ASoC: SOF: Intel: hda: Place check before dereference
     - [arm64] drm/msm/a6xx: Fix HLSQ register dumping
     - [arm64] drm/msm/shrinker: Fix can_block() logic
     - [arm64] drm/msm/a6xx: Fix dumping A650+ debugbus blocks
     - [arm64] drm/msm/a6xx: Use barriers while updating HFI Q headers
     - pmdomain: ti: omap_prm: Fix a reference leak on device node
     - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe()
     - PM: domains: De-constify fields in struct dev_pm_domain_attach_data
     - ASoC: fsl_micfil: Add access property for "VAD Detected"
     - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable()
     - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode()
     - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state()
     - ASoC: fsl_micfil: Fix event generation in micfil_quality_set()
     - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put()
     - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put()
     - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits()
     - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits()
     - ASoC: fsl_easrc: Change the type for iec958 channel status controls
     - [amd64] iommu/amd: Remove protection_domain.dev_cnt variable
     - [amd64] iommu/amd: xarray to track protection_domain->iommu list
     - [amd64] iommu/amd: Do not detach devices in domain free path
     - [amd64] iommu/amd: Reduce domain lock scope in attach device path
     - [amd64] iommu/amd: Rearrange attach device code
     - [amd64] iommu/amd: Convert dev_data lock from spinlock to mutex
     - [amd64] iommu/amd: Introduce helper function to update 256-bit DTE
     - [amd64] iommu/amd: Introduce helper function get_dte256()
     - [amd64] iommu/amd: Fix clone_alias() to use the original device's devid
     - [arm64] ASoC: qcom: qdsp6: topology: check widget type before accessing
       data
     - crypto: qat - introduce fuse array
     - crypto: qat - disable 4xxx AE cluster when lead engine is fused off
     - crypto: qat - disable 420xx AE cluster when lead engine is fused off
     - crypto: qat - fix type mismatch in RAS sysfs show functions
     - crypto: qat - use swab32 macro
     - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]
     - PCI: Enable AtomicOps only if Root Port supports them
     - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found
     - Documentation: fix a hugetlbfs reservation statement
     - ALSA: scarlett2: Add missing sentinel initializer field
     - ASoC: SOF: compress: return the configured codec from get_params
     - PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports
     - PCI: tegra194: Fix polling delay for L2 state
     - PCI: tegra194: Increase LTSSM poll time on surprise link down
     - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link
       down
     - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in
       tegra_pcie_downstream_dev_to_D0()
     - PCI: tegra194: Don't force the device into the D0 state before L2
     - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode
     - PCI: tegra194: Use devm_gpiod_get_optional() to parse
       "nvidia,refclk-select"
     - PCI: tegra194: Disable direct speed change for Endpoint mode
     - PCI: tegra194: Set LTR message request before PCIe link up in Endpoint
       mode
     - PCI: tegra194: Allow system suspend when the Endpoint link is not up
     - PCI: tegra194: Free up Endpoint resources during remove()
     - PCI: tegra194: Use DWC IP core version
     - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well
     - PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on
     - spi: mtk-snfi: unregister ECC engine on probe failure and remove()
       callback
     - ALSA: sc6000: Keep the programmed board state in card-private data
     - dm cache: fix missing return in invalidate_committed's error path
     - crypto: jitterentropy - replace long-held spinlock with mutex
     - ALSA: hda/realtek - fixed speaker no sound update
     - gfs2: Call unlock_new_inode before d_instantiate
     - net/socket.c: switch to CLASS(fd)
     - fdget(), trivial conversions
     - fanotify: call fanotify_events_supported() before path_permission() and
       security_path_notify()
     - quota: Fix race of dquot_scan_active() with quota deactivation
     - gfs2: add some missing log locking
     - gfs2: prevent NULL pointer dereference during unmount
     - efi/capsule-loader: fix incorrect sizeof in phys array reallocation
     - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine
     - [arm64] dts: mediatek: mt8365: Describe infracfg-nao as a pure syscon
     - memory: tegra124-emc: Fix dll_change check
     - memory: tegra30-emc: Fix dll_change check
     - [arm64] dts: imx8-apalis: Fix LEDs name collision
     - [arm64] dts: rockchip: Make Jaguar PCIe-refclk pin use pull-up config
     - [arm64] dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO
       (M.2 W_DISABLE1)
     - iommufd: vfio compatibility extension check for noiommu mode
     - [arm64] dts: mediatek: mt6795: Fix gpio-ranges pin count
     - [arm64] dts: mediatek: mt7981b: Fix gpio-ranges pin count
     - [arm64] dts: mediatek: mt7986a: Fix gpio-ranges pin count
     - [arm64] dts: qcom: msm8953-xiaomi-vince: correct wled ovp value
     - [arm64] dts: qcom: msm8953-xiaomi-daisy: fix backlight
     - [arm64] dts: rockchip: Fix Bluetooth stability on LCKFB TaiShan Pi
     - [arm64] dts: rockchip: Correct Fan Supply for Gameforce Ace
     - [arm64] dts: rockchip: Correct Joystick Axes on Gameforce Ace
     - [arm64] soc: qcom: ocmem: make the core clock optional
     - [arm64] soc: qcom: ocmem: register reasons for probe deferrals
     - [arm64] soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available
     - bus: rifsc: fix RIF configuration check for peripherals
     - [arm64] dts: qcom: sm8450: Fix GIC_ITS range length
     - [arm64] dts: qcom: sm8550: Fix GIC_ITS range length
     - [arm64] dts: qcom: sm8650: Fix GIC_ITS range length
     - [arm64] dts: qcom: sm8550: Fix xo clock supply of platform SD host
       controller
     - [arm64] dts: qcom: sm8650: Fix xo clock supply of SD host controller
     - [arm64] dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes
     - [arm64] dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes
     - [arm64] dts: qcom: sm8650: Enable UHS-I SDR50 and SDR104 SD card modes
     - [arm64] dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl
     - [arm64] dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered
       during boot
     - [arm64] dts: ti: k3-am62p5-sk: Disable MMC1 internal pulls on data pins
     - [arm64] dts: ti: k3-am62-lp-sk: Enable internal pulls for MMC0 data pins
     - [arm64] dts: ti: k3-am62-verdin: Fix SPI_1 GPIO CS pinctrl label
     - [arm64] dts: freescale: imx8mp-tqma8mpql-mba8mp-ras314: fix UART1 RTS/CTS
       muxing
     - [arm64] dts: lx2160a: change i2c0 (iic1) pinmux mask to one bit
     - [arm64] dts: lx2160a: remove duplicate pinmux nodes
     - [arm64] dts: lx2160a: rename pinmux nodes for readability
     - [arm64] dts: lx2160a: add sda gpio references for i2c bus recovery
     - [arm64] dts: lx2160a: change zeros to hexadecimal in pinmux nodes
     - [arm64] dts: lx2160a: complete pinmux for rcwsr12 configuration word
     - [arm64] dts: imx8qm-mek: switch Type-C connector power-role to dual
     - [arm64] dts: imx8qxp-mek: switch Type-C connector power-role to dual
     - soc/tegra: cbb: Set ERD on resume for err interrupt
     - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure
     - ocfs2/dlm: validate qr_numregions in dlm_match_regions()
     - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
     - soc: qcom: llcc: fix v1 SB syndrome register offset
     - [arm64] soc: qcom: aoss: compare against normalized cooling state
     - [arm64] dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP
     - [arm64] xor: fix conflicting attributes for xor_block_template
     - firmware: arm_ffa: Use the correct buffer size during RXTX_MAP
     - ocfs2: fix listxattr handling when the buffer is full
     - ocfs2: validate bg_bits during freefrag scan
     - ocfs2: validate group add input before caching
     - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void
       function
     - soundwire: bus: demote UNATTACHED state warnings to dev_dbg()
     - dmaengine: mxs-dma: Fix missing return value from
       of_dma_controller_register()
     - soundwire: cadence: Clear message complete before signaling waiting thread
     - tracing: Rebuild full_name on each hist_field_name() call
     - hte: tegra194: remove Kconfig dependency on Tegra194 SoC
     - remoteproc: xlnx: Fix sram property parsing
     - ima: check return value of crypto_shash_final() in boot aggregate
     - HID: asus: make asus_resume adhere to linux kernel coding standards
     - HID: asus: do not abort probe when not necessary
     - mtd: physmap_of_gemini: Fix disabled pinctrl state check
     - ima_fs: don't bother with removal of files in directory we'll be removing
     - ima_fs: get rid of lookup-by-dentry stuff
     - ima_fs: Correctly create securityfs files for unsupported hash algos
     - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range
     - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations
     - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook
     - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook
     - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation
     - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask
     - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path
     - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions
     - cxl/pci: Check memdev driver binding status in cxl_reset_done()
     - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob
     - HID: usbhid: fix deadlock in hid_post_reset()
     - ext4: fix possible null-ptr-deref in mbt_kunit_exit()
     - [arm64] bpf, arm64: Fix off-by-one in check_imm signed range check
     - bpf, sockmap: Fix af_unix iter deadlock
     - bpf, sockmap: Fix af_unix null-ptr-deref in proto update
     - bpf, sockmap: Take state lock for af_unix iter
     - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check
     - bpf: Fix NULL deref in map_kptr_match_type for scalar regs
     - bpf: allow UTF-8 literals in bpf_bprintf_prepare()
     - bpf: Validate node_id in arena_alloc_pages()
     - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT
     - pinctrl: pinctrl-pic32: Fix resource leak
     - pinctrl: cy8c95x0: remove duplicate error message
     - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe()
     - pinctrl: cy8c95x0: Avoid returning positive values to user space
     - perf branch: Avoid incrementing NULL
     - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace
     - pinctrl: realtek: Fix function signature for config argument
     - pinctrl: abx500: Fix type of 'argument' variable
     - pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT} registers
     - perf lock: Fix option value type in parse_max_stack
     - perf stat: Fix opt->value type for parse_cache_level
     - perf tools: Fix module symbol resolution for non-zero .text sh_addr
     - perf expr: Return -EINVAL for syntax error in expr__find_ids()
     - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure
     - ipmi: ssif_bmc: fix message desynchronization after truncated response
     - ipmi: ssif_bmc: change log level to dbg in irq callback
     - perf evsel: Add alternate_hw_config and use in evsel__match
     - perf tool_pmu: Factor tool events into their own PMU
     - perf python: Add parse_events function
     - perf cgroup: Update metric leader in evlist__expand_cgroup
     - perf maps: Fix copy_from that can break sorted by name order
     - perf util: Kill die() prototype, dead for a long time
     - reset: replace boolean parameters with flags parameter
     - reset: Add devres helpers to request pre-deasserted reset controls
     - i3c: master: dw-i3c: Fix missing reset assertion in remove() callback
     - i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers()
     - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status
     - backlight: sky81452-backlight: Check return value of
       devm_gpiod_get_optional() in sky81452_bl_parse_dt()
     - platform/surface: surfacepro3_button: Drop wakeup source on remove
     - leds: lgm-sso: Remove duplicate assignments for priv->mmap
     - tty: hvc_iucv: fix off-by-one in number of supported devices
     - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup
     - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata()
     - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist()
     - [amd64] platform/x86: asus-wmi: adjust screenpad power/brightness handling
     - [amd64] platform/x86: asus-wmi: fix screenpad brightness range
     - tty: serial: ip22zilog: Fix section mispatch warning
     - fs/ntfs3: terminate the cached volume label after UTF-8 conversion
     - [amd64] platform/x86: dell_rbu: avoid uninit value usage in
       packet_size_write()
     - [amd64] platform/x86: dell-wmi-sysman: bound enumeration string
       aggregation
     - RDMA/core: Prefer NLA_NUL_STRING
     - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source
     - scsi: sg: Fix sysctl sg-big-buff register during sg_init()
     - scsi: sg: Resolve soft lockup issue when opening /dev/sgX
     - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from
       byte_div_clk_src dividers
     - clk: qcom: dispcc-sm4450: Fix DSI byte clock rate setting
     - scsi: target: core: Fix integer overflow in UNMAP bounds check
     - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs
     - clk: qcom: gcc-sc8180x: Add missing GDSCs
     - clk: qcom: gcc-sc8180x: Use retention for USB power domains
     - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains
     - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk
     - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks
     - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed()
     - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels()
     - clk: imx8mq: Correct the CSI PHY sels
     - [amd64] x86/um/vdso: Drop VDSO64-y from Makefile
     - clk: qoriq: avoid format string warning
     - clk: xgene: Fix mapping leak in xgene_pllclk_init()
     - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets
     - clk: qcom: dispcc-sc7180: Add missing MDSS resets
     - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug()
     - clk: qcom: gcc-x1e80100: Keep GCC USB QTB clock always ON
     - clk: visconti: pll: initialize clk_init_data to zero
     - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()
     - [amd64] drm/i915: Relocate the SKL wm sanitation code
     - [amd64] drm/i915/wm: Verify the correct plane DDB entry
     - crypto: sa2ul - Fix AEAD fallback algorithm names
     - crypto: ccp - copy IV using skcipher ivsize
     - erofs: add encoded extent on-disk definition
     - erofs: do sanity check on m->type in z_erofs_load_compact_lcluster()
     - erofs: avoid infinite loops due to corrupted subpage compact indexes
       (CVE-2025-68251)
     - erofs: unify lcn as u64 for 32-bit platforms
     - [arm64] dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mp-navqp: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT
     - PCMCIA: Fix garbled log messages for KERN_CONT
     - [arm64] dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT
     - [arm64] dts: marvell: armada-37xx: use 'usb2-phy' in USB3 controller's
       phy-names
     - net/sched: act_mirred: fix wrong device for mac_header_xmit check in
       tcf_blockcast_redir
     - macvlan: fix macvlan_get_size() not reserving space for
       IFLA_MACVLAN_BC_CUTOFF
     - net/sched: sch_cake: fix NAT destination port not being updated in
       cake_update_flowkeys
     - nexthop: fix IPv6 route referencing IPv4 nexthop
     - net/sched: taprio: fix use-after-free in advance_sched() on schedule
       switch
     - tcp: add data-race annotations around tp->data_segs_out and
       tp->total_retrans
     - tcp: add data-race annotations for TCP_NLA_SNDQ_SIZE
     - tcp: annotate data-races around tp->bytes_sent
     - tcp: annotate data-races around tp->bytes_retrans
     - tcp: annotate data-races around tp->dsack_dups
     - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt)
     - tcp: annotate data-races around tp->plb_rehash
     - ice: update PCS latency settings for E825 10G/25Gb modes
     - ice: Remove jumbo_remove step from TX path
     - ice: fix double-free of tx_buf skb
     - ice: fix ICE_AQ_LINK_SPEED_M for 200G
     - i40e: don't advertise IFF_SUPP_NOFCS
     - e1000e: Unroll PTP in probe error handling
     - ipv6: fix possible UAF in icmpv6_rcv()
     - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
     - pppoe: drop PFC frames
     - net/mlx5: Fix HCA caps leak on notifier init failure
     - openvswitch: cap upcall PID array size and pre-size vport replies
     - netfilter: nft_osf: restrict it to ipv4
     - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
     - netfilter: conntrack: remove sprintf usage
     - netfilter: xtables: restrict several matches to inet family
     - ipvs: fix MTU check for GSO packets in tunnel mode
     - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
     - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
     - slip: reject VJ receive packets on instances with no rstate array
     - slip: bound decode() reads against the compressed packet length
     - [arm64] dts: meson-gxl-p230: fix ethernet PHY interrupt number
     - pwm: atmel-tcb: Cache clock rates and mark chip as atomic
     - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy()
     - ksmbd: destroy async_ida in ksmbd_conn_free()
     - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open
     - ksmbd: scope conn->binding slowpath to bound sessions only
     - net/rds: zero per-item info buffer before handing it to visitors
     - ice: fix timestamp interrupt configuration for E825C
     - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g
     - net_sched: sch_hhf: annotate data-races in hhf_dump_stats()
     - net/sched: sch_pie: annotate data-races in pie_dump_stats()
     - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats()
     - net/sched: sch_red: annotate data-races in red_dump_stats()
     - net/sched: sch_sfb: annotate data-races in sfb_dump_stats()
     - net: dsa: realtek: rtl8365mb: fix mode mask calculation
     - net: airoha: Move ndesc initialization at end of
       airoha_qdma_init_rx_queue()
     - virtio_net: Split struct virtio_net_rss_config
     - virtio_net: Fix endian with virtio_net_ctrl_rss
     - virtio_net: Use new RSS config structs
     - virtio_net: sync rss_trailer.max_tx_vq on queue_pairs change via
       VQ_PAIRS_SET
     - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls
     - tipc: fix double-free in tipc_buf_append()
     - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()
     - fs/adfs: validate nzones in adfs_validate_bblk()
     - rtc: abx80x: Disable alarm feature if no interrupt attached
     - kbuild: builddeb - avoid recompiles for non-cross-compiles
     - fbdev: offb: fix PCI device reference leak on probe failure
     - mailbox: mtk-cmdq: Fix CURR and END addr for task insert case
     - mailbox: mailbox-test: free channels on probe error
     - cgroup/rdma: fix integer overflow in rdmacg_try_charge()
     - mailbox: add sanity check for channel array
     - mailbox: mailbox-test: don't free the reused channel
     - mailbox: mailbox-test: initialize struct earlier
     - mailbox: mailbox-test: make data_ready a per-instance variable
     - fsnotify: fix inode reference leak in fsnotify_recalc_mask()
     - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent()
     - cgroup: Increment nr_dying_subsys_* from rmdir context
     - tracing: branch: Fix inverted check on stat tracer registration
     - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
     - netfilter: arp_tables: fix IEEE1394 ARP payload parsing
     - nvme-pci: fix missed admin queue sq doorbell write
     - drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM
     - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG
     - drm/amdgpu: fix spelling typos
     - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated
     - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2)
     - netfilter: xt_policy: fix strict mode inbound policy matching
     - netfilter: nf_conntrack_sip: don't use simple_strtoul
     - [amd64] ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED
     - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ
     - drm/sysfb: ofdrm: fix PCI device reference leaks
     - arm64/scs: Fix potential sign extension issue of advance_loc4
     - cdrom, scsi: sr: propagate read-only status to block layer via
       set_disk_ro()
     - netdevsim: zero initialize struct iphdr in dummy sk_buff
     - net/sched: netem: fix probability gaps in 4-state loss model
     - net/sched: netem: fix queue limit check to include reordered packets
     - net/sched: netem: only reseed PRNG when seed is explicitly provided
     - net/sched: netem: validate slot configuration
     - net/sched: netem: fix slot delay calculation overflow
     - net/sched: netem: check for negative latency and jitter
     - net/sched: sch_choke: annotate data-races in choke_dump_stats()
     - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats()
     - vrf: Fix a potential NPD when removing a port from a VRF
     - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
     - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit
     - NFC: trf7970a: Ignore antenna noise when checking for RF field
     - net/sched: taprio: fix NULL pointer dereference in class dump
     - neigh: let neigh_xmit take skb ownership
     - tcp: make probe0 timer handle expired user timeout
     - net, treewide: define and use MAC_ADDR_STR_LEN
     - netconsole: allow selection of egress interface via MAC address
     - netpoll: Extract carrier wait function
     - netpoll: extract IPv4 address retrieval into helper function
     - netpoll: fix IPv6 local-address corruption
     - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams
     - sched/fair: Clear rel_deadline when initializing forked entities
     - net: mctp i2c: check length before marking flow active
     - net: phy: dp83869: fix setting CLK_O_SEL field.
     - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings
     - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings
     - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings
     - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring
     - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring
     - drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring
     - ASoC: codecs: ab8500: Fix casting of private data
     - netfilter: skip recording stale or retransmitted INIT
     - sctp: discard stale INIT after handshake completion
     - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()
     - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V)
     - netconsole: propagate device name truncation in dev_name_store()
     - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87
     - ALSA: hda/conexant: Fix missing error check for jack detection
     - ALSA: hda: cs35l56: Fix uninitialized value in cs35l56_hda_read_acpi()
     - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup
     - drm/amd/display: Allow DCE link encoder without AUX registers
     - drm/amd/display: Read EDID from VBIOS embedded panel info
     - drm/xe/debugfs: Correct printing of register whitelist ranges
     - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()
     - drm/xe/gsc: Fix BO leak on error in query_compatibility_version()
     - page_pool: Set `dma_sync` to false for devmem memory provider
     - net: page_pool: create hooks for custom memory providers
     - page_pool: fix memory-provider leak in page_pool_create_percpu() error
       path
     - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING
     - iavf: stop removing VLAN filters from PF on interface down
     - iavf: wait for PF confirmation before removing VLAN filters
     - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler
     - ice: fix NULL pointer dereference in ice_reset_all_vfs()
     - net: tls: fix strparser anchor skb leak on offload RX setup failure
     - sfc: fix error code in efx_devlink_info_running_versions()
     - net/sched: cls_flower: revert unintended changes
     - [arm64] Reserve an extra page for early kernel mapping
     - smb: client: correctly handle ErrorContextData as a flexible array
     - smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)
     - LoongArch: KVM: Compile switch.S directly into the kernel
     - ntfs: ->d_compare() must not block
     - PCI: Initialize temporary device in new_id_store()
     - net: bcmgenet: Initialize u64 stats seq counter
     - net: bcmgenet: fix leaking free_bds
     - [amd64] iommu/amd: Reorder attach device code
     - [amd64] iommu/amd: Put list_add/del(dev_data) back under the domain->lock
     - perf tool_pmu: Fix aggregation on duration_time
     - net/sched: sch_pie: annotate more data-races in pie_dump_stats()
     - netpoll: Extract IPv6 address retrieval function
     - netpoll: pass buffer size to egress_dev() to avoid MAC truncation
     - page_pool: fix incorrect mp_ops error handling
     - crypto: af_alg - Cap AEAD AD length to 0x80000000
     - i40e: Cleanup PTP pins on probe failure
     - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path
     - netfilter: nf_conntrack_sip: get helper before allocating expectation
     - audit: fix incorrect inheritable capability in CAPSET records
     - Revert "ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to
       warn"
     - netfilter: nft_ct: fix missing expect put in obj eval
     - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled
     - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV
     - KVM: Reject wrapped offset in kvm_reset_dirty_gfn()
     - [s390x] KVM: s390: pci: fix GAIT table indexing due to double-scaling
       pointer arithmetic
     - [amd64] KVM: x86: Fix Xen hypercall tracepoint argument assignment
     - netfilter: nf_tables: unconditionally bump set->nelems before insertion
       (CVE-2026-23272)
     - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands
     - smb/client: fix possible infinite loop and oob read in symlink_data()
     - [amd64] drm/i915/dp: Fix VSC dynamic range signaling for RGB formats
     - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans
     - ALSA: usb-audio: Bound MIDI endpoint descriptor scans
     - ceph: fix a buffer leak in __ceph_setxattr()
     - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size
     - io-wq: check that the predecessor is hashed in io_wq_remove_pending()
     - [powerpc*] warp: Fix error handling in pika_dtm_thread
     - netfs: fix error handling in netfs_extract_user_iter()
     - irqchip/riscv-imsic: Clear interrupt move state during CPU offlining
     - libceph: Fix potential out-of-bounds access in osdmap_decode()
     - libceph: Fix potential null-ptr-deref in decode_choose_args()
     - libceph: Fix potential out-of-bounds access in crush_decode()
     - libceph: handle rbtree insertion error in decode_choose_args()
     - [amd64] iommu/vt-d: Disable DMAR for Intel Q35 IGFX
     - [amd64] drm/i915: skip __i915_request_skip() for already signaled requests
     - drm/panfrost: Fix wait_bo ioctl leaking positive return from
       dma_resv_wait_timeout()
     - drm/xe/dma-buf: handle empty bo and UAF races
     - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup
     - drm/gma500/oaktrail_lvds: fix hang on init failure
     - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init
     - iommufd: Fix return value of iommufd_fault_fops_write()
     - eventfs: Use list_add_tail_rcu() for SRCU-protected children list
     - drm/v3d: Reject empty multisync extension to prevent infinite loop
     - btrfs: use inode already stored in local variable at btrfs_rmdir()
     - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of
       BTRFS_I()
     - btrfs: fix missing last_unlink_trans update when removing a directory
     - smb: client: Use FullSessionKey for AES-256 encryption key derivation
     - btrfs: do not mark inode incompressible after inline attempt fails
     - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
     - sched_ext: Guard scx_dsq_move() against NULL kit->dsq after failed
       iter_new
     - mptcp: pm: prio: skip closed subflows
     - mptcp: drop __mptcp_fastopen_gen_msk_ackseq()
     - mptcp: fix rx timestamp corruption on fastopen
     - f2fs: fix incorrect file address mapping when inline inode is unwritten
     - f2fs: fix false alarm of lockdep on cp_global_sem lock
     - spi: sifive: Simplify clock handling with devm_clk_get_enabled()
     - spi: sifive: fix controller deregistration
     - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0
     - mptcp: pm: ADD_ADDR rtx: fix potential data-race
     - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker
     - netfs: Fix potential uninitialised var in netfs_extract_user_iter()
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.92
     - mptcp: sync the msk->sndbuf at accept() time
     - mptcp: pm: ADD_ADDR rtx: allow ID 0
     - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (CVE-2026-46158)
     - mptcp: pm: ADD_ADDR rtx: free sk if last (CVE-2026-46170)
     - ksmbd: validate owner of durable handle on reconnect (CVE-2026-31717)
     - drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status()
       (CVE-2026-46216)
     - [s390x] debug: Reject zero-length input before trimming a newline
     - Revert "perf cgroup: Update metric leader in evlist__expand_cgroup"
     - Revert "perf tool_pmu: Fix aggregation on duration_time"
     - Revert "perf python: Add parse_events function"
     - Revert "perf tool_pmu: Factor tool events into their own PMU"
     - bridge: mrp: reject zero test interval to avoid OOM panic (CVE-2026-31420)
     - spi: spi-dw-dma: fix print error log when wait finish transaction
       (CVE-2026-31560)
     - Revert "x86/vdso: Fix output operand size of RDPID"
     - sched/deadline: Less agressive dl_server handling
     - sched/deadline: Fix dl_server_stopped()
     - sched/deadline: Fix dl_server getting stuck
     - sched/deadline: Fix dl_server behaviour
     - sched/deadline: Stop dl_server before CPU goes offline
     - ksmbd: close durable scavenger races against m_fp_list lookups
     - af_unix: Give up GC if MSG_PEEK intervened. (CVE-2026-23394)
     - drm/imagination: Synchronize interrupts before suspending the GPU
       (CVE-2026-23469)
     - ata: libata-scsi: improve readability of ata_scsi_qc_issue()
     - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT
     - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS
     - ata: libata-scsi: do not needlessly defer commands when using PMP with FBS
     - perf parse-events: Expose/rename config_term_name
     - Revert "ice: fix double-free of tx_buf skb"
     - Revert "ice: Remove jumbo_remove step from TX path"
     - tracing: Fix the bug where bpf_get_stackid returns -EFAULT on the ARM64
     - net/mlx5e: Trigger neighbor resolution for unresolved destinations
     - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init
     - [amd64] x86/fgraph: Fix return_to_handler regs.rsp value
     - [amd64] iommu/vt-d: Draining PRQ in sva unbind path when FPD bit set
     - [riscv64] fgraph: Select HAVE_FUNCTION_GRAPH_TRACER depends on
       HAVE_DYNAMIC_FTRACE_WITH_ARGS
     - [riscv64] fgraph: Fix stack layout to match __arch_ftrace_regs argument of
       ftrace_return_to_handler (CVE-2025-22069)
     - hwmon: (pmbus/core) Protect regulator operations with mutex
     - [arm64] Kconfig: Remove selecting replaced HAVE_FUNCTION_GRAPH_RETVAL
     - sysfs: don't remove existing directory on update failure
     - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()
     - ksmbd: fix null pointer dereference in compare_guid_key()
     - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow
     - ksmbd: validate SID in parent security descriptor during ACL inheritance
     - smb: client: require net admin for CIFS SWN netlink
     - smb: client: protect tc_count increment in
       smb2_find_smb_sess_tcon_unlocked()
     - smb: client: use data_len for SMB2 READ encrypted folioq copy
     - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close
     - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX
     - ALSA: ua101: Reject too-short USB descriptors
     - ALSA: pcm: Don't setup bogus iov_iter for silencing
     - ALSA: asihpi: Fix potential OOB array access at reading cache
     - efi: Allocate runtime workqueue before ACPI init
     - io_uring/waitid: clear waitid info before copying it to userspace
     - drivers/base/memory: fix memory block reference leak in poison accounting
     - ipv6: ioam: refresh hdr pointer before ioam6_event()
     - mm/memory_hotplug: fix memory block reference leak on remove
     - net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
     - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
     - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START
     - Bluetooth: bnep: Fix UAF read of dev->name
     - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths
     - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer
     - Bluetooth: MGMT: validate Add Extended Advertising Data length
     - Bluetooth: serialize accept_q access
     - phonet/pep: disable BH around forwarded sk_receive_skb()
     - net: bcmgenet: keep RBUF EEE/PM disabled
     - net: ifb: report ethtool stats over num_tx_queues
     - net: pse-pd: fix sign on -ENOENT check in of_load_pse_pis()
     - netfilter: ip6t_hbh: reject oversized option lists
     - netfilter: nf_queue: hold bridge skb->dev while queued
     - netfilter: ipset: stop hash:* range iteration at end
     - netfilter: nft_inner: Fix IPv6 inner_thoff desync
     - sched_ext: Fix missing warning in scx_set_task_state() default case
     - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path
     - cgroup/cpuset: Reset DL migration state on can_attach() failure
     - fs/ntfs3: handle attr_set_size() errors when truncating files
     - l2tp: use list_del_rcu in l2tp_session_unhash
     - qed: fix double free in qed_cxt_tables_alloc()
     - ring-buffer: Fix reporting of missed events in iterator
     - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
     - vsock/vmci: fix UAF when peer resets connection during handshake
     - vsock/virtio: reset connection on receiving queue overflow
     - wifi: ath11k: clear shared SRNG pointer state on restart
     - ipv4: raw: reject IP_HDRINCL packets with ihl < 5
     - ixgbevf: fix use-after-free in VEPA multicast source pruning
     - rbd: eliminate a race in lock_dwork draining on unmap
     - lsm: hold cred_guard_mutex for lsm_set_self_attr()
     - [arm64] octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
     - ice: fix setting promisc mode while adding VID filter
     - ice: restore PTP Rx timestamp config after ethtool set-channels
     - wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
     - af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
     - wifi: mac80211: consume only present negotiated TTLM maps
     - cifs: Fix busy dentry used after unmounting
     - tracing: Do not call map->ops->elt_free() if elt_alloc() fails
     - [arm64] probes: Handle probes on hinted conditional branch instructions
     - [arm64] KVM: arm64: vgic-its: Reject restored DTE with out-of-range
       num_eventid_bits
     - [arm64] KVM: arm64: vgic: Free private_irqs when init fails after
       allocation
     - [riscv64] kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem() when
       OOM
     - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe
     - spi: qup: fix error pointer deref after DMA setup failure
     - [arm64] phy: tegra: xusb: Fix per-pad high-speed termination calibration
     - scsi: isci: Fix use-after-free in device removal path
     - spi: ep93xx: fix error pointer deref after DMA setup failure
     - spi: sprd: fix error pointer deref after DMA setup failure
     - spi: ti-qspi: fix use-after-free after DMA setup failure
     - RDMA/siw: Reject MPA FPDU length underflow before signed receive math
     - device property: set fwnode->secondary to NULL in fwnode_init()
     - drm/virtio: use uninterruptible resv lock for plane updates
     - drm/amdgpu/vpe: Force collaborate sync after TRAP
     - drm/bridge: it66121: acquire reset GPIO in probe
     - drm/bridge: megachips: remove bridge when irq request fails
     - drm/amd/display: Fix integer overflow in bios_get_image()
     - drm/amd/display: Validate GPIO pin LUT table size before iterating
     - drm/amd/display: Validate payload length and link_index in
       dc_process_dmub_aux_transfer_async
     - batman-adv: mcast: fix use-after-free in orig_node RCU release
     - batman-adv: clear current gateway during teardown
     - batman-adv: dat: handle forward allocation error
     - batman-adv: fix fragment reassembly length accounting
     - batman-adv: fix tp_meter counter underflow during shutdown
     - batman-adv: frag: disallow unicast fragment in fragment
     - batman-adv: bla: fix report_work leak on backbone_gw purge
     - batman-adv: tp_meter: avoid use of uninit sender vars
     - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown
     - batman-adv: tp_meter: fix race condition in send error reporting
     - batman-adv: tt: fix negative last_changeset_len
     - batman-adv: tt: fix negative tt_buff_len
     - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
     - hwmon: (pmbus/adm1266) reject implausible blackbox record_count
     - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer
     - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized
       buffer
     - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR
     - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in
       get_multiple
     - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()
     - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()
     - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO
       accessors
     - [arm64] pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset for
       high pins during suspend/resume
     - HID: uclogic: Fix regression of input name assignment
     - [riscv64] mm: Fixup no5lvl failure when vaddr is invalid
     - [arm64] pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for
       sm8150
     - ALSA: hda: cs35l56: Put ACPI device after setting companion
     - ALSA: hda: cs35l41: Put ACPI device on missing physical node
     - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()
     - netfilter: x_tables: unregister the templates first
     - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist()
     - tcp: Fix imbalanced icsk_accept_queue count.
     - ice: fix setting RSS VSI hash for E830
     - ice: fix locking in ice_dcb_rebuild()
     - net: lan966x: avoid unregistering netdev on register failure
     - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register
       access
     - NFSD: Fix infinite loop in layout state revocation
     - irqchip/ath79-cpu: Remove unused function
     - ublk: reject max_sectors smaller than PAGE_SECTORS in parameter validation
     - nsfs: fix wrong error code returned for pidns ioctls
     - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
     - zonefs: handle integer overflow in zonefs_fname_to_fno
     - tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().
     - [powerpc*] fix dead default for GUEST_STATE_BUFFER_TEST
     - netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call
     - netfs: Fix overrun check in netfs_extract_user_iter()
     - netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone
     - netfs: Defer the emission of trace_netfs_folio()
     - netfs: Fix streaming write being overwritten
     - netfs: Fix potential deadlock in write-through mode
     - netfs: Fix write streaming disablement if fd open O_RDWR
     - netfs: Fix early put of sink folio in netfs_read_gaps()
     - netfs: Fix partial invalidation of streaming-write folio
     - netfs: Fix a few minor bugs in netfs_page_mkwrite()
     - netfs: Remove unnecessary references to pages
     - netfs: Fix folio->private handling in netfs_perform_write()
     - net: ethernet: cortina: Make RX SKB per-port
     - net: ethernet: cortina: Drop half-assembled SKB
     - net: ethernet: cortina: Carry over frag counter
     - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference
     - wifi: ath11k: fix error path leaks in some WMI WOW calls
     - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
     - wifi: ath10k: skip WMI and beacon transmission when device is wedged
     - blk-integrity: remove seed for user mapped buffers
     - block: don't overwrite bip_vcnt in bio_integrity_copy_user()
     - block: recompute nr_integrity_segments in blk_insert_cloned_request
     - HID: quirks: really enable the intended work around for appledisplay
     - block: modify bio_integrity_map_user to accept iov_iter as argument
     - block: drop direction param from bio_integrity_copy_user()
     - blk-integrity: use simpler alignment check
     - blk-integrity: enable p2p source and destination
     - block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()
     - accel/qaic: Add overflow check to remap_pfn_range during mmap
     - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint
     - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
     - [arm64] drm/msm/dsi: don't dump registers past the mapped region
     - [arm64] drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN
     - [powerpc*] time: Remove redundant preempt_disable|enable() calls from
       arch_irq_work_raise()
     - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
     - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
     - net: tls: prevent chain-after-chain in plain text SG
     - net: phy: DP83TC811: add reading of abilities
     - [amd64] x86/xen: Fix xen_e820_swap_entry_with_ram()
     - tls: Preserve sk_err across recvmsg() when data has been copied
     - net/mlx5: Do not restore destination-less TC rules
     - scsi: sd: Fix return code handling in sd_spinup_disk()
     - ALSA: scarlett2: Add missing error check when initialise Autogain Status
     - io_uring/net: punt IORING_OP_BIND async if it needs file create
     - btrfs: fix squota accounting during enable generation
     - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
     - [arm64] drm/msm/snapshot: fix dumping of the unaligned regions
     - drm/xe/gsc: Fix double-free of managed BO in error path
     - drm/xe/vf: Fix signature of print functions
     - drm/xe/pf: Fix CFI failure in debugfs access
     - wifi: ath11k: fix peer resolution on rx path when peer_id=0
     - ice: ptp: serialize E825 PHY timer start with PTP lock
     - [amd64] drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP
     - [arm64] net: dsa: mt7530: fix FDB entries not aging out with short timeout
     - [arm64] net: dsa: mt7530: preserve VLAN tags on trapped link-local frames
     - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
     - platform/surface: aggregator_registry: omit battery & AC nodes on Surface
       Laptop 7
     - [amd64] platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
     - [amd64] platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
     - [amd64] platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
     - [amd64] platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
     - RDMA/rtrs: Fix use-after-free in path file creation cleanup
     - net: bridge: Flush multicast groups when snooping is disabled
     - bridge: mcast: Fix a possible use-after-free when removing a bridge port
     - pds_core: fix error handling in pdsc_devcmd_wait
     - pds_core: fix debugfs_lookup dentry leak and error handling
     - wifi: mac80211: fix MLE defragmentation
     - ALSA: seq: Serialize UMP output teardown with event_input
     - tracing: Avoid NULL return from hist_field_name() on truncation
     - Bluetooth: btmtk: fix urb->setup_packet leak in error paths
     - net: ag71xx: check error for platform_get_irq
     - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
     - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n)
     - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed
     - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
     - drm/xe/oa: Fix exec_queue leak on width check in stream open
     - [arm64] octeontx2-af: npc: Fix allmulticast skip logic for LBK and SDP VFs
     - net: mana: validate rx_req_idx to prevent out-of-bounds array access
     - pds_core: ensure null-termination for firmware version strings
     - net: gro: don't merge zcopy skbs
     - landlock: Fix TCP handling of short AF_UNSPEC addresses
     - block: make bio_integrity_map_user() static inline
     - security/keys: fix missed RCU read section on lookup
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.93
     - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
     - [arm64] drm/v3d: Fix use-after-free of CPU job query arrays on error path
     - [arm64] drm/v3d: Release indirect CSD GEM reference on CPU job free
     - net/sched: cls_fw: fix NULL dereference of "old" filters before change()
     - net: mctp: ensure our nlmsg responses are initialised (CVE-2026-45930)
     - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
     - net/sched: sch_sfb: Replace direct dequeue call with peek and
       qdisc_dequeue_peeked
     - bcache: fix uninitialized closure object
     - net: cpsw_new: Fix potential unregister of netdev that has not been
       registered yet (CVE-2026-43219)
     - [arm64] Introduce esr_is_ubsan_brk()
     - [arm64] debug: clean up single_step_handler logic
     - [arm64] refactor aarch32_break_handler()
     - [arm64] debug: call software breakpoint handlers statically
     - [arm64] debug: call step handlers statically
     - [arm64] debug: remove break/step handler registration infrastructure
     - [arm64] entry: Add entry and exit functions for debug exceptions
     - [arm64] debug: split hardware breakpoint exception entry
     - [arm64] debug: refactor reinstall_suspended_bps()
     - [arm64] debug: split single stepping exception entry
     - [arm64] debug: split hardware watchpoint exception entry
     - [arm64] debug: split brk64 exception entry
     - [arm64] debug: split bkpt32 exception entry
     - [arm64] debug: remove debug exception registration infrastructure
     - [arm64] debug: always unmask interrupts in el0_softstp()
     - nfc: llcp: Fix use-after-free in llcp_sock_release()
     - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
     - xfrm: Check for underflow in xfrm_state_mtu
     - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
     - netfilter: synproxy: refresh tcphdr after skb_ensure_writable
     - netfilter: xt_cpu: prefer raw_smp_processor_id
     - netfilter: ebtables: fix OOB read in compat_mtw_from_user
     - tun: free page on short-frame rejection in tun_xdp_one() (CVE-2026-46321)
     - tun: free page on build_skb failure in tun_xdp_one() (CVE-2026-46322)
     - vsock: keep poll shutdown state consistent
     - net: netlink: fix sending unassigned nsid after assigned one
     - net: netlink: don't set nsid on local notifications
     - net/smc: Do not re-initialize smc hashtables
     - [s390x] net/iucv: fix locking in .getsockopt
     - scsi: core: Run queues for all non-SDEV_DEL devices from
       scsi_run_host_queues
     - ipv4: free net->ipv4.sysctl_local_reserved_ports after
       unregister_net_sysctl_table()
     - ALSA: pcm: oss: Fix setup list UAF on proc write error
     - [amd64] ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
     - net: hsr: fix potential OOB access in supervision frame handling
     - [amd64] accel/ivpu: prevent uninitialized data bug in debugfs
     - gpio: mxc: fix irq_high handling
     - net: Avoid checksumming unreadable skb tail on trim
     - ethtool: rss: fix hkey leak when indir_size is 0
     - ethtool: module: avoid leaking a netdev ref on module flash errors
     - ethtool: module: check fw_flash_in_progress under rtnl_lock
     - ethtool: module: fix cleanup if socket used for flashing multiple devices
     - ethtool: cmis: require exact CDB reply length
     - ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
     - net: ethtool: Add new parameters and a function to support EPL
     - net: ethtool: Add support for writing firmware blocks using EPL payload
     - ethtool: cmis: validate start_cmd_payload_size from module
     - ethtool: cmis: validate fw->size against start_cmd_payload_size
     - tunnels: load network headers after skb_cow() in
       iptunnel_pmtud_build_icmp[v6]()
     - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
     - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
     - ASoC: codecs: simple-mux: Fix enum control bounds check
     - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
     - bonding: refuse to enslave CAN devices
     - ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES
     - ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup
       error
     - ethtool: pse-pd: fix missing ethnl_ops_complete()
     - ethtool: strset: fix header attribute index in ethnl_req_get_phydev()
     - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during
       fallback
     - ethtool: eeprom: add more safeties to EEPROM Netlink fallback
     - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
     - net/sched: Revert "net/sched: Restrict conditions for adding duplicating
       netems to qdisc tree"
     - net/sched: fix packet loop on netem when duplicate is on
     - net/sched: act_mirred: Move the recursion counter struct netdev_xmit
     - net/sched: act_mirred: add loop detection
     - net: Introduce skb tc depth field to track packet loops
     - net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop
     - net/sched: act_mirred: Fix return code in early mirred redirect error
       paths
     - net/handshake: Use spin_lock_bh for hn_lock
     - nvme-tcp: store negative errno in queue->tls_err
     - net/handshake: Pass negative errno through handshake_complete()
     - remove pointless includes of <linux/fdtable.h>
     - net/handshake: Take a long-lived file reference at submit
     - net/handshake: Drain pending requests at net namespace exit
     - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
     - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
     - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
     - [arm64,armhf] gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
     - [amd64,arm64] net: mana: Add NULL guards in teardown path to prevent panic
       on attach failure
     - sctp: fix race between sctp_wait_for_connect and peeloff
     - ipv6: fix possible infinite loop in rt6_fill_node()
     - ipv6: fix possible infinite loop in fib6_select_path()
     - net: skbuff: fix pskb_carve leaking zcopy pages
     - perf: Fix dangling cgroup pointer in cpuctx
     - batman-adv: v: stop OGMv2 on disabled interface
     - batman-adv: tvlv: abort OGM send on tvlv append failure
     - batman-adv: tt: reject oversized local TVLV buffers
     - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
     - batman-adv: tvlv: reject oversized TVLV packets
     - batman-adv: iv: recover OGM scheduling after forward packet error
     - batman-adv: tp_meter: avoid role confusion in tp_list
     - [s390x] cio: Restore GFP_DMA for CHSC allocation
     - batman-adv: tp_meter: directly shut down timer on cleanup
     - batman-adv: tt: fix TOCTOU race for reported vlans
     - batman-adv: tt: avoid empty VLAN responses
     - batman-adv: bla: avoid double decrement of bla.num_requests
     - mm/page_alloc: clear page->private in free_pages_prepare()
       (CVE-2026-43303)
     - media: rc: fix race between unregister and urb/irq callbacks
     - media: rc: ttusbir: fix inverted error logic
     - inet: frags: add inet_frag_queue_flush()
     - inet: frags: flush pending skbs in fqdir_pre_exit() (CVE-2025-68768)
     - HID: core: Add printk_ratelimited variants to hid_warn() etc
     - HID: pass the buffer size to hid_report_raw_event
     - HID: core: introduce hid_safe_input_report()
     - HID: core: Fix size_t specifier in hid_report_raw_event()
     - [amd64] drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD
       register
     - [amd64] drm/i915/psr: Read Intel DPCD workaround register
     - drm/dp: Add eDP 1.5 bit definition
     - [amd64] drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line
       used
     - [arm64] io: Rename ioremap_prot() to __ioremap_prot()
     - [arm64] io: Extract user memory type in ioremap_prot() (CVE-2026-23346)
     - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X
     - batman-adv: tt: prevent TVLV entry number overflow
     - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
     - usb: typec: ucsi: ccg: reject firmware images without a ':' record header
     - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
     - usb: typec: tcpm: bound altmode_desc[] per iteration in
       svdm_consume_modes()
     - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO
     - usb: typec: altmodes/displayport: validate count before reading Status
       Update VDO
     - usb: typec: wcove: don't write past struct pd_message in
       wcove_read_rx_buffer()
     - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT
     - usb: typec: ucsi: validate connector number in ucsi_connector_change()
     - USB: serial: safe_serial: fix memory corruption with small endpoint
     - media: rc: igorplugusb: fix control request setup packet
     - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()
     - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
     - Bluetooth: btusb: Allow firmware re-download when version matches
     - hpfs: fix a crash if hpfs_map_dnode_bitmap fails
     - ipc: limit next_id allocation to the valid ID range
     - auxdisplay: line-display: fix OOB read on zero-length message_store()
     - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
     - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
     - Bluetooth: HIDP: fix missing length checks in hidp_input_report()
     - Bluetooth: ISO: fix UAF in iso_recv_frame
     - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
     - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
     - Input: xpad - fix out-of-bounds access for Share button
     - parport: Fix race between port and client registration (Closes: #1130365)
     - USB: cdc-acm: Fix bit overlap and move quirk definitions to header
     - [arm64] KVM: arm64: PMU: Preserve AArch32 counter low bits
     - [amd64] KVM: SVM: Flush the current TLB when transitioning from xAVIC =>
       x2AVIC
     - [amd64] KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
     - [amd64] KVM: SEV: Use the size of the PSC header as the minimum size for
       PSC requests
     - [amd64] KVM: SEV: WARN if KVM attempts to setup scratch area with
       min_len==0
     - [amd64] KVM: SEV: Compute the correct max length of the in-GHCB scratch
       area
     - [amd64] KVM: SEV: Check PSC request indices against the actual size of the
       buffer
     - [amd64] KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC
       buffer
     - [amd64] KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
     - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux
     - iio: adc: npcm: fix unbalanced clk_disable_unprepare()
     - iio: dac: max5821: fix return value check in powerdown sync
     - iio: dac: ad5686: fix input raw value check
     - iio: dac: ad5686: acquire lock when doing powerdown control
     - iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
     - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
     - iio: gyro: itg3200: fix i2c read into the wrong stack location
     - iio: gyro: adis16260: fix division by zero in write_raw
     - iio: ssp_sensors: cancel delayed work_refresh on remove
     - iio: temperature: tsys01: fix broken PROM checksum validation
     - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL
     - iio: light: cm3323: fix reg_conf not being initialized correctly
     - iio: buffer: hw-consumer: fix use-after-free in error path
     - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
     - USB: serial: omninet: fix memory corruption with small endpoint
     - usb: cdns3: gadget: fix request skipping after clearing halt
     - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy
       acquisition failure
     - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently
       leaks the runtime PM usage counter across bind/unbind cycles
     - usb: dwc2: Fix use after free in debug code
     - Input: elan_i2c - validate firmware size before use
     - wireguard: send: append trailer after expanding head
     - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
     - macsec: fix replay protection at XPN lower-PN wrap
     - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
     - [arm64] ASoC: qcom: q6asm-dai: fix error handling in prepare and
       set_params
     - ipv6: exthdrs: refresh nh after handling HAO option
     - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
     - ipv6: validate extension header length before copying to cmsg
     - xfrm: input: hold netns during deferred transport reinjection
     - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
     - ip6: vti: Use ip6_tnl.net in vti6_changelink().
     - net: skbuff: fix missing zerocopy reference in pskb_carve helpers
     - HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
     - nfc: hci: fix out-of-bounds read in HCP header parsing
     - xfrm: route MIGRATE notifications to caller's netns
     - xfrm: ah: use skb_to_full_sk in async output callbacks
     - ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417
     - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without
       direction check
     - [arm64] ASoC: qcom: q6asm-dai: close stream only when running
     - [arm64] ASoC: qcom: q6asm-dai: do not set stream state in event and
       trigger callbacks
     - xfrm: esp: restore combined single-frag length gate
     - Input: xpad - add "Nova 2 Lite" from GameSir
     - Input: xpad - add support for ASUS ROG RAIKIRI II
     - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops
     - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
     - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490
     - [amd64] comedi: comedi_test: fix check for valid scan_begin_src in
       waveform_ai_cmdtest()
     - [amd64] comedi: comedi_test: Fix limiting of convert_arg in
       waveform_ai_cmdtest()
     - counter: Fix refcount leak in counter_alloc() error path
     - tty: serial: pch_uart: add check for dma_alloc_coherent()
     - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
     - usb: chipidea: core: convert ci_role_switch to local variable
     - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval
     - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub
       controllers
     - usb: storage: Add quirks for PNY Elite Portable SSD
     - usbip: vudc: Fix use after free bug in vudc_remove due to race condition
     - usb: usbtmc: check URB actual_length for interrupt-IN notifications
     - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
     - usb: typec: tcpm: improve handling of DISCOVER_MODES failures
     - USB: serial: option: add MeiG SRM813Q
     - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL
     - USB: serial: belkin_sa: validate interrupt status length
     - USB: serial: cypress_m8: validate interrupt packet headers
     - USB: serial: keyspan: fix missing indat transfer sanity check
     - USB: serial: mxuport: fix memory corruption with small endpoint
     - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
     - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind
     - usb: gadget: net2280: Fix double free in probe error path
     - usb: gadget: f_hid: fix device reference leak in hidg_alloc()
     - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
     - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports
     - usb: gadget: f_fs: copy only received bytes on short ep0 read
     - usb: gadget: f_fs: serialize DMABUF cancel against request completion
     - [amd64] thunderbolt: property: Reject u32 wrap in
       tb_property_entry_valid()
     - [amd64] thunderbolt: property: Reject dir_len < 4 to prevent size_t
       underflow
     - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
     - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
     - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
     - scsi: target: iscsi: Validate CHAP_R length before base64 decode
     - drm/hyperv: validate resolution_count and fix WIN8 fallback
     - drm/hyperv: validate VMBus packet size in receive callback
     - [amd64] drm/i915: Fix potential UAF in TTM object purge
     - drm/amd/pm/si: Disregard vblank time when no displays are connected
     - serial: altera_jtaguart: handle uart_add_one_port() failures
     - serial: qcom-geni: fix UART_RX_PAR_EN bit position
     - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion
       IRQ
     - serial: sh-sci: fix memory region release in error path
     - serial: zs: Fix swapped RI/DSR modem line transition counting
     - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma
     - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
     - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger
     - drm/amdkfd: Check for pdd drm file first in CRIU restore path
     - serial: dz: Fix bootconsole message clobbering at chip reset
     - serial: dz: Fix bootconsole handover lockup
     - serial: dz: Convert to use a platform device
     - serial: zs: Fix bootconsole handover lockup
     - serial: zs: Switch to using channel reset
     - serial: zs: Convert to use a platform device
     - USB: serial: cypress_m8: fix memory corruption with small endpoint
     - USB: serial: digi_acceleport: fix memory corruption with small endpoints
     - xhci: tegra: Fix ghost USB device on dual-role port unplug
     - iommu: Skip PASID validation for devices without PASID capability
     - [amd64] x86/boot: Disable stack protector for early boot code
     - [amd64] x86/kexec: Disable KCOV instrumentation after load_segments()
       (CVE-2026-43331)
     - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg
     - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer
     - serdev: Provide a bustype shutdown function
     - Bluetooth: hci_qca: Migrate to serdev specific shutdown function
     - Bluetooth: hci_qca: Convert timeout from jiffies to ms
     - ALSA: scarlett2: Return ENOSPC for out-of-bounds flash writes
     - ALSA: scarlett2: Allow flash writes ending at segment boundary
     - mm/memory: fix spurious warning when unmapping device-private/exclusive
       pages
     - [amd64] platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error
       recovery
     - net: hsr: defer node table free until after RCU readers
     - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient
     - ice: fix VF queue configuration with low MTU values
     - ring-buffer: Flush and stop persistent ring buffer on panic
     - mptcp: cleanup fallback dummy mapping generation
     - mptcp: reset rcv wnd on disconnect
     - [arm64] tlb: Flush walk cache when unsharing PMD tables
     - [arm64] octeontx2-pf: avoid double free of pool->stack on AQ init failure
     - mptcp: introduce the mptcp_init_skb helper
     - mptcp: handle first subflow closing consistently
     - mptcp: do not drop partial packets
     - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
     - iio: chemical: scd30: Use guard(mutex) to allow early returns
     - iio: chemical: scd30: fix division by zero in write_raw
     - iio: dac: ad5686: fix ref bit initialization for single-channel parts
     - ALSA: firewire-motu: Protect register DSP event queue positions
     - [arm64] usb: dwc3: xilinx: fix error handling in zynqmp init error paths
     - usb: musb: omap2430: Fix use-after-free in omap2430_probe()
     - usb: typec: ucsi: Check if power role change actually happened before
       handling
     - [amd64] thunderbolt: property: Cap recursion depth in
       __tb_property_parse_dir()
     - scsi: target: iscsi: Fix CRC overread and double-free in
       iscsit_handle_text_cmd()
     - usb: typec: ucsi: Don't update power_supply on power role change if not
       connected
     - [amd64] x86/alternatives: Rename 'apply_relocation()' to
       'text_poke_apply_relocation()'
     - [amd64] x86/ftrace: Relocate %rip-relative percpu refs in dynamic
       trampolines
     - hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with
       pmbus_lock
     - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock
     - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock
     - mm: perform all memfd seal checks in a single place
     - mm/memfd: fix spelling and grammatical issues
     - memfd: deny writeable mappings when implying SEAL_WRITE
     - usb: core: Fix SuperSpeed root hub wMaxPacketSize
     - ethtool: cmis_cdb: Fix incorrect read / write length extension
     - net/sched: act_mirred: Fix blockcast recursion bypass leading to stack
       overflow
     - [arm64] KVM: arm64: vgic-its: Drop the translation cache reference only
       for the erased entry (CVE-2026-46316)
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.94
     - bpf: Free reuseport cBPF prog after RCU grace period. (CVE-2026-52910)
     - USB: serial: mct_u232: fix memory corruption with small endpoint
     - [armhf] group is_permission_fault() with is_translation_fault()
     - [armhf] allow __do_kernel_fault() to report execution of memory faults
     - [armhf] fix hash_name() fault
     - [armhf] fix branch predictor hardening
     - net: phy: micrel: fix LAN8814 QSGMII soft reset
     - wifi: remove zero-length arrays
     - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
     - ipv6: mcast: Fix use-after-free when processing MLD queries
     - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS
     - [arm64] tee: optee: prevent use-after-free when the client exits before
       the supplicant
     - [arm64]soc: qcom: ice: Return -ENODEV if the ICE platform device is not
       found
     - erofs: add sysfs node to drop internal caches
     - erofs: tidy up synchronous decompression
     - erofs: fix use-after-free on sbi->sync_decompress
     - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
     - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id
     - ipvs: clear the svc scheduler ptr early on edit
     - netfilter: synproxy: add mutex to guard hook reference counting
     - netfilter: conntrack_irc: fix possible out-of-bounds read
     - netfilter: nft_ct: bail out on template ct in get eval
     - netfilter: bridge: make ebt_snat ARP rewrite writable
     - dm cache policy smq: check allocation under invalidate lock
     - net/sched: act_api: use RCU with deferred freeing for action lifecycle
     - 6lowpan: fix off-by-one in multicast context address compression
     - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
     - devlink: Release nested relation on devlink free
     - [arm64] drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
     - wifi: mac80211: limit injected antenna index in
       ieee80211_parse_tx_radiotap
     - pcnet32: stop holding device spin lock during napi_complete_done
     - net: Annotate sk->sk_write_space() for UDP SOCKMAP.
     - hsr: Remove WARN_ONCE() in hsr_addr_is_self().
     - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
     - net: lan743x: permit VLAN-tagged packets up to configured MTU
     - net: fec: fix pinctrl default state restore order on resume
     - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
     - Bluetooth: MGMT: validate advertising TLV before type checks
     - Bluetooth: RFCOMM: validate skb length in MCC handlers
     - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension
       handling
     - Bluetooth: bnep: reject short frames before parsing
     - Bluetooth: fix memory leak in error path of hci_alloc_dev()
     - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync
     - Bluetooth: ISO: Fix not using bc_sid as advertisement SID
     - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls
     - Bluetooth: MGMT: Fix backward compatibility with userspace
     - [arm64] octeontx2-pf: Fix NDC sync operation errors
     - [arm64] octeontx2-af: Fix initialization of mcam's entry2target_pffunc
       field
     - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
     - ptp: vclock: Switch from RCU to SRCU
     - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
     - net_sched: act_pedit: use RCU in tcf_pedit_dump()
     - net/sched: fix pedit partial COW leading to page cache corruption
       (CVE-2026-46331)
     - [arm64] octeontx2-af: npc: Fix CPT channel mask in npc_install_flow
     - vxlan: vnifilter: send notification on VNI add
     - vxlan: vnifilter: fix spurious notification on VNI update
     - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
     - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
     - sctp: purge outqueue on stale COOKIE-ECHO handling
     - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp
     - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
     - time: Fix off-by-one in settimeofday() usec validation
     - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked
       streams
     - ALSA: seq: dummy: fix UMP event stack overread
     - ima: kexec: skip IMA segment validation after kexec soft reboot
     - ima: kexec: move IMA log copy from kexec load to execute
     - spi: cadence-quadspi: fix unclocked access on unbind (CVE-2026-46203)
     - tools/rv: Fix cleanup after failed trace setup
     - tap: free page on error paths in tap_get_user_xdp() (CVE-2026-46320)
     - [arm64] tlb: Allow XZR argument to TLBI ops
     - [arm64] tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI
     - iomap: don't revert iov_iter on partially completed buffered writes
     - dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device
     - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
     - netlabel: validate unlabeled address and mask attribute lengths
     - gpio: mvebu: fix NULL pointer dereference in suspend/resume
     - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls
     - tcp: restrict SO_ATTACH_FILTER to priv users
     - net: add pskb_may_pull() to skb_gro_receive_list()
     - net/mlx4: avoid GCC 10 __bad_copy_from() false positive
     - net: ibm: emac: Fix use-after-free during device removal
     - netdev: fix double-free in netdev_nl_bind_rx_doit()
     - net: phy: clean the sfp upstream if phy probing fails
     - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
     - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
     - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure
     - net/mlx5: Use effective affinity mask for IRQ selection
     - ipv6: sit: reload inner IPv6 header after GSO offloads
     - net: openvswitch: fix possible kfree_skb of ERR_PTR
     - r8152: handle the return value of usb_reset_device()
     - gpio: zynq: fix runtime PM leak on remove
     - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
     - net: guard timestamp cmsgs to real error queue skbs
     - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic
       completion
     - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
     - rds: mark snapshot pages dirty in rds_info_getsockopt()
     - netfilter: revalidate bridge ports
     - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister
     - netfilter: x_tables: avoid leaking percpu counter pointers
     - netfilter: nf_log: validate MAC header was set before dumping it
     - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
     - [arm64,armhf] net: mvpp2: sync RX data at the hardware packet offset
     - [arm64,armhf] net: mvpp2: limit XDP frame size to the RX buffer
     - [arm64,armhf] net: mvpp2: Add metadata support for xdp mode
     - [arm64,armhf] net: mvpp2: refill RX buffers before XDP or skb use
     - [arm64,armhf] net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
     - ipv6: Fix a potential NPD in cleanup_prefix_route()
     - netfilter: ctnetlink: ensure safe access to master conntrack
       (CVE-2026-43116)
     - writeback: Avoid contention on wb->list_lock when switching inodes
     - writeback: Fix use after free in inode_switch_wbs_work_fn()
     - xfrm: hold device only for the asynchronous decryption
     - xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
     - [amd64] KVM: VMX: Update SVI during runtime APICv activation
     - [arm64] clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from
       getting parked
     - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs
     - [arm64] clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration
       time
     - drm/virtio: Fix driver removal with disabled KMS
     - [arm64,armhf] drm/vc4: fix krealloc() memory leak
     - drm/xe: fix refcount leak in xe_range_fence_insert()
     - netfilter: nft_tunnel: fix use-after-free on object destroy
     - [arm64] tee: shm: fix shm leak in register_shm_helper()
     - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend
     - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
     - [arm64] soc: qcom: ice: Fix race between qcom_ice_probe() and
       of_qcom_ice_get()
     - [amd64] accel/ivpu: Add bounds checks for firmware log indices
     - [amd64] accel/ivpu: Add buffer overflow check in MS get_info_ioctl
     - [amd64] accel/ivpu: Fix signed integer truncation in IPC receive
     - tracing/probes: Point the error offset correctly for eprobe argument error
     - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation
     - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying
     - [amd64] KVM: SEV: Decouple the need to sync the GHCB SA from the need to
       free the SA
     - [amd64] drm/i915/gem: Fix phys BO pread/pwrite with offset
     - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init
     - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
     - xfrm: espintcp: do not reuse an in-progress partial send
     - USB: serial: io_ti: fix heap overflow in get_manuf_info()
     - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
     - USB: serial: option: add usb-id for Dell Wireless DW5826e-m
     - USB: serial: kl5kusb105: fix bulk-out buffer overflow
     - ALSA: timer: Forcibly close timer instances at closing
     - ALSA: timer: Fix UAF at snd_timer_user_params()
     - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries
     - drm/virtio: fix dma_fence refcount leak on error in
       virtio_gpu_dma_fence_wait()
     - drm/amd/display: Reject gpio_bitshift >= 32 in
       bios_parser_get_gpio_pin_info()
     - mm/huge_memory: update file PMD counter before folio_put()
     - mm/damon/ops-common: call folio_test_lru() after folio_get()
     - RDMA/srp: bound SRP_RSP sense copy by the received length
     - zram: fix use-after-free in zram_bvec_write_partial()
     - udp: clear skb->dev before running a sockmap verdict
     - mptcp: fix retransmission loop when csum is enabled
     - mptcp: close TOCTOU race while computing rcv_wnd
     - mptcp: allow subflow rcv wnd to shrink
     - mptcp: sockopt: check timestamping ret value
     - mptcp: add-addr: always drop other suboptions
     - wifi: nl80211: reject oversized EMA RNR lists
     - vsock/vmci: fix sk_ack_backlog leak on failed handshake
     - timers/migration: Fix livelock in tmigr_handle_remote_up()
     - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write
     - bnxt_en: Fix NULL pointer dereference
     - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
     - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
     - pidfd: refuse access to tasks that have started exiting harder
     - fs/qnx6: fix pointer arithmetic in directory iteration
     - fuse: reject fuse_notify() pagecache ops on directories
     - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
     - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
     - i2c: tegra: Fix NOIRQ suspend/resume
     - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
     - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
     - ipc/shm: serialize orphan cleanup with shm_nattch updates
     - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
     - misc: fastrpc: fix use-after-free race in fastrpc_map_create
     - misc: fastrpc: fix DMA address corruption due to find_vma misuse
     - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
     - net/mlx5: Reorder completion before putting command entry in
       cmd_work_handler
     - net: bonding: fix NULL pointer dereference in bond_do_ioctl()
     - net: mv643xx: fix OF node refcount
     - net: rds: clear i_sends on setup unwind
     - nvmem: core: fix use-after-free bugs in error paths
     - nvmem: layouts: onie-tlv: fix hang on unknown types
     - [arm64] octeontx2-af: fix memory leak in rvu_setup_hw_resources()
     - io_uring/kbuf: don't truncate end buffer for bundles
     - io_uring/wait: fix min_timeout behavior
     - mm/hugetlb: restore reservation on error in hugetlb folio copy paths
     - mmc: core: Fix host controller programming for fixed driver type
     - mmc: dw_mmc-rockchip: Add missing private data for very old controllers
     - mmc: litex_mmc: Set mandatory idle clocks before CMD0
     - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC
     - mmc: sdhci: add signal voltage switch in sdhci_resume_host
     - pmdomain: imx: fix OF node refcount
     - rtase: Avoid sleeping in get_stats64()
     - rtase: Reset TX subqueue when clearing TX ring
     - sctp: diag: reject stale associations in dump_one path
     - sctp: stream: fully roll back denied add-stream state
     - [amd64] thunderbolt: Reject zero-length property entries in validator
     - [amd64] thunderbolt: Bound root directory content to block size
     - [amd64] thunderbolt: Clamp XDomain response data copy to allocation size
     - [amd64] thunderbolt: Validate XDomain request packet size before type cast
     - [amd64] thunderbolt: Limit XDomain response copy to actual frame size
     - [arm64] slimbus: qcom-ngd-ctrl: fix OF node refcount
     - [arm64] slimbus: qcom-ngd-ctrl: Fix up platform_driver registration
     - [arm64] slimbus: qcom-ngd-ctrl: Fix probe error path ordering
     - [arm64] slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
     - [arm64] slimbus: qcom-ngd-ctrl: Initialize controller resources in
       controller
     - [arm64] slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
     - [arm64] slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD
     - [arm64] slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
     - drm/amdkfd: fix NULL dereference in get_queue_ids()
     - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
     - drm/xe: Clear pending_disable before signaling suspend fence
     - [arm64,armhf] drm/v3d: Fix vaddr leak when indirect CSD has zeroed
       workgroups
     - drm/amdgpu: restart the CS if some parts of the VM are still invalidated
     - drm/amd/pm: fix smu13 power limit default/cap calculation
     - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2
     - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in
       set_soft_freq_limited_range
     - drm/amd/display: Bound VBIOS record-chain walk loops
     - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
     - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
     - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs
     - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
     - drm/amd/display: Use krealloc_array() in dal_vector_reserve()
     - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
     - driver core: reject devices with unregistered buses
     - mailbox: Fix NULL message support in mbox_send_message()
     - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
     - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()
     - netfilter: nft_fib: fix stale stack leak via the OIFNAME register
     - mm/memory-failure: fix hugetlb_lock AA deadlock in
       get_huge_page_for_hwpoison
     - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper
     - RDMA/umem: Move umem dmabuf revoke logic into helper function
     - RDMA/umem: Add helpers for umem dmabuf revoke lock
     - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
     - RDMA/umem: fix kernel-doc warnings
     - RDMA: Move DMA block iterator logic into dedicated files
     - RDMA/umem: Fix truncation for block sizes >= 4G
     - mm/hugetlb: avoid false positive lockdep assertion
     - mptcp: fix missing wakeups in edge scenarios
     - ipmi:ssif: Remove unnecessary indention
     - ipmi:ssif: NULL thread on error
     - ipvs: skip ipv6 extension headers for csum checks (CVE-2026-45850)
     - vsock/virtio: fix potential unbounded skb queue
     - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc
     - block: fix handling of dead zone write plugs
     - [arm64] cputype: Add NVIDIA Olympus definitions
     - [arm64] cputype: Add C1-Ultra definitions
     - [arm64] cputype: Add C1-Premium definitions
     - [arm64] errata: Mitigate TLBI errata on various Arm CPUs
     - [arm64] errata: Mitigate TLBI errata on NVIDIA Olympus CPU
     - [arm64] errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
     - net: introduce EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL()
     - tcp: use EXPORT_IPV6_MOD[_GPL]()
     - tcp: secure_seq: add back ports to TS offset (CVE-2026-23247)
     - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation
     - vsock/virtio: fix skb overhead overflow on 32-bit builds
     - netfilter: require Ethernet MAC header before using eth_hdr()
 .
   [ Salvatore Bonaccorso ]
   * [rt] Refresh "ARM: enable irq in translation/section permission fault"
   * ip6_vti: set netns_immutable on the fallback device. (CVE-2026-52909)
linux-signed-amd64 (6.12.94+1~bpo12+1) bookworm-backports; urgency=medium
 .
   * Sign kernel from linux 6.12.94-1~bpo12+1
 .
   * Rebuild for bookworm-backports
linux-signed-amd64 (6.12.90+2) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.90-2
 .
   * smb: client: reject userspace cifs.spnego descriptions
   * net/rds: reset op_nents when zerocopy page pin fails (CVE-2026-43494)
linux-signed-amd64 (6.12.90+2~bpo12+1) bookworm-backports; urgency=high
 .
   * Sign kernel from linux 6.12.90-2~bpo12+1
 .
   * Rebuild for bookworm-backports
linux-signed-amd64 (6.12.90+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.90-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.89
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.90
     - HID: playstation: Clamp num_touch_reports
     - media: uvcvideo: Enable VB2_DMABUF for metadata stream
     - [arm64] dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux
     - [arm64] regulator: mt6357: fix OF node reference imbalance
     - [arm64,armhf] regulator: rk808: fix OF node reference imbalance
     - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap
     - [amd64] media: intel/ipu6: fix error pointer dereference
     - media: saa7164: add ioremap return checks and cleanups
     - spi: aspeed-smc: fix controller deregistration
     - [amd64] platform/x86: hp-wmi: Ignore backlight and FnLock events
     - vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to
       copy
     - [arm64] drm/msm/gem: fix error handling in
       msm_ioctl_gem_info_get_metadata()
     - [amd64] drm/i915/psr: Init variable to avoid early exit from et alignment
       loop
     - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure
     - drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count.
     - drm/amdgpu: gate VM CPU HDP flush on reset lock
     - drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x
     - drm/amdkfd: Add upper bound check for num_of_nodes
     - drm/amdgpu: Add bounds checking to ib_{get,set}_value
     - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
     - drm/amdgpu/vce: Prevent partial address patches
     - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg
     - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
     - drm/amd/display: Change dither policy for 10 bpc output back to dithering
     - drm/gem: Fix inconsistent plane dimension calculation in
       drm_gem_fb_init_with_funcs()
     - drm/amdkfd: validate SVM ioctl nattr against buffer size
     - drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked()
     - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()
     - drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked()
     - drm/radeon: add missing revision check for CI
     - drm/amdgpu: zero-initialize GART table on allocation
     - drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds
     - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ
     - drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds
     - drm/amdkfd: Make all TLB-flushes heavy-weight
     - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
     - drm/amdgpu/pm: add missing revision check for CI
     - drm/amdgpu/pm: align Hawaii mclk workaround with radeon
     - [arm64] dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22
     - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
     - batman-adv: fix integer overflow on buff_pos
     - batman-adv: reject new tp_meter sessions during teardown
     - batman-adv: stop caching unowned originator pointers in BAT IV
     - batman-adv: bla: prevent use-after-free when deleting claims
     - batman-adv: bla: only purge non-released claims
     - batman-adv: bla: put backbone reference on failed claim hash insert
     - usb: typec: tcpm: reset internal port states on soft reset AMS
     - usb: dwc3: Move GUID programming after PHY initialization
     - ALSA: hda: cs35l56: Propagate ASP TX source control errors
     - ALSA: misc: Use guard() for spin locks
     - ALSA: core: Serialize deferred fasync state checks
     - ALSA: seq: Notify client and port info changes
     - ALSA: seq: Fix UMP group 16 filtering
     - Bluetooth: hci_conn: fix potential UAF in create_big_sync
     - [arm64,armhf] spi: tegra20-sflash: fix controller deregistration
     - [arm64,armhf] spi: tegra114: fix controller deregistration
     - mm/hugetlb_cma: round up per_node before logging it
     - block: cleanup blkdev_report_zones()
     - block: reorganize struct blk_zone_wplug
     - block: fix zone write plug removal
     - tracefs: Fix default permissions not being applied on initial mount
     - fbcon: Avoid OOB font access if console rotation fails
     - mm/damon/core: disallow time-quota setting zero esz
     - mm/damon/core: implement damon_kdamond_pid()
     - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values
     - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values
     - bonding: fix use-after-free due to enslave fail after slave array update
       (CVE-2026-23171)
     - io_uring/kbuf: support min length left for incremental buffers
     - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
     - btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type()
     - btrfs: fix double free in create_space_info_sub_group() error path
     - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to
       info-leak
     - tracing/probes: Limit size of event probe to 3K
     - batman-adv: stop tp_meter sessions during mesh teardown
     - batman-adv: tp_meter: fix tp_num leak on kmalloc failure
     - vsock: fix buffer size clamping order
     - vsock/virtio: fix length and offset in tap skb for split packets
     - vsock/virtio: fix empty payload in tap skb for non-linear buffers
     - vsock/virtio: fix accept queue count leak on transport mismatch
     - drm/amdgpu/vcn3: Avoid overflow on msg bound check
     - drm/amdgpu/vcn4: Avoid overflow on msg bound check
 .
   [ Salvatore Bonaccorso ]
   * Bluetooth: btmtk: accept too short WMT FUNC_CTRL events (Closes: #1136790)
   * net: skbuff: preserve shared-frag marker during coalescing (CVE-2026-46300)
   * net: skbuff: propagate shared-frag marker through frag-transfer helpers
linux-signed-amd64 (6.12.90+1~bpo12+1) bookworm-backports; urgency=high
 .
   * Sign kernel from linux 6.12.90-1~bpo12+1
 .
   * Rebuild for bookworm-backports
linux-signed-amd64 (6.12.88+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.88-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.87
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.88
     - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
     - ipmi: Add limits to event and receive message requests
     - ipmi: Check event message buffer response for bad data
     - ipmi:si: Return state to normal if message allocation fails
     - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
     - ACPI: scan: Use acpi_dev_put() in object add error paths
     - ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO
     - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug
     - ACPI: video: force native backlight on HP OMEN 16 (8A44)
     - ASoC: SOF: Don't allow pointer operations on unconfigured streams
     - spi: rockchip: fix controller deregistration
     - ksmbd: rewrite stop_sessions() with restartable iteration
     - mm: convert mm_lock_seq to a proper seqcount
     - [amd64] x86: shadow stacks: proper error handling for mmap lock
       (CVE-2026-43109)
     - [amd64] x86/shstk: Prevent deadlock during shstk sigreturn
     - [amd64] KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
     - [amd64] iommu/amd: Use atomic64_inc_return() in iommu.c
     - [amd64] iommu/amd: serialize sequence allocation under concurrent TLB
       invalidations (CVE-2026-43220) (Closes: #1135313)
     - flow_dissector: do not dissect PPPoE PFC frames
     - net: txgbe: fix RTNL assertion warning when remove module
     - net: af_key: zero aligned sockaddr tail in PF_KEY exports (CVE-2026-43088)
     - [amd64] KVM: SVM: check validity of VMCB controls when returning from SMM
     - net/sched: sch_red: Replace direct dequeue call with peek and
       qdisc_dequeue_peeked
     - Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (CVE-2026-31499)
     - exit: prevent preemption of oopsing TASK_DEAD task
     - wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr
     - wifi: mt76: mt7925: fix incorrect length field in txpower command
     - wifi: mt76: mt7921: fix a potential clc buffer length underflow
     - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work
     - wifi: b43legacy: enforce bounds check on firmware key index in RX path
     - wifi: mac80211: drop stray 'static' from fast-RX rx_result
     - wifi: rsi: fix kthread lifetime race between self-exit and external-stop
     - wifi: mac80211: use safe list iteration in radar detect work
     - wifi: ath5k: do not access array OOB (Closes: #1119093)
     - wifi: mac80211: remove station if connection prep fails
     - wifi: b43: enforce bounds check on firmware key index in b43_rx()
     - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog
       task
     - usb: usblp: fix heap leak in IEEE 1284 device ID via short response
     - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
     - ALSA: usb-audio: midi2: Restart output URBs on resume
     - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()
     - ALSA: usb-audio: Fix UAC3 cluster descriptor size check
     - USB: omap_udc: DMA: Don't enable burst 4 mode
     - USB: serial: option: add Telit Cinterion LE910Cx compositions
     - usb: ulpi: fix memory leak on ulpi_register() error paths
     - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger
     - ALSA: firewire-tascam: Do not drop unread control events
     - xfrm: provide message size for XFRM_MSG_MAPPING
     - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
     - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
     - xfrm: ah: account for ESN high bits in async callbacks
     - selinux: don't reserve xattr slot when we won't fill it
     - selinux: shrink critical section in sel_write_load()
     - selinux: prune /sys/fs/selinux/disable
     - Bluetooth: virtio_bt: clamp rx length before skb_put
     - Bluetooth: virtio_bt: validate rx pkt_type header length
     - Bluetooth: btmtk: validate WMT event SKB length before struct access
     - Bluetooth: hci_event: Fix OOB read and infinite loop in
       hci_le_create_big_complete_evt
     - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
     - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
     - [armhf] spi: sun4i: fix controller deregistration
     - [armhf] spi: ti-qspi: fix controller deregistration
     - spi: sun6i: fix controller deregistration
     - fanotify: fix false positive on permission events
     - [arm64] KVM: arm64: Fix kvm_vcpu_initialized() macro parameter
     - mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()
     - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in
       rtnl_fill_vfinfo
     - sound: ua101: fix division by zero at probe
     - net: libwx: fix VF illegal register access
     - ip6_gre: Use cached t->net in ip6erspan_changelink().
     - net/rds: handle zerocopy send cleanup before the message is queued
     - net: wwan: t7xx: validate port_count against message length in
       t7xx_port_enum_msg_handler
     - hwmon: (ltc2992) Clamp threshold writes to hardware range
     - hwmon: (ltc2992) Fix u32 overflow in power read path
     - clk: rk808: fix OF node reference imbalance
     - hwmon: (corsair-psu) Close HID device on probe errors
     - af_unix: Reject SIOCATMARK on non-stream sockets
     - block: add pgmap check to biovec_phys_mergeable
     - cifs: abort open_cached_dir if we don't request leases
     - cifs: change_conf needs to be called for session setup
     - extcon: ptn5150: handle pending IRQ events during system resume
     - gpio: of: clear OF_POPULATED on hog nodes in remove path
     - hv_sock: fix ARM64 support
     - ibmveth: Disable GSO for packets with small MSS
     - ice: fix double free in ice_sf_eth_activate() error path
     - spi: microchip-core-qspi: fix controller deregistration
     - udf: reject descriptors with oversized CRC length
     - thermal: core: Free thermal zone ID later during removal
     - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata
     - thermal/drivers/sprd: Fix raw temperature clamping in
       sprd_thm_rawdata_to_temp
     - spi: topcliff-pch: fix controller deregistration
     - spi: topcliff-pch: fix use-after-free on unbind
     - clk: imx: imx8-acm: fix flags for acm clocks
     - clk: microchip: mpfs-ccc: fix out of bounds access during output
       registration
     - cpuidle: powerpc: avoid double clear when breaking snooze
     - [amd64] ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in
       quirk table
     - [arm64] ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop
     - [arm64] ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens
     - [arm64] ASoC: qcom: q6apm: remove child devices when apm is removed
     - btrfs: fix double free in create_space_info() error path
     - dm-thin: fix metadata refcount underflow
     - dm: don't report warning when doing deferred remove
     - dm: fix a buffer overflow in ioctl processing
     - eventfs: Hold eventfs_mutex and SRCU when remount walks events
     - dm-verity-fec: correctly reject too-small FEC devices
     - dm-verity-fec: correctly reject too-small hash devices
     - isofs: validate Rock Ridge CE continuation extent against volume size
     - isofs: validate block number from NFS file handle in isofs_export_iget
     - [arm64] iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update
     - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
     - lib/scatterlist: fix length calculations in extract_kvec_to_sg
     - lib/scatterlist: fix temp buffer in extract_user_to_sg()
     - libceph: Fix slab-out-of-bounds access in auth message processing
     - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies
     - nvme-apple: drop invalid put of admin queue reference count
     - nvmet-tcp: fix race between ICReq handling and queue teardown
     - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
     - openvswitch: vport: fix self-deadlock on release of tunnel ports
     - pmdomain: core: Fix detach procedure for virtual devices in genpd
     - [arm64] RDMA/hns: Fix unlocked call to hns_roce_qp_remove()
     - [s390x] debug: Reject zero-length input in debug_input_flush_fn()
     - smb/client: fix out-of-bounds read in smb2_compound_op()
     - smb/client: fix out-of-bounds read in symlink_data()
     - smb: client: use kzalloc to zero-initialize security descriptor buffer
     - smb: client: validate dacloffset before building DACL pointers
     - [amd64] KVM: x86: check for nEPT/nNPT in slow flush hypercalls
     - mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock
     - PCI: Update saved_config_space upon resource assignment (Closes: #1131025)
     - PCI/AER: Clear only error bits in PCIe Device Status
     - PCI/AER: Stop ruling out unbound devices as error source
     - PCI/ASPM: Fix pci_clear_and_set_config_dword() usage
     - power: supply: max17042: avoid overflow when determining health
     - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss()
     - RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()
     - RDMA/mana: Validate rx_hash_key_len
     - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
     - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()
     - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
     - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads
     - RDMA/rxe: Reject unknown opcodes before ICRC processing
     - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
     - mptcp: fastclose msk when linger time is 0
     - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure
     - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure
     - mptcp: sockopt: set timestamp flags on subflow socket, not msk
     - mptcp: fix scheduling with atomic in timestamp sockopt
     - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode()
     - f2fs: fix fiemap boundary handling when read extent cache is incomplete
     - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks()
     - f2fs: fix node_cnt race between extent node destroy and writeback
     - f2fs: fix uninitialized kobject put in f2fs_init_sysfs()
     - [arm64] KVM: arm64: vgic: Fix IIDR revision field extracted from wrong
       value
     - [arm64] KVM: arm64: Fix initialisation order in __pkvm_init_finalise()
     - bpf: Fix use-after-free in arena_vm_close on fork
     - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info
     - fs: prepare for adding LSM blob to backing_file
     - dma-mapping: drop unneeded includes from dma-mapping.h
     - dma-mapping: add __dma_from_device_group_begin()/end()
     - hwmon: (powerz) Avoid cacheline sharing for DMA buffer
     - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs
     - udf: fix partition descriptor append bookkeeping
     - mtd: spinand: winbond: Declare the QE bit on W25NxxJW
     - hfsplus: fix uninit-value by validating catalog record size
     - hfsplus: fix held lock freed on hfsplus_fill_super()
     - erofs: move {in,out}pages into struct z_erofs_decompress_req
     - erofs: tidy up z_erofs_lz4_handle_overlap()
     - erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()
     - gtp: disable BH before calling udp_tunnel_xmit_skb()
     - printk: add print_hex_dump_devel()
     - crypto: caam - guard HMAC key hex dumps in hash_digest_key
     - ALSA: aloop: Fix peer runtime UAF during format-change stop
     - net: stmmac: avoid shadowing global buf_sz
     - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY()
     - net: stmmac: Prevent NULL deref when RX memory exhausted
     - wifi: mt76: mt7925: fix incorrect TLV length in CLC command
     - tracepoint: balance regfunc() on func_add() failure in
       tracepoint_add_func()
     - [arm64] KVM: arm64: Wake-up from WFI when iqrchip is in userspace
     - [amd64] x86/CPU/AMD: Prevent improper isolation of shared resources in
       Zen2's op cache
     - ksmbd: validate inherited ACE SID length
 .
   [ Salvatore Bonaccorso ]
   * ptrace: slightly saner 'get_dumpable()' logic
linux-signed-amd64 (6.12.88+1~bpo12+1) bookworm-backports; urgency=high
 .
   * Sign kernel from linux 6.12.88-1~bpo12+1
 .
   * Rebuild for bookworm-backports

linux-signed-arm64 (6.12.94+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.94-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.91
     - io_uring/kbuf: use mem_is_zero()
     - blk-cgroup: wait for blkcg cleanup before initializing new disk
     - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START
     - fs/mbcache: cancel shrink work before destroying the cache
     - md/raid1: fix the comparing region of interval tree
     - drbd: Balance RCU calls in drbd_adm_dump_devices()
     - loop: fix partition scan race between udev and loop_reread_partitions()
     - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()
     - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()
     - pstore/ram: fix resource leak when ioremap() fails
     - md: wake raid456 reshape waiters before suspend
     - btrfs: pass struct btrfs_inode to clone_copy_inline_extent()
     - btrfs: fix deadlock between reflink and transaction commit when using
       flushoncommit
     - [amd64] ACPI: x86: cmos_rtc: Clean up address space handler driver
     - [amd64] ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver
     - devres: fix missing node debug info in devm_krealloc()
     - thermal/drivers/spear: Fix error condition for reading st,thermal-flags
     - debugfs: check for NULL pointer in debugfs_create_str()
     - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str()
     - soundwire: debugfs: initialize firmware_file to empty string
     - PCI: use generic driver_override infrastructure
     - platform/wmi: use generic driver_override infrastructure
     - [s390x] cio: use generic driver_override infrastructure
     - bus: fsl-mc: use generic driver_override infrastructure
     - irqchip/irq-pic32-evic: Address warning related to wrong printf()
       formatter
     - hrtimers: Update the return type of enqueue_hrtimer()
     - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns()
     - hrtimer: Reduce trace noise in hrtimer_start()
     - locking: Fix rwlock support in <linux/spinlock_up.h>
     - firmware: dmi: Correct an indexing error in dmi.h
     - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt()
     - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished
       irq_prepare_bcn_tasklet
     - bpf: test_run: Fix the null pointer dereference issue in
       bpf_lwt_xmit_push_encap
     - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH
     - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n
     - [s390x] bpf: Zero-extend bpf prog return values and kfunc arguments
     - params: Replace __modinit with __init_or_module
     - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n
     - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in
       mt76_connac2_tx_check_aggr()
     - wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control
     - wifi: mt76: mt7615: fix use_cts_prot support
     - wifi: mt76: mt7915: fix use_cts_prot support
     - wifi: mt76: mt7925: prevent NULL pointer dereference in
       mt7925_tx_check_aggr()
     - wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi
     - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor
     - wifi: mt76: mt7921: Place upper limit on station AID
     - [arm64] cpufeature: Make PMUVer and PerfMon unsigned
     - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event
     - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()
     - wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()
     - wifi: mt76: mt7921: fix 6GHz regulatory update on connection
     - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path
     - bpf: Fix variable length stack write over spilled pointers
     - bpf,arc_jit: Fix missing newline in pr_err messages
     - wifi: rtw89: phy: fix uninitialized variable access in
       rtw89_phy_cfo_set_crystal_cap()
     - r8152: fix incorrect register write to USB_UPHY_XTAL
     - [powerpc*] crash: fix backup region offset update to elfcorehdr
     - [powerpc*] crash: Update backup region offset in elfcorehdr on memory
       hotplug
     - macvlan: annotate data-races around port->bc_queue_len_used
     - bpf: fix end-of-list detection in cgroup_storage_get_next_key()
     - bpf: Fix stale offload->prog pointer after constant blinding
     - wifi: brcmfmac: Fix error pointer dereference
     - wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode()
     - bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks
     - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()
     - wifi: ath10k: fix station lookup failure during disconnect
     - ACPI: AGDI: fix missing newline in error message
     - [arm64] kexec: Remove duplicate allocation for trans_pgd
     - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
     - net: bcmgenet: add bcmgenet_has_* helpers
     - net: bcmgenet: move DESC_INDEX flow to ring 0
     - net: bcmgenet: support reclaiming unsent Tx packets
     - net: bcmgenet: switch to use 64bit statistics
     - net: bcmgenet: fix racing timeout handler
     - eth: fbnic: Use wake instead of start
     - netfilter: xt_socket: enable defrag after all other checks
     - netfilter: nft_fwd_netdev: check ttl/hl before forwarding
     - bpf: fix mm lifecycle in open-coded task_vma iterator
     - bpf: switch task_vma iterator from mmap_lock to per-VMA locks
     - bpf: return VMA snapshot from task_vma iterator
     - bpf: Fix RCU stall in bpf_fd_array_map_clear()
     - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf
     - bpf: Relax scalar id equivalence for state pruning
     - bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars
     - net/sched: act_ct: Only release RCU read lock after ct_ft
     - net: airoha: Implement BQL support
     - net: airoha: Add missing RX_CPU_IDX() configuration in
       airoha_qdma_cleanup_rx_queue()
     - bpf: Allow instructions with arena source and non-arena dest registers
     - net/rds: Optimize rds_ib_laddr_check
     - net/rds: Restrict use of RDS/IB to the initial network namespace
     - bpf: Fix OOB in pcpu_init_value
     - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
     - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG
     - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+
     - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110
     - net: phy: fix a return path in get_phy_c45_ids()
     - net/mlx5e: Fix features not applied during netdev registration
     - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic()
     - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb
     - Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU
     - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error
     - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
     - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
     - Bluetooth: SCO: check for codecs->num_codecs == 1 before assigning to
       sco_pi(sk)->codec
     - net: phy: qcom: at803x: Use the correct bit to disable extended next page
     - ipv4: udp: fix typos in comments
     - ipv6: udp: fix typos in comments
     - udp: Force compute_score to always inline
     - tcp: Don't set treq->req_usec_ts in cookie_tcp_reqsk_init().
     - sctp: fix missing encap_port propagation for GSO fragments
     - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master
     - drm/komeda: fix integer overflow in AFBC framebuffer size check
     - ASoC: SOF: ipc3: Use standard dev_dbg API
     - ASoC: add symmetric_ prefix for dai->rate/channels/sample_bits
     - ASoC: soc-compress: use function to clear symmetric params
     - drm/sun4i: backend: fix error pointer dereference
     - ASoC: sti: Return errors from regmap_field_alloc()
     - ASoC: sti: use managed regmap_field allocations
     - dm cache: fix null-deref with concurrent writes in passthrough mode
     - dm cache: fix write path cache coherency in passthrough mode
     - dm cache: fix write hang in passthrough mode
     - dm cache policy smq: fix missing locks in invalidating cache blocks
     - dm cache: fix concurrent write failure in passthrough mode
     - dm cache: support shrinking the origin device
     - dm cache: fix dirty mapping checking in passthrough mode switching
     - platform/chrome: chromeos_tbmc: Drop wakeup source on remove
     - PCI: endpoint: Align pci_epc_set_msix(), pci_epc_ops::set_msix() nr_irqs
       encoding
     - PCI: dwc: ep: Fix MSI-X Table Size configuration in dw_pcie_ep_set_msix()
     - PCI: dwc: Invoke post_init in dw_pcie_resume_noirq()
     - PCI: dwc: Perform cleanup in the error path of dw_pcie_resume_noirq()
     - dm cache metadata: fix memory leak on metadata abort retry
     - dm log: fix out-of-bounds write due to region_count overflow
     - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in
       atomic_enable()
     - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to
       drm_bridge_funcs
     - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge
       atomic check
     - spi: spi-nxp-fspi: enable runtime pm for fspi
     - spi: nxp-fspi: Use reinit_completion() for repeated operations
     - spi: fsl-qspi: Use reinit_completion() for repeated operations
     - media: i2c: og01a1b: Replace client->dev usage
     - media: i2c: og01a1b: Fix V4L2 subdevice data initialization on probe
     - drm/v3d: Handle error from drm_sched_entity_init()
     - drm/sun4i: Fix resource leaks
     - drm/amdgpu: Add default case in DVI mode validation
     - dm init: ensure device probing has finished in dm-mod.waitfor=
     - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build
       break
     - crypto: tegra - finalize crypto req on error
     - crypto: tegra - Transfer HASH init function to crypto engine
     - crypto: tegra - Reserve keyslots to allocate dynamically
     - crypto: tegra - Disable softirqs before finalizing request
     - crypto: atmel - Use unregister_{aeads,ahashes,skciphers}
     - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs
     - padata: Remove cpu online check from cpu add and removal
     - padata: Put CPU offline callback in ONLINE section to allow failure
     - PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the
       documentation
     - drm/amdgpu/gfx10: look at the right prop for gfx queue priority
     - drm/amdgpu/gfx11: look at the right prop for gfx queue priority
     - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo
     - drm/imagination: Switch reset_reason fields from enum to u32
     - iommu/tegra241-cmdqv: Set supports_cmd op in tegra241_vcmdq_hw_init()
     - [arm64] drm/msm/dpu: fix mismatch between power and frequency
     - [arm64] drm/msm/dsi: add the missing parameter description
     - [arm64] drm/msm/dsi: fix bits_per_pclk
     - [arm64] drm/msm/dsi: fix hdisplay calculation for CMD mode panel
     - [arm64] drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0
     - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first
     - drm/panel: simple: Correct G190EAN01 prepare timing
     - PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion
       support
     - ALSA: core: Validate compress device numbers without dynamic minors
     - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled
     - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs
     - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock
     - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0
     - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels
     - drm/amd/pm/ci: Fill DW8 fields from SMC
     - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board
     - drm/amdgpu: add amdgpu_device reference in ip block
     - drm/amdgpu: update the handle ptr in dump_ip_state
     - drm/amdgpu: update the handle ptr in early_init
     - drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled
     - hwmon: Switch back to struct platform_driver::remove()
     - hwmon: (aspeed-g6-pwm-tach): remove redundant driver remove callback
     - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace
       '}')
     - [amd64] ASoC: SOF: Intel: hda: Place check before dereference
     - [arm64] drm/msm/a6xx: Fix HLSQ register dumping
     - [arm64] drm/msm/shrinker: Fix can_block() logic
     - [arm64] drm/msm/a6xx: Fix dumping A650+ debugbus blocks
     - [arm64] drm/msm/a6xx: Use barriers while updating HFI Q headers
     - pmdomain: ti: omap_prm: Fix a reference leak on device node
     - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe()
     - PM: domains: De-constify fields in struct dev_pm_domain_attach_data
     - ASoC: fsl_micfil: Add access property for "VAD Detected"
     - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable()
     - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode()
     - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state()
     - ASoC: fsl_micfil: Fix event generation in micfil_quality_set()
     - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put()
     - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put()
     - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits()
     - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits()
     - ASoC: fsl_easrc: Change the type for iec958 channel status controls
     - [amd64] iommu/amd: Remove protection_domain.dev_cnt variable
     - [amd64] iommu/amd: xarray to track protection_domain->iommu list
     - [amd64] iommu/amd: Do not detach devices in domain free path
     - [amd64] iommu/amd: Reduce domain lock scope in attach device path
     - [amd64] iommu/amd: Rearrange attach device code
     - [amd64] iommu/amd: Convert dev_data lock from spinlock to mutex
     - [amd64] iommu/amd: Introduce helper function to update 256-bit DTE
     - [amd64] iommu/amd: Introduce helper function get_dte256()
     - [amd64] iommu/amd: Fix clone_alias() to use the original device's devid
     - [arm64] ASoC: qcom: qdsp6: topology: check widget type before accessing
       data
     - crypto: qat - introduce fuse array
     - crypto: qat - disable 4xxx AE cluster when lead engine is fused off
     - crypto: qat - disable 420xx AE cluster when lead engine is fused off
     - crypto: qat - fix type mismatch in RAS sysfs show functions
     - crypto: qat - use swab32 macro
     - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]
     - PCI: Enable AtomicOps only if Root Port supports them
     - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found
     - Documentation: fix a hugetlbfs reservation statement
     - ALSA: scarlett2: Add missing sentinel initializer field
     - ASoC: SOF: compress: return the configured codec from get_params
     - PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports
     - PCI: tegra194: Fix polling delay for L2 state
     - PCI: tegra194: Increase LTSSM poll time on surprise link down
     - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link
       down
     - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in
       tegra_pcie_downstream_dev_to_D0()
     - PCI: tegra194: Don't force the device into the D0 state before L2
     - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode
     - PCI: tegra194: Use devm_gpiod_get_optional() to parse
       "nvidia,refclk-select"
     - PCI: tegra194: Disable direct speed change for Endpoint mode
     - PCI: tegra194: Set LTR message request before PCIe link up in Endpoint
       mode
     - PCI: tegra194: Allow system suspend when the Endpoint link is not up
     - PCI: tegra194: Free up Endpoint resources during remove()
     - PCI: tegra194: Use DWC IP core version
     - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well
     - PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on
     - spi: mtk-snfi: unregister ECC engine on probe failure and remove()
       callback
     - ALSA: sc6000: Keep the programmed board state in card-private data
     - dm cache: fix missing return in invalidate_committed's error path
     - crypto: jitterentropy - replace long-held spinlock with mutex
     - ALSA: hda/realtek - fixed speaker no sound update
     - gfs2: Call unlock_new_inode before d_instantiate
     - net/socket.c: switch to CLASS(fd)
     - fdget(), trivial conversions
     - fanotify: call fanotify_events_supported() before path_permission() and
       security_path_notify()
     - quota: Fix race of dquot_scan_active() with quota deactivation
     - gfs2: add some missing log locking
     - gfs2: prevent NULL pointer dereference during unmount
     - efi/capsule-loader: fix incorrect sizeof in phys array reallocation
     - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine
     - [arm64] dts: mediatek: mt8365: Describe infracfg-nao as a pure syscon
     - memory: tegra124-emc: Fix dll_change check
     - memory: tegra30-emc: Fix dll_change check
     - [arm64] dts: imx8-apalis: Fix LEDs name collision
     - [arm64] dts: rockchip: Make Jaguar PCIe-refclk pin use pull-up config
     - [arm64] dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO
       (M.2 W_DISABLE1)
     - iommufd: vfio compatibility extension check for noiommu mode
     - [arm64] dts: mediatek: mt6795: Fix gpio-ranges pin count
     - [arm64] dts: mediatek: mt7981b: Fix gpio-ranges pin count
     - [arm64] dts: mediatek: mt7986a: Fix gpio-ranges pin count
     - [arm64] dts: qcom: msm8953-xiaomi-vince: correct wled ovp value
     - [arm64] dts: qcom: msm8953-xiaomi-daisy: fix backlight
     - [arm64] dts: rockchip: Fix Bluetooth stability on LCKFB TaiShan Pi
     - [arm64] dts: rockchip: Correct Fan Supply for Gameforce Ace
     - [arm64] dts: rockchip: Correct Joystick Axes on Gameforce Ace
     - [arm64] soc: qcom: ocmem: make the core clock optional
     - [arm64] soc: qcom: ocmem: register reasons for probe deferrals
     - [arm64] soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available
     - bus: rifsc: fix RIF configuration check for peripherals
     - [arm64] dts: qcom: sm8450: Fix GIC_ITS range length
     - [arm64] dts: qcom: sm8550: Fix GIC_ITS range length
     - [arm64] dts: qcom: sm8650: Fix GIC_ITS range length
     - [arm64] dts: qcom: sm8550: Fix xo clock supply of platform SD host
       controller
     - [arm64] dts: qcom: sm8650: Fix xo clock supply of SD host controller
     - [arm64] dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes
     - [arm64] dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes
     - [arm64] dts: qcom: sm8650: Enable UHS-I SDR50 and SDR104 SD card modes
     - [arm64] dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl
     - [arm64] dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered
       during boot
     - [arm64] dts: ti: k3-am62p5-sk: Disable MMC1 internal pulls on data pins
     - [arm64] dts: ti: k3-am62-lp-sk: Enable internal pulls for MMC0 data pins
     - [arm64] dts: ti: k3-am62-verdin: Fix SPI_1 GPIO CS pinctrl label
     - [arm64] dts: freescale: imx8mp-tqma8mpql-mba8mp-ras314: fix UART1 RTS/CTS
       muxing
     - [arm64] dts: lx2160a: change i2c0 (iic1) pinmux mask to one bit
     - [arm64] dts: lx2160a: remove duplicate pinmux nodes
     - [arm64] dts: lx2160a: rename pinmux nodes for readability
     - [arm64] dts: lx2160a: add sda gpio references for i2c bus recovery
     - [arm64] dts: lx2160a: change zeros to hexadecimal in pinmux nodes
     - [arm64] dts: lx2160a: complete pinmux for rcwsr12 configuration word
     - [arm64] dts: imx8qm-mek: switch Type-C connector power-role to dual
     - [arm64] dts: imx8qxp-mek: switch Type-C connector power-role to dual
     - soc/tegra: cbb: Set ERD on resume for err interrupt
     - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure
     - ocfs2/dlm: validate qr_numregions in dlm_match_regions()
     - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
     - soc: qcom: llcc: fix v1 SB syndrome register offset
     - [arm64] soc: qcom: aoss: compare against normalized cooling state
     - [arm64] dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP
     - [arm64] xor: fix conflicting attributes for xor_block_template
     - firmware: arm_ffa: Use the correct buffer size during RXTX_MAP
     - ocfs2: fix listxattr handling when the buffer is full
     - ocfs2: validate bg_bits during freefrag scan
     - ocfs2: validate group add input before caching
     - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void
       function
     - soundwire: bus: demote UNATTACHED state warnings to dev_dbg()
     - dmaengine: mxs-dma: Fix missing return value from
       of_dma_controller_register()
     - soundwire: cadence: Clear message complete before signaling waiting thread
     - tracing: Rebuild full_name on each hist_field_name() call
     - hte: tegra194: remove Kconfig dependency on Tegra194 SoC
     - remoteproc: xlnx: Fix sram property parsing
     - ima: check return value of crypto_shash_final() in boot aggregate
     - HID: asus: make asus_resume adhere to linux kernel coding standards
     - HID: asus: do not abort probe when not necessary
     - mtd: physmap_of_gemini: Fix disabled pinctrl state check
     - ima_fs: don't bother with removal of files in directory we'll be removing
     - ima_fs: get rid of lookup-by-dentry stuff
     - ima_fs: Correctly create securityfs files for unsupported hash algos
     - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range
     - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations
     - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook
     - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook
     - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation
     - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask
     - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path
     - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions
     - cxl/pci: Check memdev driver binding status in cxl_reset_done()
     - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob
     - HID: usbhid: fix deadlock in hid_post_reset()
     - ext4: fix possible null-ptr-deref in mbt_kunit_exit()
     - [arm64] bpf, arm64: Fix off-by-one in check_imm signed range check
     - bpf, sockmap: Fix af_unix iter deadlock
     - bpf, sockmap: Fix af_unix null-ptr-deref in proto update
     - bpf, sockmap: Take state lock for af_unix iter
     - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check
     - bpf: Fix NULL deref in map_kptr_match_type for scalar regs
     - bpf: allow UTF-8 literals in bpf_bprintf_prepare()
     - bpf: Validate node_id in arena_alloc_pages()
     - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT
     - pinctrl: pinctrl-pic32: Fix resource leak
     - pinctrl: cy8c95x0: remove duplicate error message
     - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe()
     - pinctrl: cy8c95x0: Avoid returning positive values to user space
     - perf branch: Avoid incrementing NULL
     - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace
     - pinctrl: realtek: Fix function signature for config argument
     - pinctrl: abx500: Fix type of 'argument' variable
     - pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT} registers
     - perf lock: Fix option value type in parse_max_stack
     - perf stat: Fix opt->value type for parse_cache_level
     - perf tools: Fix module symbol resolution for non-zero .text sh_addr
     - perf expr: Return -EINVAL for syntax error in expr__find_ids()
     - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure
     - ipmi: ssif_bmc: fix message desynchronization after truncated response
     - ipmi: ssif_bmc: change log level to dbg in irq callback
     - perf evsel: Add alternate_hw_config and use in evsel__match
     - perf tool_pmu: Factor tool events into their own PMU
     - perf python: Add parse_events function
     - perf cgroup: Update metric leader in evlist__expand_cgroup
     - perf maps: Fix copy_from that can break sorted by name order
     - perf util: Kill die() prototype, dead for a long time
     - reset: replace boolean parameters with flags parameter
     - reset: Add devres helpers to request pre-deasserted reset controls
     - i3c: master: dw-i3c: Fix missing reset assertion in remove() callback
     - i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers()
     - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status
     - backlight: sky81452-backlight: Check return value of
       devm_gpiod_get_optional() in sky81452_bl_parse_dt()
     - platform/surface: surfacepro3_button: Drop wakeup source on remove
     - leds: lgm-sso: Remove duplicate assignments for priv->mmap
     - tty: hvc_iucv: fix off-by-one in number of supported devices
     - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup
     - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata()
     - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist()
     - [amd64] platform/x86: asus-wmi: adjust screenpad power/brightness handling
     - [amd64] platform/x86: asus-wmi: fix screenpad brightness range
     - tty: serial: ip22zilog: Fix section mispatch warning
     - fs/ntfs3: terminate the cached volume label after UTF-8 conversion
     - [amd64] platform/x86: dell_rbu: avoid uninit value usage in
       packet_size_write()
     - [amd64] platform/x86: dell-wmi-sysman: bound enumeration string
       aggregation
     - RDMA/core: Prefer NLA_NUL_STRING
     - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source
     - scsi: sg: Fix sysctl sg-big-buff register during sg_init()
     - scsi: sg: Resolve soft lockup issue when opening /dev/sgX
     - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from
       byte_div_clk_src dividers
     - clk: qcom: dispcc-sm4450: Fix DSI byte clock rate setting
     - scsi: target: core: Fix integer overflow in UNMAP bounds check
     - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs
     - clk: qcom: gcc-sc8180x: Add missing GDSCs
     - clk: qcom: gcc-sc8180x: Use retention for USB power domains
     - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains
     - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk
     - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks
     - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed()
     - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels()
     - clk: imx8mq: Correct the CSI PHY sels
     - [amd64] x86/um/vdso: Drop VDSO64-y from Makefile
     - clk: qoriq: avoid format string warning
     - clk: xgene: Fix mapping leak in xgene_pllclk_init()
     - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets
     - clk: qcom: dispcc-sc7180: Add missing MDSS resets
     - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug()
     - clk: qcom: gcc-x1e80100: Keep GCC USB QTB clock always ON
     - clk: visconti: pll: initialize clk_init_data to zero
     - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()
     - [amd64] drm/i915: Relocate the SKL wm sanitation code
     - [amd64] drm/i915/wm: Verify the correct plane DDB entry
     - crypto: sa2ul - Fix AEAD fallback algorithm names
     - crypto: ccp - copy IV using skcipher ivsize
     - erofs: add encoded extent on-disk definition
     - erofs: do sanity check on m->type in z_erofs_load_compact_lcluster()
     - erofs: avoid infinite loops due to corrupted subpage compact indexes
       (CVE-2025-68251)
     - erofs: unify lcn as u64 for 32-bit platforms
     - [arm64] dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mp-navqp: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT
     - PCMCIA: Fix garbled log messages for KERN_CONT
     - [arm64] dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT
     - [arm64] dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT
     - [arm64] dts: marvell: armada-37xx: use 'usb2-phy' in USB3 controller's
       phy-names
     - net/sched: act_mirred: fix wrong device for mac_header_xmit check in
       tcf_blockcast_redir
     - macvlan: fix macvlan_get_size() not reserving space for
       IFLA_MACVLAN_BC_CUTOFF
     - net/sched: sch_cake: fix NAT destination port not being updated in
       cake_update_flowkeys
     - nexthop: fix IPv6 route referencing IPv4 nexthop
     - net/sched: taprio: fix use-after-free in advance_sched() on schedule
       switch
     - tcp: add data-race annotations around tp->data_segs_out and
       tp->total_retrans
     - tcp: add data-race annotations for TCP_NLA_SNDQ_SIZE
     - tcp: annotate data-races around tp->bytes_sent
     - tcp: annotate data-races around tp->bytes_retrans
     - tcp: annotate data-races around tp->dsack_dups
     - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt)
     - tcp: annotate data-races around tp->plb_rehash
     - ice: update PCS latency settings for E825 10G/25Gb modes
     - ice: Remove jumbo_remove step from TX path
     - ice: fix double-free of tx_buf skb
     - ice: fix ICE_AQ_LINK_SPEED_M for 200G
     - i40e: don't advertise IFF_SUPP_NOFCS
     - e1000e: Unroll PTP in probe error handling
     - ipv6: fix possible UAF in icmpv6_rcv()
     - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
     - pppoe: drop PFC frames
     - net/mlx5: Fix HCA caps leak on notifier init failure
     - openvswitch: cap upcall PID array size and pre-size vport replies
     - netfilter: nft_osf: restrict it to ipv4
     - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
     - netfilter: conntrack: remove sprintf usage
     - netfilter: xtables: restrict several matches to inet family
     - ipvs: fix MTU check for GSO packets in tunnel mode
     - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
     - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
     - slip: reject VJ receive packets on instances with no rstate array
     - slip: bound decode() reads against the compressed packet length
     - [arm64] dts: meson-gxl-p230: fix ethernet PHY interrupt number
     - pwm: atmel-tcb: Cache clock rates and mark chip as atomic
     - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy()
     - ksmbd: destroy async_ida in ksmbd_conn_free()
     - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open
     - ksmbd: scope conn->binding slowpath to bound sessions only
     - net/rds: zero per-item info buffer before handing it to visitors
     - ice: fix timestamp interrupt configuration for E825C
     - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g
     - net_sched: sch_hhf: annotate data-races in hhf_dump_stats()
     - net/sched: sch_pie: annotate data-races in pie_dump_stats()
     - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats()
     - net/sched: sch_red: annotate data-races in red_dump_stats()
     - net/sched: sch_sfb: annotate data-races in sfb_dump_stats()
     - net: dsa: realtek: rtl8365mb: fix mode mask calculation
     - net: airoha: Move ndesc initialization at end of
       airoha_qdma_init_rx_queue()
     - virtio_net: Split struct virtio_net_rss_config
     - virtio_net: Fix endian with virtio_net_ctrl_rss
     - virtio_net: Use new RSS config structs
     - virtio_net: sync rss_trailer.max_tx_vq on queue_pairs change via
       VQ_PAIRS_SET
     - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls
     - tipc: fix double-free in tipc_buf_append()
     - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()
     - fs/adfs: validate nzones in adfs_validate_bblk()
     - rtc: abx80x: Disable alarm feature if no interrupt attached
     - kbuild: builddeb - avoid recompiles for non-cross-compiles
     - fbdev: offb: fix PCI device reference leak on probe failure
     - mailbox: mtk-cmdq: Fix CURR and END addr for task insert case
     - mailbox: mailbox-test: free channels on probe error
     - cgroup/rdma: fix integer overflow in rdmacg_try_charge()
     - mailbox: add sanity check for channel array
     - mailbox: mailbox-test: don't free the reused channel
     - mailbox: mailbox-test: initialize struct earlier
     - mailbox: mailbox-test: make data_ready a per-instance variable
     - fsnotify: fix inode reference leak in fsnotify_recalc_mask()
     - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent()
     - cgroup: Increment nr_dying_subsys_* from rmdir context
     - tracing: branch: Fix inverted check on stat tracer registration
     - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
     - netfilter: arp_tables: fix IEEE1394 ARP payload parsing
     - nvme-pci: fix missed admin queue sq doorbell write
     - drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM
     - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG
     - drm/amdgpu: fix spelling typos
     - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated
     - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2)
     - netfilter: xt_policy: fix strict mode inbound policy matching
     - netfilter: nf_conntrack_sip: don't use simple_strtoul
     - [amd64] ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED
     - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ
     - drm/sysfb: ofdrm: fix PCI device reference leaks
     - arm64/scs: Fix potential sign extension issue of advance_loc4
     - cdrom, scsi: sr: propagate read-only status to block layer via
       set_disk_ro()
     - netdevsim: zero initialize struct iphdr in dummy sk_buff
     - net/sched: netem: fix probability gaps in 4-state loss model
     - net/sched: netem: fix queue limit check to include reordered packets
     - net/sched: netem: only reseed PRNG when seed is explicitly provided
     - net/sched: netem: validate slot configuration
     - net/sched: netem: fix slot delay calculation overflow
     - net/sched: netem: check for negative latency and jitter
     - net/sched: sch_choke: annotate data-races in choke_dump_stats()
     - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats()
     - vrf: Fix a potential NPD when removing a port from a VRF
     - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
     - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit
     - NFC: trf7970a: Ignore antenna noise when checking for RF field
     - net/sched: taprio: fix NULL pointer dereference in class dump
     - neigh: let neigh_xmit take skb ownership
     - tcp: make probe0 timer handle expired user timeout
     - net, treewide: define and use MAC_ADDR_STR_LEN
     - netconsole: allow selection of egress interface via MAC address
     - netpoll: Extract carrier wait function
     - netpoll: extract IPv4 address retrieval into helper function
     - netpoll: fix IPv6 local-address corruption
     - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams
     - sched/fair: Clear rel_deadline when initializing forked entities
     - net: mctp i2c: check length before marking flow active
     - net: phy: dp83869: fix setting CLK_O_SEL field.
     - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings
     - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings
     - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings
     - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring
     - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring
     - drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring
     - drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring
     - ASoC: codecs: ab8500: Fix casting of private data
     - netfilter: skip recording stale or retransmitted INIT
     - sctp: discard stale INIT after handshake completion
     - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()
     - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V)
     - netconsole: propagate device name truncation in dev_name_store()
     - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87
     - ALSA: hda/conexant: Fix missing error check for jack detection
     - ALSA: hda: cs35l56: Fix uninitialized value in cs35l56_hda_read_acpi()
     - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup
     - drm/amd/display: Allow DCE link encoder without AUX registers
     - drm/amd/display: Read EDID from VBIOS embedded panel info
     - drm/xe/debugfs: Correct printing of register whitelist ranges
     - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()
     - drm/xe/gsc: Fix BO leak on error in query_compatibility_version()
     - page_pool: Set `dma_sync` to false for devmem memory provider
     - net: page_pool: create hooks for custom memory providers
     - page_pool: fix memory-provider leak in page_pool_create_percpu() error
       path
     - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING
     - iavf: stop removing VLAN filters from PF on interface down
     - iavf: wait for PF confirmation before removing VLAN filters
     - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler
     - ice: fix NULL pointer dereference in ice_reset_all_vfs()
     - net: tls: fix strparser anchor skb leak on offload RX setup failure
     - sfc: fix error code in efx_devlink_info_running_versions()
     - net/sched: cls_flower: revert unintended changes
     - [arm64] Reserve an extra page for early kernel mapping
     - smb: client: correctly handle ErrorContextData as a flexible array
     - smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)
     - LoongArch: KVM: Compile switch.S directly into the kernel
     - ntfs: ->d_compare() must not block
     - PCI: Initialize temporary device in new_id_store()
     - net: bcmgenet: Initialize u64 stats seq counter
     - net: bcmgenet: fix leaking free_bds
     - [amd64] iommu/amd: Reorder attach device code
     - [amd64] iommu/amd: Put list_add/del(dev_data) back under the domain->lock
     - perf tool_pmu: Fix aggregation on duration_time
     - net/sched: sch_pie: annotate more data-races in pie_dump_stats()
     - netpoll: Extract IPv6 address retrieval function
     - netpoll: pass buffer size to egress_dev() to avoid MAC truncation
     - page_pool: fix incorrect mp_ops error handling
     - crypto: af_alg - Cap AEAD AD length to 0x80000000
     - i40e: Cleanup PTP pins on probe failure
     - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path
     - netfilter: nf_conntrack_sip: get helper before allocating expectation
     - audit: fix incorrect inheritable capability in CAPSET records
     - Revert "ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to
       warn"
     - netfilter: nft_ct: fix missing expect put in obj eval
     - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled
     - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV
     - KVM: Reject wrapped offset in kvm_reset_dirty_gfn()
     - [s390x] KVM: s390: pci: fix GAIT table indexing due to double-scaling
       pointer arithmetic
     - [amd64] KVM: x86: Fix Xen hypercall tracepoint argument assignment
     - netfilter: nf_tables: unconditionally bump set->nelems before insertion
       (CVE-2026-23272)
     - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands
     - smb/client: fix possible infinite loop and oob read in symlink_data()
     - [amd64] drm/i915/dp: Fix VSC dynamic range signaling for RGB formats
     - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans
     - ALSA: usb-audio: Bound MIDI endpoint descriptor scans
     - ceph: fix a buffer leak in __ceph_setxattr()
     - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size
     - io-wq: check that the predecessor is hashed in io_wq_remove_pending()
     - [powerpc*] warp: Fix error handling in pika_dtm_thread
     - netfs: fix error handling in netfs_extract_user_iter()
     - irqchip/riscv-imsic: Clear interrupt move state during CPU offlining
     - libceph: Fix potential out-of-bounds access in osdmap_decode()
     - libceph: Fix potential null-ptr-deref in decode_choose_args()
     - libceph: Fix potential out-of-bounds access in crush_decode()
     - libceph: handle rbtree insertion error in decode_choose_args()
     - [amd64] iommu/vt-d: Disable DMAR for Intel Q35 IGFX
     - [amd64] drm/i915: skip __i915_request_skip() for already signaled requests
     - drm/panfrost: Fix wait_bo ioctl leaking positive return from
       dma_resv_wait_timeout()
     - drm/xe/dma-buf: handle empty bo and UAF races
     - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup
     - drm/gma500/oaktrail_lvds: fix hang on init failure
     - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init
     - iommufd: Fix return value of iommufd_fault_fops_write()
     - eventfs: Use list_add_tail_rcu() for SRCU-protected children list
     - drm/v3d: Reject empty multisync extension to prevent infinite loop
     - btrfs: use inode already stored in local variable at btrfs_rmdir()
     - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of
       BTRFS_I()
     - btrfs: fix missing last_unlink_trans update when removing a directory
     - smb: client: Use FullSessionKey for AES-256 encryption key derivation
     - btrfs: do not mark inode incompressible after inline attempt fails
     - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
     - sched_ext: Guard scx_dsq_move() against NULL kit->dsq after failed
       iter_new
     - mptcp: pm: prio: skip closed subflows
     - mptcp: drop __mptcp_fastopen_gen_msk_ackseq()
     - mptcp: fix rx timestamp corruption on fastopen
     - f2fs: fix incorrect file address mapping when inline inode is unwritten
     - f2fs: fix false alarm of lockdep on cp_global_sem lock
     - spi: sifive: Simplify clock handling with devm_clk_get_enabled()
     - spi: sifive: fix controller deregistration
     - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0
     - mptcp: pm: ADD_ADDR rtx: fix potential data-race
     - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker
     - netfs: Fix potential uninitialised var in netfs_extract_user_iter()
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.92
     - mptcp: sync the msk->sndbuf at accept() time
     - mptcp: pm: ADD_ADDR rtx: allow ID 0
     - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (CVE-2026-46158)
     - mptcp: pm: ADD_ADDR rtx: free sk if last (CVE-2026-46170)
     - ksmbd: validate owner of durable handle on reconnect (CVE-2026-31717)
     - drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status()
       (CVE-2026-46216)
     - [s390x] debug: Reject zero-length input before trimming a newline
     - Revert "perf cgroup: Update metric leader in evlist__expand_cgroup"
     - Revert "perf tool_pmu: Fix aggregation on duration_time"
     - Revert "perf python: Add parse_events function"
     - Revert "perf tool_pmu: Factor tool events into their own PMU"
     - bridge: mrp: reject zero test interval to avoid OOM panic (CVE-2026-31420)
     - spi: spi-dw-dma: fix print error log when wait finish transaction
       (CVE-2026-31560)
     - Revert "x86/vdso: Fix output operand size of RDPID"
     - sched/deadline: Less agressive dl_server handling
     - sched/deadline: Fix dl_server_stopped()
     - sched/deadline: Fix dl_server getting stuck
     - sched/deadline: Fix dl_server behaviour
     - sched/deadline: Stop dl_server before CPU goes offline
     - ksmbd: close durable scavenger races against m_fp_list lookups
     - af_unix: Give up GC if MSG_PEEK intervened. (CVE-2026-23394)
     - drm/imagination: Synchronize interrupts before suspending the GPU
       (CVE-2026-23469)
     - ata: libata-scsi: improve readability of ata_scsi_qc_issue()
     - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT
     - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS
     - ata: libata-scsi: do not needlessly defer commands when using PMP with FBS
     - perf parse-events: Expose/rename config_term_name
     - Revert "ice: fix double-free of tx_buf skb"
     - Revert "ice: Remove jumbo_remove step from TX path"
     - tracing: Fix the bug where bpf_get_stackid returns -EFAULT on the ARM64
     - net/mlx5e: Trigger neighbor resolution for unresolved destinations
     - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init
     - [amd64] x86/fgraph: Fix return_to_handler regs.rsp value
     - [amd64] iommu/vt-d: Draining PRQ in sva unbind path when FPD bit set
     - [riscv64] fgraph: Select HAVE_FUNCTION_GRAPH_TRACER depends on
       HAVE_DYNAMIC_FTRACE_WITH_ARGS
     - [riscv64] fgraph: Fix stack layout to match __arch_ftrace_regs argument of
       ftrace_return_to_handler (CVE-2025-22069)
     - hwmon: (pmbus/core) Protect regulator operations with mutex
     - [arm64] Kconfig: Remove selecting replaced HAVE_FUNCTION_GRAPH_RETVAL
     - sysfs: don't remove existing directory on update failure
     - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()
     - ksmbd: fix null pointer dereference in compare_guid_key()
     - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow
     - ksmbd: validate SID in parent security descriptor during ACL inheritance
     - smb: client: require net admin for CIFS SWN netlink
     - smb: client: protect tc_count increment in
       smb2_find_smb_sess_tcon_unlocked()
     - smb: client: use data_len for SMB2 READ encrypted folioq copy
     - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close
     - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX
     - ALSA: ua101: Reject too-short USB descriptors
     - ALSA: pcm: Don't setup bogus iov_iter for silencing
     - ALSA: asihpi: Fix potential OOB array access at reading cache
     - efi: Allocate runtime workqueue before ACPI init
     - io_uring/waitid: clear waitid info before copying it to userspace
     - drivers/base/memory: fix memory block reference leak in poison accounting
     - ipv6: ioam: refresh hdr pointer before ioam6_event()
     - mm/memory_hotplug: fix memory block reference leak on remove
     - net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
     - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
     - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START
     - Bluetooth: bnep: Fix UAF read of dev->name
     - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths
     - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer
     - Bluetooth: MGMT: validate Add Extended Advertising Data length
     - Bluetooth: serialize accept_q access
     - phonet/pep: disable BH around forwarded sk_receive_skb()
     - net: bcmgenet: keep RBUF EEE/PM disabled
     - net: ifb: report ethtool stats over num_tx_queues
     - net: pse-pd: fix sign on -ENOENT check in of_load_pse_pis()
     - netfilter: ip6t_hbh: reject oversized option lists
     - netfilter: nf_queue: hold bridge skb->dev while queued
     - netfilter: ipset: stop hash:* range iteration at end
     - netfilter: nft_inner: Fix IPv6 inner_thoff desync
     - sched_ext: Fix missing warning in scx_set_task_state() default case
     - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path
     - cgroup/cpuset: Reset DL migration state on can_attach() failure
     - fs/ntfs3: handle attr_set_size() errors when truncating files
     - l2tp: use list_del_rcu in l2tp_session_unhash
     - qed: fix double free in qed_cxt_tables_alloc()
     - ring-buffer: Fix reporting of missed events in iterator
     - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
     - vsock/vmci: fix UAF when peer resets connection during handshake
     - vsock/virtio: reset connection on receiving queue overflow
     - wifi: ath11k: clear shared SRNG pointer state on restart
     - ipv4: raw: reject IP_HDRINCL packets with ihl < 5
     - ixgbevf: fix use-after-free in VEPA multicast source pruning
     - rbd: eliminate a race in lock_dwork draining on unmap
     - lsm: hold cred_guard_mutex for lsm_set_self_attr()
     - [arm64] octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
     - ice: fix setting promisc mode while adding VID filter
     - ice: restore PTP Rx timestamp config after ethtool set-channels
     - wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
     - af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
     - wifi: mac80211: consume only present negotiated TTLM maps
     - cifs: Fix busy dentry used after unmounting
     - tracing: Do not call map->ops->elt_free() if elt_alloc() fails
     - [arm64] probes: Handle probes on hinted conditional branch instructions
     - [arm64] KVM: arm64: vgic-its: Reject restored DTE with out-of-range
       num_eventid_bits
     - [arm64] KVM: arm64: vgic: Free private_irqs when init fails after
       allocation
     - [riscv64] kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem() when
       OOM
     - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe
     - spi: qup: fix error pointer deref after DMA setup failure
     - [arm64] phy: tegra: xusb: Fix per-pad high-speed termination calibration
     - scsi: isci: Fix use-after-free in device removal path
     - spi: ep93xx: fix error pointer deref after DMA setup failure
     - spi: sprd: fix error pointer deref after DMA setup failure
     - spi: ti-qspi: fix use-after-free after DMA setup failure
     - RDMA/siw: Reject MPA FPDU length underflow before signed receive math
     - device property: set fwnode->secondary to NULL in fwnode_init()
     - drm/virtio: use uninterruptible resv lock for plane updates
     - drm/amdgpu/vpe: Force collaborate sync after TRAP
     - drm/bridge: it66121: acquire reset GPIO in probe
     - drm/bridge: megachips: remove bridge when irq request fails
     - drm/amd/display: Fix integer overflow in bios_get_image()
     - drm/amd/display: Validate GPIO pin LUT table size before iterating
     - drm/amd/display: Validate payload length and link_index in
       dc_process_dmub_aux_transfer_async
     - batman-adv: mcast: fix use-after-free in orig_node RCU release
     - batman-adv: clear current gateway during teardown
     - batman-adv: dat: handle forward allocation error
     - batman-adv: fix fragment reassembly length accounting
     - batman-adv: fix tp_meter counter underflow during shutdown
     - batman-adv: frag: disallow unicast fragment in fragment
     - batman-adv: bla: fix report_work leak on backbone_gw purge
     - batman-adv: tp_meter: avoid use of uninit sender vars
     - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown
     - batman-adv: tp_meter: fix race condition in send error reporting
     - batman-adv: tt: fix negative last_changeset_len
     - batman-adv: tt: fix negative tt_buff_len
     - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
     - hwmon: (pmbus/adm1266) reject implausible blackbox record_count
     - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer
     - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized
       buffer
     - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR
     - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in
       get_multiple
     - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()
     - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()
     - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO
       accessors
     - [arm64] pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset for
       high pins during suspend/resume
     - HID: uclogic: Fix regression of input name assignment
     - [riscv64] mm: Fixup no5lvl failure when vaddr is invalid
     - [arm64] pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for
       sm8150
     - ALSA: hda: cs35l56: Put ACPI device after setting companion
     - ALSA: hda: cs35l41: Put ACPI device on missing physical node
     - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()
     - netfilter: x_tables: unregister the templates first
     - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist()
     - tcp: Fix imbalanced icsk_accept_queue count.
     - ice: fix setting RSS VSI hash for E830
     - ice: fix locking in ice_dcb_rebuild()
     - net: lan966x: avoid unregistering netdev on register failure
     - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register
       access
     - NFSD: Fix infinite loop in layout state revocation
     - irqchip/ath79-cpu: Remove unused function
     - ublk: reject max_sectors smaller than PAGE_SECTORS in parameter validation
     - nsfs: fix wrong error code returned for pidns ioctls
     - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
     - zonefs: handle integer overflow in zonefs_fname_to_fno
     - tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().
     - [powerpc*] fix dead default for GUEST_STATE_BUFFER_TEST
     - netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call
     - netfs: Fix overrun check in netfs_extract_user_iter()
     - netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone
     - netfs: Defer the emission of trace_netfs_folio()
     - netfs: Fix streaming write being overwritten
     - netfs: Fix potential deadlock in write-through mode
     - netfs: Fix write streaming disablement if fd open O_RDWR
     - netfs: Fix early put of sink folio in netfs_read_gaps()
     - netfs: Fix partial invalidation of streaming-write folio
     - netfs: Fix a few minor bugs in netfs_page_mkwrite()
     - netfs: Remove unnecessary references to pages
     - netfs: Fix folio->private handling in netfs_perform_write()
     - net: ethernet: cortina: Make RX SKB per-port
     - net: ethernet: cortina: Drop half-assembled SKB
     - net: ethernet: cortina: Carry over frag counter
     - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference
     - wifi: ath11k: fix error path leaks in some WMI WOW calls
     - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
     - wifi: ath10k: skip WMI and beacon transmission when device is wedged
     - blk-integrity: remove seed for user mapped buffers
     - block: don't overwrite bip_vcnt in bio_integrity_copy_user()
     - block: recompute nr_integrity_segments in blk_insert_cloned_request
     - HID: quirks: really enable the intended work around for appledisplay
     - block: modify bio_integrity_map_user to accept iov_iter as argument
     - block: drop direction param from bio_integrity_copy_user()
     - blk-integrity: use simpler alignment check
     - blk-integrity: enable p2p source and destination
     - block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()
     - accel/qaic: Add overflow check to remap_pfn_range during mmap
     - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint
     - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
     - [arm64] drm/msm/dsi: don't dump registers past the mapped region
     - [arm64] drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN
     - [powerpc*] time: Remove redundant preempt_disable|enable() calls from
       arch_irq_work_raise()
     - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
     - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
     - net: tls: prevent chain-after-chain in plain text SG
     - net: phy: DP83TC811: add reading of abilities
     - [amd64] x86/xen: Fix xen_e820_swap_entry_with_ram()
     - tls: Preserve sk_err across recvmsg() when data has been copied
     - net/mlx5: Do not restore destination-less TC rules
     - scsi: sd: Fix return code handling in sd_spinup_disk()
     - ALSA: scarlett2: Add missing error check when initialise Autogain Status
     - io_uring/net: punt IORING_OP_BIND async if it needs file create
     - btrfs: fix squota accounting during enable generation
     - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
     - [arm64] drm/msm/snapshot: fix dumping of the unaligned regions
     - drm/xe/gsc: Fix double-free of managed BO in error path
     - drm/xe/vf: Fix signature of print functions
     - drm/xe/pf: Fix CFI failure in debugfs access
     - wifi: ath11k: fix peer resolution on rx path when peer_id=0
     - ice: ptp: serialize E825 PHY timer start with PTP lock
     - [amd64] drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP
     - [arm64] net: dsa: mt7530: fix FDB entries not aging out with short timeout
     - [arm64] net: dsa: mt7530: preserve VLAN tags on trapped link-local frames
     - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
     - platform/surface: aggregator_registry: omit battery & AC nodes on Surface
       Laptop 7
     - [amd64] platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
     - [amd64] platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
     - [amd64] platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
     - [amd64] platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
     - RDMA/rtrs: Fix use-after-free in path file creation cleanup
     - net: bridge: Flush multicast groups when snooping is disabled
     - bridge: mcast: Fix a possible use-after-free when removing a bridge port
     - pds_core: fix error handling in pdsc_devcmd_wait
     - pds_core: fix debugfs_lookup dentry leak and error handling
     - wifi: mac80211: fix MLE defragmentation
     - ALSA: seq: Serialize UMP output teardown with event_input
     - tracing: Avoid NULL return from hist_field_name() on truncation
     - Bluetooth: btmtk: fix urb->setup_packet leak in error paths
     - net: ag71xx: check error for platform_get_irq
     - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
     - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n)
     - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed
     - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
     - drm/xe/oa: Fix exec_queue leak on width check in stream open
     - [arm64] octeontx2-af: npc: Fix allmulticast skip logic for LBK and SDP VFs
     - net: mana: validate rx_req_idx to prevent out-of-bounds array access
     - pds_core: ensure null-termination for firmware version strings
     - net: gro: don't merge zcopy skbs
     - landlock: Fix TCP handling of short AF_UNSPEC addresses
     - block: make bio_integrity_map_user() static inline
     - security/keys: fix missed RCU read section on lookup
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.93
     - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
     - [arm64] drm/v3d: Fix use-after-free of CPU job query arrays on error path
     - [arm64] drm/v3d: Release indirect CSD GEM reference on CPU job free
     - net/sched: cls_fw: fix NULL dereference of "old" filters before change()
     - net: mctp: ensure our nlmsg responses are initialised (CVE-2026-45930)
     - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
     - net/sched: sch_sfb: Replace direct dequeue call with peek and
       qdisc_dequeue_peeked
     - bcache: fix uninitialized closure object
     - net: cpsw_new: Fix potential unregister of netdev that has not been
       registered yet (CVE-2026-43219)
     - [arm64] Introduce esr_is_ubsan_brk()
     - [arm64] debug: clean up single_step_handler logic
     - [arm64] refactor aarch32_break_handler()
     - [arm64] debug: call software breakpoint handlers statically
     - [arm64] debug: call step handlers statically
     - [arm64] debug: remove break/step handler registration infrastructure
     - [arm64] entry: Add entry and exit functions for debug exceptions
     - [arm64] debug: split hardware breakpoint exception entry
     - [arm64] debug: refactor reinstall_suspended_bps()
     - [arm64] debug: split single stepping exception entry
     - [arm64] debug: split hardware watchpoint exception entry
     - [arm64] debug: split brk64 exception entry
     - [arm64] debug: split bkpt32 exception entry
     - [arm64] debug: remove debug exception registration infrastructure
     - [arm64] debug: always unmask interrupts in el0_softstp()
     - nfc: llcp: Fix use-after-free in llcp_sock_release()
     - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
     - xfrm: Check for underflow in xfrm_state_mtu
     - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
     - netfilter: synproxy: refresh tcphdr after skb_ensure_writable
     - netfilter: xt_cpu: prefer raw_smp_processor_id
     - netfilter: ebtables: fix OOB read in compat_mtw_from_user
     - tun: free page on short-frame rejection in tun_xdp_one() (CVE-2026-46321)
     - tun: free page on build_skb failure in tun_xdp_one() (CVE-2026-46322)
     - vsock: keep poll shutdown state consistent
     - net: netlink: fix sending unassigned nsid after assigned one
     - net: netlink: don't set nsid on local notifications
     - net/smc: Do not re-initialize smc hashtables
     - [s390x] net/iucv: fix locking in .getsockopt
     - scsi: core: Run queues for all non-SDEV_DEL devices from
       scsi_run_host_queues
     - ipv4: free net->ipv4.sysctl_local_reserved_ports after
       unregister_net_sysctl_table()
     - ALSA: pcm: oss: Fix setup list UAF on proc write error
     - [amd64] ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
     - net: hsr: fix potential OOB access in supervision frame handling
     - [amd64] accel/ivpu: prevent uninitialized data bug in debugfs
     - gpio: mxc: fix irq_high handling
     - net: Avoid checksumming unreadable skb tail on trim
     - ethtool: rss: fix hkey leak when indir_size is 0
     - ethtool: module: avoid leaking a netdev ref on module flash errors
     - ethtool: module: check fw_flash_in_progress under rtnl_lock
     - ethtool: module: fix cleanup if socket used for flashing multiple devices
     - ethtool: cmis: require exact CDB reply length
     - ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
     - net: ethtool: Add new parameters and a function to support EPL
     - net: ethtool: Add support for writing firmware blocks using EPL payload
     - ethtool: cmis: validate start_cmd_payload_size from module
     - ethtool: cmis: validate fw->size against start_cmd_payload_size
     - tunnels: load network headers after skb_cow() in
       iptunnel_pmtud_build_icmp[v6]()
     - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
     - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
     - ASoC: codecs: simple-mux: Fix enum control bounds check
     - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
     - bonding: refuse to enslave CAN devices
     - ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES
     - ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup
       error
     - ethtool: pse-pd: fix missing ethnl_ops_complete()
     - ethtool: strset: fix header attribute index in ethnl_req_get_phydev()
     - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during
       fallback
     - ethtool: eeprom: add more safeties to EEPROM Netlink fallback
     - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
     - net/sched: Revert "net/sched: Restrict conditions for adding duplicating
       netems to qdisc tree"
     - net/sched: fix packet loop on netem when duplicate is on
     - net/sched: act_mirred: Move the recursion counter struct netdev_xmit
     - net/sched: act_mirred: add loop detection
     - net: Introduce skb tc depth field to track packet loops
     - net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop
     - net/sched: act_mirred: Fix return code in early mirred redirect error
       paths
     - net/handshake: Use spin_lock_bh for hn_lock
     - nvme-tcp: store negative errno in queue->tls_err
     - net/handshake: Pass negative errno through handshake_complete()
     - remove pointless includes of <linux/fdtable.h>
     - net/handshake: Take a long-lived file reference at submit
     - net/handshake: Drain pending requests at net namespace exit
     - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
     - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
     - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
     - [arm64,armhf] gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
     - [amd64,arm64] net: mana: Add NULL guards in teardown path to prevent panic
       on attach failure
     - sctp: fix race between sctp_wait_for_connect and peeloff
     - ipv6: fix possible infinite loop in rt6_fill_node()
     - ipv6: fix possible infinite loop in fib6_select_path()
     - net: skbuff: fix pskb_carve leaking zcopy pages
     - perf: Fix dangling cgroup pointer in cpuctx
     - batman-adv: v: stop OGMv2 on disabled interface
     - batman-adv: tvlv: abort OGM send on tvlv append failure
     - batman-adv: tt: reject oversized local TVLV buffers
     - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
     - batman-adv: tvlv: reject oversized TVLV packets
     - batman-adv: iv: recover OGM scheduling after forward packet error
     - batman-adv: tp_meter: avoid role confusion in tp_list
     - [s390x] cio: Restore GFP_DMA for CHSC allocation
     - batman-adv: tp_meter: directly shut down timer on cleanup
     - batman-adv: tt: fix TOCTOU race for reported vlans
     - batman-adv: tt: avoid empty VLAN responses
     - batman-adv: bla: avoid double decrement of bla.num_requests
     - mm/page_alloc: clear page->private in free_pages_prepare()
       (CVE-2026-43303)
     - media: rc: fix race between unregister and urb/irq callbacks
     - media: rc: ttusbir: fix inverted error logic
     - inet: frags: add inet_frag_queue_flush()
     - inet: frags: flush pending skbs in fqdir_pre_exit() (CVE-2025-68768)
     - HID: core: Add printk_ratelimited variants to hid_warn() etc
     - HID: pass the buffer size to hid_report_raw_event
     - HID: core: introduce hid_safe_input_report()
     - HID: core: Fix size_t specifier in hid_report_raw_event()
     - [amd64] drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD
       register
     - [amd64] drm/i915/psr: Read Intel DPCD workaround register
     - drm/dp: Add eDP 1.5 bit definition
     - [amd64] drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line
       used
     - [arm64] io: Rename ioremap_prot() to __ioremap_prot()
     - [arm64] io: Extract user memory type in ioremap_prot() (CVE-2026-23346)
     - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X
     - batman-adv: tt: prevent TVLV entry number overflow
     - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
     - usb: typec: ucsi: ccg: reject firmware images without a ':' record header
     - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
     - usb: typec: tcpm: bound altmode_desc[] per iteration in
       svdm_consume_modes()
     - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO
     - usb: typec: altmodes/displayport: validate count before reading Status
       Update VDO
     - usb: typec: wcove: don't write past struct pd_message in
       wcove_read_rx_buffer()
     - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT
     - usb: typec: ucsi: validate connector number in ucsi_connector_change()
     - USB: serial: safe_serial: fix memory corruption with small endpoint
     - media: rc: igorplugusb: fix control request setup packet
     - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()
     - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
     - Bluetooth: btusb: Allow firmware re-download when version matches
     - hpfs: fix a crash if hpfs_map_dnode_bitmap fails
     - ipc: limit next_id allocation to the valid ID range
     - auxdisplay: line-display: fix OOB read on zero-length message_store()
     - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
     - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
     - Bluetooth: HIDP: fix missing length checks in hidp_input_report()
     - Bluetooth: ISO: fix UAF in iso_recv_frame
     - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
     - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
     - Input: xpad - fix out-of-bounds access for Share button
     - parport: Fix race between port and client registration (Closes: #1130365)
     - USB: cdc-acm: Fix bit overlap and move quirk definitions to header
     - [arm64] KVM: arm64: PMU: Preserve AArch32 counter low bits
     - [amd64] KVM: SVM: Flush the current TLB when transitioning from xAVIC =>
       x2AVIC
     - [amd64] KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
     - [amd64] KVM: SEV: Use the size of the PSC header as the minimum size for
       PSC requests
     - [amd64] KVM: SEV: WARN if KVM attempts to setup scratch area with
       min_len==0
     - [amd64] KVM: SEV: Compute the correct max length of the in-GHCB scratch
       area
     - [amd64] KVM: SEV: Check PSC request indices against the actual size of the
       buffer
     - [amd64] KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC
       buffer
     - [amd64] KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
     - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux
     - iio: adc: npcm: fix unbalanced clk_disable_unprepare()
     - iio: dac: max5821: fix return value check in powerdown sync
     - iio: dac: ad5686: fix input raw value check
     - iio: dac: ad5686: acquire lock when doing powerdown control
     - iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
     - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
     - iio: gyro: itg3200: fix i2c read into the wrong stack location
     - iio: gyro: adis16260: fix division by zero in write_raw
     - iio: ssp_sensors: cancel delayed work_refresh on remove
     - iio: temperature: tsys01: fix broken PROM checksum validation
     - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL
     - iio: light: cm3323: fix reg_conf not being initialized correctly
     - iio: buffer: hw-consumer: fix use-after-free in error path
     - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
     - USB: serial: omninet: fix memory corruption with small endpoint
     - usb: cdns3: gadget: fix request skipping after clearing halt
     - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy
       acquisition failure
     - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently
       leaks the runtime PM usage counter across bind/unbind cycles
     - usb: dwc2: Fix use after free in debug code
     - Input: elan_i2c - validate firmware size before use
     - wireguard: send: append trailer after expanding head
     - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
     - macsec: fix replay protection at XPN lower-PN wrap
     - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
     - [arm64] ASoC: qcom: q6asm-dai: fix error handling in prepare and
       set_params
     - ipv6: exthdrs: refresh nh after handling HAO option
     - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
     - ipv6: validate extension header length before copying to cmsg
     - xfrm: input: hold netns during deferred transport reinjection
     - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
     - ip6: vti: Use ip6_tnl.net in vti6_changelink().
     - net: skbuff: fix missing zerocopy reference in pskb_carve helpers
     - HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
     - nfc: hci: fix out-of-bounds read in HCP header parsing
     - xfrm: route MIGRATE notifications to caller's netns
     - xfrm: ah: use skb_to_full_sk in async output callbacks
     - ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417
     - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without
       direction check
     - [arm64] ASoC: qcom: q6asm-dai: close stream only when running
     - [arm64] ASoC: qcom: q6asm-dai: do not set stream state in event and
       trigger callbacks
     - xfrm: esp: restore combined single-frag length gate
     - Input: xpad - add "Nova 2 Lite" from GameSir
     - Input: xpad - add support for ASUS ROG RAIKIRI II
     - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops
     - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
     - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490
     - [amd64] comedi: comedi_test: fix check for valid scan_begin_src in
       waveform_ai_cmdtest()
     - [amd64] comedi: comedi_test: Fix limiting of convert_arg in
       waveform_ai_cmdtest()
     - counter: Fix refcount leak in counter_alloc() error path
     - tty: serial: pch_uart: add check for dma_alloc_coherent()
     - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
     - usb: chipidea: core: convert ci_role_switch to local variable
     - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval
     - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub
       controllers
     - usb: storage: Add quirks for PNY Elite Portable SSD
     - usbip: vudc: Fix use after free bug in vudc_remove due to race condition
     - usb: usbtmc: check URB actual_length for interrupt-IN notifications
     - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
     - usb: typec: tcpm: improve handling of DISCOVER_MODES failures
     - USB: serial: option: add MeiG SRM813Q
     - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL
     - USB: serial: belkin_sa: validate interrupt status length
     - USB: serial: cypress_m8: validate interrupt packet headers
     - USB: serial: keyspan: fix missing indat transfer sanity check
     - USB: serial: mxuport: fix memory corruption with small endpoint
     - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
     - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind
     - usb: gadget: net2280: Fix double free in probe error path
     - usb: gadget: f_hid: fix device reference leak in hidg_alloc()
     - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
     - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports
     - usb: gadget: f_fs: copy only received bytes on short ep0 read
     - usb: gadget: f_fs: serialize DMABUF cancel against request completion
     - [amd64] thunderbolt: property: Reject u32 wrap in
       tb_property_entry_valid()
     - [amd64] thunderbolt: property: Reject dir_len < 4 to prevent size_t
       underflow
     - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
     - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
     - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
     - scsi: target: iscsi: Validate CHAP_R length before base64 decode
     - drm/hyperv: validate resolution_count and fix WIN8 fallback
     - drm/hyperv: validate VMBus packet size in receive callback
     - [amd64] drm/i915: Fix potential UAF in TTM object purge
     - drm/amd/pm/si: Disregard vblank time when no displays are connected
     - serial: altera_jtaguart: handle uart_add_one_port() failures
     - serial: qcom-geni: fix UART_RX_PAR_EN bit position
     - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion
       IRQ
     - serial: sh-sci: fix memory region release in error path
     - serial: zs: Fix swapped RI/DSR modem line transition counting
     - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma
     - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
     - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger
     - drm/amdkfd: Check for pdd drm file first in CRIU restore path
     - serial: dz: Fix bootconsole message clobbering at chip reset
     - serial: dz: Fix bootconsole handover lockup
     - serial: dz: Convert to use a platform device
     - serial: zs: Fix bootconsole handover lockup
     - serial: zs: Switch to using channel reset
     - serial: zs: Convert to use a platform device
     - USB: serial: cypress_m8: fix memory corruption with small endpoint
     - USB: serial: digi_acceleport: fix memory corruption with small endpoints
     - xhci: tegra: Fix ghost USB device on dual-role port unplug
     - iommu: Skip PASID validation for devices without PASID capability
     - [amd64] x86/boot: Disable stack protector for early boot code
     - [amd64] x86/kexec: Disable KCOV instrumentation after load_segments()
       (CVE-2026-43331)
     - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg
     - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer
     - serdev: Provide a bustype shutdown function
     - Bluetooth: hci_qca: Migrate to serdev specific shutdown function
     - Bluetooth: hci_qca: Convert timeout from jiffies to ms
     - ALSA: scarlett2: Return ENOSPC for out-of-bounds flash writes
     - ALSA: scarlett2: Allow flash writes ending at segment boundary
     - mm/memory: fix spurious warning when unmapping device-private/exclusive
       pages
     - [amd64] platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error
       recovery
     - net: hsr: defer node table free until after RCU readers
     - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient
     - ice: fix VF queue configuration with low MTU values
     - ring-buffer: Flush and stop persistent ring buffer on panic
     - mptcp: cleanup fallback dummy mapping generation
     - mptcp: reset rcv wnd on disconnect
     - [arm64] tlb: Flush walk cache when unsharing PMD tables
     - [arm64] octeontx2-pf: avoid double free of pool->stack on AQ init failure
     - mptcp: introduce the mptcp_init_skb helper
     - mptcp: handle first subflow closing consistently
     - mptcp: do not drop partial packets
     - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
     - iio: chemical: scd30: Use guard(mutex) to allow early returns
     - iio: chemical: scd30: fix division by zero in write_raw
     - iio: dac: ad5686: fix ref bit initialization for single-channel parts
     - ALSA: firewire-motu: Protect register DSP event queue positions
     - [arm64] usb: dwc3: xilinx: fix error handling in zynqmp init error paths
     - usb: musb: omap2430: Fix use-after-free in omap2430_probe()
     - usb: typec: ucsi: Check if power role change actually happened before
       handling
     - [amd64] thunderbolt: property: Cap recursion depth in
       __tb_property_parse_dir()
     - scsi: target: iscsi: Fix CRC overread and double-free in
       iscsit_handle_text_cmd()
     - usb: typec: ucsi: Don't update power_supply on power role change if not
       connected
     - [amd64] x86/alternatives: Rename 'apply_relocation()' to
       'text_poke_apply_relocation()'
     - [amd64] x86/ftrace: Relocate %rip-relative percpu refs in dynamic
       trampolines
     - hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with
       pmbus_lock
     - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock
     - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock
     - mm: perform all memfd seal checks in a single place
     - mm/memfd: fix spelling and grammatical issues
     - memfd: deny writeable mappings when implying SEAL_WRITE
     - usb: core: Fix SuperSpeed root hub wMaxPacketSize
     - ethtool: cmis_cdb: Fix incorrect read / write length extension
     - net/sched: act_mirred: Fix blockcast recursion bypass leading to stack
       overflow
     - [arm64] KVM: arm64: vgic-its: Drop the translation cache reference only
       for the erased entry (CVE-2026-46316)
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.94
     - bpf: Free reuseport cBPF prog after RCU grace period. (CVE-2026-52910)
     - USB: serial: mct_u232: fix memory corruption with small endpoint
     - [armhf] group is_permission_fault() with is_translation_fault()
     - [armhf] allow __do_kernel_fault() to report execution of memory faults
     - [armhf] fix hash_name() fault
     - [armhf] fix branch predictor hardening
     - net: phy: micrel: fix LAN8814 QSGMII soft reset
     - wifi: remove zero-length arrays
     - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
     - ipv6: mcast: Fix use-after-free when processing MLD queries
     - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS
     - [arm64] tee: optee: prevent use-after-free when the client exits before
       the supplicant
     - [arm64]soc: qcom: ice: Return -ENODEV if the ICE platform device is not
       found
     - erofs: add sysfs node to drop internal caches
     - erofs: tidy up synchronous decompression
     - erofs: fix use-after-free on sbi->sync_decompress
     - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
     - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id
     - ipvs: clear the svc scheduler ptr early on edit
     - netfilter: synproxy: add mutex to guard hook reference counting
     - netfilter: conntrack_irc: fix possible out-of-bounds read
     - netfilter: nft_ct: bail out on template ct in get eval
     - netfilter: bridge: make ebt_snat ARP rewrite writable
     - dm cache policy smq: check allocation under invalidate lock
     - net/sched: act_api: use RCU with deferred freeing for action lifecycle
     - 6lowpan: fix off-by-one in multicast context address compression
     - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
     - devlink: Release nested relation on devlink free
     - [arm64] drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
     - wifi: mac80211: limit injected antenna index in
       ieee80211_parse_tx_radiotap
     - pcnet32: stop holding device spin lock during napi_complete_done
     - net: Annotate sk->sk_write_space() for UDP SOCKMAP.
     - hsr: Remove WARN_ONCE() in hsr_addr_is_self().
     - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
     - net: lan743x: permit VLAN-tagged packets up to configured MTU
     - net: fec: fix pinctrl default state restore order on resume
     - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
     - Bluetooth: MGMT: validate advertising TLV before type checks
     - Bluetooth: RFCOMM: validate skb length in MCC handlers
     - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension
       handling
     - Bluetooth: bnep: reject short frames before parsing
     - Bluetooth: fix memory leak in error path of hci_alloc_dev()
     - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync
     - Bluetooth: ISO: Fix not using bc_sid as advertisement SID
     - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls
     - Bluetooth: MGMT: Fix backward compatibility with userspace
     - [arm64] octeontx2-pf: Fix NDC sync operation errors
     - [arm64] octeontx2-af: Fix initialization of mcam's entry2target_pffunc
       field
     - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
     - ptp: vclock: Switch from RCU to SRCU
     - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
     - net_sched: act_pedit: use RCU in tcf_pedit_dump()
     - net/sched: fix pedit partial COW leading to page cache corruption
       (CVE-2026-46331)
     - [arm64] octeontx2-af: npc: Fix CPT channel mask in npc_install_flow
     - vxlan: vnifilter: send notification on VNI add
     - vxlan: vnifilter: fix spurious notification on VNI update
     - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
     - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
     - sctp: purge outqueue on stale COOKIE-ECHO handling
     - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp
     - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
     - time: Fix off-by-one in settimeofday() usec validation
     - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked
       streams
     - ALSA: seq: dummy: fix UMP event stack overread
     - ima: kexec: skip IMA segment validation after kexec soft reboot
     - ima: kexec: move IMA log copy from kexec load to execute
     - spi: cadence-quadspi: fix unclocked access on unbind (CVE-2026-46203)
     - tools/rv: Fix cleanup after failed trace setup
     - tap: free page on error paths in tap_get_user_xdp() (CVE-2026-46320)
     - [arm64] tlb: Allow XZR argument to TLBI ops
     - [arm64] tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI
     - iomap: don't revert iov_iter on partially completed buffered writes
     - dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device
     - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
     - netlabel: validate unlabeled address and mask attribute lengths
     - gpio: mvebu: fix NULL pointer dereference in suspend/resume
     - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls
     - tcp: restrict SO_ATTACH_FILTER to priv users
     - net: add pskb_may_pull() to skb_gro_receive_list()
     - net/mlx4: avoid GCC 10 __bad_copy_from() false positive
     - net: ibm: emac: Fix use-after-free during device removal
     - netdev: fix double-free in netdev_nl_bind_rx_doit()
     - net: phy: clean the sfp upstream if phy probing fails
     - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
     - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
     - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure
     - net/mlx5: Use effective affinity mask for IRQ selection
     - ipv6: sit: reload inner IPv6 header after GSO offloads
     - net: openvswitch: fix possible kfree_skb of ERR_PTR
     - r8152: handle the return value of usb_reset_device()
     - gpio: zynq: fix runtime PM leak on remove
     - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
     - net: guard timestamp cmsgs to real error queue skbs
     - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic
       completion
     - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
     - rds: mark snapshot pages dirty in rds_info_getsockopt()
     - netfilter: revalidate bridge ports
     - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister
     - netfilter: x_tables: avoid leaking percpu counter pointers
     - netfilter: nf_log: validate MAC header was set before dumping it
     - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
     - [arm64,armhf] net: mvpp2: sync RX data at the hardware packet offset
     - [arm64,armhf] net: mvpp2: limit XDP frame size to the RX buffer
     - [arm64,armhf] net: mvpp2: Add metadata support for xdp mode
     - [arm64,armhf] net: mvpp2: refill RX buffers before XDP or skb use
     - [arm64,armhf] net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
     - ipv6: Fix a potential NPD in cleanup_prefix_route()
     - netfilter: ctnetlink: ensure safe access to master conntrack
       (CVE-2026-43116)
     - writeback: Avoid contention on wb->list_lock when switching inodes
     - writeback: Fix use after free in inode_switch_wbs_work_fn()
     - xfrm: hold device only for the asynchronous decryption
     - xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
     - [amd64] KVM: VMX: Update SVI during runtime APICv activation
     - [arm64] clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from
       getting parked
     - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs
     - [arm64] clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration
       time
     - drm/virtio: Fix driver removal with disabled KMS
     - [arm64,armhf] drm/vc4: fix krealloc() memory leak
     - drm/xe: fix refcount leak in xe_range_fence_insert()
     - netfilter: nft_tunnel: fix use-after-free on object destroy
     - [arm64] tee: shm: fix shm leak in register_shm_helper()
     - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend
     - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
     - [arm64] soc: qcom: ice: Fix race between qcom_ice_probe() and
       of_qcom_ice_get()
     - [amd64] accel/ivpu: Add bounds checks for firmware log indices
     - [amd64] accel/ivpu: Add buffer overflow check in MS get_info_ioctl
     - [amd64] accel/ivpu: Fix signed integer truncation in IPC receive
     - tracing/probes: Point the error offset correctly for eprobe argument error
     - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation
     - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying
     - [amd64] KVM: SEV: Decouple the need to sync the GHCB SA from the need to
       free the SA
     - [amd64] drm/i915/gem: Fix phys BO pread/pwrite with offset
     - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init
     - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
     - xfrm: espintcp: do not reuse an in-progress partial send
     - USB: serial: io_ti: fix heap overflow in get_manuf_info()
     - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
     - USB: serial: option: add usb-id for Dell Wireless DW5826e-m
     - USB: serial: kl5kusb105: fix bulk-out buffer overflow
     - ALSA: timer: Forcibly close timer instances at closing
     - ALSA: timer: Fix UAF at snd_timer_user_params()
     - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries
     - drm/virtio: fix dma_fence refcount leak on error in
       virtio_gpu_dma_fence_wait()
     - drm/amd/display: Reject gpio_bitshift >= 32 in
       bios_parser_get_gpio_pin_info()
     - mm/huge_memory: update file PMD counter before folio_put()
     - mm/damon/ops-common: call folio_test_lru() after folio_get()
     - RDMA/srp: bound SRP_RSP sense copy by the received length
     - zram: fix use-after-free in zram_bvec_write_partial()
     - udp: clear skb->dev before running a sockmap verdict
     - mptcp: fix retransmission loop when csum is enabled
     - mptcp: close TOCTOU race while computing rcv_wnd
     - mptcp: allow subflow rcv wnd to shrink
     - mptcp: sockopt: check timestamping ret value
     - mptcp: add-addr: always drop other suboptions
     - wifi: nl80211: reject oversized EMA RNR lists
     - vsock/vmci: fix sk_ack_backlog leak on failed handshake
     - timers/migration: Fix livelock in tmigr_handle_remote_up()
     - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write
     - bnxt_en: Fix NULL pointer dereference
     - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
     - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
     - pidfd: refuse access to tasks that have started exiting harder
     - fs/qnx6: fix pointer arithmetic in directory iteration
     - fuse: reject fuse_notify() pagecache ops on directories
     - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
     - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
     - i2c: tegra: Fix NOIRQ suspend/resume
     - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
     - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
     - ipc/shm: serialize orphan cleanup with shm_nattch updates
     - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
     - misc: fastrpc: fix use-after-free race in fastrpc_map_create
     - misc: fastrpc: fix DMA address corruption due to find_vma misuse
     - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
     - net/mlx5: Reorder completion before putting command entry in
       cmd_work_handler
     - net: bonding: fix NULL pointer dereference in bond_do_ioctl()
     - net: mv643xx: fix OF node refcount
     - net: rds: clear i_sends on setup unwind
     - nvmem: core: fix use-after-free bugs in error paths
     - nvmem: layouts: onie-tlv: fix hang on unknown types
     - [arm64] octeontx2-af: fix memory leak in rvu_setup_hw_resources()
     - io_uring/kbuf: don't truncate end buffer for bundles
     - io_uring/wait: fix min_timeout behavior
     - mm/hugetlb: restore reservation on error in hugetlb folio copy paths
     - mmc: core: Fix host controller programming for fixed driver type
     - mmc: dw_mmc-rockchip: Add missing private data for very old controllers
     - mmc: litex_mmc: Set mandatory idle clocks before CMD0
     - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC
     - mmc: sdhci: add signal voltage switch in sdhci_resume_host
     - pmdomain: imx: fix OF node refcount
     - rtase: Avoid sleeping in get_stats64()
     - rtase: Reset TX subqueue when clearing TX ring
     - sctp: diag: reject stale associations in dump_one path
     - sctp: stream: fully roll back denied add-stream state
     - [amd64] thunderbolt: Reject zero-length property entries in validator
     - [amd64] thunderbolt: Bound root directory content to block size
     - [amd64] thunderbolt: Clamp XDomain response data copy to allocation size
     - [amd64] thunderbolt: Validate XDomain request packet size before type cast
     - [amd64] thunderbolt: Limit XDomain response copy to actual frame size
     - [arm64] slimbus: qcom-ngd-ctrl: fix OF node refcount
     - [arm64] slimbus: qcom-ngd-ctrl: Fix up platform_driver registration
     - [arm64] slimbus: qcom-ngd-ctrl: Fix probe error path ordering
     - [arm64] slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
     - [arm64] slimbus: qcom-ngd-ctrl: Initialize controller resources in
       controller
     - [arm64] slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
     - [arm64] slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD
     - [arm64] slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
     - drm/amdkfd: fix NULL dereference in get_queue_ids()
     - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
     - drm/xe: Clear pending_disable before signaling suspend fence
     - [arm64,armhf] drm/v3d: Fix vaddr leak when indirect CSD has zeroed
       workgroups
     - drm/amdgpu: restart the CS if some parts of the VM are still invalidated
     - drm/amd/pm: fix smu13 power limit default/cap calculation
     - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2
     - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in
       set_soft_freq_limited_range
     - drm/amd/display: Bound VBIOS record-chain walk loops
     - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
     - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
     - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs
     - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
     - drm/amd/display: Use krealloc_array() in dal_vector_reserve()
     - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
     - driver core: reject devices with unregistered buses
     - mailbox: Fix NULL message support in mbox_send_message()
     - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
     - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()
     - netfilter: nft_fib: fix stale stack leak via the OIFNAME register
     - mm/memory-failure: fix hugetlb_lock AA deadlock in
       get_huge_page_for_hwpoison
     - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper
     - RDMA/umem: Move umem dmabuf revoke logic into helper function
     - RDMA/umem: Add helpers for umem dmabuf revoke lock
     - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
     - RDMA/umem: fix kernel-doc warnings
     - RDMA: Move DMA block iterator logic into dedicated files
     - RDMA/umem: Fix truncation for block sizes >= 4G
     - mm/hugetlb: avoid false positive lockdep assertion
     - mptcp: fix missing wakeups in edge scenarios
     - ipmi:ssif: Remove unnecessary indention
     - ipmi:ssif: NULL thread on error
     - ipvs: skip ipv6 extension headers for csum checks (CVE-2026-45850)
     - vsock/virtio: fix potential unbounded skb queue
     - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc
     - block: fix handling of dead zone write plugs
     - [arm64] cputype: Add NVIDIA Olympus definitions
     - [arm64] cputype: Add C1-Ultra definitions
     - [arm64] cputype: Add C1-Premium definitions
     - [arm64] errata: Mitigate TLBI errata on various Arm CPUs
     - [arm64] errata: Mitigate TLBI errata on NVIDIA Olympus CPU
     - [arm64] errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
     - net: introduce EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL()
     - tcp: use EXPORT_IPV6_MOD[_GPL]()
     - tcp: secure_seq: add back ports to TS offset (CVE-2026-23247)
     - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation
     - vsock/virtio: fix skb overhead overflow on 32-bit builds
     - netfilter: require Ethernet MAC header before using eth_hdr()
 .
   [ Salvatore Bonaccorso ]
   * [rt] Refresh "ARM: enable irq in translation/section permission fault"
   * ip6_vti: set netns_immutable on the fallback device. (CVE-2026-52909)
linux-signed-arm64 (6.12.94+1~bpo12+1) bookworm-backports; urgency=medium
 .
   * Sign kernel from linux 6.12.94-1~bpo12+1
 .
   * Rebuild for bookworm-backports
linux-signed-arm64 (6.12.90+2) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.90-2
 .
   * smb: client: reject userspace cifs.spnego descriptions
   * net/rds: reset op_nents when zerocopy page pin fails (CVE-2026-43494)
linux-signed-arm64 (6.12.90+2~bpo12+1) bookworm-backports; urgency=high
 .
   * Sign kernel from linux 6.12.90-2~bpo12+1
 .
   * Rebuild for bookworm-backports
linux-signed-arm64 (6.12.90+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.90-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.89
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.90
     - HID: playstation: Clamp num_touch_reports
     - media: uvcvideo: Enable VB2_DMABUF for metadata stream
     - [arm64] dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux
     - [arm64] regulator: mt6357: fix OF node reference imbalance
     - [arm64,armhf] regulator: rk808: fix OF node reference imbalance
     - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap
     - [amd64] media: intel/ipu6: fix error pointer dereference
     - media: saa7164: add ioremap return checks and cleanups
     - spi: aspeed-smc: fix controller deregistration
     - [amd64] platform/x86: hp-wmi: Ignore backlight and FnLock events
     - vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to
       copy
     - [arm64] drm/msm/gem: fix error handling in
       msm_ioctl_gem_info_get_metadata()
     - [amd64] drm/i915/psr: Init variable to avoid early exit from et alignment
       loop
     - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure
     - drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count.
     - drm/amdgpu: gate VM CPU HDP flush on reset lock
     - drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x
     - drm/amdkfd: Add upper bound check for num_of_nodes
     - drm/amdgpu: Add bounds checking to ib_{get,set}_value
     - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
     - drm/amdgpu/vce: Prevent partial address patches
     - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg
     - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
     - drm/amd/display: Change dither policy for 10 bpc output back to dithering
     - drm/gem: Fix inconsistent plane dimension calculation in
       drm_gem_fb_init_with_funcs()
     - drm/amdkfd: validate SVM ioctl nattr against buffer size
     - drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked()
     - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()
     - drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked()
     - drm/radeon: add missing revision check for CI
     - drm/amdgpu: zero-initialize GART table on allocation
     - drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds
     - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ
     - drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds
     - drm/amdkfd: Make all TLB-flushes heavy-weight
     - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
     - drm/amdgpu/pm: add missing revision check for CI
     - drm/amdgpu/pm: align Hawaii mclk workaround with radeon
     - [arm64] dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22
     - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
     - batman-adv: fix integer overflow on buff_pos
     - batman-adv: reject new tp_meter sessions during teardown
     - batman-adv: stop caching unowned originator pointers in BAT IV
     - batman-adv: bla: prevent use-after-free when deleting claims
     - batman-adv: bla: only purge non-released claims
     - batman-adv: bla: put backbone reference on failed claim hash insert
     - usb: typec: tcpm: reset internal port states on soft reset AMS
     - usb: dwc3: Move GUID programming after PHY initialization
     - ALSA: hda: cs35l56: Propagate ASP TX source control errors
     - ALSA: misc: Use guard() for spin locks
     - ALSA: core: Serialize deferred fasync state checks
     - ALSA: seq: Notify client and port info changes
     - ALSA: seq: Fix UMP group 16 filtering
     - Bluetooth: hci_conn: fix potential UAF in create_big_sync
     - [arm64,armhf] spi: tegra20-sflash: fix controller deregistration
     - [arm64,armhf] spi: tegra114: fix controller deregistration
     - mm/hugetlb_cma: round up per_node before logging it
     - block: cleanup blkdev_report_zones()
     - block: reorganize struct blk_zone_wplug
     - block: fix zone write plug removal
     - tracefs: Fix default permissions not being applied on initial mount
     - fbcon: Avoid OOB font access if console rotation fails
     - mm/damon/core: disallow time-quota setting zero esz
     - mm/damon/core: implement damon_kdamond_pid()
     - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values
     - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values
     - bonding: fix use-after-free due to enslave fail after slave array update
       (CVE-2026-23171)
     - io_uring/kbuf: support min length left for incremental buffers
     - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
     - btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type()
     - btrfs: fix double free in create_space_info_sub_group() error path
     - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to
       info-leak
     - tracing/probes: Limit size of event probe to 3K
     - batman-adv: stop tp_meter sessions during mesh teardown
     - batman-adv: tp_meter: fix tp_num leak on kmalloc failure
     - vsock: fix buffer size clamping order
     - vsock/virtio: fix length and offset in tap skb for split packets
     - vsock/virtio: fix empty payload in tap skb for non-linear buffers
     - vsock/virtio: fix accept queue count leak on transport mismatch
     - drm/amdgpu/vcn3: Avoid overflow on msg bound check
     - drm/amdgpu/vcn4: Avoid overflow on msg bound check
 .
   [ Salvatore Bonaccorso ]
   * Bluetooth: btmtk: accept too short WMT FUNC_CTRL events (Closes: #1136790)
   * net: skbuff: preserve shared-frag marker during coalescing (CVE-2026-46300)
   * net: skbuff: propagate shared-frag marker through frag-transfer helpers
linux-signed-arm64 (6.12.90+1~bpo12+1) bookworm-backports; urgency=high
 .
   * Sign kernel from linux 6.12.90-1~bpo12+1
 .
   * Rebuild for bookworm-backports
linux-signed-arm64 (6.12.88+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.88-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.87
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.88
     - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
     - ipmi: Add limits to event and receive message requests
     - ipmi: Check event message buffer response for bad data
     - ipmi:si: Return state to normal if message allocation fails
     - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
     - ACPI: scan: Use acpi_dev_put() in object add error paths
     - ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO
     - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug
     - ACPI: video: force native backlight on HP OMEN 16 (8A44)
     - ASoC: SOF: Don't allow pointer operations on unconfigured streams
     - spi: rockchip: fix controller deregistration
     - ksmbd: rewrite stop_sessions() with restartable iteration
     - mm: convert mm_lock_seq to a proper seqcount
     - [amd64] x86: shadow stacks: proper error handling for mmap lock
       (CVE-2026-43109)
     - [amd64] x86/shstk: Prevent deadlock during shstk sigreturn
     - [amd64] KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
     - [amd64] iommu/amd: Use atomic64_inc_return() in iommu.c
     - [amd64] iommu/amd: serialize sequence allocation under concurrent TLB
       invalidations (CVE-2026-43220) (Closes: #1135313)
     - flow_dissector: do not dissect PPPoE PFC frames
     - net: txgbe: fix RTNL assertion warning when remove module
     - net: af_key: zero aligned sockaddr tail in PF_KEY exports (CVE-2026-43088)
     - [amd64] KVM: SVM: check validity of VMCB controls when returning from SMM
     - net/sched: sch_red: Replace direct dequeue call with peek and
       qdisc_dequeue_peeked
     - Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (CVE-2026-31499)
     - exit: prevent preemption of oopsing TASK_DEAD task
     - wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr
     - wifi: mt76: mt7925: fix incorrect length field in txpower command
     - wifi: mt76: mt7921: fix a potential clc buffer length underflow
     - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work
     - wifi: b43legacy: enforce bounds check on firmware key index in RX path
     - wifi: mac80211: drop stray 'static' from fast-RX rx_result
     - wifi: rsi: fix kthread lifetime race between self-exit and external-stop
     - wifi: mac80211: use safe list iteration in radar detect work
     - wifi: ath5k: do not access array OOB (Closes: #1119093)
     - wifi: mac80211: remove station if connection prep fails
     - wifi: b43: enforce bounds check on firmware key index in b43_rx()
     - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog
       task
     - usb: usblp: fix heap leak in IEEE 1284 device ID via short response
     - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
     - ALSA: usb-audio: midi2: Restart output URBs on resume
     - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()
     - ALSA: usb-audio: Fix UAC3 cluster descriptor size check
     - USB: omap_udc: DMA: Don't enable burst 4 mode
     - USB: serial: option: add Telit Cinterion LE910Cx compositions
     - usb: ulpi: fix memory leak on ulpi_register() error paths
     - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger
     - ALSA: firewire-tascam: Do not drop unread control events
     - xfrm: provide message size for XFRM_MSG_MAPPING
     - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
     - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
     - xfrm: ah: account for ESN high bits in async callbacks
     - selinux: don't reserve xattr slot when we won't fill it
     - selinux: shrink critical section in sel_write_load()
     - selinux: prune /sys/fs/selinux/disable
     - Bluetooth: virtio_bt: clamp rx length before skb_put
     - Bluetooth: virtio_bt: validate rx pkt_type header length
     - Bluetooth: btmtk: validate WMT event SKB length before struct access
     - Bluetooth: hci_event: Fix OOB read and infinite loop in
       hci_le_create_big_complete_evt
     - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
     - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
     - [armhf] spi: sun4i: fix controller deregistration
     - [armhf] spi: ti-qspi: fix controller deregistration
     - spi: sun6i: fix controller deregistration
     - fanotify: fix false positive on permission events
     - [arm64] KVM: arm64: Fix kvm_vcpu_initialized() macro parameter
     - mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()
     - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in
       rtnl_fill_vfinfo
     - sound: ua101: fix division by zero at probe
     - net: libwx: fix VF illegal register access
     - ip6_gre: Use cached t->net in ip6erspan_changelink().
     - net/rds: handle zerocopy send cleanup before the message is queued
     - net: wwan: t7xx: validate port_count against message length in
       t7xx_port_enum_msg_handler
     - hwmon: (ltc2992) Clamp threshold writes to hardware range
     - hwmon: (ltc2992) Fix u32 overflow in power read path
     - clk: rk808: fix OF node reference imbalance
     - hwmon: (corsair-psu) Close HID device on probe errors
     - af_unix: Reject SIOCATMARK on non-stream sockets
     - block: add pgmap check to biovec_phys_mergeable
     - cifs: abort open_cached_dir if we don't request leases
     - cifs: change_conf needs to be called for session setup
     - extcon: ptn5150: handle pending IRQ events during system resume
     - gpio: of: clear OF_POPULATED on hog nodes in remove path
     - hv_sock: fix ARM64 support
     - ibmveth: Disable GSO for packets with small MSS
     - ice: fix double free in ice_sf_eth_activate() error path
     - spi: microchip-core-qspi: fix controller deregistration
     - udf: reject descriptors with oversized CRC length
     - thermal: core: Free thermal zone ID later during removal
     - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata
     - thermal/drivers/sprd: Fix raw temperature clamping in
       sprd_thm_rawdata_to_temp
     - spi: topcliff-pch: fix controller deregistration
     - spi: topcliff-pch: fix use-after-free on unbind
     - clk: imx: imx8-acm: fix flags for acm clocks
     - clk: microchip: mpfs-ccc: fix out of bounds access during output
       registration
     - cpuidle: powerpc: avoid double clear when breaking snooze
     - [amd64] ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in
       quirk table
     - [arm64] ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop
     - [arm64] ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens
     - [arm64] ASoC: qcom: q6apm: remove child devices when apm is removed
     - btrfs: fix double free in create_space_info() error path
     - dm-thin: fix metadata refcount underflow
     - dm: don't report warning when doing deferred remove
     - dm: fix a buffer overflow in ioctl processing
     - eventfs: Hold eventfs_mutex and SRCU when remount walks events
     - dm-verity-fec: correctly reject too-small FEC devices
     - dm-verity-fec: correctly reject too-small hash devices
     - isofs: validate Rock Ridge CE continuation extent against volume size
     - isofs: validate block number from NFS file handle in isofs_export_iget
     - [arm64] iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update
     - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
     - lib/scatterlist: fix length calculations in extract_kvec_to_sg
     - lib/scatterlist: fix temp buffer in extract_user_to_sg()
     - libceph: Fix slab-out-of-bounds access in auth message processing
     - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies
     - nvme-apple: drop invalid put of admin queue reference count
     - nvmet-tcp: fix race between ICReq handling and queue teardown
     - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
     - openvswitch: vport: fix self-deadlock on release of tunnel ports
     - pmdomain: core: Fix detach procedure for virtual devices in genpd
     - [arm64] RDMA/hns: Fix unlocked call to hns_roce_qp_remove()
     - [s390x] debug: Reject zero-length input in debug_input_flush_fn()
     - smb/client: fix out-of-bounds read in smb2_compound_op()
     - smb/client: fix out-of-bounds read in symlink_data()
     - smb: client: use kzalloc to zero-initialize security descriptor buffer
     - smb: client: validate dacloffset before building DACL pointers
     - [amd64] KVM: x86: check for nEPT/nNPT in slow flush hypercalls
     - mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock
     - PCI: Update saved_config_space upon resource assignment (Closes: #1131025)
     - PCI/AER: Clear only error bits in PCIe Device Status
     - PCI/AER: Stop ruling out unbound devices as error source
     - PCI/ASPM: Fix pci_clear_and_set_config_dword() usage
     - power: supply: max17042: avoid overflow when determining health
     - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss()
     - RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()
     - RDMA/mana: Validate rx_hash_key_len
     - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
     - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()
     - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
     - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads
     - RDMA/rxe: Reject unknown opcodes before ICRC processing
     - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
     - mptcp: fastclose msk when linger time is 0
     - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure
     - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure
     - mptcp: sockopt: set timestamp flags on subflow socket, not msk
     - mptcp: fix scheduling with atomic in timestamp sockopt
     - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode()
     - f2fs: fix fiemap boundary handling when read extent cache is incomplete
     - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks()
     - f2fs: fix node_cnt race between extent node destroy and writeback
     - f2fs: fix uninitialized kobject put in f2fs_init_sysfs()
     - [arm64] KVM: arm64: vgic: Fix IIDR revision field extracted from wrong
       value
     - [arm64] KVM: arm64: Fix initialisation order in __pkvm_init_finalise()
     - bpf: Fix use-after-free in arena_vm_close on fork
     - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info
     - fs: prepare for adding LSM blob to backing_file
     - dma-mapping: drop unneeded includes from dma-mapping.h
     - dma-mapping: add __dma_from_device_group_begin()/end()
     - hwmon: (powerz) Avoid cacheline sharing for DMA buffer
     - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs
     - udf: fix partition descriptor append bookkeeping
     - mtd: spinand: winbond: Declare the QE bit on W25NxxJW
     - hfsplus: fix uninit-value by validating catalog record size
     - hfsplus: fix held lock freed on hfsplus_fill_super()
     - erofs: move {in,out}pages into struct z_erofs_decompress_req
     - erofs: tidy up z_erofs_lz4_handle_overlap()
     - erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()
     - gtp: disable BH before calling udp_tunnel_xmit_skb()
     - printk: add print_hex_dump_devel()
     - crypto: caam - guard HMAC key hex dumps in hash_digest_key
     - ALSA: aloop: Fix peer runtime UAF during format-change stop
     - net: stmmac: avoid shadowing global buf_sz
     - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY()
     - net: stmmac: Prevent NULL deref when RX memory exhausted
     - wifi: mt76: mt7925: fix incorrect TLV length in CLC command
     - tracepoint: balance regfunc() on func_add() failure in
       tracepoint_add_func()
     - [arm64] KVM: arm64: Wake-up from WFI when iqrchip is in userspace
     - [amd64] x86/CPU/AMD: Prevent improper isolation of shared resources in
       Zen2's op cache
     - ksmbd: validate inherited ACE SID length
 .
   [ Salvatore Bonaccorso ]
   * ptrace: slightly saner 'get_dumpable()' logic
linux-signed-arm64 (6.12.88+1~bpo12+1) bookworm-backports; urgency=high
 .
   * Sign kernel from linux 6.12.88-1~bpo12+1
 .
   * Rebuild for bookworm-backports

linuxcnc (1:2.9.4-2+deb13u1) trixie; urgency=medium
 .
   * Team upload.
 .
   * Added 0010-sanitize-hal-paths.patch to sanitize name for module in
     rtapi_app (Closes: #1140943).
   * Added d/gbp.conf to enforce the use of pristine-tar and using
     correct git branch for stable updates.

lxd (5.0.2+git20231211.1364ae4-9+deb13u7) trixie-security; urgency=high
 .
   * Cherry-pick fixes for the following security issues:
     - CVE-2026-9639 / GHSA-j93m-3j9p-m5m8
     - CVE-2026-9640 / GHSA-ppq7-4492-5552
     - CVE-2026-48749 / GHSA-vghh-5rfx-xhq8
     - CVE-2026-48750 / GHSA-9j25-mm2h-2f76
     - CVE-2026-48751 / GHSA-47w9-6r3f-938g
     - CVE-2026-48752 / GHSA-jpf8-86f3-wp38
     - CVE-2026-48755 / GHSA-fmc8-p6q7-75cc
     - CVE-2026-48769 / GHSA-pjff-c2wc-f6jm
     - CVE-2026-55621 / GHSA-7mr3-28h5-m5vx
     - CVE-2026-55622 / GHSA-qx75-2p3r-pwm5

lxml-html-clean (0.4.4-1~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie.
     - CVE-2026-28348: CSS @import Filter Bypass via Unicode Escapes
     - CVE-2026-28350: <base> tag injection through default Cleaner
                       configuration
 .
 lxml-html-clean (0.4.4-1) unstable; urgency=medium
 .
   * New upstream version.
   * Bump standards version.
lxml-html-clean (0.4.3-1) unstable; urgency=medium
 .
   * New upstream version. Closes: #1114193.
   * Bump standards version.

mediawiki (1:1.43.9+dfsg-1~deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 1.43.9, fixing CVE-2026-58024, CVE-2026-58025,
     CVE-2026-58026, CVE-2026-58027, CVE-2026-58028, CVE-2026-58029,
     CVE-2026-58030, CVE-2026-58032, CVE-2026-58033, CVE-2026-58037. This
     version is not affected by CVE-2026-58036.
     * Drop patches merged upstream.
mediawiki (1:1.43.8+dfsg-2) unstable; urgency=medium
 .
   * Cherry-pick upstream patch fixing CVE-2026-34095 mitigation
   * Refresh patches
mediawiki (1:1.43.8+dfsg-1) unstable; urgency=medium
 .
   * New upstream version 1.43.8, fixing CVE-2026-5266, CVE-2026-34086,
     CVE-2026-34087, CVE-2026-34088, CVE-2026-34091, CVE-2026-34092,
     CVE-2026-34093, CVE-2026-34094, CVE-2026-34095. This version is not
     affected by CVE-2026-34089, CVE-2026-34090.

mesa (25.0.7-2+deb13u1) trixie; urgency=high
 .
   * Non-maintainer upload by the LTS Team.
   * Backport patch for CVE-2026-40393:
     - backport support function STACK_ARRAY, cherry-pick file from upstream.
     - backport commits fixing the issue

miniupnpd (2.3.9-2+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-5720: integer underflow in SOAPAction header parsing
     (Closes: #1134334)

mistral (20.0.0-2+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2026-41283: Mistral policy enforcement bypass allows unauthorized
     public resource creation and arbitrary code execution. Applied upstream
     patches:
     - Restrict publicize policies to admin only
     - Remove unnecessary expect_errors=True from policy tests
     - Add code_sources publicize policy and enforcement
     - Restrict code_sources and dynamic_actions policies to
     - Add dynamic_actions publicize policy and enforcement
     - Add workbooks publicize policy and enforcement
     - Add cron_triggers publicize policy and enforcement
     - Add environments publicize policy and enforcement
    (Closes: #1138843)
   * OSSN-0098: Mistral workflow execution context exposes Keystone auth token.
     Applied upstream patch: "Strip sensitive info from workflow execution
     context" (Closes: #1138849).

modsecurity (3.0.14-1+deb13u1) trixie; urgency=medium
 .
   [ Ervin Hegedus ]
   * Add fixes for CVE-2026-30923 and CVE-2026-42268

mutt (2.2.13-1+deb13u1) trixie; urgency=medium
 .
   * CVE-2026-43859 CVE-2026-43860 CVE-2026-43861 CVE-2026-43862
     CVE-2026-43863 CVE-2026-43864 (Closes: #1135699)

mxml (3.3.1-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-5037: Out-of-bounds read in index_sort() (Closes: #1132328)
mxml (3.3.1-1+deb13u1~deb12u1) bookworm; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for bookworm.
 .
 mxml (3.3.1-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-5037: Out-of-bounds read in index_sort() (Closes: #1132328)

nagios4 (4.4.6-4.1+deb13u1) trixie-security; urgency=high
 .
   * CSRF Security Fix backported from upstream 4.5.12 commit
     e5ed38e53a5d65721520c7c67be0746d63da28cb (cgi/cmd.c and
     html/index.php.in).  See
     https://www.nagios.com/security-disclosures/nagios-core/4-5-12/
     for the upstream disclosure.  No CVE assigned.
     Closes: #1136340.
   * This can break third party integrations that POST to cmd.cgi
     without first setting NagFormId (the CSRF check fails).  Upstream
     PR 1055 has been added as a workaround - see README.Debian.

nbconvert (7.16.6-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-39377: Arbitrary File Write via Path Traversal in
     Cell Attachment Filenames (Closes: #1134889)
   * CVE-2026-39378: Arbitrary File Read via Path Traversal in
     HTMLExporter Image Embedding (Closes: #1134890)

netatalk (4.2.3~ds-1+deb13u2) trixie-security; urgency=high
 .
   [ Daniel Markstedt ]
   * add patch that fixes:
     CVE-2026-44047 CVE-2026-44048 CVE-2026-44049 CVE-2026-44050 CVE-2026-44051
     CVE-2026-44052 CVE-2026-44054 CVE-2026-44055 CVE-2026-44057 CVE-2026-44060
     CVE-2026-44062 CVE-2026-44064 CVE-2026-44066 CVE-2026-44068 CVE-2026-44076
     CVE-2026-45354 CVE-2026-45355 CVE-2026-45356 CVE-2026-45698 CVE-2026-45699

neutron (2:26.0.3-0+deb13u2) trixie-security; urgency=medium
 .
   * New upstream point release.
   * Removed patches applied upstream:
     - Add_state_reporting_back_to_metadata_agents.patch
     - Fix_LoopingCallBase_argument_issue.patch
   * Add start-time=%t in neutron-api-uwsgi.ini.
   * Add haproxy as runtime depends of neutron-ovn-agent. Thanks to Sakirnth
     Nagarasa for the report (Closes: #1135272).
   * CVE-2026-50266 / OSSA-2026-021: Neutron port RBAC policy bypass allows
     project managers to set trusted device owners on shared networks. Added
     upstream patch: Fix port RBAC policies to require network ownership
     (Closes: #1138844).
neutron (2:26.0.0-9+deb13u1) trixie; urgency=medium
 .
   * OSSA-2026-016: Neutron tagging policy bypass allows project readers to
     mutate tags. Added upstream patch: "Fix plural policy names in tagging
     controller and floatingip policy" (Closes: #1138172).

nghttp2 (1.64.0-1.1+deb13u1) trixie-security; urgency=medium
 .
   * Non-maintainer upload by the Security Team.
   * CVE-2026-27135 (Closes: #1131369)
     Fix missing iframe->state validations to avoid assertion failure.
   * Add test for CVE-2026-27135 (cherry-picked from upstream c619c7b)

nginx (1.26.3-3+deb13u7) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Upstream: limit header length for HTTP/2 and gRPC (CVE-2026-42055)
     (Closes: #1140359)
   * Charset: fixed another rare buffer overread in recode_from_utf8()
     (CVE-2026-48142) (Closes: #1140361)
nginx (1.26.3-3+deb13u6) trixie-security; urgency=medium
 .
   * Apply both patches to fix CVE-2026-42946. In the previous version,
     only one part of the patch was applied, so the fix was incomplete.
     This really fixes CVE-2026-42946, thanks to charles@debian.org for
     pointing it out.
     * d/p/CVE-2026-42946.patch rename to d/p/CVE-2026-42946.2.patch
     * d/p/CVE-2026-42946.1.patch add
   * backport fix for buffer overflow vulnerability in the
     ngx_http_rewrite_module (CVE-2026-9256) from upstream 1.30.2 nginx.
     * d/p/CVE-2026-9256.patch add
   * backport max_headers directive from upstream nginx. It limits the number
     of request headers accepted from clients. Fixes remote denial-of-service
     exploit.
     And move max_headers from core module to the ngx_http_header_count_module
     to avoid potential ABI breakage and keep all the 3rd party modules
     compatible with the new version of nginx without recompilation.
     A big thanks to Miao Wang for preparing the modification.
     Fixes TEMP-1138794-BADE22.
     * d/p/FIX-HTTP2bomb.patch add
nginx (1.26.3-3+deb13u5) trixie-security; urgency=medium
 .
   * backport changes from upstream nginx, HTTP/3 address spoofing
     (CVE-2026-40460), buffer overflow in the ngx_http_rewrite_module
     (CVE-2026-42945), buffer overread in the ngx_http_scgi_module and
     ngx_http_uwsgi_module (CVE-2026-42946), resolver use-after-free in OCSP
     (CVE-2026-40701), buffer overread in the ngx_http_charset_module
     (CVE-2026-42934)
     * d/p/CVE-2026-40460.patch add
     * d/p/CVE-2026-42945.patch add
     * d/p/CVE-2026-42946.patch add
     * d/p/CVE-2026-40701.patch add
     * d/p/CVE-2026-42934.patch add

node-shell-quote (1.7.4+~1.7.1-1+deb13u1) trixie-security; urgency=medium
 .
   * Team upload
   * Validate object-token shapes (Closes: #1137372, CVE-2026-9277)
node-shell-quote (1.7.4+~1.7.1-1+deb12u1) bookworm-security; urgency=medium
 .
   * Team upload
   * Validate object-token shapes (Closes: #1137372, CVE-2026-9277)

nss (2:3.110-1+deb13u3) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * improve handling of escape sequences in pk11uri_ParseAttributes
     (CVE-2026-12318)
nss (2:3.110-1+deb13u2) trixie-security; urgency=medium
 .
   * CVE-2026-6766
   * CVE-2026-6767
   * CVE-2026-6772

ojalgo (55.0.0+ds-1+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * Use a simplified salsa-ci.yml for trixie.
   * Backport upstream and Debian fixes from 56.2.1-3. Closes: #1140433.

okular (4:25.04.2-1+deb13u1) trixie-security; urgency=medium
 .
   * Multiple security issues in parsing Fax files

opencc (1.1.9+ds1-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2025-15536: Out-of-bounds read (Closes: #1126286)

openjpeg2 (2.5.3-2.1~deb13u2) trixie-security; urgency=medium
 .
   * CVE-2026-6192 (Closes: #1133832)

openslide (3.4.1+dfsg-7+deb13u1) trixie; urgency=medium
 .
   * CVE-2026-48977.patch: new: fix CVE-2026-48977.
     The change lacks attempt to apply the test case, because the binary
     representation of a newly introduced test file is not possible in the
     patch. (Closes: #1140003)

openssl (3.5.6-1~deb13u2) trixie-security; urgency=medium
 .
   * CVE-2026-7383 ("Possible Heap Buffer Overflow in ASN.1 Multibyte String
     Conversion")
   * CVE-2026-9076 ("Out-of-Bounds Read in CMS Password-Based Decryption")
   * CVE-2026-34180 ("Heap Buffer Over-read in ASN.1 Content Parsing")
   * CVE-2026-34181 ("PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC
     Keys")
   * CVE-2026-34182 ("CMS AuthEnvelopedData Processing May Accept Forged
     Messages")
   * CVE-2026-34183 ("Unbounded Memory Growth in the QUIC PATH_CHALLENGE
     Handler")
   * CVE-2026-42764 ("NULL pointer dereference in QUIC server initial packet
     handling")
   * CVE-2026-42766 ("Possible NULL Dereference in Password-Based CMS
     Decryption")
   * CVE-2026-42767 ("NULL Pointer Dereference in CRMF EncryptedValue
     Decryption")
   * CVE-2026-42768 ("Multi-RecipientInfo Bleichenbacher Oracle in
     CMS_decrypt() and PKCS7_decrypt()")
   * CVE-2026-42769 ("Trust-Anchor Substitution via cert/issuer Typo in CMP
     rootCaKeyUpdate")
   * CVE-2026-42770 ("FFC-DH Peer Validation Uses Attacker-Supplied q")
   * CVE-2026-45445 ("AES-OCB IV Ignored on EVP_Cipher() Path")
   * CVE-2026-45446 ("Incorrect Tag Processing for Empty Messages in
     AES-GCM-SIV and AES-SIV modes")
   * CVE-2026-45447 ("Heap Use-After-Free in OpenSSL PKCS7_verify()")

openvpn (2.6.14-1+deb13u3) trixie-security; urgency=high
 .
   * Cherry-pick upstream security patches from the 2.6.21 release
     - CVE-2026-12996: Fix use-after-free bug in ack_write_buf(), triggerable by
       a well-timed sequence of control channel + authentication packets
     - CVE-2026-13117: Fix use-after-free bug in tls_wrap_reneg(), triggerable
       by suitable sequence of dynamic tls-crypt control-channel packets
     - CVE-2026-13122: Fix server crash on reception of suitably malformed
       auth-token, if --auth-gen-token external-auth is active
     - CVE-2026-12932: Fix memory-leak in tls-crypt-v2 client key handling that
       could lead to out-of-memory situations and subsequent server crashes
     - CVE-2026-11771: Fix possible 1-byte buffer overrun on NTLMv2 proxy
       responses.
     - CVE-2026-13698: Fix another memory leak on reception of suitable
       tls-crypt-v2 packets that could lead to an out of memory situation and
       server crash
openvpn (2.6.14-1+deb13u2) trixie-security; urgency=medium
 .
   * Cherry-pick upstream security patches
     - CVE-2026-40215: fix race condition in TLS handshake that could lead to
       leaking of packet data from a previous handshake under specific
       circumstances
     - CVE-2026-35058: fix server ASSERT() on receiving a suitably malformed
       packet with a valid tls-crypt-v2 key

pdns (4.9.16-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 4.9.16, fixing security issue
     CVE-2026-42005.
pdns (4.9.15-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 4.9.15, fixing security issues
     CVE-2026-42000, CVE-2026-42001, CVE-2026-42002, CVE-2026-42396.

pdns-recursor (5.2.11-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 5.2.11, fixing security issues
     CVE-2026-33612, CVE-2026-40012, CVE-2026-42005, CVE-2026-42390,
     CVE-2026-42390, CVE-2026-42388, CVE-2026-42387, CVE-2026-52690.

php-guzzlehttp-psr7 (2.7.1-1+deb13u1) trixie; urgency=medium
 .
   * Backport fixes from upstream
     - Encode plus sign in withQueryValue() and withQueryValues() (#636)
     - Harden ServerRequest globals handling (#660)
     - Normalize global header values (#718)
     - Reject control characters in URI hosts (#715) [CVE-2026-49214]
     - Reject malformed Host authorities (#717) [CVE-2026-48998]
     (Closes: #1138265)
   * Track debian/trixie branch

php-league-csv (9.23.0+dfsg-1+deb13u1) trixie; urgency=medium
 .
   * Add upstream patch to fix failing test with PHP 8.4.14+ (Closes: #1137038)

php-twig (3.27.0-0+deb13u1) trixie-security; urgency=medium
 .
   [ Fabien Potencier ]
   * Fix sandbox bypass: propagate sandbox state to checkArrow for source-policy
     sandboxing [CVE-2026-24425]
   * Fix sandbox `__toString` bypasses [CVE-2026-47732]
   * Pre-escape HTML input on the `spaceless` filter [CVE-2026-46628]
   * Document template_from_string caveats when used in a sandboxed env
     [CVE-2026-46634]
   * Document that the sandbox doesn't protect against resource exhaustion
     [CVE-2026-46627]
   * Fix sandbox bypass in deprecated internal wrappers [CVE-2026-48805]
   * Fix sandbox bypass in the "column" filter under SourcePolicyInterface
     [CVE-2026-48808]
   * Fix sandbox __toString bypass via Traversable in join/replace filters
   * Fix sandbox `__toString` bypass via the `in` and `not in` operators
     [CVE-2026-48807]
   * Fix sandbox __toString policy bypass via dynamic mapping keys
     [CVE-2026-48806]
   * Fix sandbox filter/tag/function allow-list bypass when sandbox state
     changes between renders [CVE-2026-46636]
   * Update CHANGELOG
   * Prepare the 3.27.0 release
 .
   [ Alexandre Daubois ]
   * Fix sandbox bypass in object destructuring assignment [CVE-2026-46639]
   * Fix unbounded memoisation of `IntlDateFormatter` / `NumberFormatter`
     [CVE-2026-46629]
   * Fix sandbox bypass: PHP code injection via {% use %} template name
     [CVE-2026-46633]
   * Fix sandbox bypass in the `{% sandbox %}` tag when including a preloaded
     template [CVE-2026-46638]
   * Fix sandbox bypass: PHP code injection via _self / import macro reference
     [CVE-2026-46640]
   * Fix sandbox bypass in the "column" filter [CVE-2026-46635]
 .
   [ Nicolas Grekas ]
   * Fix XSS by adjusting `is_safe` annotation on HTML-emitting filters
     [CVE-2026-46637]
   * Pre-escape HTML input on `inline_css` and `inky_to_html` filters
   * [Profiler] Escape template and profile names in HtmlDumper [CVE-2026-47730]
 .
   [ David Prévot ]
   * Track debian/trixie branch
   * Refresh patches
   * Make phpab tolerant
   * Update build for related path
php-twig (3.26.0-1) unstable; urgency=medium
 .
   [ Fabien Potencier ]
   * Fix sandbox bypass: propagate sandbox state to checkArrow for source-policy
     sandboxing [CVE-2026-24425]
   * Fix sandbox `__toString` bypasses [CVE-2026-47732]
   * Pre-escape HTML input on the `spaceless` filter [CVE-2026-46628]
   * Document template_from_string caveats when used in a sandboxed env
     [CVE-2026-46634]
   * Document that the sandbox doesn't protect against resource exhaustion
     [CVE-2026-46627]
   * Update CHANGELOG
   * Prepare the 3.26.0 release
 .
   [ Alexandre Daubois ]
   * Fix sandbox bypass in object destructuring assignment [CVE-2026-46639]
   * Fix unbounded memoisation of `IntlDateFormatter` / `NumberFormatter`
     [CVE-2026-46629]
   * Fix sandbox bypass: PHP code injection via {% use %} template name
     [CVE-2026-46633]
   * Fix sandbox bypass in the `{% sandbox %}` tag when including a preloaded
     template [CVE-2026-46638]
   * Fix sandbox bypass: PHP code injection via _self / import macro reference
     [CVE-2026-46640]
   * Fix sandbox bypass in the "column" filter [CVE-2026-46635]
 .
   [ Nicolas Grekas ]
   * Fix XSS by adjusting `is_safe` annotation on HTML-emitting filters
    [CVE-2026-46637]
   * Pre-escape HTML input on `inline_css` and `inky_to_html` filters
   * [Profiler] Escape template and profile names in HtmlDumper [CVE-2026-47730]
 .
   [ David Prévot ]
   * Use full version with RequiresPhp
   * Update standards version to 4.7.4
php-twig (3.26.0-0+deb13u1) trixie-security; urgency=medium
 .
   [ Fabien Potencier ]
   * Fix sandbox bypass: propagate sandbox state to checkArrow for source-policy
     sandboxing [CVE-2026-24425]
   * Fix sandbox `__toString` bypasses [CVE-2026-47732]
   * Pre-escape HTML input on the `spaceless` filter [CVE-2026-46628]
   * Document template_from_string caveats when used in a sandboxed env
     [CVE-2026-46634]
   * Document that the sandbox doesn't protect against resource exhaustion
     [CVE-2026-46627]
   * Update CHANGELOG
   * Prepare the 3.26.0 release
 .
   [ Alexandre Daubois ]
   * Fix sandbox bypass in object destructuring assignment [CVE-2026-46639]
   * Fix unbounded memoisation of `IntlDateFormatter` / `NumberFormatter`
     [CVE-2026-46629]
   * Fix sandbox bypass: PHP code injection via {% use %} template name
     [CVE-2026-46633]
   * Fix sandbox bypass in the `{% sandbox %}` tag when including a preloaded
     template [CVE-2026-46638]
   * Fix sandbox bypass: PHP code injection via _self / import macro reference
     [CVE-2026-46640]
   * Fix sandbox bypass in the "column" filter [CVE-2026-46635]
 .
   [ Nicolas Grekas ]
   * Fix XSS by adjusting `is_safe` annotation on HTML-emitting filters
     [CVE-2026-46637]
   * Pre-escape HTML input on `inline_css` and `inky_to_html` filters
   * [Profiler] Escape template and profile names in HtmlDumper [CVE-2026-47730]
 .
   [ David Prévot ]
   * Track debian/trixie branch
   * Refresh patches
   * Make phpab tolerant
   * Update build for related path
php-twig (3.24.0-1) unstable; urgency=medium
 .
   [ Fabien Potencier ]
   * Add support for renaming variables in object destructuring
   * Deprecate passing a non-AbstractExpression node to Parser::setParent()
   * Deprecate passing non AbstractExpression nodes to MatchesBinary
   * Add getOperatorTokens() to ExpressionParserInterface to separate operator
     token registration from parser identity
   * Prepare the 3.24.0 release
 .
   [ HypeMC ]
   * Support short-circuiting in null-safe operator chains
 .
   [ Matthias Pigulla ]
   * Add `html_attr_relaxed` escaping strategy
   * Add an `html_attr` function to make outputting HTML attributes easier
 .
   [ David Prévot ]
   * Refresh patches
   * Reorder Files paragraphs in debian/copyright by directory depth
   * Upgrade upstream signing key to new packet format
php-twig (3.23.0-2) unstable; urgency=medium
 .
   * Compatibility with recent PHPUnit (13)
php-twig (3.23.0-1) unstable; urgency=medium
 .
   [ Fabien Potencier ]
   * Fix spread operator behavior
   * Add === and !== operators
   * Add the = assignment operator
   * Add support for object and mapping destructuring
   * Update CHANGELOG
 .
   [ Ondřej Machulda ]
   * Fix opcache preload warning for unlinked anonymous class
 .
   [ Felds Liscia ]
   * Add null-safe operator
 .
   [ David Prévot ]
   * Convert d/watch to version 5
   * Update build for related path
   * Update Standards-Version to 4.7.3
php-twig (3.22.2-2) unstable; urgency=medium
 .
   * Source-only upload
php-twig (3.22.2-1) unstable; urgency=medium
 .
   [ Fabien Potencier ]
   * Update CHANGELOG
   * Prepare the 3.22.2 release
 .
   [ Younes ENNAJI ]
   * [Core] Fix cycle() with non-countable ArrayAccess+Traversable objects
 .
   [ Tac Tacelosky ]
   * use getShareDir as an indicator of Symfony version
 .
   [ Andreas ]
   * Avoid ord deprecation in PHP 8.5
 .
   [ David Prévot ]
   * Revert "Require recent php-symfony-intl for changed tests"
php-twig (3.22.1-3) unstable; urgency=medium
 .
   * [Intl] Update data to ICU 78.1
   * Require recent php-symfony-intl for changed tests
php-twig (3.22.1-2) unstable; urgency=medium
 .
   * Source-only upload
php-twig (3.22.1-1) unstable; urgency=medium
 .
   [ Fabien Potencier ]
   * Prepare the 3.22.1 release
 .
   [ Javier Eguiluz ]
   * Allow Symfony 8 packages in Twig extra packages
 .
   [ Andreas Erhard ]
   * Add caution note for random function usage
php-twig (3.22.0-2) unstable; urgency=medium
 .
   * Source-only upload for testing migration
php-twig (3.22.0-1) unstable; urgency=medium
 .
   [ Fabien Potencier ]
   * Fix compatibility layer
   * Update CHANGELOG
 .
   [ Simon André ]
   * Compile 'index' with repr (not string) in EmbedNode
 .
   [ Doeke Norg ]
   * Update configuration keys + allow extra keys for extensions
 .
   [ Vincent Langlet ]
   * Support two words test guard
 .
   [ Nicolas Grekas ]
   * Fix compatibility with Symfony 8
   * Fix accessing arrays with stringable objects as key
 .
   [ Christophe Coevoet ]
   * Avoid errors when failing to guess the template info for an error
 .
   [ David Prévot ]
   * Make phpab tolerant
   * debian/control: Document nocheck flags
php-twig (3.21.1-3) unstable; urgency=medium
 .
   * Source-only upload for testing migration
php-twig (3.21.1-2) unstable; urgency=medium
 .
   * Upload to unstable now that trixie has been released
   * PHPunit 12 compatibility: additional fixes
   * Remove Rules-Requires-Root
   * Fix intl test
php-twig (3.21.1-1) experimental; urgency=medium
 .
   * Upload to experimental during the freeze
 .
   [ Fabien Potencier ]
   * Introduce operator classes to describe operators provided by extensions
     instead of arrays
   * Fix testing and expression when it evaluates to an instance of Markup
   * Prepare the 3.21.1 release
 .
   [ Jérôme Tamarelle ]
   * Create attributes `AsTwigFilter`, `AsTwigFunction` and `AsTwigTest` to
     ease extension development
 .
   [ David Prévot ]
   * Update Standards-Version to 4.7.2

php8.4 (8.4.23-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream version 8.4.23
    + [CVE-2026-14355]: Memory corruption (zend_mm_heap corrupted) in
      openssl_encrypt with AES-WRAP-PAD.
php8.4 (8.4.22-1) unstable; urgency=medium
 .
   * Update the php-fpm-reopenlogs script to not depend on PID file
   * New upstream version 8.4.22
php8.4 (8.4.21-1) unstable; urgency=medium
 .
   * New upstream version 8.4.21 (Closes: #1136054)
php8.4 (8.4.21-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream version 8.4.21
    + [CVE-2026-7263]: Dom\XMLDocument::C14N() emits duplicate xmlns
      declarations after setAttributeNS()
    + [CVE-2026-29078, CVE-2026-29079]: Upgrade to lexbor v2.7.0
    + [CVE-2026-6735]: XSS within status endpoint
    + [CVE-2026-7259]: Null pointer dereference in php_mb_check_encoding()
      via mb_ereg_search_init()
    + [CVE-2026-6104]: Out-of-bounds access in mbfl_name2encoding_ex()
    + [CVE-2025-14179]: SQL injection via NUL bytes in quoted strings
    + [CVE-2026-6722]: Stale SOAP_GLOBAL(ref_map) pointer with Apache Map
    + [CVE-2026-7261]: Use-after-free after header parsing failure with
      SOAP_PERSISTENCE_SESSION
    + [CVE-2026-7262]: Broken Apache map value NULL check
    + [CVE-2026-7568]: Signed integer overflow of char array offset
    + [CVE-2026-7258]: Consistently pass unsigned char to ctype.h functions
php8.4 (8.4.20-1) unstable; urgency=medium
 .
   * New upstream version 8.4.20
php8.4 (8.4.16-1) unstable; urgency=medium
 .
   * Add preliminary LiteSpeed SAPI support
   * New upstream version 8.4.16
    + [CVE-2025-14180]: Fixed GHSA-8xr5-qppj-gvwj (PDO quoting result null
      deref).
    + [CVE-2025-14178]: Fixed GHSA-h96m-rvf9-jgm2 (Heap buffer overflow in
      array_merge()).
    + [CVE-2025-14177]: Fixed GHSA-3237-qqm7-mfv7 (Information Leak of
      Memory in getimagesize).

pillow (11.1.0-5+deb13u4) trixie; urgency=medium
 .
   * Followup fix for CVE-2026-42310 (Closes: #1141330)
pillow (11.1.0-5+deb13u3) trixie-security; urgency=medium
 .
   * CVE-2026-42308
   * CVE-2026-42310
   * CVE-2026-42311

poco (1.13.0-6+deb13u1) trixie; urgency=medium
 .
   * QA upload.
   * CVE-2025-6375: Segmentation fault in MultipartStreamBuf
     (Closes: #1108157)

poetry (2.1.2+dfsg-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-34591: Wheel Path Traversal Leading to Arbitrary File Write
     (Closes: #1132609)

poppler (25.03.0-5+deb13u4) trixie; urgency=medium
 .
   * Team upload
   * Fix creation of ill-formed PDF document signatures (Poppler issue #1596)
     - fixes "Invalid signature time when signing a PDF" (Closes: #1127146)
     Signatures made with previous versions of Poppler may not be recognized
     by other applications as valid.
poppler (25.03.0-5+deb13u3) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * SplashOutputDev: Fix integer overflow in tilingPatternFill (CVE-2026-10118)
     (Closes: #1138708)
   * Make sure regex doesn't stack overflow by limiting it (CVE-2025-43718)
     (Closes: #1117046)
   * Check for duplicate entries (CVE-2025-52885) (Closes: #1117853)

postfix (3.10.11-0+deb13u1) trixie; urgency=medium
 .
   * New upstream version 3.10.11, fixing 5 low-impact issues:
     - Bugfix: null pointer read and heap data overread
       in the Postfix SMTP client's smtp_dns_reply_filter
     - Robustness: the Postfix SMTP server will no longer receive (and discard)
       an unlimited amount of text while receiving a long SMTP command line
     - Robustness: do not receive (and discard) unlimited amounts of data
       with BDAT commands
     - Bugfix: panic (assertion failure and voluntary crash) while parsing
       a TLSA reply with length 3
     - Bugfix: the SMTP client did not xtext_quote a '+' character in a
       DSN ORCPT parameter value.  A strict receiver implementation could reject
       or discard the parameter value (this has never been reported to happen)
postfix (3.10.10-0+deb13u1) trixie; urgency=medium
 .
   [ Michael Tokarev ]
   * keep postfix running during upgrades (Closes: #1120869)
   * linux7.patch: support building of the source on 7.x kernels
 .
   * new upstream stable/bugfix release 3.10.10:
   - Bitrot: builds with musl libc broke, because they were using an obsolete
     NO_SNPRINTF code path.
   - Two fixes for a signed integer overshift condition (a left shift into the
     sign bit). This "works" on contemporary CPUs, but may break in the future.
   - Fix an 'uninitialized value' error in the 'collate.pl' script.
 .
   * new upstream stable/bugfix release 3.10.9:
   - Bugfix: The RFC 2047 encoder for the sender "full name" could
     loop when a very long full_name_encoding_charset value was
     configured in main.cf.
   - Bugfix buffer over-read when Postfix an enhanced status code is not
     followed by other text. For example, "5.7.2" without text after the
     three-number code.  This CANNOT be triggered with an SMTP or LMTP server
     response; is confirmed with an access(5) table and likely with a policy
     server response; can possibly be triggered with pipe-to-command output,
     header_checks(5), body_checks(5), an error(8) transport in transport_maps,
     or a milter response; and is confirmed with a DNSBL server TXT response
     while Postfix is configured with "$rbl_code $rbl_text" in rbl_reply_maps
     or default_rbl_reply. This could result in process termination.
     (Closes: #1135718, CVE-2026-43964)
   - Code cleanup: log a fatal error instead of dereferencing a null pointer
     after a first/next cursor initialization failure.
   - Portability: support for recent FreeBSD, NetBSD, and OpenBSD versions.
   - Bugfix: When truncating a database file, the cdb: database client looked
     at the file size from before requesting an exclusive lock on a database
     file, instead of the file size after the exclusive lock was granted.
   - Bugfix: file descriptor leak after fork() failure.
   - Mistakes in debug logging.
   - Unchecked null pointer results after an out-of-memory condition in a
     library dependency. Found by Claude Opus 4.6. The fix is to return an
     error status or to log a fatal error.
   - Missing or incomplete guards for ssize_t or int overflow.  These limits
     are unlikely to be exceeded because the size of in-memory objects is
     limited by design (the number of in-memory objects is also limited).
 .
   * new upstream stable/bugfix release 3.10.8:
   - Improved Milter error handling for messages that arrive over a
     long-lived SMTP connection.
   - Fix "posttls-finger -v -v -v" panic and recursive panic.
 .
   * new upstream stable/bugfix release 3.10.7:
   - build fix for modern compilers and standard bool types
     (already included in debian)
 .
   * new upstream stable/bugfix release 3.10.6:
   - Bugfix: warning messages that smtp_tls_wrappermode requires
     "smtp_tls_security_level = encrypt".
     Root cause: support for "TLS-Required: no" broke client-side
     TLS wrappermode support, by downgrading a connection to TLS
     security level 'may'.
     The fix changes the downgrade level for wrappermode connections
     to 'encrypt'.
     Rationale: by design, TLS can be optional only for connections
     that use STARTTLS.  The downgrade to unauthenticated 'encrypt'
     allows a sender to avoid an email delivery problem.
   - New logging: the Postfix SMTP client will log a warning when
     an MX hostname does not match STS policy MX patterns, with
     "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
     TLSRPT support enabled in a TLS policy plugin. It will log a
     successful match only when verbose logging is enabled.
   - Bugfix: SMTP client null pointer crash when an STS policy plugin
     sends no policy_string or no mx_pattern attributes.
     This can happen only during tests with a fake STS plugin.
   - Bugfix: segfault when a duplicate parameter name is given to
     "postconf -X" or "postconf -#'.
   - Documentation: removed incorrect text from the parameter description for
     smtp_cname_overrides_servername
 .
   [ Aaron Thompson ]
   * debian-postfix-chroot-cmd.patch: Fix non-ASCII whitespace typo
   * configure-instance.in: fix typo
   * d/README.Debian: minor copyediting
   * Fix some cosmetic typos
postfix (3.10.8-1) unstable; urgency=medium
 .
   * New upstream version 3.10.8
   * Revert "rules: specify -std=gnu17 for CC (#1097639)"
     (similar solution is adopted upstream)
postfix (3.10.6-4) unstable; urgency=medium
 .
   * disable chrooting by default finally, after 25 years of everyone suffering.
     Only limited support for chroot mode will be provided for backwards
     compatibility.  With this in mind, let's close all chroot-related bugs.
     Closes: #151692, #1084167, #606007, #631665, #714770, #406348,
     Closes: #1026394, #257096, #278530, #776685, #893516, #935825,
     Closes: #678808, #896879, #412413, #802043
   * yes there's no 3.10.6-3 changelog entry - which was chroot disabling
     without closing the bugs.
postfix (3.10.6-3) unstable; urgency=medium
 .
   * disable chrooting by default finally, after 25 years of everyone suffering
postfix (3.10.6-1) unstable; urgency=medium
 .
   * new upstream stable release:
 .
    - Bugfix (defect introduced: Postfix 3.10, date: 20250117).
      Symptom: warning messages that smtp_tls_wrappermode requires
      "smtp_tls_security_level = encrypt".
      Root cause: support for "TLS-Required: no" broke client-side
      TLS wrappermode support, by downgrading a connection to TLS
      security level 'may'.
      The fix changes the downgrade level for wrappermode connections
      to 'encrypt'. Rationale: by design, TLS can be optional only
      for connections that use STARTTLS. The downgrade to unauthenticated
      'encrypt' allows a sender to avoid an email delivery problem.
      Problem reported by Joshua Tyler Cochran.
 .
    - New logging: the Postfix SMTP client will log a warning when
      an MX hostname does not match STS policy MX patterns, with
      "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
      TLSRPT support enabled in a TLS policy plugin. It will log a
      successful match only when verbose logging is enabled.
 .
    - Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
      client null pointer crash when an STS policy plugin sends no
      policy_string or no mx_pattern attributes. This can happen only
      during tests with a fake STS plugin.
 .
    - Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
      when a duplicate parameter name is given to "postconf -X" or
      "postconf -#'.
 .
    - Documentation: removed incorrect text from the parameter
      description for smtp_cname_overrides_servername. File:
      proto/postconf.proto.
postfix (3.10.5-3) unstable; urgency=medium
 .
   [ Aaron Thompson ]
   * debian-postfix-chroot-cmd.patch: Fix non-ASCII whitespace typo
   * configure-instance.in: fix typo
   * d/README.Debian: minor copyediting
   * Fix some cosmetic typos
 .
   [ Michael Tokarev ]
   * changelog: fix the Closes: #1120869 line in the previous upload
 .
 postfix (3.10.5-2) unstable; urgency=medium
 .
   * keep postfix running during upgrades (Closes: #1120869)
 .
     Instead of stopping postfix instances before upgrade and starting
     them after, keep them running during whole upgrade, and restart in
     one go when finished.
 .
     Sometimes during upgrade, old running instance might try to run
     a new binary which is somehow incompatible with the old instance.
     Or a new binary try to load old dictionary module and fails.
     In the worst case, it will cause throttle for this service,
     but it will be over on restart after upgrade.
 .
     But keeping postfix running will make 2 things happen:
 .
     1. In many situations, email will continue working during upgrades;
     2. Secondary instances will be restarted automatically too
 .
   * d/rules: stop stopping/restarting postfix-resolvconf,
     since it is pointless
postfix (3.10.5-2) unstable; urgency=medium
 .
   * keep postfix running during upgrades (#1120869)
 .
     Instead of stopping postfix instances before upgrade and starting
     them after, keep them running during whole upgrade, and restart in
     one go when finished.
 .
     Sometimes during upgrade, old running instance might try to run
     a new binary which is somehow incompatible with the old instance.
     Or a new binary try to load old dictionary module and fails.
     In the worst case, it will cause throttle for this service,
     but it will be over on restart after upgrade.
 .
     But keeping postfix running will make 2 things happen:
 .
     1. In many situations, email will continue working during upgrades;
     2. Secondary instances will be restarted automatically too
 .
   * d/rules: stop stopping/restarting postfix-resolvconf,
     since it is pointless
postfix (3.10.5-1) unstable; urgency=medium
 .
   * new upstream stable release.  From the Release Notes:
 .
   * Workaround for an interface mis-match between the Postfix SMTP
     client and MTA-STS policy plugins.
 .
       * The existing behavior is to connect to any MX host listed
         in DNS, and to match the server certificate against any STS
         policy MX host pattern.
 .
       * The corrected behavior is to connect to an MX host only if
         its name matches any STS policy MX host pattern, and to
         match the server certificate against the MX hostname.
 .
     The corrected behavior must be enabled in two places: in Postfix
     with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default:
     "yes") and in an MTA-STS plugin by enabling TLSRPT support, so
     that the plugin forwards STS policy attributes to Postfix. This
     works even if Postfix TLSRPT support is disabled at build time
     or at runtime.
 .
   * TLSRPT Workaround: when a TLSRPT policy-type value is
     "no-policy-found", pretend that the TLSRPT policy domain value
     is equal to the recipient domain. This ignores that different
     policy types (TLSA, STS) use different policy domains. But this
     is what Microsoft does, and therefore, what other tools expect.
 .
   * Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP
     client's connection reuse logic did not distinguish between
     sessions that require SMTPUTF8 support, and sessions that do
     not. The solution is 1) to store sessions with different SMTPUTF8
     requirements under distinct connection cache storage keys, and
     2) to not cache a connection when SMTPUTF8 is required but the
     server does not support that feature.
 .
   * Bugfix (defect introduced: Postfix 3.0, date 20140731): the
     smtpd 'disconnect' command statistics did not count commands
     with "bad syntax" and "bad UTF-8 syntax" errors.
 .
   * Bugfix: the August 2025 patch broke DBM library support which
     is still needed on Solaris; and the same change could result
     in warnings with "database X is older than source file Y".
 .
   * Postfix 3.11 forward compatibility: to avoid ugly warnings when
     Postfix 3.11 is rolled back to an older version, allow a
     preliminary 'size' record in maildrop queue files created with
     Postfix 3.11 or later.
 .
   * Bugfix (defect introduced: Postfix 3.8, date 20220128):
     non-reproducible build, because the 'postconf -e' output order
     for new main.cf entries was no longer deterministic. Problem
     reported by Oleksandr Natalenko, diagnosis by Eray Aslan.
 .
   * To make builds predictable, add missing meta_directory and
     shlib_directory settings to the stock main.cf file. Problem
     diagnosed by Eray Aslan.
 .
   * Bugfix (defect introduced: Postfix 3.9, date 20230517):
     posttls-finger(1) logged an incorrectly-formatted port number.
     Viktor Dukhovni.

postgresql-17 (17.10-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 17.10.
 .
     + Prevent unbounded recursion while processing startup packets
       (Michael Paquier)
 .
       A malicious client could crash the connected backend by alternating
       rejected SSL and GSS encryption requests indefinitely.
 .
       The PostgreSQL Project thanks Calif.io (in collaboration with Claude and
       Anthropic Research) for reporting this problem. (CVE-2026-6479)
 .
     + Fix assorted integer overflows in memory-allocation calculations
       (Tom Lane, Nathan Bossart, Heikki Linnakangas)
 .
       Various places were incautious about the possibility of integer overflow
       in calculations of how much memory to allocate.  Overflow would lead to
       allocating a too-small buffer which the caller would then write past the
       end of.  This would at least trigger server crashes, and probably could
       be exploited for arbitrary code execution.  In many but by no means all
       cases, the hazard exists only in 32-bit builds.
 .
       The PostgreSQL Project thanks Xint Code, Bruce Dang, Sven Klemm, and
       Pavel Kohout for reporting these problems. (CVE-2026-6473)
 .
     + Properly quote subscription names in pg_createsubscriber
       (Nathan Bossart)
 .
       The given subscription name was inserted into SQL commands without
       quoting, so that SQL injection could be achieved in the (perhaps
       unlikely) case that the subscription name comes from an untrusted
       source.
 .
       The PostgreSQL Project thanks Yu Kunpeng for reporting this problem.
       (CVE-2026-6476)
 .
     + Properly quote object names in logical replication origin checks
       (Pavel Kohout)
 .
       ALTER SUBSCRIPTION ... REFRESH PUBLICATION interpolated schema and
       relation names into SQL commands without quoting them, allowing
       execution of arbitrary SQL on the publisher.
 .
       The PostgreSQL Project thanks Pavel Kohout for reporting this problem.
       (CVE-2026-6638)
 .
     + Reject over-length options in ts_headline() (Michael Paquier)
 .
       The StartSel, StopSel and FragmentDelimiter strings must not exceed 32Kb
       in length, but this was not checked for.  An over-length value would
       typically crash the server.
 .
       The PostgreSQL Project thanks Xint Code for reporting this problem.
       (CVE-2026-6473)
 .
     + Guard against malicious time zone names in timeofday() and pg_strftime()
       (Tom Lane)
 .
       A crafted time zone setting could pass % sequences to snprintf(),
       potentially causing crashes or disclosure of server memory.  Another
       path to similar results was to overflow the limited-size output buffer
       used by pg_strftime().
 .
       The PostgreSQL Project thanks Xint Code for reporting this problem.
       (CVE-2026-6474)
 .
     + When creating a multirange type, ensure the user has CREATE privilege on
       the schema specified for the multirange type (Jelte Fennema-Nio)
 .
       The multirange type can be put into a different schema than its parent
       range type, but we neglected to apply the required privilege check when
       doing so.
 .
       The PostgreSQL Project thanks Jelte Fennema-Nio for reporting this
       problem. (CVE-2026-6472)
 .
     + Use timing-safe string comparisons in authentication code
       (Michael Paquier)
 .
       Use timingsafe_bcmp() instead of memcpy() or strcmp() when checking
       passwords, hashes, etc.  It is not known whether the data dependency of
       those functions is usefully exploitable in any of these places, but in
       the interests of safety, replace them.
 .
       The PostgreSQL Project thanks Joe Conway for reporting this problem.
       (CVE-2026-6478)
 .
     + Mark PQfn() as unsafe, and avoid using it within libpq (Nathan Bossart)
 .
       For a non-integral result type, PQfn() is not passed the size of the
       output buffer, so it cannot check that the data returned by the server
       will fit.  A malicious server could therefore overwrite client memory.
       This is unfixable without an API change, so mark the function as
       deprecated.  Internally to libpq, use a variant version that can apply
       the missing check.
 .
       The PostgreSQL Project thanks Yu Kunpeng and Martin Heistermann for
       reporting this problem. (CVE-2026-6477)
 .
     + Prevent path traversal in pg_basebackup and pg_rewind (Michael Paquier)
 .
       These applications failed to validate output file paths read from their
       input, so that a malicious source could overwrite any file writable by
       these applications.  Constrain where data can be written by rejecting
       paths that are absolute or contain parent-directory references.
 .
       The PostgreSQL Project thanks XlabAI Team of Tencent Xuanwu Lab and
       Valery Gubanov for reporting this problem. (CVE-2026-6475)
 .
     + Guard against field overflow within contrib/intarray's query_int type
       and contrib/ltree's ltxtquery type (Tom Lane)
 .
       Parsing of these query structures did not check for overflow of 16-bit
       fields, so that construction of an invalid query tree was possible.
       This can crash the server when executing the query.
 .
       The PostgreSQL Project thanks Xint Code for reporting this problem.
       (CVE-2026-6473)
 .
     + Guard against overly long values of contrib/ltree's lquery type
       (Michael Paquier)
 .
       Values with more than 64K items caused internal overflows, potentially
       resulting in stack smashes or wrong answers.
 .
       The PostgreSQL Project thanks Vergissmeinnicht, A1ex, and Jihe Wang for
       reporting this problem. (CVE-2026-6473)
 .
     + Prevent SQL injection and buffer overruns in contrib/spi
       (Nathan Bossart)
 .
       check_foreign_key() was insufficiently careful about quoting key values,
       and also used fixed-length buffers for constructing queries.  While this
       module is only meant as example code, it still shouldn't contain such
       dangerous errors.
 .
       The PostgreSQL Project thanks Nikolay Samokhvalov for reporting this
       problem. (CVE-2026-6637)

protobuf (3.21.12-11+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Fix CVE-2026-0994: JSON recursion depth bypass (closes: #1126302).
   * Fix CVE-2026-6409: PHP Denial of Service (closes: #1134895).
 .
   [ Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com> ]
   * Complete fix of CVE-2024-7254 (closes: #1082381):
     - add recursion checks and recursion limit,
     - add tests.
 .
   [ Laszlo Boszormenyi (GCS) ]
   * Fix CVE-2025-4565: data containing an arbitrary number of recursive
     groups, recursive messages or a series of SGROUP tags can be corrupted
     by exceeding the Python recursion limit (closes: #1108057).

psd-tools (1.10.7+dfsg.1-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-27809: Compression module vulnerabilities (Closes: #1129098)

pupnp (1:1.14.20-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-41682: SSRF port confusion

pymdown-extensions (10.13-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2025-68142: ReDOS in Figure Capture extension (Closes: #1123672)

pyopenssl (25.0.0-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-27448: Unhandled exceptions in set_tlsext_servername_callback
     callbacks did not cancel connections
   * CVE-2026-27459: Buffer overflow in DTLS cookie callback

pytest-httpbin (2.1.0-1+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * Disable flaky test. Closes: #1137653.

python-daphne (4.1.2-2+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-44545: DoS via unbounded WebSocket message sizes
   * CVE-2026-44546: Header injection on WebSocket upgrade path
   * (Closes: #1138864)

python-django (3:4.2.28-0+deb13u2) stable-proposed-updates; urgency=medium
 .
   * The fix for CVE-2025-6069 in the python3.13 source package (released
     as part of a suite of updates in 3.13.5-2+deb13u2) modified Python's
     html.parser.HTMLParser class in such a way that changed the behaviour of
     Django's strip_tags() method. As a result of this change, we update the
     testsuite here for the newly expected results in order to prevent a build
     failure. (Closes: #1137039)

python-dynaconf (3.1.7-2+deb13u1) trixie; urgency=medium
 .
   * CVE-2026-33154 (Closes: #1131476)

python-grpc-tools (1.14.1-8+deb13u1) trixie; urgency=medium
 .
   * Team upload.
 .
   [ Theodore Tucker ]
   * d/patches: Fix shadowed variable in grpc_tools/command.py (Closes: #1132763)

python-handy-archives (0.2.0-5+deb13u1) trixie; urgency=medium
 .
   * Fix Zip64 end of central directory locator. (Closes: #1137041)

python-idna (3.10-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-45409: DoS from specially crafted inputs (Closes: #1139164)

python-iniparse (0.5.1-1+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * Fix race condition in test_multiprocessing. Closes: #1137634.

python-jwcrypto (1.5.6-1.1~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie.
 .
 python-jwcrypto (1.5.6-1.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-39373: JWT bomb Attack in deserialize (Closes: #1133006)

python-markdown (3.7-2+deb13u1) trixie; urgency=medium
 .
   * Adapt to changes in html.parser module in the new Python, backported
     to Trixie as part of CVE fixes (closes: #1137043).

python-marshmallow (3.26.2-0+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * New upstream release.
     - CVE-2025-68480: DoS with Schema.load(many)  (Closes: #1123888)
python-marshmallow (3.26.1-0.4) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * Disable useless Salsa CI tests
   * Drop "Rules-Requires-Root: no": it is the default now
   * Bump Standards-Version to 4.7.3, drop Priority: tag
   * Drop unused python3-tz build-dep
   * Rewrite d/watch in v5 format
python-marshmallow (3.26.1-0.3) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * Handle new error message in newer Python (closes: #1123267).

python-memray (1.17.0+dfsg-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-32722: XSS in generated HTML reports via unescaped
     command-line metadata (Closes: #1131372)

python-oslo.messaging (16.1.0-3+deb13u1) trixie-security; urgency=medium
 .
   * Add fix-not-using-non-durable.patch.
   * CVE-2026-44393 / OSSN-0096: oslo.messaging does not verify RabbitMQ broker
     hostname during TLS handshake. Added upstream patch: Fix RabbitMQ TLS
     hostname verification (Closes: #1138848).

python-urllib3 (2.3.0-3+deb13u2) trixie-security; urgency=medium
 .
   * CVE-2026-44431 (Closes: #1136653)

python-virtualenv (20.31.2+ds-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-22702: Time-of-Check-Time-of-Use Vulnerabilities
     in Directory Creation (Closes: #1125191)

python-webob (1:1.8.10-0+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * New upstream release.
     - CVE-2026-44889: Location header normalization during redirect
       leads to open redirect
python-webob (1:1.8.9-2) unstable; urgency=medium
 .
   * Team upload.
   * Add debian/salsa-ci.yml
   * Mark build-deps as !nocheck or !nodoc
   * Remove redundant Priority: optional from source stanza.
   * Update lintian override info format
 .
   [ Shanavas M ]
   * Fix test failure (Closes: #1123459)
   * Bumped standards version to 4.7.4

python-xmltodict (0.13.0-1.1~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie.
 .
 python-xmltodict (0.13.0-1.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2025-9375: XML Injection (Closes: #1113825)
python-xmltodict (0.13.0-1.1~deb12u1) bookworm; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for bookworm.
 .
 python-xmltodict (0.13.0-1.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2025-9375: XML Injection (Closes: #1113825)

python3.13 (3.13.5-2+deb13u3) trixie; urgency=medium
 .
   [ Stefano Rivera ]
   * Patches:
     - Fix a crash in SNI callback when the SSL object is gone.
     - Fix reference leaks in ssl.SSLContext objects. (Closes: #1138157)
     - Avoid garbage collecting objects too early when sharing __dict__
       (Closes: #1108039)
     - Update the patch for CVE-2026-6019 to use decodeURIComponent.
 .
   [ Moritz Mühlenhoff ]
   * CVE-2026-1502
   * CVE-2026-3276
   * CVE-2026-7774
   * CVE-2026-8328
   * CVE-2026-9669

qemu (1:10.0.11+ds-0+deb13u1) trixie; urgency=medium
 .
   * new upstream stable/bugfix release:
    - Update version for 10.0.11 release
    - linux-user: Fix AT_PHDR when program headers are relocated into their own segment
    - hw/pci: Replace assert with bounds check and return
    - ppc/pnv_phb3: Error out on invalid config access
    - linux-user/xtensa: fix unlock of uninitialized frame pointer on sigreturn
    - linux-user/xtensa: save/restore FP registers across signal delivery
    - target/xtensa: add cpu_set_fcr/fsr helpers to sync fp_status
    - ui/sdl2: Set GL ES profile before creating initial GL context
    - hw/9pfs: reject . and .. in Twstat rename
    - hw/9pfs: fix abort due to illegal name with Twstat rename
    - gdbstub: Update x86 control register bits
    - target/i386: apply mod to immediate count of an RCL/RCR operation
    - hw/uefi: fix parse_hexstr
      (Closes: CVE-2026-48915)
    - target/riscv: mask vxrm csrw write to the low 2 bits
    - disas/riscv.c: fix inst_length()
    - target/riscv/cpu_helper.c: add PMA access fault
    - target/riscv/cpu_helper.c: fault with reserved PTE.PBMT val
    - target/riscv/insn_trans/trans_rvzicbo.c.inc: save opcode before helpers
    - disas/riscv.c: add 'cbo' insns to disassembler
    - target/riscv/csr.c: fix mstatus.UXL reserved value
    - target/riscv/csr.c: do not allow mstatus MPV/GVA writes
    - target/riscv/cpu_helper.c: allow LOAD_ADDR_MIS promotion to AMO fault
    - virtio: Allow to fill a whole virtqueue in order
    - libvduse: fix buffer overflow in vduse_queue_read_indirect_desc()
      (Closes: CVE-2026-6425)
    - libvhost-user: fix buffer overflow in virtqueue_read_indirect_desc()
      (Closes: CVE-2026-6425)
    - tests/qtest: Add amd-iommu command buffer head wrap test
    - amd_iommu: Update command buffer head ptr in MMIO region after wraparound
    - amd_iommu: restrict command buffer head/tail ranges to ring size
    - linux-user: add preadv2/preadv2
    - system/rtc: Fix a possible year-2038 integer overflow problem
    - linux-user/strace: add fsmount series of syscalls
    - linux-user: implement fsmount(2) series of syscalls
    - fpu: Handle all rounding modes in partsN_uncanon_normal
    - hw/usb/hcd-ohci: Clean up USBPacket before freeing ISO TD packet
    - qed: Don't try to flush during incoming migration
    - qcow2: Fix data loss on zero write with detect-zeroes=unmap
    - iotests/046: Test that discard/write_zeroes wait for dependencies
    - qcow2: Fix corruption on discard during write with COW
    - qemu-io: Add 'aio_discard' command
    - virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check
      (Closes: #1139923, CVE-2026-48914)
    - block/io: fallback to bounce buffer if BLKZEROOUT is not supported because of alignment
    - s390x/pci: Fix interrupt forwarding disable for interpreted devices
    - target/s390x: Make container ids in SysIB_15x 1-based
    - tests/unit: add test-envlist covering setenv/unsetenv name matching
    - util/envlist: fix prefix-match in envlist_unsetenv() name lookup
    - 9pfs: fix missing rename lock in v9fs_co_readdir_many
      (Closes: CVE-2026-48004)
    - tests/9pfs: add deep absolute path test
    - tests/qtest/libqos: add qvirtqueue_reset_pool() for descriptor pool reset
    - hw/9pfs: let callers of v9fs_path_sprintf() and v9fs_fix_path() handle errors
    - hw/9pfs: add error handling to v9fs_fix_path()
    - hw/9pfs: change V9fsPath.size to size_t and v9fs_path_sprintf() return type
    - hw/9pfs: add NULL check in v9fs_path_is_ancestor()
    - hw/9pfs: move G_GNUC_PRINTF to header
    - linux-user/s390x: restore fpu_status rounding mode from FPC on sigreturn
    - linux-user/sh4: restore FP rounding mode on sigreturn
    - linux-user/sh4: preserve T/M/Q bits across signal delivery
    - linux-user/mips: save/restore FCSR across signal delivery
    - linux-user/ppc: restore fp_status from FPSCR on sigreturn
    - hw/net/rocker_of_dpa: Avoid unaligned accesses in _of_dpa_flow_match()
    - hw/net/rocker_of_dpa: Check group ID pointers are not NULL
    - target/arm: Don't assert if 64-bit EL2 AT insn sees a Domain fault
    - target/arm: Set correct fp flags for FLOGB when FPCR.AH = 1
    - target/arm: Use FPST_A64_F16 for SVE FCVTLT_hs
    - target/arm: SVE2 FMAXP, FMINP must honour AH=1
    - block/linux-aio: bound ioq_submit() recursion depth
    - mc146818rtc: Fix get_guest_rtc_ns() overflow bug
    - apic: fix delivery bitmask with modified xAPIC ids
    - lsi53c895a: clear tag byte when processing messages
    - lsi53c895a: fix use-after-free of cancelled request
    - ui: fix validation of VNC extended clipboard data length
      (Closes: CVE-2026-8343)
    - ui/vnc: fix OOB read updating VNC update frequency stats
      (Closes: CVE-2026-48003)
    - ui/vnc: fix OOB write in lossy rect worker code
      (Closes: CVE-2026-48002)
    - ui/vnc: fix OOB write in VNC stats array
      (Closes: CVE-2026-48002)
    - ui/vnc: fix OOB read access in VNC SASL mechname array
    - target/riscv: clear mseccfg on reset for all dependent extensions
    - target/riscv: Update the local interrupt mask
    - target/riscv: Add mseccfg to VMStateDescription
    - target/riscv: Save stimer and vstimer in CPU vmstate
    - target/riscv/pmp: Fix integer overflow in TOR and NA4 address computation
    - target/riscv: Fix medeleg[11] read-only zero bit for M-mode ECALL
    - hw/char: sifive_uart: Implement txctrl.txen and rxctrl.rxen
    - hw/char: sifive_uart: Avoid infinite delay of async xmit function
    - target/riscv: Allow mseccfg access based on ext_zicfilp
    - hw/riscv/riscv-iommu: Fix Svnapot 64KB pages
    - target/riscv: Update MISA.X for non-standard extensions
    - target/riscv: Update MISA.C for Zc* extensions
qemu (1:10.0.10+ds-0+deb13u1) trixie; urgency=medium
 .
   * 10.0.10 upstream stable/bugfix release:
    - Update version for 10.0.10 release
    - block/graph-lock: fix missed wakeup in bdrv_graph_co_rdunlock()
    - block: Add more defaults to DEFAULT_BLOCK_CONF
    - block: Create DEFAULT_BLOCK_CONF macro
    - ide-test: Test reset during TRIM
    - ide-test: Factor out wait_dma_completion()
    - ide: Clean up ide_trim_co_entry() to be idiomatic coroutine code
    - ide: Minimal fix for deadlock between TRIM and drain
    - block: Add flags parameter to blk_*_pdiscard()
    - block: Add blk_co_start/end_request() and BDRV_REQ_NO_QUEUE
    - blkdebug: Add 'delay-ns' option
    - linux-user/sh4: Fix setup_sigtramp to match Linux kernel
      trampoline pattern
    - linux-user/sh4: Fix target_ucontext tuc_link field type
    - linux-user: Fix AT_EXECFN in AUXV for symlinked programs
    - hw/nvme: fix admin cq msix setup
    - tests/functional/qemu_test/asset.py: Don't use setxattr
      when it doesn't exist
    - meson.build: Add -fzero-init-padding-bits=all
    - hw/i2c/microbit_i2c: Don't index off end of twi_read_sequence[]
    - aspeed/hace: Prevent total_req_len overflow
    - aspeed/hace: Fix out-of-bounds read in has_padding()
    - hw/display/cirrus_vga: Fix packed-24 color-expansion transparent copies
    - hw/display/cirrus_vga: Fix packed-24 color-expansion
      transparent pattern fills
    - hw/ufs: Keep MCQ SQs alive while requests are outstanding
    - hw/ufs: Reject zero-depth MCQ queues
    - hw/ufs: Guard MCQ CQ accesses against missing queues
    - hw/ufs: Validate MCQ SQ references before use
    - hw/uefi: check auth.hdr_length minimum size
      (Closes: CVE-2026-8341)
    - hw/uefi: avoid possibly unaligned variable_auth_2 struct field access
      (Closes: CVE-2026-41440)
    - hw/uefi: verify data size before accessing it in wrap_pkcs7
      (Closes: CVE-2026-41439)
    - hw/uefi: add name_size check to uefi_vars_mm_lock_variable()
      (Closes: CVE-2026-41438)
    - hw/uefi: fix ucs2 string helper functions
      (Closes: CVE-2026-41437)
    - hw/uefi: verify pio_xfer_offset before calculating buffer checksum
      (Closes: CVE-2026-41436)
    - hw/uefi: fix buffer overruns
      (Closes: CVE-2026-41435)
    - hw/misc/bcm2835_rng: Specify valid memory access sizes
    - target/arm: Report IL=0 for Thumb 16-bit BKPT insn
    - target/microblaze: Fix endianness used to disassemble
    - hw/intc/arm_gicv3: Fix NS write to ICC_AP1Rn_EL1 when prebits < 7
    - hw/net/allwinner-sun8i-emac: Flush queued packets when rx is enabled
    - hw/ppc/e500: fix bus-frequency property hardcoded to zero in CPU FDT node
    - hw/ppc/e500: Move clock and TB frequency to machine class
    - tests/rcutorture: Fix build error
    - hw/intc/xics: Add a check for an invalid server id
    - linux-user: Translate errno in IP_RECVERR and IPV6_RECVERR
    - linux-user: Allow getsockopt() with NULL optval address
    - linux-user: Flush errors by using exit() instead of _exit() in error path
    - linux-user: Add missing CDROM ioctls
    - target/riscv: Use ELEN for Fractional LMUL check
    - target/riscv: Don't OR mip.SEIP when mvien is one
    - target/riscv: Generate access fault if sc comparison fails
    - riscv_htif: reject invalid signature ranges (end <= begin)
    - hw/intc: fix heap OOB in ACLINT MTIMER multi-socket
    - target/riscv: fix stale ptshift and base on page walk restart
    - hw/riscv/virt-acpi-build.c: Use kvm timer frequency when kvm enabled
    - linux-user: Flush errors by using exit() instead of _exit() in error path
    - linux-user: Use abi_int for imr_ifindex in ip_mreqn struct
    - linux-user: Fix CLONE_PARENT_SETTID when using fork-like clone
    - linux-user: Add getsockopt() for SO_RCVTIMEO_NEW and SO_SNDTIMEO_NEW
    - linux-user: Add setsockopt() for SO_RCVTIMEO_NEW and SO_SNDTIMEO_NEW
    - linux-user: Define SO_TIMESTAMP*_NEW and SO_RCVTIMEIO_NEW
    - linux-user/mips: sync k0 TLS for EF_MIPS_MACH_OCTEON userlands
    - linux-user/strace: Use pointer type for read and write values
    - linux-user/arm/nwfpe: Use thread-local storage for qemufpa
    - linux-user/arm/nwfpe: Replace user_registers with current_cpu
    - linux-user: Don't define target_stat64 struct for loongarch64
    - linux-user: fix off-by-one in host_to_target_for_each_rtattr()
    - linux-user/ppc: Fix ppc64 rt_sigframe stack offset
    - hw/sh4/sh7750: Remove forgotten abort() in the MM_ITLB_DATA handler
    - hw/misc: Fix the valid access size to the avr-power device
    - migration: vmstate_save_state_v: fix double error_setg
    - hw/display: don't accidentally autofree existing virgl resources
      (Closes: CVE-2026-6502)
    - meson: add missing semicolon in pthread_condattr_setclock test
    - target/i386/tcg: fix decoding of MOVBE and CRC32 in 16-bit mode
    - target/i386: fix missing PF_INSTR in SIGSEGV context
    - target/i386: fix strList leak in x86_cpu_get_unavailable_features
    - target/arm/tcg/translate.c: remove MO_TE usage
    - ui/console-vc: fix off-by-one in CSI J 2 (clear entire screen)
    - ui/spice-app: detect runtime directory creation failures
    - serial COM: windows serial COM PollingFunc don't sleep
    - util/cutils: Fix heap corruption under Windows
    - virtio-blk: fix zone report buffer out-of-memory
      (Closes: CVE-2026-5761)
    - qemu-keymap: fix altgr modifier lookup for newer xkeyboard-config
    - hw/uefi: fix heap overflow
      (Closes: CVE-2026-5744)
    - virtio-scsi: pass the same cdb_size to virtio_scsi_pop_req
      and virtio_scsi_handle_cmd_req_prepare
      (Closes: CVE-2026-5763)
    - util/readline: Fix out-of-bounds access in readline_insert_char()
    - target/arm: fix fault_s1ns for stage 2 faults
    - target/arm: do_ats_write(): avoid assertion when ptw failed
    - bsd-user, linux-user: signal: recursive signal delivery fix
    - linux-user: Make openat2() use -L for absolute paths
    - linux-user: update select timeout writeback
    - linux-user: fix name_to_handle_at when AT_HANDLE_MNT_ID_UNIQUE flag is set
    - util: fix missing aio_wait sym in qemu guest agent only build
    - monitor: Fix deadlock in monitor_cleanup
    - scsi: Don't consider LOGICAL UNIT NOT SUPPORTED guest recoverable
    - ide: Fix potential assertion failure on VM stop for PIO read error
    - ui/vnc-jobs: fix VncRectEntry leak on job cleanup
    - hw/net/rocker: Avoid double-free of l2_flood.group_ids
    - lsi53c895a: keep SCSIRequest alive during DMA
    - lsi53c895a: keep lsi_request alive as long as the SCSIRequest
    - lsi53c895a: keep lsi_request and SCSIRequest in local variables
    - lsi53c895a: do not do anything else if a reset is requested
      by writing ISTAT0
    - lsi53c895a: keep a reference to the device while SCRIPTS execute
      (Closes: #1085299, CVE-2024-6519)
    - scripts/qemu-guest-agent/fsfreeze-hook: Fix syslog-fallback logic
    - scripts/qemu-guest-agent/fsfreeze-hook: Avoid use of PIPESTATUS
    - scripts/qemu-guest-agent/fsfreeze-hook: Avoid bash-isms
    - hw/nvme: fix heap-buffer-overflow in nvme_abort
    - hw/nvme: re-enable wzds bit in namespace dlfeat
    - tcg: Pass host-endian values to plugin_gen_mem_callbacks_*
    - hw/audio/sb16: validate VMState fields in post_load
    - block/curl: free s->password in cleanup paths
    - linux-aio: Resubmit tails of short reads/writes
    - linux-aio: Put all parameters into qemu_laiocb
    - hw/dma/pl080: Fix transfer logic in PL080
    - linux-user/i386/signal.c: Correct definition of target_fpstate_32
    - hw/ssi/aspeed_smc: Convert mem ops to read/write_with_attrs
      for error handling
    - hw/net/ftgmac100: Improve DMA error handling
    - hw/usb/hcd-ohci: check for MPS=0 to avoid infinite loop
      (Closes: CVE-2026-3890)
    - rust: suggest passing --locked to "cargo install"
    - target/riscv: rvv: Fix page probe issues in vext_ldff
    - target/riscv: rvv: Fix missing flags merge in probe_pages
      for cross-page accesses
    - Expand the probe_pages helper function to handle probe flags
    - block: Drop detach_subchain for bdrv_replace_node
    - virtio-gpu: fix overflow check when allocating 2d image
      (Closes: CVE-2026-3886)
    - io: Fix TLS bye task leak
    - ppc/pnv: generate dtb after machine initialization is complete
    - ppc/pnv: fix dumpdtb option
    - block/mirror: fix assertion failure upon duplicate complete
      for job using 'replaces'
    - throttle-group: Fix race condition in throttle_group_restart_queue()
    - target/i386: fix NULL pointer dereference in legacy-cache=off handling
    - hw/dma/pl080: Ignore bottom 2 bits of LLI register
    - hw/dma/pl080: Update interrupts after pl080_run()
    - hw/dma/pl080: Handle bogus swidth and dwidth in transfers
    - linux-user: fix mremap with old_size=0 for shared mappings
    - linux-user: Fix zero_bss for RX PT_LOAD segments
    - hw/net/rtl8319: Work around GCC sanitizer / -Wstringop-overflow bug
 .
   * 10.0.9 stable/bugfix release:
    - Update version for 10.0.9 release
    - hyperv/syndbg: check length returned by cpu_physical_memory_map()
      (Closes: CVE-2026-3842)
    - fuse: Copy write buffer content before polling
    - target/loongarch: Avoid recursive PNX exception on CSR_BADI fetch
    - target/loongarch: Preserve PTE permission bits in LDPTE
    - hw/net/npcm_gmac: Catch accesses off the end of the register array
    - linux-user: fix TIOCGSID ioctl
    - tests/tcg/multiarch/test-mmap: Check mmaps beyond reserved_va
    - bsd-user: Deal with mmap where start > reserved_va
    - linux-user: Deal with mmap where start > reserved_va
    - hw/net/xilinx_ethlite: Check for oversized TX packets
    - virtio-gpu: Ensure BHs are invoked only from main-loop thread
    - block/nfs: Do not enter coroutine from CB
    - block: Never drop BLOCK_IO_ERROR with action=stop for rate limiting
    - block/throttle-groups: fix deadlock with iolimits and muliple iothreads
    - mirror: Fix missed dirty bitmap writes during startup
      (Closes: #1129349)
    - block/curl: fix concurrent completion handling
    - block/vmdk: fix OOB read in vmdk_read_extent()
      (Closes: #1128478, CVE-2026-2243)
    - hw/net/smc91c111: Don't allow negative-length packets
    - io: fix cleanup for websock I/O source data on cancellation
    - io: fix cleanup for TLS I/O source data on cancellation
    - io: separate freeing of tasks from marking them as complete
    - target/i386/hvf/x86_mmu: Fix compiler warning
    - hw/i386/vmmouse: Fix hypercall clobbers
    - tests/docker: upgrade most non-lcitool debian tests to debian 13
    - hw/9pfs: fix missing EOPNOTSUPP on Twstat and Trenameat
      for fs synth driver
    - hw/9pfs: fix data race in v9fs_mark_fids_unreclaim()
    - target/arm: set the correct TI bits for WFIT traps
    - hw/ssi/xilinx_spips: Reset TX FIFO in reset
    - hw/misc/virt_ctrl: Fix incorrect trace event in read operation
    - virtio-snd: tighten read amount in in_cb
      (Closes: #1129604, CVE-2026-3195)
    - virtio-snd: fix max_size bounds check in input cb
      (Closes: #1129604, CVE-2026-3195)
    - virtio-snd: handle 5.14.6.2 for PCM_INFO properly
      (Closes: #1129605, CVE-2026-3196)
    - virtio-snd: remove TODO comments
    - virtio-gpu-virgl: Add virtio-gpu-virgl-hostmem-region type
      (was in virtio-gpu-virgl-Add-virtio-gpu-virgl-hostmem-region.patch)
    - target/arm: Fix feature check in DO_SVE2_RRX, DO_SVE2_RRX_TB
    - target/arm: Account for SME in aarch64_sve_narrow_vq() assertion
    - target/arm: Introduce ARMCPU.sme_max_vq
    - hw/i2c/aspeed_i2c: Fix out-of-bounds read in I2C MMIO handlers
    - docs/about/emulation: Add documentation for hotblocks plugin arguments
    - contrib/plugins/hotblocks: Print uint64_t with PRIu64 rather than PRId64
    - contrib/plugins/hotblocks: Fix off by one error in iteration
      of sorted blocks
    - contrib/plugins/hotblocks: Correctly free sorted counts list
    - contrib/plugins: Fix type conflict of GLib function pointers
    - python: drop uses of pkg_resources
    - plugins: fix cross-build using LLVM for Windows targets
    - s390x/pci: Fix endianness for zPCI BAR values

qtmir (0.8.0~git20250407.ea2f477-1+deb13u1) trixie; urgency=medium
 .
   * debian/patches:
     + Add 0009_src-modules-Add-header-for-getpid.patch. Add include for getpid()
       function.
     + Add 0002_src-modules-Re-introduce-lost-workaround-for-font-re.patch.
       Regression fix, fix arbitrary font rendering glitches. (LP:#1583088).
     + Add 0011_src-platforms-Wrap-window-activity-change-in-a-try-c.patch.
       Selecting the active window can lead to a range exception, so avoid a
       crash by wrapping this in a try-catch.
     + Add 0012_src-modules-Partial-revert-of-e73ef71622ad3202b77bf6.patch. Drop
       overzealous code when removing a window.
     + Trivial rebase of 2003_disable-benchmarks.patch.
     + Add 0022_modules-MirSurface-try-to-let-Mir-forceClose-dead-su.patch.
       Attempt at forceClosing dead surfaces.
     + Add 0031a_src-platforms-Select-GLRenderingProvider-based-on-su.patch and
       0031b_src-platforms-fix-anonymous-call-for-C-20.patch. Support Lomiri on
       Asahi Linux.
     + Add 0033_src-platforms-Do-not-composite-again-on-running-comp.patch. Don't
       crash when GRID_UNIT_PX is set to other values than 8. Fix scaling support
       in Lomiri.
     + Add 0034_src-platforms-Remove-guard-producing-dead-code-use-c.patch.
       src/platforms: Remove guard producing dead code; use caching instead.
     + Add 0035_src-platforms-Export-Xwayland-DISPLAY-to-systemd-and.patch.
       src/platforms: Export Xwayland DISPLAY to systemd and DBus.
     + Add 1001_do-not-focus-windows-on-touchdown-events.patch.
       wrappedwindowmanagementpolicy: do not focus windows on touch down events.
       Otherwise Mir will incorrectly focus the last opened window in Lomiri
       spread.

rauc (1.13-3+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-34155: Improper Signing of Plain Bundles Exceeding 2 GiB

redis (5:8.0.2-3+deb13u2) trixie-security; urgency=high
 .
   * CVE-2025-67733: RESP protocol injection via Lua error_reply. A user
     could manipulate data read by a connection by injecting CR/LF
     sequences into a Redis error reply.
   * CVE-2026-21863: Remote DoS with malformed Cluster bus message. A peer
     could send a crafted PING/PONG/MEET packet whose gossip count or
     ping-extension header exceeds the received packet length, causing
     out-of-bounds reads and a server crash.

request-tracker5 (5.0.7+dfsg-4+deb13u3) trixie-security; urgency=high
 .
   * Include missing default configuration items for security vulnerability
     fixes included in 5.0.7+dfsg-3. Namely: RestrictLinkDomains and Cipher
     in %SMIME.
   * Apply upstream patch which fixes several security vulnerabilities:
     - [CVE-2026-6841] Reflected cross-site scripting via the search "Page" URL
       parameter.
     - [CVE-2026-41073] Spreadsheet (CSV/formula) injection via ticket values
       that are exported to a spreadsheet from search results.  User-controlled
       data is not sanitized before being written to the output file, which can
       cause spreadsheet applications such as Microsoft Excel to interpret
       crafted values as formulas or macros when the file is opened.
     - [CVE-2026-41075] SQL injection via the entry_aggregator parameter in JSON
       search. An authenticated user can craft input that is incorporated into
       database queries without proper validation, potentially allowing them to
       read or modify data in the RT database.
     - [CVE-2026-41076] LDAP authentication bypass when RT is configured to
       authenticate users against an LDAP or Active Directory server. Under
       certain LDAP server configurations, an attacker may be able to
       authenticate as any LDAP-backed RT user without supplying valid
       credentials.
     - [CVE-2026-44229] Cross-site scripting via uploaded content that is served
       inline rather than as an attachment.
     - [CVE-2026-44230] Reflected cross-site scripting on search-results chart
       pages.
     - [CVE-2026-44231] Privilege escalation and information disclosure via the
       REST 2.0 user collection endpoint. A Privileged RT user can obtain
       authentication credentials belonging to other users, including
       administrators, and use those credentials to read data via RT's RSS and
       iCal feed endpoints. The same request that exposes the credentials also
       rotates them, which invalidates previously-distributed feed URLs across
       the instance.

resource-agents (1:4.16.0-3+deb13u2) trixie; urgency=medium
 .
   * debian/patches: fix bash syntax error (Closes: #1133386)

rhino (1.7.15.1-0.1~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie.
 .
 rhino (1.7.15.1-0.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * New upstream release.
     - CVE-2025-66453: High CPU usage and potential DoS when passing
       specific numbers to toFixed() (Closes: #1121953)

rlottie (0.1+dfsg-4.2+deb13u2) trixie; urgency=medium
 .
   * Fix off-by-one error in Fortify-FreeType-raster.patch.
   * Add Fixed-vpath-potential-issue.patch to fix CVE-2026-47319.
     (Closes: #1138919)
   * Add Limit-recursion-in-LOTLayerItem.patch to fix CVE-2026-47320.
     (Closes: #1138920)
   * New Fixed-signed-shift-issue.patch probably fixes CVE-2026-10305.
     (Closes: #1139179)
   * New Fix-heap-buffer-overflow-from-short-truncation.patch.

roundcube (1.6.16+dfsg-0+deb13u1) trixie-security; urgency=high
 .
   * New upstream security and bugfix release (closes: #1137507).
     + Fix CVE-2026-48842: pre-auth SQL injection in `virtuser_query plugin`
       via `preg_replace()` backslash escape bypass.
     + Fix CVE-2026-48843: SSRF bypass via specific local address URLs.  Add
       support non quad-dotted IPs and non-decimal fields to
       d/p/Avoid-dependency-on-new-package-mlocati-ip-lib.patch in order to
       match the new upstream behavior.
     + Fix CVE-2026-48844: Code injection vulnerability via code evaluation
       support in LDAP autovalues option.  Code evaluation support has now been
       removed.
     + Fix CVE-2026-48845: Local/private URL fetch bypass when remote resources
       were not allowed.
     + Fix CVE-2026-48846: Bypass of remote image blocking via CSS `var()`.
     + Fix CVE-2026-48847: Pre-auth arbitrary file delete via redis/memcache
       session poisoning bypass.
     + Fix CVE-2026-48848: CSS injection bypass in HTML sanitizer via SVG
       <animate attributeName="style">.
     + Fix CVE-2026-48849: Stored XSS/HTML/CSS injection in subject field of
       the draft restore dialog.
     + Fix PHP8 warnings.
     + Fix potential too long value in IMAP ID command.
   * Refresh d/patches.
roundcube (1.6.15+dfsg-1) unstable; urgency=high
 .
   * New upstream security and bugfix release (closes: #1132268).
     + Fix SVG animate FUNCIRI attribute bypass (remote image loading via
       fill/filter/stroke).
     + Fix regression where mail search would fail on non-ascii search
       criteria.
     + Fix regression where some data url images could get ignored/lost.
   * Refresh d/patches and remove those applied upstream.
   * d/control: Add Build-Depends: node-source-map.
   * Improve custom patch to avoid dependency on mlocati/ip-lib:
     + Trim leading zeros from the decimal representation of IPv4 octets to
       match GuzzleHTTP's mangling of invalid IP addresses.
     + Treat IPv4-mapped and IPv4-compatible addresses as belonging to the
       local range when the v4 address is also local.

rsync (3.4.1+ds1-5+deb13u4) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Import upstream patch to reject overlong HTTP proxy response lines,
     avoiding a one byte out of bounds stack write when using RSYNC_PROXY.
     (CVE-2026-45232).
rsync (3.4.1+ds1-5+deb13u3) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Address several vulnerabilities
     - CVE-2026-29518: Symlink-race TOCTOU in daemon (use chroot = no)
     - CVE-2026-43617: Authorization bypass via hostname resolution (daemon
       chroot mode)
     - CVE-2026-43618: Integer overflow in compressed-token decoder (info
       disclosure)
     - CVE-2026-43619: Symlink-race conditions in path-based syscalls
     - CVE-2026-43620: Out-of-bounds array read in receiver recv_files()
   * d/t/upstream-tests: Build t_chmod_secure and t_secure_relpath

rtl-433 (25.02-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2025-34450: Buffer overflow in parse_rfraw()
     (Closes: #1126178)

ruby-css-parser (1.19.0-1+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * Import upstream patch to stop disabling HTTPS certificate verification
     when loading remote CSS. (CVE-2026-44312)

rust-time (0.3.37-1+deb13u1) trixie; urgency=medium
 .
   * Backport upstream fix for CVE-2026-25727 (Closes: #1128404)

samba (2:4.22.10+dfsg-0+deb13u1) trixie; urgency=medium
 .
   * switch to actual upstream release for the May-2026 security fixes:
 .
   * This is a security release in order to address the following defects:
 .
     CVE-2026-1933: Missing access checks on reparse point operations
       On a share marked "read only = yes" and on file handles opened R/O users
       can set or delete the reparse point xattrs on files that the user has
       write-access in the file system for.
       https://www.samba.org/samba/security/CVE-2026-1933.html
 .
     CVE-2026-2340: WORM vfs module does not block overwrites
       The WORM (Write-Once, Read Many) vfs module is supposed to lock write
       access to shared files, so they cannot be altered after initial writes.
       It was allowing files to be overwritten by renaming a newly created file
       over a protected file.
       https://www.samba.org/samba/security/CVE-2026-2340.html
 .
     CVE-2026-3012: auto-enrolment GPO installing CA certificate over http
       without verification
       To bootstrap a certificate chain a domain member must fetch a certificate
       without TLS. It was trusting HTTP for this when a more secure encrypted
       LDAP channel was also available.
       https://www.samba.org/samba/security/CVE-2026-3012.html
 .
     CVE-2026-3238: Denial of service against AD DC WINS server
       The WINS server component of the Active Directory Domain controller code
       in Samba is vulnerable to a NULL pointer dereference and crash caused by
       an unauthenticated UDP packet.
       https://www.samba.org/samba/security/CVE-2026-3238.html
 .
     CVE-2026-4408: Unauthenticated Remote Code Execution in Samba DCE/RPC
       SAMR server
       Samba file servers and classic (non-AD) domain controllers with
       samba-dcerpcd started as a system service and with a "check password
       script" that has the %u substitution character are vulnerable to a
       remote code execution.
       https://www.samba.org/samba/security/CVE-2026-4408.html
 .
     CVE-2026-4480: Unauthenticated Remote Code Execution in Samba
       printing subsystem
       Samba print servers with a "print command" that has the %J substitution
       character are vulnerable to a Remote Code Execution.
       https://www.samba.org/samba/security/CVE-2026-4480.html
samba (2:4.22.8+dfsg-0+deb13u2) trixie-security; urgency=medium
 .
   * https://bugzilla.samba.org/show_bug.cgi?id=16018
     May-2026 samba security update fixing the following issues:
     CVE-2026-1933: Missing access check on reparse point operations
       https://bugzilla.samba.org/show_bug.cgi?id=15992
     CVE-2026-2340: vfs_worm does not block directory modification
       https://bugzilla.samba.org/show_bug.cgi?id=15997
     CVE-2026-3012: group policy certificate enrollment uses http://
       without validation
       https://bugzilla.samba.org/show_bug.cgi?id=16003
     CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server
       https://bugzilla.samba.org/show_bug.cgi?id=16012
     CVE-2026-4480: Unauthenticated Remote Code Execution using print command
       https://bugzilla.samba.org/show_bug.cgi?id=16033
     CVE-2026-4408: Remote Code Execution in SAMR when check password script
       contains %u substitution placeholder
       https://bugzilla.samba.org/show_bug.cgi?id=16034

shim (16.1-2~deb13u1) trixie; urgency=medium
 .
   * Backport new shim release to trixie
     + Needed so we have a new shim signed with both Microsoft UEFI
       Root CAs
   * Disable NX for the trixie build
     + We don't have a complete NX boot chain here.
   * Also switch to using the default version of gcc in trixie
shim (16.1-2~deb12u1) bookworm; urgency=medium
 .
   [ Steve McIntyre ]
   * Backport new shim release to bookworm
     + Needed so we have a new shim signed with both Microsoft UEFI
       Root CAs
   * Disable NX for the bookworm build
     + We don't have a complete NX boot chain here.
   * Also switch to using the default version of gcc in bookworm
shim (16.1-1) unstable; urgency=medium
 .
   * New upstream release: 16.1
   * Switch to gcc-14
   * Drop old patches, no longer needed
     + 0001-sbat-Add-grub.peimage-2-to-latest-CVE-2024-2312.patch
     + 0002-sbat-Also-bump-latest-for-grub-4-and-to-todays-date.patch
   * Add new patch from upstream:
     + 0001-Fix-build-with-binutils-2.46.patch. Closes: #1125741
   * Add lintian overrides:
     + Ignore included binaries for unit tests
   * Bump SBAT revocation level to 2024040900 aka
     "shim,4\ngrub,4\ngrub.peimage,2\n"
   * Enable NX for the sid/forky build
     + We should have a complete NX boot chain now...

shim-helpers-amd64-signed (1+16.1+2~deb13u1) trixie; urgency=medium
 .
   * Update to shim 16.1-2~deb13u1
shim-helpers-amd64-signed (1+16.1+2~deb12u1) bookworm; urgency=medium
 .
   * Update to shim 16.1-2~deb12u1
shim-helpers-amd64-signed (1+16.1+1) unstable; urgency=medium
 .
   * Update to shim 16.1-1

shim-helpers-arm64-signed (1+16.1+2~deb13u1) trixie; urgency=medium
 .
   * Update to shim 16.1-2~deb13u1
shim-helpers-arm64-signed (1+16.1+2~deb12u1) bookworm; urgency=medium
 .
   * Update to shim 16.1-2~deb12u1
shim-helpers-arm64-signed (1+16.1+1) unstable; urgency=medium
 .
   * Update to shim 16.1-1

shim-signed (1.51~1+deb13u1) trixie; urgency=medium
 .
   * Signed versions of the 16.1-2~deb13u1 shim build for trixie
   * Update build-dep to use 16.1-2~deb13u1
shim-signed (1.51~1+deb12u1) bookworm; urgency=medium
 .
   * Signed versions of the 16.1-2~deb12u1 shim build for bookworm
   * Update build-dep to use 16.1-2~deb12u1
shim-signed (1.50) unstable; urgency=medium
 .
   * Fix up stupid omission in the previous package upload - the
     changes in 1.49 did not take into account the "SecureBoot enabled"
     case when adding a default error trap. Closes: #1137098, #1137101.
shim-signed (1.49) unstable; urgency=medium
 .
   * Make mokutil parsing more robust. Closes: #1137063
     + Cope with "Platform is in Setup Mode" message
     + If we get any other unexpected output, print what we got for debugging.
shim-signed (1.48) unstable; urgency=medium
 .
   * Add support for verifying and then combining signatures from
     multiple signed shims.
     + Existing sbverify versions in Debian are buggy when verifying.
     + Switch to using a python script verify_combine_sigs to fill in
       the gaps.
   * In preinst, try to verify that the signed shim we're trying to
     install will actually boot on this system - let's not break
     systems on upgrade.
   * We now include a dual-signed shim including the 2023 CA.
     Closes: #1112197
   * The shim included is now NX-capable. Closes: #1064102

skanpage (25.04.2-1+deb13u1) trixie; urgency=medium
 .
   * CVE-2025-55174 (Closes: #1121443)

smartdns (46.1+dfsg-1.1~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie.
 .
 smartdns (46.1+dfsg-1.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-1425: Stack buffer overflow in DNS SVCB/HTTPS record parsing
     (Closes: #1126538)

sogo (5.12.1-3+deb13u2) trixie-security; urgency=medium
 .
   * Non-maintainer upload.
 .
   [ Peter Wienemann ]
   * Add patch to fix CVE-2026-46445 and CVE-2026-46446:
     - CVE-2026-46445: SQL injection vulnerability when at least one user
       source is a PostgreSQL database
     - CVE-2026-46446: SQL injection vulnerability when at least one user
       source is an SQL database (MariaDB or PostgreSQL) and passwords are
       stored in plain text
   * Add patch to fix CVE-2025-71276: (Closes: #1131605)
     XSS with events, tasks and contacts categories
   * Add patch to fix CVE-2026-3054: (Closes: #1130878)
     XSS via manipulation of the argument hint
   * Add patch to fix CVE-2026-33550: (Closes: #1131606)
     TOTP vulnerabilities:
     - If a user disables/enables it, it is not renewed.
     - Length is too short (12 rather than recommended 20).
   * Add patch to fix CVE-2026-8496:
     A maliciously crafted ICS calendar invitation file allows arbitrary
     JavaScript execution within the authenticated SOGo webmail session.
   * Add patch to fix a regression introduced by fix for CVE-2026-8496
   * Add patch to fix CVE-2026-8851:
     SQL injection vulnerability in the access control list
     management functionality that allows authenticated users to extract
     arbitrary data from the database by injecting SQL subqueries through
     the uid parameter of the addUserInAcls endpoint.
   * Add patch to fix folder path in fix for CVE-2026-8851
   * Add patch to fix openid validation:
     Verify that the returned email domain is authorized and that the
     user exists in the local source.
   * Add two patches to fix XSS in message subject rendering
   * Add three patches to fix message rendering
 .
   [ Jordi Mallach ]
   * Add upstream patch to fix impersonation issues when importing events.

spip (4.4.15+dfsg-0+deb13u1) trixie-security; urgency=medium
 .
   [ David Prévot ]
   * Document CVE in previouss changelog entry
 .
   [ Matthieu Marcillaud ]
   * build: Ajout du polyfill PHP 8.5
   * build: update dependencies
   * build: Version 4.4.15
     + Fix remote code execution vulnerability in the private space
       [CVE-2026-8429]
     + Fix remote code execution vulnerability in the public space that is
       limited to certain nginx configurations [CVE-2026-8430]
spip (4.4.14+dfsg-1) unstable; urgency=medium
 .
   [ David Prévot ]
   * Document CVE in previouss changelog entry
   * Update mutualisation to 2.0.1
   * Update standards version to 4.7.4, no changes needed.
 .
   [ Matthieu Marcillaud ]
   * build: Ajout du polyfill PHP 8.5
   * build: update dependencies
   * build: Version 4.4.14
spip (4.4.13+dfsg-1) unstable; urgency=medium
 .
   [ Matthieu Marcillaud ]
   * build: Version 4.4.13

squid (6.13-2+deb13u2) trixie-security; urgency=medium
 .
   * CVE-2026-33515
   * CVE-2026-33526
   * CVE-2026-47729
   * CVE-2026-50012

squirrel3 (3.1-8.2+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2021-41556: Sandbox Escape (Closes: #1016212)

sshfs-fuse (3.7.3-1.2~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie
 .
 sshfs-fuse (3.7.3-1.2) unstable; urgency=high
 .
   * Non-maintainer upload.
   * add contain_symlinks option to prevent symlink escape attacks
     (CVE-2026-47187) (Closes: #1138293)
   * reject hostname option injection via bracketed mount source (CVE-2026-48711)
     (Closes: #1138293)
sshfs-fuse (3.7.3-1.2~deb12u1) bookworm; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for bookworm
 .
 sshfs-fuse (3.7.3-1.2) unstable; urgency=high
 .
   * Non-maintainer upload.
   * add contain_symlinks option to prevent symlink escape attacks
     (CVE-2026-47187) (Closes: #1138293)
   * reject hostname option injection via bracketed mount source (CVE-2026-48711)
     (Closes: #1138293)

starlette (0.46.1-3+deb13u2) trixie-security; urgency=medium
 .
   * CVE-2026-48710 (Closes: #1137375)

starman (0.4018-0+deb13u1) trixie; urgency=medium
 .
   [ gregor herrmann ]
   * Import upstream version 0.4018.
     - Fix HTTP request smuggling: Transfer-Encoding now takes precedence
       over Content-Length per RFC 7230 §3.3.3 (CVE-2026-40560)
     Closes: #1135229

strongswan (6.0.1-6+deb13u6) trixie-security; urgency=medium
 .
   * d/patches: add fix for double-free when cloning empty IDs (CVE-2026-47895)

swift (2.35.1-0+deb13u2) trixie-security; urgency=medium
 .
   * CVE-2026-49017: Swift proxy-server denial of service via truncated s3api
     chunked upload. Applied upstream patch: "s3api: Error on truncated
     aws-chunked input" (Closes: #1138170).

symfony (6.4.41+dfsg-0+deb13u1) trixie-security; urgency=medium
 .
   [ Fabien Potencier ]
   * Update VERSION for 6.4.41
 .
   [ Nicolas Grekas ]
   * [HtmlSanitizer] Reject BiDi override characters and percent-encode spaces
     in URLs [CVE-2026-45064]
   * [MonologBridge] Bind server:log to localhost by default [CVE-2026-45077]
   * [Yaml] Bound recursion depth in the parser [CVE-2026-45133]
   * [TwigBridge] Fix XSS issue in CodeExtension::fileExcerpt() [CVE-2026-45072]
   * [Cache] Validate the prefix given to AbstractAdapter::clear()
     [CVE-2026-45073]
   * [Yaml] Bound collection-alias resolution in the parser [CVE-2026-45304]
   * [Yaml] Harden the Parser::cleanup() regexes against catastrophic
     backtracking [CVE-2026-45305]
   * [Runtime] Fix CVE-2024-50340 patch bypass by gating argv on
     $_SERVER['QUERY_STRING'] [CVE-2026-46626]
   * [HttpClient] Block IPv6 transition forms in NoPrivateNetworkHttpClient
     [CVE-2026-48736]
   * [HttpFoundation] Block IPv6 transition forms in IpUtils::PRIVATE_SUBNETS
     [CVE-2026-48736]
   * [HtmlSanitizer] Reject percent-encoded BiDi marks and Unicode whitespace
      in URLs [CVE-2026-48760]
   * [HtmlSanitizer] Sanitize URL attributes on <object>, <applet>, <iframe>,
     <img>, and the URL inside <meta http-equiv="refresh"> content
     [CVE-2026-48761]
   * [Routing] Fix dot-segment encoding for chained "../" and "./" in generated
     URLs [CVE-2026-48784]
   * [Security] Don't honor user-supplied _failure_path on failure_forward
     [CVE-2026-48489]
 .
   [ Alexandre Daubois ]
   * [Routing] Fix regex alternation anchoring in UrlGenerator requirement
     validation [CVE-2026-45065]
   * [DomCrawler] Fix XXE in addXmlContent() by not enabling `validateOnParse`
     [CVE-2026-45071]
   * [HtmlSanitizer] Fix allowLinkHosts/allowMediaHosts bypass via URL parser
     differentials and <area> misclassification [CVE-2026-45066]
   * [Security] Add missing claims in `OidcTokenHandler` [CVE-2026-45069]
   * [Security] Anchor emailAddress regex to RDN boundary in X509Authenticator
     [CVE-2026-45063]
   * [Mime] Reject email addresses containing line breaks in Address
     [CVE-2026-45067]
   * [Mailer] Add end-of-options separator before recipients in
     SendmailTransport; reject addresses starting with a dash [CVE-2026-45068]
   * [Mailer][Mailjet] Reject webhooks with missing or invalid Basic credentials
     [CVE-2026-45754]
symfony (6.4.40+dfsg-0+deb13u1) trixie-security; urgency=medium
 .
   [ Fabien Potencier ]
   * Update VERSION for 6.4.40
 .
   [ Nicolas Grekas ]
   * [HtmlSanitizer] Reject BiDi override characters and percent-encode spaces
     in URLs [CVE-2026-45064]
   * [MonologBridge] Bind server:log to localhost by default [CVE-2026-45077]
   * [Yaml] Bound recursion depth in the parser [CVE-2026-45133]
   * [TwigBridge] Fix XSS issue in CodeExtension::fileExcerpt() [CVE-2026-45072]
   * [Cache] Validate the prefix given to AbstractAdapter::clear()
     [CVE-2026-45073]
   * [Yaml] Bound collection-alias resolution in the parser [CVE-2026-45304]
   * [Yaml] Harden the Parser::cleanup() regexes against catastrophic
     backtracking [CVE-2026-45305]
   * [Runtime] Fix CVE-2024-50340 patch bypass by gating argv on
     $_SERVER['QUERY_STRING'] [CVE-2026-46626]
 .
   [ Alexandre Daubois ]
   * [Routing] Fix regex alternation anchoring in UrlGenerator requirement
     validation [CVE-2026-45065]
   * [DomCrawler] Fix XXE in addXmlContent() by not enabling `validateOnParse`
     [CVE-2026-45071]
   * [HtmlSanitizer] Fix allowLinkHosts/allowMediaHosts bypass via URL parser
     differentials and <area> misclassification [CVE-2026-45066]
   * [Security] Add missing claims in `OidcTokenHandler` [CVE-2026-45069]
   * [Security] Anchor emailAddress regex to RDN boundary in X509Authenticator
     [CVE-2026-45063]
   * [Mime] Reject email addresses containing line breaks in Address
     [CVE-2026-45067]
   * [Mailer] Add end-of-options separator before recipients in
     SendmailTransport; reject addresses starting with a dash [CVE-2026-45068]
   * [Mailer][Mailjet] Reject webhooks with missing or invalid Basic credentials
     [CVE-2026-45754]
symfony (6.4.25+dfsg-1) unstable; urgency=medium
 .
   [ Fabien Potencier ]
   * Update VERSION for 6.4.25
 .
   [ David Prévot ]
   * Remove Rules-Requires-Root
   * Use --include-path instead of --include for phpunit
   * PHPunit 12 compatibility
symfony (6.4.24+dfsg-1) unstable; urgency=medium
 .
   [ Fabien Potencier ]
   * Update VERSION for 6.4.24
 .
   [ David Prévot ]
   * Skip another failing test on reproducible infrastructure
   * Fix test failure with libxml 2.14.x (Closes: #1107547)

thunderbird (1:140.12.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security
thunderbird (1:140.12.0esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * Rebuild for bookworm-security
thunderbird (1:140.11.0esr-1) unstable; urgency=medium
 .
   * [3d3d128] New upstream version 140.11.0esr
     Fixed CVE issues in upstream version 140.11 (MFSA 2026-51):
     CVE-2026-8946: Incorrect boundary conditions in the Audio/Video: Web
                    Codecs component
     CVE-2026-8388: Incorrect boundary conditions in the JavaScript Engine: JIT
                    component
     CVE-2026-8947: Use-after-free in the DOM: Bindings (WebIDL) component
     CVE-2026-8391: Other issue in the JavaScript Engine component
     CVE-2026-8401: Sandbox escape in the Profile Backup component
     CVE-2026-8949: Integer overflow in the Widget: Win32 component
     CVE-2026-8950: Same-origin policy bypass in the Networking: HTTP component
     CVE-2026-8953: Sandbox escape due to use-after-free in the Disability
                    Access APIs component
     CVE-2026-8954: Incorrect boundary conditions, integer overflow in the
                    Audio/Video component
     CVE-2026-8955: Privilege escalation in the DOM: Workers component
     CVE-2026-8956: Integer overflow in the Networking: JAR component
     CVE-2026-8957: Privilege escalation in the Enterprise Policies component
     CVE-2026-8958: Information disclosure, sandbox escape in the Security:
                    Process Sandboxing component
     CVE-2026-8959: Sandbox escape due to incorrect boundary conditions in the
                    Widget: Win32 component
     CVE-2026-8961: Spoofing issue in the Form Autofill component
     CVE-2026-8962: Mitigation bypass in the DOM: Security component
     CVE-2026-8968: Denial-of-service due to invalid pointer in the
                    Audio/Video: Web Codecs component
     CVE-2026-8970: Privilege escalation in the Security component
     CVE-2026-8974: Memory safety bugs fixed in Thunderbird 140.11 and
                    Thunderbird 151
     CVE-2026-8975: Memory safety bugs fixed in Thunderbird 140.11 and
                    Thunderbird 151
   * [19ff1a5] rebuild patch queue from patch-queue branch
     modified patches:
     fixes/Fix-conflicting-types-for-once_flag-and-call_once-with-gl.patch
thunderbird (1:140.11.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security
thunderbird (1:140.11.0esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * Rebuild for bookworm-security
thunderbird (1:140.10.2esr-1) unstable; urgency=medium
 .
   * [6ae05c1] New upstream version 140.10.2esr
     Fixed CVE issues in upstream version 140.10.2 (MFSA 2026-44):
     CVE-2026-8090: Use-after-free in the DOM: Networking component
     CVE-2026-8094: Other issue in the WebRTC component
     CVE-2026-8092: Memory safety bugs fixed in Thunderbird ESR 140.10.2 and
                    Thunderbird 150.0.2
thunderbird (1:140.10.2esr-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security
thunderbird (1:140.10.2esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * Rebuild for bookworm-security
thunderbird (1:140.10.1esr-1) unstable; urgency=medium
 .
   * [f774578] New upstream version 140.10.1esr
     Fixed CVE issues in upstream version 140.10.1 (MFSA 2026-39):
     CVE-2026-7320: Information disclosure due to incorrect boundary conditions
                    in the Audio/Video component
     CVE-2026-7321: Sandbox escape due to incorrect boundary conditions in the
                    WebRTC: Networking component
     CVE-2026-7322: Memory safety bugs fixed in Thunderbird ESR 140.10.1 and
                    Thunderbird 150.0.1
     CVE-2026-7323: Memory safety bugs fixed in Thunderbird ESR 140.10.1 and
                    Thunderbird 150.0.1

tigervnc (1.15.0+dfsg-2.1~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie.
 .
 tigervnc (1.15.0+dfsg-2.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-34352: Prevent other users reading x0vncserver screen
     (Closes: #1132166)

tomcat10 (10.1.55-1~deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 10.1.55.
     - Fixes the following security vulnerabilities identified as
       CVE-2026-41284, CVE-2026-41293, CVE-2026-42498, CVE-2026-43512,
       CVE-2026-43513, CVE-2026-43514, CVE-2026-43515, CVE-2026-34500,
       CVE-2026-34487, CVE-2026-34483, CVE-2026-32990, CVE-2026-29146,
       CVE-2026-29145, CVE-2026-29129, CVE-2026-25854, CVE-2026-24880
   * Refresh the patches.
   * New build dependency on Bouncy Castle.
tomcat10 (10.1.55-1~deb12u1) bookworm-security; urgency=medium
 .
   * New upstream version 10.1.55.
     - Fixes the following security vulnerabilities identified as
       CVE-2026-41284, CVE-2026-41293, CVE-2026-42498, CVE-2026-43512,
       CVE-2026-43513, CVE-2026-43514, CVE-2026-43515, CVE-2026-34500,
       CVE-2026-34487, CVE-2026-34483, CVE-2026-32990, CVE-2026-29146,
       CVE-2026-29145, CVE-2026-29129, CVE-2026-25854, CVE-2026-24880
   * Refresh the patches.
   * New build dependency on Bouncy Castle.
tomcat10 (10.1.54-1) unstable; urgency=medium
 .
   * New upstream release
     - Refreshed the patches
     - New build dependency on Bouncy Castle
tomcat10 (10.1.52-2) unstable; urgency=medium
 .
   * Drop tomcat10 server packages because only one Tomcat version is supported
     per release. Only retain libtomcat10-java because of compatibility reasons
     for now. Users are strongly encouraged to switch to Tomcat 11 instead.
   * Standards-Version updated to 4.7.4
tomcat10 (10.1.52-1) unstable; urgency=medium
 .
   * New upstream version 10.1.52.
    - Fix CVE-2025-61795: denial-of-service (Closes: #1119294)
    - Fix CVE-2025-48989: "made you reset attack" (Closes: #1111096)
   * Declare compliance with Debian Policy 4.7.3.
   * Refresh the patches.

tomcat11 (11.0.22-1~deb13u1) trixie-security; urgency=medium
 .
   * Backport 11.0.22 to trixie.
     - Fixes the following security vulnerabilities identified as
       CVE-2026-41284, CVE-2026-41293, CVE-2026-42498, CVE-2026-43512,
       CVE-2026-43513, CVE-2026-43514, CVE-2026-43515, CVE-2026-34500,
       CVE-2026-34487, CVE-2026-34483, CVE-2026-32990, CVE-2026-29146,
       CVE-2026-29145, CVE-2026-29129, CVE-2026-25854, CVE-2026-24880
       and CVE-2026-24734.
tomcat11 (11.0.21-1) unstable; urgency=medium
 .
   * New upstream release
     - Refreshed the patches
     - New build dependency on Bouncy Castle
tomcat11 (11.0.18-1) unstable; urgency=medium
 .
   * New upstream version 11.0.18.
   * Refresh all patches.
   * Declare compliance with Debian Policy 4.7.3.
tomcat11 (11.0.15-1) unstable; urgency=medium
 .
   * New upstream release
     - Refreshed the patches
   * Converted debian/watch to version 5 format

tor (0.4.9.11-0+deb13u1) trixie-security; urgency=medium
 .
   * Upload 0.4.9.11 to debian-security, fixing several denial of
     service issues.  Consult the upstream changelog for details.
tor (0.4.9.11-0+deb12u1) bookworm-security; urgency=medium
 .
   * Upload 0.4.9.11 to debian-security, fixing several denial of
     service issues.  Consult the upstream changelog for details.
   * Keep systemd files in /lib (as opposed to /usr/lib)
tor (0.4.9.9-1) unstable; urgency=medium
 .
   * New upstream version.
tor (0.4.9.9-1~bpo13+1) trixie-backports; urgency=medium
 .
   * Rebuild for trixie-backports.
tor (0.4.9.9-1~bpo12+1) bookworm-backports-sloppy; urgency=medium
 .
   * Rebuild for bookworm-backports-sloppy.
   * Keep systemd files in /lib (as opposed to /usr/lib)
tor (0.4.9.8-1) unstable; urgency=medium
 .
   [ Jérôme Charaoui ]
   * New upstream version.
 .
   [ Peter Palfrader ]
   * Update the apparmor profile to allow tor reading everything below
     /etc/tor/, not just at the top level.  Thanks to alexey.
     Re: #888728.
tor (0.4.9.8-1~bpo13+1) trixie-backports; urgency=medium
 .
   * Rebuild for trixie-backports.
tor (0.4.9.8-1~bpo12+1) bookworm-backports-sloppy; urgency=medium
 .
   * Rebuild for bookworm-backports-sloppy.
   * Keep systemd files in /lib (as opposed to /usr/lib)

unbound (1.22.0-2+deb13u3) trixie-security; urgency=medium
 .
   * May-2026 security updates in debian/patches/26-05/ subdir:
     01-Use-the-same-EDE-removal-logic-when-encoding-errors.patch
       this change was part of 1.25 release, it is a slight change in behaviour
       implemented after 1.22.0 release.  This change is not necessary for the
       security update, but it makes subsequent changes in this area to apply.
     02-CVE-2026-33278-Possible-RCU-in-DNSSEC-validation.patch
     03-CVE-2026-42944-Heap-overflow-multiple-nsid-cookie-padding.patch
     04-CVE-2026-42959-Crash-DNSSEC-validation-of-malicious-content.patch
     05-CVE-2026-32792-Packet-of-death-with-DNSCrypt.patch
     06-CVE-2026-40622-Ghost-domain-name-variant.patch
        (patch edited, expanded TTL_IS_EXPIRED() macro not present in 1.22)
     07-CVE-2026-41292-Parsing-a-long-list-of-incoming-EDNS-options.patch
     08-CVE-2026-42534-Jostle-logic-bypass-degrades-performance.patch
     09-CVE-2026-42923-Degradation-of-service-unbouded-NSEC-hash-calc.patch
     10-CVE-2026-42960-Possible-cache-poisoning-following-delegation.patch
     11-CVE-2026-44390-Unbounded-name-compression.patch
     12-CVE-2026-44608-UAF-in-RPZ-code.patch
     13-Unit-test-for-CVE-2026-33278.patch
     14-Unit-test-for-CVE-2026-42944.patch
     15-Unit-test-for-CVE-2026-42959.patch
     16-Unit-test-for-CVE-2026-40622.patch
     17-Unit-test-for-CVE-2026-42960.patch
     (Closes: #1137187)

varnish (7.7.0-3+deb13u1) trixie-security; urgency=medium
 .
   * Backport the fix for the VSV00019 request smuggling vulnerability.
   * Backport the fix for the VSV00017 denial of service vulnerability
     (CVE-2025-8671).
   * Use Type=forking again for varnishncsa.service, or else a reload
     would kill the program. (See: #1118046)
   * Update debian/watch and debian/control for Vinyl Cache.

vitrage (14.0.0-4+deb13u1) trixie; urgency=medium
 .
   * CVE-2026-28370 / OSSA-2026-003: Remote code execution through Vitrage query
     parser. Applied upstream patch "Replace eval with function matching".
     (Closes: #1139452)

wireless-regdb (2026.05.30-1~deb13u1) trixie; urgency=medium
 .
   * Rebuild for trixie
 .
 wireless-regdb (2026.05.30-1) unstable; urgency=medium
 .
   * New upstream version:
     - Add regulatory info for CEPT countries FO, GI, IM, SM and VA listed by
       WiFi Alliance
     - Update 6 GHz rules for Hong Kong (HK)
     - Update 5/6 GHz power rules for Russia (RU)
     - Fix 60 GHz power unit for Ukraine (UA)
     - Update 6 GHz rules for South Africa (ZA)
     - Update 6 GHz rules for South Korea (KR)
     - allow 320MHz channel width for Russia
     - Update regulatory info for Brunei Darussalam (BN) for 2022
     - Update regulatory rules for Sri Lanka (LK)
 .
 wireless-regdb (2026.03.18-1) unstable; urgency=medium
 .
   * New upstream version:
     - Update regulatory rules for India (IN) on 6GHz
wireless-regdb (2026.05.30-1~deb12u1) bookworm; urgency=medium
 .
   * Rebuild for bookworm
 .
 wireless-regdb (2026.05.30-1) unstable; urgency=medium
 .
   * New upstream version:
     - Add regulatory info for CEPT countries FO, GI, IM, SM and VA listed by
       WiFi Alliance
     - Update 6 GHz rules for Hong Kong (HK)
     - Update 5/6 GHz power rules for Russia (RU)
     - Fix 60 GHz power unit for Ukraine (UA)
     - Update 6 GHz rules for South Africa (ZA)
     - Update 6 GHz rules for South Korea (KR)
     - allow 320MHz channel width for Russia
     - Update regulatory info for Brunei Darussalam (BN) for 2022
     - Update regulatory rules for Sri Lanka (LK)
 .
 wireless-regdb (2026.03.18-1) unstable; urgency=medium
 .
   * New upstream version:
     - Update regulatory rules for India (IN) on 6GHz
wireless-regdb (2026.03.18-1) unstable; urgency=medium
 .
   * New upstream version:
     - Update regulatory rules for India (IN) on 6GHz
wireless-regdb (2026.02.04-1) unstable; urgency=medium
 .
   [ Ben Hutchings ]
   * New upstream version:
     - Update regulatory info for Australia (AU) for 2025
     - Update broken link in regulatory.bin(5) manpage
     - Update regulatory info for Malaysia (MY) for 2024
     - Update regulatory info for Malaysia (MY) for 2025
     - Update regulatory info for Tunisia (TN) on 6GHz for 2025
     - Update regulatory info for Canada (CA) for 2025
   * d/rules: Install regulatory.db under /usr without dh_movetousr
     (Closes: #1122785)
   * d/README.Debian: Remove minimum kernel version for direct-loading
   * Add support and documentation for setting default regulatory domain
 .
   [ Bastian Germann ]
   * Drop unnecessary B-D m2crypto (Closes: #1126431)

wireshark (4.4.16-0+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * New upstream release.
     - CVE-2026-9759: ROHC protocol dissector crash

xorg-server (2:21.1.16-1.3+deb13u3) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * sync: fix deletion of counters and fences (CVE-2026-50257, CVE-2026-50260)
     (Closes: #1138680)
   * sync: restart trigger list iteration in SyncChangeCounter after TriggerFired
     (CVE-2026-50261) (Closes: #1138680)
   * xkb: reject key types with num_levels exceeding XkbMaxShiftLevel
     (CVE-2026-50258) (Closes: #1138680)
   * xkb: clamp nMaps to mapWidths buffer size in CheckKeyTypes (CVE-2026-50259)
     (Closes: #1138680)
   * glx: fix reversed length check in ChangeDrawableAttributes (CVE-2026-50262)
     (Closes: #1138680)
   * saver: re-fetch screen private after CheckScreenPrivate in CreateSaverWindow
     (CVE-2026-50263) (Closes: #1138680)
   * dix: increase XLFDMAXFONTNAMELEN to match libXfont2's MAXFONTNAMELEN
     (CVE-2026-50256) (Closes: #1138680)
   * dri2: Use booleans for (fake) front buffer tracking in do_get_buffers
     (CVE-2026-50264) (Closes: #1138680)
   * dri2: Deduplicate attachments in do_get_buffer (CVE-2026-50264)
     (Closes: #1138680)

xz-utils (5.8.1-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-34743: Buffer overflow in lzma_index_append()
     (Closes: #1132497)

yelp (42.2-4+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * sandbox escape via ghelp: URIs loaded by help pages, allowing a
     malicious help document to read arbitrary files (e.g. via /proc)
     and exfiltrate them over the network (Closes: #1136299).
=======================================
Sat, 16 May 2026 - Debian 13.5 released
=======================================
=========================================================================
[Date: Sat, 16 May 2026 08:47:04 -0000] [ftpmaster: Archive Administrator]
Removed the following packages from stable:

dav4tbsync |      4.7-2 | source
webext-dav4tbsync |      4.7-2 | all
Closed bugs: 1116359

------------------- Reason -------------------
RoM; no longer required; integrated into newer Thunderbird versions
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 16 May 2026 08:52:08 -0000] [ftpmaster: Archive Administrator]
Removed the following packages from stable:

linux-headers-6.12.63+deb13-amd64 |  6.12.63-1 | amd64
linux-headers-6.12.63+deb13-cloud-amd64 |  6.12.63-1 | amd64
linux-headers-6.12.63+deb13-rt-amd64 |  6.12.63-1 | amd64
linux-headers-6.12.74+deb13+1-amd64 |  6.12.74-2 | amd64
linux-headers-6.12.74+deb13+1-cloud-amd64 |  6.12.74-2 | amd64
linux-headers-6.12.74+deb13+1-rt-amd64 |  6.12.74-2 | amd64
linux-headers-6.12.85+deb13-amd64 |  6.12.85-1 | amd64
linux-headers-6.12.85+deb13-cloud-amd64 |  6.12.85-1 | amd64
linux-headers-6.12.85+deb13-rt-amd64 |  6.12.85-1 | amd64
linux-image-6.12.63+deb13-amd64-dbg |  6.12.63-1 | amd64
linux-image-6.12.63+deb13-amd64-unsigned |  6.12.63-1 | amd64
linux-image-6.12.63+deb13-cloud-amd64-dbg |  6.12.63-1 | amd64
linux-image-6.12.63+deb13-cloud-amd64-unsigned |  6.12.63-1 | amd64
linux-image-6.12.63+deb13-rt-amd64-dbg |  6.12.63-1 | amd64
linux-image-6.12.63+deb13-rt-amd64-unsigned |  6.12.63-1 | amd64
linux-image-6.12.74+deb13+1-amd64-dbg |  6.12.74-2 | amd64
linux-image-6.12.74+deb13+1-amd64-unsigned |  6.12.74-2 | amd64
linux-image-6.12.74+deb13+1-cloud-amd64-dbg |  6.12.74-2 | amd64
linux-image-6.12.74+deb13+1-cloud-amd64-unsigned |  6.12.74-2 | amd64
linux-image-6.12.74+deb13+1-rt-amd64-dbg |  6.12.74-2 | amd64
linux-image-6.12.74+deb13+1-rt-amd64-unsigned |  6.12.74-2 | amd64
linux-image-6.12.85+deb13-amd64-dbg |  6.12.85-1 | amd64
linux-image-6.12.85+deb13-amd64-unsigned |  6.12.85-1 | amd64
linux-image-6.12.85+deb13-cloud-amd64-dbg |  6.12.85-1 | amd64
linux-image-6.12.85+deb13-cloud-amd64-unsigned |  6.12.85-1 | amd64
linux-image-6.12.85+deb13-rt-amd64-dbg |  6.12.85-1 | amd64
linux-image-6.12.85+deb13-rt-amd64-unsigned |  6.12.85-1 | amd64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 16 May 2026 08:52:37 -0000] [ftpmaster: Archive Administrator]
Removed the following packages from stable:

ata-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
ata-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
ata-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
btrfs-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
btrfs-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
btrfs-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
cdrom-core-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
cdrom-core-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
cdrom-core-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
crypto-dm-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
crypto-dm-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
crypto-dm-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
crypto-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
crypto-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
crypto-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
drm-core-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
drm-core-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
drm-core-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
ext4-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
ext4-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
ext4-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
f2fs-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
f2fs-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
f2fs-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
fat-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
fat-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
fat-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
fb-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
fb-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
fb-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
firewire-core-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
firewire-core-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
firewire-core-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
hypervisor-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
hypervisor-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
hypervisor-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
input-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
input-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
input-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
isofs-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
isofs-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
isofs-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
jfs-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
jfs-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
jfs-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
kernel-image-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
kernel-image-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
kernel-image-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
linux-headers-6.12.63+deb13-powerpc64le |  6.12.63-1 | ppc64el
linux-headers-6.12.63+deb13-powerpc64le-64k |  6.12.63-1 | ppc64el
linux-headers-6.12.74+deb13+1-powerpc64le |  6.12.74-2 | ppc64el
linux-headers-6.12.74+deb13+1-powerpc64le-64k |  6.12.74-2 | ppc64el
linux-headers-6.12.85+deb13-powerpc64le |  6.12.85-1 | ppc64el
linux-headers-6.12.85+deb13-powerpc64le-64k |  6.12.85-1 | ppc64el
linux-image-6.12.63+deb13-powerpc64le |  6.12.63-1 | ppc64el
linux-image-6.12.63+deb13-powerpc64le-64k |  6.12.63-1 | ppc64el
linux-image-6.12.63+deb13-powerpc64le-64k-dbg |  6.12.63-1 | ppc64el
linux-image-6.12.63+deb13-powerpc64le-dbg |  6.12.63-1 | ppc64el
linux-image-6.12.74+deb13+1-powerpc64le |  6.12.74-2 | ppc64el
linux-image-6.12.74+deb13+1-powerpc64le-64k |  6.12.74-2 | ppc64el
linux-image-6.12.74+deb13+1-powerpc64le-64k-dbg |  6.12.74-2 | ppc64el
linux-image-6.12.74+deb13+1-powerpc64le-dbg |  6.12.74-2 | ppc64el
linux-image-6.12.85+deb13-powerpc64le |  6.12.85-1 | ppc64el
linux-image-6.12.85+deb13-powerpc64le-64k |  6.12.85-1 | ppc64el
linux-image-6.12.85+deb13-powerpc64le-64k-dbg |  6.12.85-1 | ppc64el
linux-image-6.12.85+deb13-powerpc64le-dbg |  6.12.85-1 | ppc64el
loop-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
loop-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
loop-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
md-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
md-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
md-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
mtd-core-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
mtd-core-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
mtd-core-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
multipath-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
multipath-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
multipath-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
nbd-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
nbd-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
nbd-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
nic-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
nic-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
nic-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
nic-shared-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
nic-shared-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
nic-shared-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
nic-usb-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
nic-usb-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
nic-usb-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
nic-wireless-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
nic-wireless-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
nic-wireless-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
ppp-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
ppp-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
ppp-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
sata-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
sata-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
sata-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
scsi-core-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
scsi-core-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
scsi-core-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
scsi-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
scsi-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
scsi-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
scsi-nic-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
scsi-nic-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
scsi-nic-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
serial-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
serial-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
serial-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
squashfs-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
squashfs-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
squashfs-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
udf-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
udf-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
udf-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
uinput-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
uinput-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
uinput-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
usb-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
usb-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
usb-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
usb-serial-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
usb-serial-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
usb-serial-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
usb-storage-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
usb-storage-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
usb-storage-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el
xfs-modules-6.12.63+deb13-powerpc64le-di |  6.12.63-1 | ppc64el
xfs-modules-6.12.74+deb13+1-powerpc64le-di |  6.12.74-2 | ppc64el
xfs-modules-6.12.85+deb13-powerpc64le-di |  6.12.85-1 | ppc64el

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 16 May 2026 08:53:22 -0000] [ftpmaster: Archive Administrator]
Removed the following packages from stable:

ata-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
ata-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
ata-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
btrfs-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
btrfs-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
btrfs-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
cdrom-core-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
cdrom-core-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
cdrom-core-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
crypto-dm-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
crypto-dm-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
crypto-dm-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
crypto-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
crypto-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
crypto-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
drm-core-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
drm-core-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
drm-core-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
ext4-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
ext4-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
ext4-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
f2fs-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
f2fs-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
f2fs-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
fat-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
fat-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
fat-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
fb-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
fb-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
fb-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
input-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
input-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
input-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
isofs-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
isofs-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
isofs-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
jfs-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
jfs-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
jfs-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
kernel-image-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
kernel-image-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
kernel-image-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
linux-headers-6.12.63+deb13-riscv64 |  6.12.63-1 | riscv64
linux-headers-6.12.74+deb13+1-riscv64 |  6.12.74-2 | riscv64
linux-headers-6.12.85+deb13-riscv64 |  6.12.85-1 | riscv64
linux-image-6.12.63+deb13-riscv64 |  6.12.63-1 | riscv64
linux-image-6.12.63+deb13-riscv64-dbg |  6.12.63-1 | riscv64
linux-image-6.12.74+deb13+1-riscv64 |  6.12.74-2 | riscv64
linux-image-6.12.74+deb13+1-riscv64-dbg |  6.12.74-2 | riscv64
linux-image-6.12.85+deb13-riscv64 |  6.12.85-1 | riscv64
linux-image-6.12.85+deb13-riscv64-dbg |  6.12.85-1 | riscv64
loop-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
loop-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
loop-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
md-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
md-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
md-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
mmc-core-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
mmc-core-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
mmc-core-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
mmc-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
mmc-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
mmc-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
mtd-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
mtd-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
mtd-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
multipath-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
multipath-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
multipath-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
nbd-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
nbd-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
nbd-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
nic-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
nic-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
nic-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
nic-shared-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
nic-shared-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
nic-shared-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
nic-usb-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
nic-usb-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
nic-usb-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
nic-wireless-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
nic-wireless-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
nic-wireless-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
pata-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
pata-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
pata-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
ppp-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
ppp-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
ppp-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
sata-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
sata-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
sata-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
scsi-core-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
scsi-core-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
scsi-core-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
scsi-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
scsi-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
scsi-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
scsi-nic-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
scsi-nic-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
scsi-nic-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
squashfs-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
squashfs-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
squashfs-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
udf-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
udf-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
udf-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
usb-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
usb-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
usb-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
usb-serial-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
usb-serial-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
usb-serial-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
usb-storage-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
usb-storage-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
usb-storage-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64
xfs-modules-6.12.63+deb13-riscv64-di |  6.12.63-1 | riscv64
xfs-modules-6.12.74+deb13+1-riscv64-di |  6.12.74-2 | riscv64
xfs-modules-6.12.85+deb13-riscv64-di |  6.12.85-1 | riscv64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 16 May 2026 08:54:45 -0000] [ftpmaster: Archive Administrator]
Removed the following packages from stable:

btrfs-modules-6.12.63+deb13-s390x-di |  6.12.63-1 | s390x
btrfs-modules-6.12.74+deb13+1-s390x-di |  6.12.74-2 | s390x
btrfs-modules-6.12.85+deb13-s390x-di |  6.12.85-1 | s390x
cdrom-core-modules-6.12.63+deb13-s390x-di |  6.12.63-1 | s390x
cdrom-core-modules-6.12.74+deb13+1-s390x-di |  6.12.74-2 | s390x
cdrom-core-modules-6.12.85+deb13-s390x-di |  6.12.85-1 | s390x
crypto-dm-modules-6.12.63+deb13-s390x-di |  6.12.63-1 | s390x
crypto-dm-modules-6.12.74+deb13+1-s390x-di |  6.12.74-2 | s390x
crypto-dm-modules-6.12.85+deb13-s390x-di |  6.12.85-1 | s390x
crypto-modules-6.12.63+deb13-s390x-di |  6.12.63-1 | s390x
crypto-modules-6.12.74+deb13+1-s390x-di |  6.12.74-2 | s390x
crypto-modules-6.12.85+deb13-s390x-di |  6.12.85-1 | s390x
dasd-extra-modules-6.12.63+deb13-s390x-di |  6.12.63-1 | s390x
dasd-extra-modules-6.12.74+deb13+1-s390x-di |  6.12.74-2 | s390x
dasd-extra-modules-6.12.85+deb13-s390x-di |  6.12.85-1 | s390x
dasd-modules-6.12.63+deb13-s390x-di |  6.12.63-1 | s390x
dasd-modules-6.12.74+deb13+1-s390x-di |  6.12.74-2 | s390x
dasd-modules-6.12.85+deb13-s390x-di |  6.12.85-1 | s390x
ext4-modules-6.12.63+deb13-s390x-di |  6.12.63-1 | s390x
ext4-modules-6.12.74+deb13+1-s390x-di |  6.12.74-2 | s390x
ext4-modules-6.12.85+deb13-s390x-di |  6.12.85-1 | s390x
f2fs-modules-6.12.63+deb13-s390x-di |  6.12.63-1 | s390x
f2fs-modules-6.12.74+deb13+1-s390x-di |  6.12.74-2 | s390x
f2fs-modules-6.12.85+deb13-s390x-di |  6.12.85-1 | s390x
fat-modules-6.12.63+deb13-s390x-di |  6.12.63-1 | s390x
fat-modules-6.12.74+deb13+1-s390x-di |  6.12.74-2 | s390x
fat-modules-6.12.85+deb13-s390x-di |  6.12.85-1 | s390x
isofs-modules-6.12.63+deb13-s390x-di |  6.12.63-1 | s390x
isofs-modules-6.12.74+deb13+1-s390x-di |  6.12.74-2 | s390x
isofs-modules-6.12.85+deb13-s390x-di |  6.12.85-1 | s390x
kernel-image-6.12.63+deb13-s390x-di |  6.12.63-1 | s390x
kernel-image-6.12.74+deb13+1-s390x-di |  6.12.74-2 | s390x
kernel-image-6.12.85+deb13-s390x-di |  6.12.85-1 | s390x
linux-headers-6.12.63+deb13-s390x |  6.12.63-1 | s390x
linux-headers-6.12.74+deb13+1-s390x |  6.12.74-2 | s390x
linux-headers-6.12.85+deb13-s390x |  6.12.85-1 | s390x
linux-image-6.12.63+deb13-s390x |  6.12.63-1 | s390x
linux-image-6.12.63+deb13-s390x-dbg |  6.12.63-1 | s390x
linux-image-6.12.74+deb13+1-s390x |  6.12.74-2 | s390x
linux-image-6.12.74+deb13+1-s390x-dbg |  6.12.74-2 | s390x
linux-image-6.12.85+deb13-s390x |  6.12.85-1 | s390x
linux-image-6.12.85+deb13-s390x-dbg |  6.12.85-1 | s390x
loop-modules-6.12.63+deb13-s390x-di |  6.12.63-1 | s390x
loop-modules-6.12.74+deb13+1-s390x-di |  6.12.74-2 | s390x
loop-modules-6.12.85+deb13-s390x-di |  6.12.85-1 | s390x
md-modules-6.12.63+deb13-s390x-di |  6.12.63-1 | s390x
md-modules-6.12.74+deb13+1-s390x-di |  6.12.74-2 | s390x
md-modules-6.12.85+deb13-s390x-di |  6.12.85-1 | s390x
mtd-core-modules-6.12.63+deb13-s390x-di |  6.12.63-1 | s390x
mtd-core-modules-6.12.74+deb13+1-s390x-di |  6.12.74-2 | s390x
mtd-core-modules-6.12.85+deb13-s390x-di |  6.12.85-1 | s390x
multipath-modules-6.12.63+deb13-s390x-di |  6.12.63-1 | s390x
multipath-modules-6.12.74+deb13+1-s390x-di |  6.12.74-2 | s390x
multipath-modules-6.12.85+deb13-s390x-di |  6.12.85-1 | s390x
nbd-modules-6.12.63+deb13-s390x-di |  6.12.63-1 | s390x
nbd-modules-6.12.74+deb13+1-s390x-di |  6.12.74-2 | s390x
nbd-modules-6.12.85+deb13-s390x-di |  6.12.85-1 | s390x
nic-modules-6.12.63+deb13-s390x-di |  6.12.63-1 | s390x
nic-modules-6.12.74+deb13+1-s390x-di |  6.12.74-2 | s390x
nic-modules-6.12.85+deb13-s390x-di |  6.12.85-1 | s390x
scsi-core-modules-6.12.63+deb13-s390x-di |  6.12.63-1 | s390x
scsi-core-modules-6.12.74+deb13+1-s390x-di |  6.12.74-2 | s390x
scsi-core-modules-6.12.85+deb13-s390x-di |  6.12.85-1 | s390x
scsi-modules-6.12.63+deb13-s390x-di |  6.12.63-1 | s390x
scsi-modules-6.12.74+deb13+1-s390x-di |  6.12.74-2 | s390x
scsi-modules-6.12.85+deb13-s390x-di |  6.12.85-1 | s390x
udf-modules-6.12.63+deb13-s390x-di |  6.12.63-1 | s390x
udf-modules-6.12.74+deb13+1-s390x-di |  6.12.74-2 | s390x
udf-modules-6.12.85+deb13-s390x-di |  6.12.85-1 | s390x
xfs-modules-6.12.63+deb13-s390x-di |  6.12.63-1 | s390x
xfs-modules-6.12.74+deb13+1-s390x-di |  6.12.74-2 | s390x
xfs-modules-6.12.85+deb13-s390x-di |  6.12.85-1 | s390x

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 16 May 2026 08:55:03 -0000] [ftpmaster: Archive Administrator]
Removed the following packages from stable:

linux-headers-6.12.63+deb13-arm64 |  6.12.63-1 | arm64
linux-headers-6.12.63+deb13-arm64-16k |  6.12.63-1 | arm64
linux-headers-6.12.63+deb13-cloud-arm64 |  6.12.63-1 | arm64
linux-headers-6.12.63+deb13-rt-arm64 |  6.12.63-1 | arm64
linux-headers-6.12.74+deb13+1-arm64 |  6.12.74-2 | arm64
linux-headers-6.12.74+deb13+1-arm64-16k |  6.12.74-2 | arm64
linux-headers-6.12.74+deb13+1-cloud-arm64 |  6.12.74-2 | arm64
linux-headers-6.12.74+deb13+1-rt-arm64 |  6.12.74-2 | arm64
linux-headers-6.12.85+deb13-arm64 |  6.12.85-1 | arm64
linux-headers-6.12.85+deb13-arm64-16k |  6.12.85-1 | arm64
linux-headers-6.12.85+deb13-cloud-arm64 |  6.12.85-1 | arm64
linux-headers-6.12.85+deb13-rt-arm64 |  6.12.85-1 | arm64
linux-image-6.12.63+deb13-arm64-16k-dbg |  6.12.63-1 | arm64
linux-image-6.12.63+deb13-arm64-16k-unsigned |  6.12.63-1 | arm64
linux-image-6.12.63+deb13-arm64-dbg |  6.12.63-1 | arm64
linux-image-6.12.63+deb13-arm64-unsigned |  6.12.63-1 | arm64
linux-image-6.12.63+deb13-cloud-arm64-dbg |  6.12.63-1 | arm64
linux-image-6.12.63+deb13-cloud-arm64-unsigned |  6.12.63-1 | arm64
linux-image-6.12.63+deb13-rt-arm64-dbg |  6.12.63-1 | arm64
linux-image-6.12.63+deb13-rt-arm64-unsigned |  6.12.63-1 | arm64
linux-image-6.12.74+deb13+1-arm64-16k-dbg |  6.12.74-2 | arm64
linux-image-6.12.74+deb13+1-arm64-16k-unsigned |  6.12.74-2 | arm64
linux-image-6.12.74+deb13+1-arm64-dbg |  6.12.74-2 | arm64
linux-image-6.12.74+deb13+1-arm64-unsigned |  6.12.74-2 | arm64
linux-image-6.12.74+deb13+1-cloud-arm64-dbg |  6.12.74-2 | arm64
linux-image-6.12.74+deb13+1-cloud-arm64-unsigned |  6.12.74-2 | arm64
linux-image-6.12.74+deb13+1-rt-arm64-dbg |  6.12.74-2 | arm64
linux-image-6.12.74+deb13+1-rt-arm64-unsigned |  6.12.74-2 | arm64
linux-image-6.12.85+deb13-arm64-16k-dbg |  6.12.85-1 | arm64
linux-image-6.12.85+deb13-arm64-16k-unsigned |  6.12.85-1 | arm64
linux-image-6.12.85+deb13-arm64-dbg |  6.12.85-1 | arm64
linux-image-6.12.85+deb13-arm64-unsigned |  6.12.85-1 | arm64
linux-image-6.12.85+deb13-cloud-arm64-dbg |  6.12.85-1 | arm64
linux-image-6.12.85+deb13-cloud-arm64-unsigned |  6.12.85-1 | arm64
linux-image-6.12.85+deb13-rt-arm64-dbg |  6.12.85-1 | arm64
linux-image-6.12.85+deb13-rt-arm64-unsigned |  6.12.85-1 | arm64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 16 May 2026 08:55:24 -0000] [ftpmaster: Archive Administrator]
Removed the following packages from stable:

linux-headers-6.12.63+deb13-rpi |  6.12.63-1 | armel
linux-headers-6.12.74+deb13+1-rpi |  6.12.74-2 | armel
linux-headers-6.12.85+deb13-rpi |  6.12.85-1 | armel
linux-image-6.12.63+deb13-rpi |  6.12.63-1 | armel
linux-image-6.12.63+deb13-rpi-dbg |  6.12.63-1 | armel
linux-image-6.12.74+deb13+1-rpi |  6.12.74-2 | armel
linux-image-6.12.74+deb13+1-rpi-dbg |  6.12.74-2 | armel
linux-image-6.12.85+deb13-rpi |  6.12.85-1 | armel
linux-image-6.12.85+deb13-rpi-dbg |  6.12.85-1 | armel

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 16 May 2026 08:55:44 -0000] [ftpmaster: Archive Administrator]
Removed the following packages from stable:

ata-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
ata-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
ata-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
btrfs-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
btrfs-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
btrfs-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
cdrom-core-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
cdrom-core-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
cdrom-core-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
crypto-dm-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
crypto-dm-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
crypto-dm-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
crypto-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
crypto-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
crypto-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
drm-core-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
drm-core-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
drm-core-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
ext4-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
ext4-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
ext4-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
f2fs-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
f2fs-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
f2fs-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
fat-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
fat-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
fat-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
fb-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
fb-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
fb-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
input-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
input-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
input-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
isofs-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
isofs-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
isofs-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
jfs-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
jfs-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
jfs-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
kernel-image-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
kernel-image-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
kernel-image-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
linux-headers-6.12.63+deb13-armmp |  6.12.63-1 | armhf
linux-headers-6.12.63+deb13-armmp-lpae |  6.12.63-1 | armhf
linux-headers-6.12.63+deb13-rt-armmp |  6.12.63-1 | armhf
linux-headers-6.12.74+deb13+1-armmp |  6.12.74-2 | armhf
linux-headers-6.12.74+deb13+1-armmp-lpae |  6.12.74-2 | armhf
linux-headers-6.12.74+deb13+1-rt-armmp |  6.12.74-2 | armhf
linux-headers-6.12.85+deb13-armmp |  6.12.85-1 | armhf
linux-headers-6.12.85+deb13-armmp-lpae |  6.12.85-1 | armhf
linux-headers-6.12.85+deb13-rt-armmp |  6.12.85-1 | armhf
linux-image-6.12.63+deb13-armmp |  6.12.63-1 | armhf
linux-image-6.12.63+deb13-armmp-dbg |  6.12.63-1 | armhf
linux-image-6.12.63+deb13-armmp-lpae |  6.12.63-1 | armhf
linux-image-6.12.63+deb13-armmp-lpae-dbg |  6.12.63-1 | armhf
linux-image-6.12.63+deb13-rt-armmp |  6.12.63-1 | armhf
linux-image-6.12.63+deb13-rt-armmp-dbg |  6.12.63-1 | armhf
linux-image-6.12.74+deb13+1-armmp |  6.12.74-2 | armhf
linux-image-6.12.74+deb13+1-armmp-dbg |  6.12.74-2 | armhf
linux-image-6.12.74+deb13+1-armmp-lpae |  6.12.74-2 | armhf
linux-image-6.12.74+deb13+1-armmp-lpae-dbg |  6.12.74-2 | armhf
linux-image-6.12.74+deb13+1-rt-armmp |  6.12.74-2 | armhf
linux-image-6.12.74+deb13+1-rt-armmp-dbg |  6.12.74-2 | armhf
linux-image-6.12.85+deb13-armmp |  6.12.85-1 | armhf
linux-image-6.12.85+deb13-armmp-dbg |  6.12.85-1 | armhf
linux-image-6.12.85+deb13-armmp-lpae |  6.12.85-1 | armhf
linux-image-6.12.85+deb13-armmp-lpae-dbg |  6.12.85-1 | armhf
linux-image-6.12.85+deb13-rt-armmp |  6.12.85-1 | armhf
linux-image-6.12.85+deb13-rt-armmp-dbg |  6.12.85-1 | armhf
loop-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
loop-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
loop-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
md-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
md-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
md-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
mmc-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
mmc-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
mmc-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
mtd-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
mtd-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
mtd-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
multipath-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
multipath-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
multipath-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
nbd-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
nbd-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
nbd-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
nic-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
nic-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
nic-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
nic-shared-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
nic-shared-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
nic-shared-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
nic-usb-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
nic-usb-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
nic-usb-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
nic-wireless-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
nic-wireless-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
nic-wireless-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
pata-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
pata-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
pata-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
ppp-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
ppp-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
ppp-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
sata-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
sata-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
sata-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
scsi-core-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
scsi-core-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
scsi-core-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
scsi-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
scsi-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
scsi-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
scsi-nic-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
scsi-nic-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
scsi-nic-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
sound-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
sound-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
sound-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
speakup-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
speakup-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
speakup-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
squashfs-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
squashfs-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
squashfs-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
udf-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
udf-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
udf-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
uinput-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
uinput-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
uinput-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
usb-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
usb-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
usb-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
usb-serial-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
usb-serial-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
usb-serial-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf
usb-storage-modules-6.12.63+deb13-armmp-di |  6.12.63-1 | armhf
usb-storage-modules-6.12.74+deb13+1-armmp-di |  6.12.74-2 | armhf
usb-storage-modules-6.12.85+deb13-armmp-di |  6.12.85-1 | armhf

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 16 May 2026 08:56:07 -0000] [ftpmaster: Archive Administrator]
Removed the following packages from stable:

ata-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
ata-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
ata-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
btrfs-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
btrfs-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
btrfs-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
cdrom-core-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
cdrom-core-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
cdrom-core-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
crypto-dm-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
crypto-dm-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
crypto-dm-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
crypto-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
crypto-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
crypto-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
drm-core-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
drm-core-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
drm-core-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
ext4-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
ext4-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
ext4-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
f2fs-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
f2fs-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
f2fs-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
fat-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
fat-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
fat-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
fb-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
fb-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
fb-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
firewire-core-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
firewire-core-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
firewire-core-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
input-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
input-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
input-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
isofs-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
isofs-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
isofs-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
jfs-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
jfs-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
jfs-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
kernel-image-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
kernel-image-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
kernel-image-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
linux-image-6.12.63+deb13-amd64 |  6.12.63-1 | amd64
linux-image-6.12.63+deb13-cloud-amd64 |  6.12.63-1 | amd64
linux-image-6.12.63+deb13-rt-amd64 |  6.12.63-1 | amd64
linux-image-6.12.74+deb13+1-amd64 |  6.12.74-2 | amd64
linux-image-6.12.74+deb13+1-cloud-amd64 |  6.12.74-2 | amd64
linux-image-6.12.74+deb13+1-rt-amd64 |  6.12.74-2 | amd64
linux-image-6.12.85+deb13-amd64 |  6.12.85-1 | amd64
linux-image-6.12.85+deb13-cloud-amd64 |  6.12.85-1 | amd64
linux-image-6.12.85+deb13-rt-amd64 |  6.12.85-1 | amd64
loop-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
loop-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
loop-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
md-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
md-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
md-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
mmc-core-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
mmc-core-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
mmc-core-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
mmc-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
mmc-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
mmc-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
mtd-core-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
mtd-core-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
mtd-core-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
multipath-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
multipath-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
multipath-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
nbd-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
nbd-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
nbd-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
nic-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
nic-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
nic-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
nic-pcmcia-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
nic-pcmcia-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
nic-pcmcia-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
nic-shared-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
nic-shared-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
nic-shared-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
nic-usb-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
nic-usb-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
nic-usb-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
nic-wireless-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
nic-wireless-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
nic-wireless-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
pata-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
pata-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
pata-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
pcmcia-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
pcmcia-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
pcmcia-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
pcmcia-storage-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
pcmcia-storage-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
pcmcia-storage-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
ppp-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
ppp-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
ppp-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
rfkill-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
rfkill-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
rfkill-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
sata-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
sata-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
sata-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
scsi-core-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
scsi-core-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
scsi-core-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
scsi-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
scsi-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
scsi-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
scsi-nic-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
scsi-nic-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
scsi-nic-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
serial-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
serial-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
serial-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
sound-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
sound-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
sound-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
speakup-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
speakup-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
speakup-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
squashfs-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
squashfs-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
squashfs-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
udf-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
udf-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
udf-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
uinput-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
uinput-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
uinput-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
usb-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
usb-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
usb-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
usb-serial-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
usb-serial-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
usb-serial-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
usb-storage-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
usb-storage-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
usb-storage-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64
xfs-modules-6.12.63+deb13-amd64-di |  6.12.63-1 | amd64
xfs-modules-6.12.74+deb13+1-amd64-di |  6.12.74-2 | amd64
xfs-modules-6.12.85+deb13-amd64-di |  6.12.85-1 | amd64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux-signed-amd64)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 16 May 2026 08:56:18 -0000] [ftpmaster: Archive Administrator]
Removed the following packages from stable:

ata-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
ata-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
ata-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
btrfs-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
btrfs-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
btrfs-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
cdrom-core-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
cdrom-core-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
cdrom-core-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
crypto-dm-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
crypto-dm-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
crypto-dm-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
crypto-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
crypto-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
crypto-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
ext4-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
ext4-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
ext4-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
f2fs-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
f2fs-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
f2fs-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
fat-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
fat-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
fat-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
fb-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
fb-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
fb-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
input-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
input-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
input-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
isofs-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
isofs-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
isofs-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
jfs-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
jfs-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
jfs-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
kernel-image-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
kernel-image-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
kernel-image-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
linux-image-6.12.63+deb13-arm64 |  6.12.63-1 | arm64
linux-image-6.12.63+deb13-arm64-16k |  6.12.63-1 | arm64
linux-image-6.12.63+deb13-cloud-arm64 |  6.12.63-1 | arm64
linux-image-6.12.63+deb13-rt-arm64 |  6.12.63-1 | arm64
linux-image-6.12.74+deb13+1-arm64 |  6.12.74-2 | arm64
linux-image-6.12.74+deb13+1-arm64-16k |  6.12.74-2 | arm64
linux-image-6.12.74+deb13+1-cloud-arm64 |  6.12.74-2 | arm64
linux-image-6.12.74+deb13+1-rt-arm64 |  6.12.74-2 | arm64
linux-image-6.12.85+deb13-arm64 |  6.12.85-1 | arm64
linux-image-6.12.85+deb13-arm64-16k |  6.12.85-1 | arm64
linux-image-6.12.85+deb13-cloud-arm64 |  6.12.85-1 | arm64
linux-image-6.12.85+deb13-rt-arm64 |  6.12.85-1 | arm64
loop-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
loop-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
loop-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
md-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
md-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
md-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
mmc-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
mmc-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
mmc-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
multipath-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
multipath-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
multipath-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
nbd-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
nbd-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
nbd-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
nic-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
nic-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
nic-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
nic-shared-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
nic-shared-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
nic-shared-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
nic-usb-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
nic-usb-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
nic-usb-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
nic-wireless-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
nic-wireless-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
nic-wireless-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
ppp-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
ppp-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
ppp-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
sata-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
sata-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
sata-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
scsi-core-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
scsi-core-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
scsi-core-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
scsi-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
scsi-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
scsi-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
scsi-nic-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
scsi-nic-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
scsi-nic-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
sound-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
sound-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
sound-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
speakup-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
speakup-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
speakup-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
squashfs-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
squashfs-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
squashfs-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
udf-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
udf-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
udf-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
uinput-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
uinput-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
uinput-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
usb-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
usb-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
usb-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
usb-serial-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
usb-serial-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
usb-serial-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
usb-storage-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
usb-storage-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
usb-storage-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64
xfs-modules-6.12.63+deb13-arm64-di |  6.12.63-1 | arm64
xfs-modules-6.12.74+deb13+1-arm64-di |  6.12.74-2 | arm64
xfs-modules-6.12.85+deb13-arm64-di |  6.12.85-1 | arm64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux-signed-arm64)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 16 May 2026 08:56:32 -0000] [ftpmaster: Archive Administrator]
Removed the following packages from stable:

openjdk-25-jvmci-jdk | 25.0.2+10-1~deb13u2 | amd64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by openjdk-25)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 16 May 2026 08:57:08 -0000] [ftpmaster: Archive Administrator]
Removed the following packages from stable:

linux-headers-6.12.63+deb13-common |  6.12.63-1 | all
linux-headers-6.12.63+deb13-common-rt |  6.12.63-1 | all
linux-headers-6.12.74+deb13+1-common |  6.12.74-2 | all
linux-headers-6.12.74+deb13+1-common-rt |  6.12.74-2 | all
linux-headers-6.12.85+deb13-common |  6.12.85-1 | all
linux-headers-6.12.85+deb13-common-rt |  6.12.85-1 | all
linux-support-6.12.63+deb13 |  6.12.63-1 | all
linux-support-6.12.74+deb13+1 |  6.12.74-2 | all
linux-support-6.12.85+deb13 |  6.12.85-1 | all

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux - based on source metadata)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 16 May 2026 08:57:22 -0000] [ftpmaster: Archive Administrator]
Removed the following packages from stable:

linux-kbuild-6.12.63+deb13 |  6.12.63-1 | i386
linux-kbuild-6.12.74+deb13+1 |  6.12.74-2 | i386
linux-kbuild-6.12.85+deb13 |  6.12.85-1 | i386

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux - based on source metadata)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 16 May 2026 08:57:35 -0000] [ftpmaster: Archive Administrator]
Removed the following packages from stable:

linux-kbuild-6.12.63+deb13 |  6.12.63-1 | amd64
linux-kbuild-6.12.74+deb13+1 |  6.12.74-2 | amd64
linux-kbuild-6.12.85+deb13 |  6.12.85-1 | amd64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux - based on source metadata)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 16 May 2026 08:57:47 -0000] [ftpmaster: Archive Administrator]
Removed the following packages from stable:

linux-kbuild-6.12.63+deb13 |  6.12.63-1 | armel
linux-kbuild-6.12.74+deb13+1 |  6.12.74-2 | armel
linux-kbuild-6.12.85+deb13 |  6.12.85-1 | armel

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux - based on source metadata)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 16 May 2026 08:58:06 -0000] [ftpmaster: Archive Administrator]
Removed the following packages from stable:

linux-kbuild-6.12.63+deb13 |  6.12.63-1 | armhf
linux-kbuild-6.12.74+deb13+1 |  6.12.74-2 | armhf
linux-kbuild-6.12.85+deb13 |  6.12.85-1 | armhf

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux - based on source metadata)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 16 May 2026 08:58:29 -0000] [ftpmaster: Archive Administrator]
Removed the following packages from stable:

linux-kbuild-6.12.63+deb13 |  6.12.63-1 | s390x
linux-kbuild-6.12.74+deb13+1 |  6.12.74-2 | s390x
linux-kbuild-6.12.85+deb13 |  6.12.85-1 | s390x

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux - based on source metadata)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 16 May 2026 08:58:45 -0000] [ftpmaster: Archive Administrator]
Removed the following packages from stable:

linux-kbuild-6.12.63+deb13 |  6.12.63-1 | arm64
linux-kbuild-6.12.74+deb13+1 |  6.12.74-2 | arm64
linux-kbuild-6.12.85+deb13 |  6.12.85-1 | arm64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux - based on source metadata)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 16 May 2026 08:58:59 -0000] [ftpmaster: Archive Administrator]
Removed the following packages from stable:

linux-kbuild-6.12.63+deb13 |  6.12.63-1 | ppc64el
linux-kbuild-6.12.74+deb13+1 |  6.12.74-2 | ppc64el
linux-kbuild-6.12.85+deb13 |  6.12.85-1 | ppc64el

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux - based on source metadata)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 16 May 2026 08:59:15 -0000] [ftpmaster: Archive Administrator]
Removed the following packages from stable:

linux-kbuild-6.12.63+deb13 |  6.12.63-1 | riscv64
linux-kbuild-6.12.74+deb13+1 |  6.12.74-2 | riscv64
linux-kbuild-6.12.85+deb13 |  6.12.85-1 | riscv64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux - based on source metadata)
----------------------------------------------
=========================================================================
389-ds-base (3.1.2+dfsg1-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
 .
   [ Timo Aaltonen ]
   * patches: Fix CVE-2025-14905. (Closes: #1130910)

7zip (25.01+dfsg-1~deb13u2) trixie; urgency=medium
 .
   * Non-maintainer upload by the LTS Security Team.
 .
   [ YOKOTA Hiroshi ]
   * Relax "breaks"/"replaces" line in debian/control, allowing for
     p7zip/p7zip-rar/7zip OSPU.

apache2 (2.4.67-1~deb13u2) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security
apache2 (2.4.67-1~deb13u1) trixie; urgency=medium
 .
   * New upstream release (Closes: #1135737, CVE-2026-23918, CVE-2026-24072,
     CVE-2026-29169, CVE-2026-33006, CVE-2026-33007, CVE-2026-33523,
     CVE-2026-33857, CVE-2026-34032, CVE-2026-34059)
   * Refresh patches
apache2 (2.4.67-1~deb12u2) bookworm-security; urgency=medium
 .
   * Rebuild for bookworm-security
apache2 (2.4.67-1~deb12u1) bookworm; urgency=medium
 .
   * New upstream release (Closes: #1135737, CVE-2026-23918, CVE-2026-24072,
     CVE-2026-29169, CVE-2026-33006, CVE-2026-33007, CVE-2026-33523,
     CVE-2026-33857, CVE-2026-34032, CVE-2026-34059)
   * Refresh patches
apache2 (2.4.66-8) unstable; urgency=medium
 .
   * Apply a patch from Thorsten Glaser for fixing segfault
     on http2 module (Closes: #1128831)
apache2 (2.4.66-7) unstable; urgency=medium
 .
   [ MichaIng ]
   * d/systemd: allow ReadWritePaths to not exist
 .
   [Luca Boccassi]
   * Fix testsuite with systemd (Closes: #1129071)
apache2 (2.4.66-6) unstable; urgency=high
 .
   * Fix upstream mismerge of HTTP2 module leading to SEGV
     (Closes: #1126177)
   * Split testsuite avoiding timeout (Closes: #1126571)
apache2 (2.4.66-5) unstable; urgency=medium
 .
   * Upload to sid
   * Add charset for autoindex (Closes: #1125778).
   * Fix zombie process due to FastCGI (Closes: #1125713)
apache2 (2.4.66-4) experimental; urgency=medium
 .
   * Readd forgotten suexec-custom.patch patch
apache2 (2.4.66-3) experimental; urgency=medium
 .
   [ Helmut Grohne ]
   * Add a new cross build patch (Closes: #1122137)
 .
   [ Bastien Roucariès ]
   * Fix apache2-bin: regular seg faults in mod_http2
     (Closes: #1125368)
   * Emit per default XHTML for autoindex (Closes: #1072804)
   * Add a list-vhosts command (Closes: #1054562)
apache2 (2.4.66-2) unstable; urgency=medium
 .
   * Update test framework
   * Parallelize tests when more than 3 CPUs are available
apache2 (2.4.66-1) unstable; urgency=medium
 .
   [ Laurent Bigonville ]
   * Enable systemd module (Closes: #860087).
   * debian/apache2ctl: Fix the restart and greceful when using system.
     When apache is not running and restart or greceful is called, apache
     was running in the user cgroup and system was be confused
     (Closes: #927302).
     This will also avoid to leak fd to apache
     (Closes: #713967).
 .
   [ Helmut Grohne ]
   * Fix FTCBFS: (Closes: #913094)
     + Annotate perl build dependency with :any.
     + cross.patch: Use AC_PATH_TOOL to find pkg-config.
     + Generate server/test_char.h ahead of the build
 .
   [ Jason Perrin ]
   * Fix packaging steps undo setting of setuid bit
     (Closes: #900612)
 .
   [ Bastien Roucariès]
   * Harden systemd services. Set ProtectSystem=full
     ProtectHome=read-only, RestrictSUIDSGID=yes.
     This may break read-write CGI script to /home and
     WebDaV or other CGI/php/lua uses.
   * Move /var/run to /run and /var/lock to /run/lock
   * Allow CAP_SYS_CHROOT for chroot
     (Closes: #1091855)
   * Remove apache2 IPC
 .
   [ Moritz Schlarb ]
   * Support Rules-Requires-Root: no (Closes: #1105015)
 .
   [ Yadd ]
   * New upstream version (Closes: #1121926, CVE-2025-55753, CVE-2025-58098,
     CVE-2025-59775, CVE-2025-65082, CVE-2025-66200)

awstats (7.9-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload by the LTS Security Team.
   * CVE-2025-63261: Fix a command injection vulnerability caused by using
     Perl's 2-argument open() function. (Closes: #1131878)

base-files (13.8+deb13u5) trixie; urgency=medium
 .
   * Update debian_version and os-release for Debian 13.5 point release.

bepasty (1.2.1-1+deb13u1) trixie; urgency=medium
 .
   * Fix loading pygments css. Closes: #1124997

bind9 (1:9.20.21-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream version 9.20.21
    - [CVE-2026-1519]: Fix unbounded NSEC3 iterations when validating
      referrals to unsigned delegations.
    - [CVE-2026-3104]: Fix memory leaks in code preparing DNSSEC proofs of
      non-existence.
    - [CVE-2026-3119]: Prevent a crash in code processing queries
      containing a TKEY record.
    - [CVE-2026-3591]: Fix a stack use-after-return flaw in SIG(0) handling
      code.
bind9 (1:9.20.21-1~deb13u1~bpo12+1) bookworm-backports; urgency=medium
 .
   * Rebuild for bookworm-backports.
bind9 (1:9.20.20-1) unstable; urgency=medium
 .
   * New upstream version 9.20.20
bind9 (1:9.20.20-1~bpo12+1) bookworm-backports; urgency=medium
 .
   [ Bernhard Schmidt ]
   * Rebuild for trixie-backports.
   * d/gbp.conf: set branch for bookworm-backports
bind9 (1:9.20.19-1) unstable; urgency=medium
 .
   * New upstream version 9.20.19
bind9 (1:9.20.19-1~bpo12+1) bookworm-backports; urgency=medium
 .
   * Rebuild for bookworm-backports.
   * d/gbp.conf: set branch for bookworm-backports
bind9 (1:9.20.18-1) unstable; urgency=medium
 .
   * New upstream version 9.20.18
    + [CVE-2025-13878]: Fix incorrect length checks for BRID and HHIT
      records.

bird2 (2.17.1-1+deb13u2) stable; urgency=medium
 .
   * Backport all fixes from upstream 2.17.4:
     + ASPA: Fix downstream validation
     + BGP: Fix restart behavior on reconfiguration
     + Filters: Fix string attributes
     + Logging: Fix error handling

black (25.1.0-3+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-32274: Arbitrary file writes from unsanitized user input
     (Closes: #1130657)

bubblewrap (0.11.0-2+deb13u1) trixie; urgency=medium
 .
   * d/control, d/gbp.conf: Branch for Debian 13 stable updates
   * d/patches: Fix privilege escalation if bubblewrap is setuid root.
     /usr/bin/bwrap has not been installed setuid-root by default since
     Debian 11, but if it was made setuid via a dpkg-statoverride set up
     by the local sysadmin (most likely in conjunction with turning off
     the ability for unprivileged users to create new user namespaces),
     then the version included in Debian 13.4 would be vulnerable.
     (CVE-2026-41163, Closes: #1134704)
     Note that the ability to install bubblewrap setuid-root has been
     deprecated upstream, and the version included in Debian 14 will
     refuse to run if it is setuid.

calibre (8.5.0+ds-1+deb13u2) trixie; urgency=medium
 .
   * CVE-2026-25635: CHM Input: Ignore internal files that have paths that
     end up outside the container
   * CVE-2026-25636: DRYer
   * CVE-2026-25731: ZIP Output: Change the template engine used for HTML
     templating from templite to Mustache, for greater safety and
     performance. Note that this is a breaking change if you use custom
     templates with ZIP output.
   * Use pystache instead of templite to fix CVE-2026-25731
   * Add NEWS about CVE-2026-25731 fix
   * CVE-2026-26064: ODT Input: Ensure images are extracted within
     container
   * CVE-2026-26065: PDB Input: Ensure extracted images are within the
     container
   * CVE-2026-27810: Content server: Sanitize content disposition received
     as query parameter
   * CVE-2026-27824: Content server: When banning IPs for repeated login is
     enabled, only use the IP address not any HTTP headers as the ban key

chromium (147.0.7727.137-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-7363: Use after free in Canvas. Reported by heapracer.
     - CVE-2026-7361: Use after free in iOS. Reported by Google.
     - CVE-2026-7344: Use after free in Accessibility. Reported by Google.
     - CVE-2026-7343: Use after free in Views. Reported by Google.
     - CVE-2026-7333: Use after free in GPU.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-7360: Insufficient validation of untrusted input in Compositing.
       Reported by Google.
     - CVE-2026-7359: Use after free in ANGLE. Reported by Google.
     - CVE-2026-7358: Use after free in Animation. Reported by Google.
     - CVE-2026-7334: Use after free in Views. Reported by Batuhan Eşref KOÇ.
     - CVE-2026-7357: Use after free in GPU. Reported by Google.
     - CVE-2026-7356: Use after free in Navigation. Reported by Google.
     - CVE-2026-7354: Out of bounds read and write in Angle. Reported by Google.
     - CVE-2026-7353: Heap buffer overflow in Skia. Reported by Google.
     - CVE-2026-7352: Use after free in Media. Reported by Google.
     - CVE-2026-7351: Race in MHTML. Reported by Google.
     - CVE-2026-7350: Use after free in WebMIDI. Reported by Google.
     - CVE-2026-7349: Use after free in Cast. Reported by Google.
     - CVE-2026-7348: Use after free in Codecs. Reported by Google.
     - CVE-2026-7335: Use after free in media.
       Reported by Jungwoo Lee (@physicube) and Wongi Lee (@_qwerty_po).
     - CVE-2026-7336: Use after free in WebRTC. Reported by Mozilla.
     - CVE-2026-7337: Type Confusion in V8. Reported by q@calif.io.
     - CVE-2026-7347: Use after free in Chromoting. Reported by Google.
     - CVE-2026-7346: Inappropriate implementation in Tint. Reported by Google.
     - CVE-2026-7345: Insufficient validation of untrusted input in Feedback.
       Reported by Google.
     - CVE-2026-7338: Use after free in Cast. Reported by Krace.
     - CVE-2026-7342: Use after free in WebView. Reported by Google.
     - CVE-2026-7341: Use after free in WebRTC. Reported by Google.
     - CVE-2026-7339: Heap buffer overflow in WebRTC.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-7340: Integer overflow in ANGLE.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-7355: Use after free in Media. Reported by Google.
 .
   [ Jianfeng Liu ]
   * d/patches:
     - upstream/Fix-GL-native-pixmap-import-support-reset-in-GpuInit.patch:
       Fixes upstream issue https://crbug.com/501115509. This issue is
       introduced in v147, and unfortunately the fix won't get into v147. This
       issue affects both vaapi and v4l2 decoding under ozone wayland.
     - fixes/enable-widevine-on-arm64-linux-platform.patch: Enable widevine
       support on arm64. There is no official support for widevine on arm64
       linux while there are libwidevine binaries extracted from chromeos,
       which can work on linux (closes: #1052440).
chromium (147.0.7727.137-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-7363: Use after free in Canvas. Reported by heapracer.
     - CVE-2026-7361: Use after free in iOS. Reported by Google.
     - CVE-2026-7344: Use after free in Accessibility. Reported by Google.
     - CVE-2026-7343: Use after free in Views. Reported by Google.
     - CVE-2026-7333: Use after free in GPU.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-7360: Insufficient validation of untrusted input in Compositing.
       Reported by Google.
     - CVE-2026-7359: Use after free in ANGLE. Reported by Google.
     - CVE-2026-7358: Use after free in Animation. Reported by Google.
     - CVE-2026-7334: Use after free in Views. Reported by Batuhan Eşref KOÇ.
     - CVE-2026-7357: Use after free in GPU. Reported by Google.
     - CVE-2026-7356: Use after free in Navigation. Reported by Google.
     - CVE-2026-7354: Out of bounds read and write in Angle. Reported by Google.
     - CVE-2026-7353: Heap buffer overflow in Skia. Reported by Google.
     - CVE-2026-7352: Use after free in Media. Reported by Google.
     - CVE-2026-7351: Race in MHTML. Reported by Google.
     - CVE-2026-7350: Use after free in WebMIDI. Reported by Google.
     - CVE-2026-7349: Use after free in Cast. Reported by Google.
     - CVE-2026-7348: Use after free in Codecs. Reported by Google.
     - CVE-2026-7335: Use after free in media.
       Reported by Jungwoo Lee (@physicube) and Wongi Lee (@_qwerty_po).
     - CVE-2026-7336: Use after free in WebRTC. Reported by Mozilla.
     - CVE-2026-7337: Type Confusion in V8. Reported by q@calif.io.
     - CVE-2026-7347: Use after free in Chromoting. Reported by Google.
     - CVE-2026-7346: Inappropriate implementation in Tint. Reported by Google.
     - CVE-2026-7345: Insufficient validation of untrusted input in Feedback.
       Reported by Google.
     - CVE-2026-7338: Use after free in Cast. Reported by Krace.
     - CVE-2026-7342: Use after free in WebView. Reported by Google.
     - CVE-2026-7341: Use after free in WebRTC. Reported by Google.
     - CVE-2026-7339: Heap buffer overflow in WebRTC.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-7340: Integer overflow in ANGLE.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-7355: Use after free in Media. Reported by Google.
 .
   [ Jianfeng Liu ]
   * d/patches:
     - upstream/Fix-GL-native-pixmap-import-support-reset-in-GpuInit.patch:
       Fixes upstream issue https://crbug.com/501115509. This issue is
       introduced in v147, and unfortunately the fix won't get into v147. This
       issue affects both vaapi and v4l2 decoding under ozone wayland.
     - fixes/enable-widevine-on-arm64-linux-platform.patch: Enable widevine
       support on arm64. There is no official support for widevine on arm64
       linux while there are libwidevine binaries extracted from chromeos,
       which can work on linux (closes: #1052440).
chromium (147.0.7727.116-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-6919: Use after free in DevTools.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-6920: Out of bounds read in GPU.
       Reported by tatiwari of Microsoft.
     - CVE-2026-6921: Race in GPU. Reported by soiax.
 .
   [ Jochen Sprickerhof ]
   * Make chromium.png icon reproducible (closes: #1134412).
chromium (147.0.7727.116-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-6919: Use after free in DevTools.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-6920: Out of bounds read in GPU.
       Reported by tatiwari of Microsoft.
     - CVE-2026-6921: Race in GPU. Reported by soiax.
 .
   [ Jochen Sprickerhof ]
   * Make chromium.png icon reproducible (closes: #1134412).
chromium (147.0.7727.116-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-6919: Use after free in DevTools.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-6920: Out of bounds read in GPU.
       Reported by tatiwari of Microsoft.
     - CVE-2026-6921: Race in GPU. Reported by soiax.
 .
   [ Jochen Sprickerhof ]
   * Make chromium.png icon reproducible (closes: #1134412).
chromium (147.0.7727.101-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-6296: Heap buffer overflow in ANGLE. Reported by cinzinga.
     - CVE-2026-6297: Use after free in Proxy. Reported by heapracer.
     - CVE-2026-6298: Heap buffer overflow in Skia.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-6299: Use after free in Prerender. Reported by Google.
     - CVE-2026-6358: Use after free in XR. Reported by Jihyeon Jeong
       (Compsec Lab, Seoul National University / Research Intern).
     - CVE-2026-6359: Use after free in Video.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-6300: Use after free in CSS.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-6301: Type Confusion in Turbofan. Reported by qymag1c.
     - CVE-2026-6302: Use after free in Video. Reported by Syn4pse.
     - CVE-2026-6303: Use after free in Codecs. Reported by Google.
     - CVE-2026-6304: Use after free in Graphite. Reported by Google.
     - CVE-2026-6305: Heap buffer overflow in PDFium.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-6306: Heap buffer overflow in PDFium.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-6307: Type Confusion in Turbofan.
       Reported by Project WhatForLunch (@pjwhatforlunch).
     - CVE-2026-6308: Out of bounds read in Media. Reported by Google.
     - CVE-2026-6309: Use after free in Viz. Reported by Google.
     - CVE-2026-6360: Use after free in FileSystem. Reported by asjidkalam.
     - CVE-2026-6310: Use after free in Dawn. Reported by Google.
     - CVE-2026-6311: Uninitialized Use in Accessibility. Reported by Google.
     - CVE-2026-6312: Insufficient policy enforcement in Passwords.
       Reported by Google.
     - CVE-2026-6313: Insufficient policy enforcement in CORS.
       Reported by Google.
     - CVE-2026-6314: Out of bounds write in GPU. Reported by Google.
     - CVE-2026-6315: Use after free in Permissions. Reported by Google.
     - CVE-2026-6316: Use after free in Forms. Reported by Google.
     - CVE-2026-6361: Heap buffer overflow in PDFium. Reported by Google.
     - CVE-2026-6362: Use after free in Codecs.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-6317: Use after free in Cast. Reported by Google.
     - CVE-2026-6363: Type Confusion in V8. Reported by Google.
     - CVE-2026-6318: Use after free in Codecs. Reported by Syn4pse.
     - CVE-2026-6319: Use after free in Payments. Reported by pwn2addr.
     - CVE-2026-6364: Out of bounds read in Skia.
       Reported by Google Threat Intelligence.
chromium (147.0.7727.101-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-6296: Heap buffer overflow in ANGLE. Reported by cinzinga.
     - CVE-2026-6297: Use after free in Proxy. Reported by heapracer.
     - CVE-2026-6298: Heap buffer overflow in Skia.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-6299: Use after free in Prerender. Reported by Google.
     - CVE-2026-6358: Use after free in XR. Reported by Jihyeon Jeong
       (Compsec Lab, Seoul National University / Research Intern).
     - CVE-2026-6359: Use after free in Video.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-6300: Use after free in CSS.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-6301: Type Confusion in Turbofan. Reported by qymag1c.
     - CVE-2026-6302: Use after free in Video. Reported by Syn4pse.
     - CVE-2026-6303: Use after free in Codecs. Reported by Google.
     - CVE-2026-6304: Use after free in Graphite. Reported by Google.
     - CVE-2026-6305: Heap buffer overflow in PDFium.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-6306: Heap buffer overflow in PDFium.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-6307: Type Confusion in Turbofan.
       Reported by Project WhatForLunch (@pjwhatforlunch).
     - CVE-2026-6308: Out of bounds read in Media. Reported by Google.
     - CVE-2026-6309: Use after free in Viz. Reported by Google.
     - CVE-2026-6360: Use after free in FileSystem. Reported by asjidkalam.
     - CVE-2026-6310: Use after free in Dawn. Reported by Google.
     - CVE-2026-6311: Uninitialized Use in Accessibility. Reported by Google.
     - CVE-2026-6312: Insufficient policy enforcement in Passwords.
       Reported by Google.
     - CVE-2026-6313: Insufficient policy enforcement in CORS.
       Reported by Google.
     - CVE-2026-6314: Out of bounds write in GPU. Reported by Google.
     - CVE-2026-6315: Use after free in Permissions. Reported by Google.
     - CVE-2026-6316: Use after free in Forms. Reported by Google.
     - CVE-2026-6361: Heap buffer overflow in PDFium. Reported by Google.
     - CVE-2026-6362: Use after free in Codecs.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-6317: Use after free in Cast. Reported by Google.
     - CVE-2026-6363: Type Confusion in V8. Reported by Google.
     - CVE-2026-6318: Use after free in Codecs. Reported by Syn4pse.
     - CVE-2026-6319: Use after free in Payments. Reported by pwn2addr.
     - CVE-2026-6364: Out of bounds read in Skia.
       Reported by Google Threat Intelligence.
chromium (147.0.7727.101-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-6296: Heap buffer overflow in ANGLE. Reported by cinzinga.
     - CVE-2026-6297: Use after free in Proxy. Reported by heapracer.
     - CVE-2026-6298: Heap buffer overflow in Skia.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-6299: Use after free in Prerender. Reported by Google.
     - CVE-2026-6358: Use after free in XR. Reported by Jihyeon Jeong
       (Compsec Lab, Seoul National University / Research Intern).
     - CVE-2026-6359: Use after free in Video.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-6300: Use after free in CSS.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-6301: Type Confusion in Turbofan. Reported by qymag1c.
     - CVE-2026-6302: Use after free in Video. Reported by Syn4pse.
     - CVE-2026-6303: Use after free in Codecs. Reported by Google.
     - CVE-2026-6304: Use after free in Graphite. Reported by Google.
     - CVE-2026-6305: Heap buffer overflow in PDFium.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-6306: Heap buffer overflow in PDFium.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-6307: Type Confusion in Turbofan.
       Reported by Project WhatForLunch (@pjwhatforlunch).
     - CVE-2026-6308: Out of bounds read in Media. Reported by Google.
     - CVE-2026-6309: Use after free in Viz. Reported by Google.
     - CVE-2026-6360: Use after free in FileSystem. Reported by asjidkalam.
     - CVE-2026-6310: Use after free in Dawn. Reported by Google.
     - CVE-2026-6311: Uninitialized Use in Accessibility. Reported by Google.
     - CVE-2026-6312: Insufficient policy enforcement in Passwords.
       Reported by Google.
     - CVE-2026-6313: Insufficient policy enforcement in CORS.
       Reported by Google.
     - CVE-2026-6314: Out of bounds write in GPU. Reported by Google.
     - CVE-2026-6315: Use after free in Permissions. Reported by Google.
     - CVE-2026-6316: Use after free in Forms. Reported by Google.
     - CVE-2026-6361: Heap buffer overflow in PDFium. Reported by Google.
     - CVE-2026-6362: Use after free in Codecs.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-6317: Use after free in Cast. Reported by Google.
     - CVE-2026-6363: Type Confusion in V8. Reported by Google.
     - CVE-2026-6318: Use after free in Codecs. Reported by Syn4pse.
     - CVE-2026-6319: Use after free in Payments. Reported by pwn2addr.
     - CVE-2026-6364: Out of bounds read in Skia.
       Reported by Google Threat Intelligence.
chromium (147.0.7727.55-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream stable release.
     - CVE-2026-5858: Heap buffer overflow in WebML.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5859: Integer overflow in WebML. Reported by Anonymous.
     - CVE-2026-5860: Use after free in WebRTC.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5861: Use after free in V8. Reported by 5shain.
     - CVE-2026-5862: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-5863: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-5864: Heap buffer overflow in WebAudio. Reported by Syn4pse.
     - CVE-2026-5865: Type Confusion in V8.
       Reported by Project WhatForLunch (@pjwhatforlunch).
     - CVE-2026-5866: Use after free in Media.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5867: Heap buffer overflow in WebML. Reported by Syn4pse.
     - CVE-2026-5868: Heap buffer overflow in ANGLE. Reported by cinzinga.
     - CVE-2026-5869: Heap buffer overflow in WebML.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5870: Integer overflow in Skia. Reported by Google.
     - CVE-2026-5871: Type Confusion in V8. Reported by Google.
     - CVE-2026-5872: Use after free in Blink. Reported by Google.
     - CVE-2026-5873: Out of bounds read and write in V8. Reported by Google.
     - CVE-2026-5874: Use after free in PrivateAI. Reported by Krace.
     - CVE-2026-5875: Policy bypass in Blink.
       Reported by Lyra Rebane (rebane2001).
     - CVE-2026-5876: Side-channel information leakage in Navigation.
       Reported by Lyra Rebane (rebane2001).
     - CVE-2026-5877: Use after free in Navigation.
       Reported by Cassidy Kim(@cassidy6564).
     - CVE-2026-5878: Incorrect security UI in Blink.
       Reported by Shaheen Fazim.
     - CVE-2026-5879: Insufficient validation of untrusted input in ANGLE.
       Reported by parkminchan, working for SSD Labs Korea.
     - CVE-2026-5880: Incorrect security UI in browser UI.
     - CVE-2026-5881: Policy bypass in LocalNetworkAccess. Reported by asnine.
     - CVE-2026-5882: Incorrect security UI in Fullscreen.
     - CVE-2026-5883: Use after free in Media. Reported by sherkito.
     - CVE-2026-5884: Insufficient validation of untrusted input in Media.
       Reported by xmzyshypnc.
     - CVE-2026-5885: Insufficient validation of untrusted input in WebML.
       Reported by Bryan Bernhart.
     - CVE-2026-5886: Out of bounds read in WebAudio.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5887: Insufficient validation of untrusted input in Downloads.
       Reported by daffainfo.
     - CVE-2026-5888: Uninitialized Use in WebCodecs. Reported by Identified by
       the Octane Security Team: Giovanni Vignone, Paolo Gentry,
       Robert van Eijk.
     - CVE-2026-5889: Cryptographic Flaw in PDFium. Reported by mlafon.
     - CVE-2026-5890: Race in WebCodecs. Reported by Casper Woudenberg.
     - CVE-2026-5891: Insufficient policy enforcement in browser UI.
       Reported by Tianyi Hu.
     - CVE-2026-5892: Insufficient policy enforcement in PWAs.
       Reported by Tianyi Hu.
     - CVE-2026-5893: Race in V8. Reported by QYmag1c.
     - CVE-2026-5894: Inappropriate implementation in PDF.
       Reported by Povcfe of Tencent Security Xuanwu Lab.
     - CVE-2026-5895: Incorrect security UI in Omnibox.
       Reported by Renwa Hiwa @RenwaX23.
     - CVE-2026-5896: Policy bypass in Audio.
       Reported by Luan Herrera (@lbherrera_).
     - CVE-2026-5897: Incorrect security UI in Downloads.
       Reported by Farras Givari.
     - CVE-2026-5898: Incorrect security UI in Omnibox.
       Reported by saidinahikam032.
     - CVE-2026-5899: Incorrect security UI in History Navigation.
       Reported by Islam Rzayev.
     - CVE-2026-5900: Policy bypass in Downloads.
       Reported by Luan Herrera (@lbherrera_).
     - CVE-2026-5901: Policy bypass in DevTools.
       Reported by Povcfe of Tencent Security Xuanwu Lab.
     - CVE-2026-5902: Race in Media. Reported by Luke Francis.
     - CVE-2026-5903: Policy bypass in IFrameSandbox. Reported by @Ciarands.
     - CVE-2026-5904: Use after free in V8.
       Reported by Zhenpeng (Leo) Lin at depthfirst.
     - CVE-2026-5905: Incorrect security UI in Permissions.
       Reported by daffainfo.
     - CVE-2026-5906: Incorrect security UI in Omnibox.
       Reported by mohamedhesham9173.
     - CVE-2026-5907: Insufficient data validation in Media.
       Reported by Luke Francis.
     - CVE-2026-5908: Integer overflow in Media.
       Reported by Ameen Basha M K & Mohammed Yasar B.
     - CVE-2026-5909: Integer overflow in Media.
       Reported by Mohammed Yasar B & Ameen Basha M K.
     - CVE-2026-5910: Integer overflow in Media.
       Reported by Ameen Basha M K & Mohammed Yasar B.
     - CVE-2026-5911: Policy bypass in ServiceWorkers. Reported by lebr0nli
       of National Yang Ming Chiao Tung University, Dept. of CS, Security
       and Systems Lab.
     - CVE-2026-5912: Integer overflow in WebRTC.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5913: Out of bounds read in Blink.
       Reported by Vitaly Simonovich.
     - CVE-2026-5914: Type Confusion in CSS. Reported by Syn4pse.
     - CVE-2026-5915: Insufficient validation of untrusted input in WebML.
       Reported by ningxin.hu@intel.com.
     - CVE-2026-5918: Inappropriate implementation in Navigation.
       Reported by Google.
     - CVE-2026-5919: Insufficient validation of untrusted input in WebSockets.
       Reported by Richard Belisle.
   * d/patches:
     - upstream/profile.patch: drop, merged upstream.
     - upstream/fix-boringssl-loong64.patch: drop, merged upstream.
     - debianization/clang-version.patch: refresh.
     - disable/signin.patch: refresh.
     - disable/catapult.patch: refresh.
     - disable/unrar.patch: drop, merged upstream.
     - trixie/nodejs-set-intersection.patch: update for upstream refactoring.
     - bookworm/clang19.patch: -fno-lifetime-dse is unsupported. Also move
       to llvm-19 directory.
     - ungoogled/disable-ai.patch: sync from ungoogled-chromium project.
       Also re-add code that creates new tab's search bar (closes: #1132651).
     - debianization/safe-libcxx.patch: add a patch to force building with
       libc++'s LIBCPP_HARDENING_MODE turned on. See
       https://issues.chromium.org/issues/485696265 for the
       (security-related) rationale.
     - llvm-19/static-assert.patch: add another chunk of static_assert()
       removals that clang 19 needs.
     - rust-1.85/image.patch: enable nightly features for image_v0.25
       [trixie, bookworm].
     - bookworm/constexpr.patch: update/refresh for renamed file [bookworm].
   * d/rules:
     - drop "enable_glic=false", as upstream now forces their AI on everyone;
       but we strip it out with ungoogled/disable-ai.patch.
 .
   [ Daniel Richard G. ]
   * d/patches:
     - bookworm/gn-absl.patch: Add visibility specifier to absl/crc:crc32,
       and re-sort the patch to keep the edits organized.
     - trixie/gn-len.patch: Refresh.
     - trixie/gn-module-name.patch: New patch to address older GN not knowing
       about the {{cc_module_name}} substitution [trixie, bookworm].
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0001-Add-PPC64-support-for-boringssl.patch: refresh for
       upstream changes
     - third_party/0002-third_party-libvpx-Remove-bad-ppc64-config.patch:
       refresh for upstream changes
     - third_party/0002-regenerate-xnn-buildgn.patch: refresh for upstream
       changes
     - libaom/0001-Add-pregenerated-config-for-libaom-on-ppc64.patch: regenerate
 .
   [ Jianfeng Liu ]
   * d/patches/loongarch64:
     - 0024-disable-BROTLI_MODEL-macro-for-some-targets.patch: add upstream
       patch to fix brotil on loong64
chromium (147.0.7727.55-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream stable release.
     - CVE-2026-5858: Heap buffer overflow in WebML.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5859: Integer overflow in WebML. Reported by Anonymous.
     - CVE-2026-5860: Use after free in WebRTC.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5861: Use after free in V8. Reported by 5shain.
     - CVE-2026-5862: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-5863: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-5864: Heap buffer overflow in WebAudio. Reported by Syn4pse.
     - CVE-2026-5865: Type Confusion in V8.
       Reported by Project WhatForLunch (@pjwhatforlunch).
     - CVE-2026-5866: Use after free in Media.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5867: Heap buffer overflow in WebML. Reported by Syn4pse.
     - CVE-2026-5868: Heap buffer overflow in ANGLE. Reported by cinzinga.
     - CVE-2026-5869: Heap buffer overflow in WebML.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5870: Integer overflow in Skia. Reported by Google.
     - CVE-2026-5871: Type Confusion in V8. Reported by Google.
     - CVE-2026-5872: Use after free in Blink. Reported by Google.
     - CVE-2026-5873: Out of bounds read and write in V8. Reported by Google.
     - CVE-2026-5874: Use after free in PrivateAI. Reported by Krace.
     - CVE-2026-5875: Policy bypass in Blink.
       Reported by Lyra Rebane (rebane2001).
     - CVE-2026-5876: Side-channel information leakage in Navigation.
       Reported by Lyra Rebane (rebane2001).
     - CVE-2026-5877: Use after free in Navigation.
       Reported by Cassidy Kim(@cassidy6564).
     - CVE-2026-5878: Incorrect security UI in Blink.
       Reported by Shaheen Fazim.
     - CVE-2026-5879: Insufficient validation of untrusted input in ANGLE.
       Reported by parkminchan, working for SSD Labs Korea.
     - CVE-2026-5880: Incorrect security UI in browser UI.
     - CVE-2026-5881: Policy bypass in LocalNetworkAccess. Reported by asnine.
     - CVE-2026-5882: Incorrect security UI in Fullscreen.
     - CVE-2026-5883: Use after free in Media. Reported by sherkito.
     - CVE-2026-5884: Insufficient validation of untrusted input in Media.
       Reported by xmzyshypnc.
     - CVE-2026-5885: Insufficient validation of untrusted input in WebML.
       Reported by Bryan Bernhart.
     - CVE-2026-5886: Out of bounds read in WebAudio.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5887: Insufficient validation of untrusted input in Downloads.
       Reported by daffainfo.
     - CVE-2026-5888: Uninitialized Use in WebCodecs. Reported by Identified by
       the Octane Security Team: Giovanni Vignone, Paolo Gentry,
       Robert van Eijk.
     - CVE-2026-5889: Cryptographic Flaw in PDFium. Reported by mlafon.
     - CVE-2026-5890: Race in WebCodecs. Reported by Casper Woudenberg.
     - CVE-2026-5891: Insufficient policy enforcement in browser UI.
       Reported by Tianyi Hu.
     - CVE-2026-5892: Insufficient policy enforcement in PWAs.
       Reported by Tianyi Hu.
     - CVE-2026-5893: Race in V8. Reported by QYmag1c.
     - CVE-2026-5894: Inappropriate implementation in PDF.
       Reported by Povcfe of Tencent Security Xuanwu Lab.
     - CVE-2026-5895: Incorrect security UI in Omnibox.
       Reported by Renwa Hiwa @RenwaX23.
     - CVE-2026-5896: Policy bypass in Audio.
       Reported by Luan Herrera (@lbherrera_).
     - CVE-2026-5897: Incorrect security UI in Downloads.
       Reported by Farras Givari.
     - CVE-2026-5898: Incorrect security UI in Omnibox.
       Reported by saidinahikam032.
     - CVE-2026-5899: Incorrect security UI in History Navigation.
       Reported by Islam Rzayev.
     - CVE-2026-5900: Policy bypass in Downloads.
       Reported by Luan Herrera (@lbherrera_).
     - CVE-2026-5901: Policy bypass in DevTools.
       Reported by Povcfe of Tencent Security Xuanwu Lab.
     - CVE-2026-5902: Race in Media. Reported by Luke Francis.
     - CVE-2026-5903: Policy bypass in IFrameSandbox. Reported by @Ciarands.
     - CVE-2026-5904: Use after free in V8.
       Reported by Zhenpeng (Leo) Lin at depthfirst.
     - CVE-2026-5905: Incorrect security UI in Permissions.
       Reported by daffainfo.
     - CVE-2026-5906: Incorrect security UI in Omnibox.
       Reported by mohamedhesham9173.
     - CVE-2026-5907: Insufficient data validation in Media.
       Reported by Luke Francis.
     - CVE-2026-5908: Integer overflow in Media.
       Reported by Ameen Basha M K & Mohammed Yasar B.
     - CVE-2026-5909: Integer overflow in Media.
       Reported by Mohammed Yasar B & Ameen Basha M K.
     - CVE-2026-5910: Integer overflow in Media.
       Reported by Ameen Basha M K & Mohammed Yasar B.
     - CVE-2026-5911: Policy bypass in ServiceWorkers. Reported by lebr0nli
       of National Yang Ming Chiao Tung University, Dept. of CS, Security
       and Systems Lab.
     - CVE-2026-5912: Integer overflow in WebRTC.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5913: Out of bounds read in Blink.
       Reported by Vitaly Simonovich.
     - CVE-2026-5914: Type Confusion in CSS. Reported by Syn4pse.
     - CVE-2026-5915: Insufficient validation of untrusted input in WebML.
       Reported by ningxin.hu@intel.com.
     - CVE-2026-5918: Inappropriate implementation in Navigation.
       Reported by Google.
     - CVE-2026-5919: Insufficient validation of untrusted input in WebSockets.
       Reported by Richard Belisle.
   * d/patches:
     - upstream/profile.patch: drop, merged upstream.
     - upstream/fix-boringssl-loong64.patch: drop, merged upstream.
     - debianization/clang-version.patch: refresh.
     - disable/signin.patch: refresh.
     - disable/catapult.patch: refresh.
     - disable/unrar.patch: drop, merged upstream.
     - trixie/nodejs-set-intersection.patch: update for upstream refactoring.
     - bookworm/clang19.patch: -fno-lifetime-dse is unsupported. Also move
       to llvm-19 directory.
     - ungoogled/disable-ai.patch: sync from ungoogled-chromium project.
       Also re-add code that creates new tab's search bar (closes: #1132651).
     - debianization/safe-libcxx.patch: add a patch to force building with
       libc++'s LIBCPP_HARDENING_MODE turned on. See
       https://issues.chromium.org/issues/485696265 for the
       (security-related) rationale.
     - llvm-19/static-assert.patch: add another chunk of static_assert()
       removals that clang 19 needs.
     - rust-1.85/image.patch: enable nightly features for image_v0.25
       [trixie, bookworm].
     - bookworm/constexpr.patch: update/refresh for renamed file [bookworm].
   * d/rules:
     - drop "enable_glic=false", as upstream now forces their AI on everyone;
       but we strip it out with ungoogled/disable-ai.patch.
 .
   [ Daniel Richard G. ]
   * d/patches:
     - bookworm/gn-absl.patch: Add visibility specifier to absl/crc:crc32,
       and re-sort the patch to keep the edits organized.
     - trixie/gn-len.patch: Refresh.
     - trixie/gn-module-name.patch: New patch to address older GN not knowing
       about the {{cc_module_name}} substitution [trixie, bookworm].
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0001-Add-PPC64-support-for-boringssl.patch: refresh for
       upstream changes
     - third_party/0002-third_party-libvpx-Remove-bad-ppc64-config.patch:
       refresh for upstream changes
     - third_party/0002-regenerate-xnn-buildgn.patch: refresh for upstream
       changes
     - libaom/0001-Add-pregenerated-config-for-libaom-on-ppc64.patch: regenerate
 .
   [ Jianfeng Liu ]
   * d/patches/loongarch64:
     - 0024-disable-BROTLI_MODEL-macro-for-some-targets.patch: add upstream
       patch to fix brotil on loong64
chromium (147.0.7727.55-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream stable release.
     - CVE-2026-5858: Heap buffer overflow in WebML.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5859: Integer overflow in WebML. Reported by Anonymous.
     - CVE-2026-5860: Use after free in WebRTC.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5861: Use after free in V8. Reported by 5shain.
     - CVE-2026-5862: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-5863: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-5864: Heap buffer overflow in WebAudio. Reported by Syn4pse.
     - CVE-2026-5865: Type Confusion in V8.
       Reported by Project WhatForLunch (@pjwhatforlunch).
     - CVE-2026-5866: Use after free in Media.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5867: Heap buffer overflow in WebML. Reported by Syn4pse.
     - CVE-2026-5868: Heap buffer overflow in ANGLE. Reported by cinzinga.
     - CVE-2026-5869: Heap buffer overflow in WebML.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5870: Integer overflow in Skia. Reported by Google.
     - CVE-2026-5871: Type Confusion in V8. Reported by Google.
     - CVE-2026-5872: Use after free in Blink. Reported by Google.
     - CVE-2026-5873: Out of bounds read and write in V8. Reported by Google.
     - CVE-2026-5874: Use after free in PrivateAI. Reported by Krace.
     - CVE-2026-5875: Policy bypass in Blink.
       Reported by Lyra Rebane (rebane2001).
     - CVE-2026-5876: Side-channel information leakage in Navigation.
       Reported by Lyra Rebane (rebane2001).
     - CVE-2026-5877: Use after free in Navigation.
       Reported by Cassidy Kim(@cassidy6564).
     - CVE-2026-5878: Incorrect security UI in Blink.
       Reported by Shaheen Fazim.
     - CVE-2026-5879: Insufficient validation of untrusted input in ANGLE.
       Reported by parkminchan, working for SSD Labs Korea.
     - CVE-2026-5880: Incorrect security UI in browser UI.
     - CVE-2026-5881: Policy bypass in LocalNetworkAccess. Reported by asnine.
     - CVE-2026-5882: Incorrect security UI in Fullscreen.
     - CVE-2026-5883: Use after free in Media. Reported by sherkito.
     - CVE-2026-5884: Insufficient validation of untrusted input in Media.
       Reported by xmzyshypnc.
     - CVE-2026-5885: Insufficient validation of untrusted input in WebML.
       Reported by Bryan Bernhart.
     - CVE-2026-5886: Out of bounds read in WebAudio.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5887: Insufficient validation of untrusted input in Downloads.
       Reported by daffainfo.
     - CVE-2026-5888: Uninitialized Use in WebCodecs. Reported by Identified by
       the Octane Security Team: Giovanni Vignone, Paolo Gentry,
       Robert van Eijk.
     - CVE-2026-5889: Cryptographic Flaw in PDFium. Reported by mlafon.
     - CVE-2026-5890: Race in WebCodecs. Reported by Casper Woudenberg.
     - CVE-2026-5891: Insufficient policy enforcement in browser UI.
       Reported by Tianyi Hu.
     - CVE-2026-5892: Insufficient policy enforcement in PWAs.
       Reported by Tianyi Hu.
     - CVE-2026-5893: Race in V8. Reported by QYmag1c.
     - CVE-2026-5894: Inappropriate implementation in PDF.
       Reported by Povcfe of Tencent Security Xuanwu Lab.
     - CVE-2026-5895: Incorrect security UI in Omnibox.
       Reported by Renwa Hiwa @RenwaX23.
     - CVE-2026-5896: Policy bypass in Audio.
       Reported by Luan Herrera (@lbherrera_).
     - CVE-2026-5897: Incorrect security UI in Downloads.
       Reported by Farras Givari.
     - CVE-2026-5898: Incorrect security UI in Omnibox.
       Reported by saidinahikam032.
     - CVE-2026-5899: Incorrect security UI in History Navigation.
       Reported by Islam Rzayev.
     - CVE-2026-5900: Policy bypass in Downloads.
       Reported by Luan Herrera (@lbherrera_).
     - CVE-2026-5901: Policy bypass in DevTools.
       Reported by Povcfe of Tencent Security Xuanwu Lab.
     - CVE-2026-5902: Race in Media. Reported by Luke Francis.
     - CVE-2026-5903: Policy bypass in IFrameSandbox. Reported by @Ciarands.
     - CVE-2026-5904: Use after free in V8.
       Reported by Zhenpeng (Leo) Lin at depthfirst.
     - CVE-2026-5905: Incorrect security UI in Permissions.
       Reported by daffainfo.
     - CVE-2026-5906: Incorrect security UI in Omnibox.
       Reported by mohamedhesham9173.
     - CVE-2026-5907: Insufficient data validation in Media.
       Reported by Luke Francis.
     - CVE-2026-5908: Integer overflow in Media.
       Reported by Ameen Basha M K & Mohammed Yasar B.
     - CVE-2026-5909: Integer overflow in Media.
       Reported by Mohammed Yasar B & Ameen Basha M K.
     - CVE-2026-5910: Integer overflow in Media.
       Reported by Ameen Basha M K & Mohammed Yasar B.
     - CVE-2026-5911: Policy bypass in ServiceWorkers. Reported by lebr0nli
       of National Yang Ming Chiao Tung University, Dept. of CS, Security
       and Systems Lab.
     - CVE-2026-5912: Integer overflow in WebRTC.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5913: Out of bounds read in Blink.
       Reported by Vitaly Simonovich.
     - CVE-2026-5914: Type Confusion in CSS. Reported by Syn4pse.
     - CVE-2026-5915: Insufficient validation of untrusted input in WebML.
       Reported by ningxin.hu@intel.com.
     - CVE-2026-5918: Inappropriate implementation in Navigation.
       Reported by Google.
     - CVE-2026-5919: Insufficient validation of untrusted input in WebSockets.
       Reported by Richard Belisle.
   * d/patches:
     - upstream/profile.patch: drop, merged upstream.
     - upstream/fix-boringssl-loong64.patch: drop, merged upstream.
     - debianization/clang-version.patch: refresh.
     - disable/signin.patch: refresh.
     - disable/catapult.patch: refresh.
     - disable/unrar.patch: drop, merged upstream.
     - trixie/nodejs-set-intersection.patch: update for upstream refactoring.
     - bookworm/clang19.patch: -fno-lifetime-dse is unsupported. Also move
       to llvm-19 directory.
     - ungoogled/disable-ai.patch: sync from ungoogled-chromium project.
       Also re-add code that creates new tab's search bar (closes: #1132651).
     - debianization/safe-libcxx.patch: add a patch to force building with
       libc++'s LIBCPP_HARDENING_MODE turned on. See
       https://issues.chromium.org/issues/485696265 for the
       (security-related) rationale.
     - llvm-19/static-assert.patch: add another chunk of static_assert()
       removals that clang 19 needs.
     - rust-1.85/image.patch: enable nightly features for image_v0.25
       [trixie, bookworm].
     - bookworm/constexpr.patch: update/refresh for renamed file [bookworm].
   * d/rules:
     - drop "enable_glic=false", as upstream now forces their AI on everyone;
       but we strip it out with ungoogled/disable-ai.patch.
 .
   [ Daniel Richard G. ]
   * d/patches:
     - bookworm/gn-absl.patch: Add visibility specifier to absl/crc:crc32,
       and re-sort the patch to keep the edits organized.
     - trixie/gn-len.patch: Refresh.
     - trixie/gn-module-name.patch: New patch to address older GN not knowing
       about the {{cc_module_name}} substitution [trixie, bookworm].
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0001-Add-PPC64-support-for-boringssl.patch: refresh for
       upstream changes
     - third_party/0002-third_party-libvpx-Remove-bad-ppc64-config.patch:
       refresh for upstream changes
     - third_party/0002-regenerate-xnn-buildgn.patch: refresh for upstream
       changes
     - libaom/0001-Add-pregenerated-config-for-libaom-on-ppc64.patch: regenerate
 .
   [ Jianfeng Liu ]
   * d/patches/loongarch64:
     - 0024-disable-BROTLI_MODEL-macro-for-some-targets.patch: add upstream
       patch to fix brotil on loong64
chromium (146.0.7680.177-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-5272: Heap buffer overflow in GPU.
       Reported by inspector-ambitious.
     - CVE-2026-5273: Use after free in CSS. Reported by Anonymous.
     - CVE-2026-5274: Integer overflow in Codecs.
       Reported by heapracer (@heapracer).
     - CVE-2026-5275: Heap buffer overflow in ANGLE.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5276: Insufficient policy enforcement in WebUSB.
       Reported by Ariel Simon.
     - CVE-2026-5277: Integer overflow in ANGLE.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5278: Use after free in Web MIDI.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5279: Object corruption in V8.
       Reported by Hyeonjun Ahn (@_deayzl).
     - CVE-2026-5280: Use after free in WebCodecs.
       Reported by heapracer (@heapracer).
     - CVE-2026-5281: Use after free in Dawn.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-5282: Out of bounds read in WebCodecs.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5283: Inappropriate implementation in ANGLE.
       Reported by sweetchip.
     - CVE-2026-5284: Use after free in Dawn.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-5285: Use after free in WebGL.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5286: Use after free in Dawn. Reported by sweetchip.
     - CVE-2026-5287: Use after free in PDF. Reported by Syn4pse.
     - CVE-2026-5288: Use after free in WebView. Reported by Google.
     - CVE-2026-5289: Use after free in Navigation. Reported by Google.
     - CVE-2026-5290: Use after free in Compositing. Reported by Google.
     - CVE-2026-5291: Inappropriate implementation in WebGL.
       Reported by heapracer (@heapracer).
     - CVE-2026-5292: Out of bounds read in WebCodecs. Reported by Google.
   * d/patches:
     - upstream/Fix-blink-compilation-for-platforms-other-than-x86-and-arm.patch:
       drop, merged upstream.
     - ungoogled/disable-ai.patch: resync with u-c.
 .
   [ Daniel Richard G. ]
   * d/copyright: Exclude *.pb (protobuf) binary files.
   * d/patches: Various ungoogled-chromium-related updates.
     - disable/glic.patch: Drop, replaced with disable-ai.patch from the
       ungoogled-chromium project.
     - ungoogled/disable-ai.patch: Import new patch from ungoogled-chromium
       that zaps glic, screen_ai, and various other adjacent AI-based features.
     - ungoogled/disable-mei-preload.patch: Import patch to allow building
       without *.pb files.
     - ungoogled/disable-privacy-sandbox.patch: Update imported patch.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0005-blink-add-audio-vector-support.patch: Fix FBTFS from
       upstream adding vector-accelerated audio delay functions
 .
   [ Jianfeng Liu ]
   * d/patches/upstream:
     - Fix-blink-compilation-for-platforms-other-than-x86-and-arm.patch: Fix
       FBTFS from upstream for blink audio delay function on loong64
chromium (146.0.7680.177-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-5272: Heap buffer overflow in GPU.
       Reported by inspector-ambitious.
     - CVE-2026-5273: Use after free in CSS. Reported by Anonymous.
     - CVE-2026-5274: Integer overflow in Codecs.
       Reported by heapracer (@heapracer).
     - CVE-2026-5275: Heap buffer overflow in ANGLE.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5276: Insufficient policy enforcement in WebUSB.
       Reported by Ariel Simon.
     - CVE-2026-5277: Integer overflow in ANGLE.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5278: Use after free in Web MIDI.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5279: Object corruption in V8.
       Reported by Hyeonjun Ahn (@_deayzl).
     - CVE-2026-5280: Use after free in WebCodecs.
       Reported by heapracer (@heapracer).
     - CVE-2026-5281: Use after free in Dawn.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-5282: Out of bounds read in WebCodecs.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5283: Inappropriate implementation in ANGLE.
       Reported by sweetchip.
     - CVE-2026-5284: Use after free in Dawn.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-5285: Use after free in WebGL.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5286: Use after free in Dawn. Reported by sweetchip.
     - CVE-2026-5287: Use after free in PDF. Reported by Syn4pse.
     - CVE-2026-5288: Use after free in WebView. Reported by Google.
     - CVE-2026-5289: Use after free in Navigation. Reported by Google.
     - CVE-2026-5290: Use after free in Compositing. Reported by Google.
     - CVE-2026-5291: Inappropriate implementation in WebGL.
       Reported by heapracer (@heapracer).
     - CVE-2026-5292: Out of bounds read in WebCodecs. Reported by Google.
   * d/patches:
     - upstream/Fix-blink-compilation-for-platforms-other-than-x86-and-arm.patch:
       drop, merged upstream.
     - ungoogled/disable-ai.patch: resync with u-c.
 .
   [ Daniel Richard G. ]
   * d/copyright: Exclude *.pb (protobuf) binary files.
   * d/patches: Various ungoogled-chromium-related updates.
     - disable/glic.patch: Drop, replaced with disable-ai.patch from the
       ungoogled-chromium project.
     - ungoogled/disable-ai.patch: Import new patch from ungoogled-chromium
       that zaps glic, screen_ai, and various other adjacent AI-based features.
     - ungoogled/disable-mei-preload.patch: Import patch to allow building
       without *.pb files.
     - ungoogled/disable-privacy-sandbox.patch: Update imported patch.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0005-blink-add-audio-vector-support.patch: Fix FBTFS from
       upstream adding vector-accelerated audio delay functions
 .
   [ Jianfeng Liu ]
   * d/patches/upstream:
     - Fix-blink-compilation-for-platforms-other-than-x86-and-arm.patch: Fix
       FBTFS from upstream for blink audio delay function on loong64
chromium (146.0.7680.177-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-5272: Heap buffer overflow in GPU.
       Reported by inspector-ambitious.
     - CVE-2026-5273: Use after free in CSS. Reported by Anonymous.
     - CVE-2026-5274: Integer overflow in Codecs.
       Reported by heapracer (@heapracer).
     - CVE-2026-5275: Heap buffer overflow in ANGLE.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5276: Insufficient policy enforcement in WebUSB.
       Reported by Ariel Simon.
     - CVE-2026-5277: Integer overflow in ANGLE.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5278: Use after free in Web MIDI.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5279: Object corruption in V8.
       Reported by Hyeonjun Ahn (@_deayzl).
     - CVE-2026-5280: Use after free in WebCodecs.
       Reported by heapracer (@heapracer).
     - CVE-2026-5281: Use after free in Dawn.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-5282: Out of bounds read in WebCodecs.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5283: Inappropriate implementation in ANGLE.
       Reported by sweetchip.
     - CVE-2026-5284: Use after free in Dawn.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-5285: Use after free in WebGL.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-5286: Use after free in Dawn. Reported by sweetchip.
     - CVE-2026-5287: Use after free in PDF. Reported by Syn4pse.
     - CVE-2026-5288: Use after free in WebView. Reported by Google.
     - CVE-2026-5289: Use after free in Navigation. Reported by Google.
     - CVE-2026-5290: Use after free in Compositing. Reported by Google.
     - CVE-2026-5291: Inappropriate implementation in WebGL.
       Reported by heapracer (@heapracer).
     - CVE-2026-5292: Out of bounds read in WebCodecs. Reported by Google.
   * d/patches:
     - upstream/Fix-blink-compilation-for-platforms-other-than-x86-and-arm.patch:
       drop, merged upstream.
     - ungoogled/disable-ai.patch: resync with u-c.
 .
   [ Daniel Richard G. ]
   * d/copyright: Exclude *.pb (protobuf) binary files.
   * d/patches: Various ungoogled-chromium-related updates.
     - disable/glic.patch: Drop, replaced with disable-ai.patch from the
       ungoogled-chromium project.
     - ungoogled/disable-ai.patch: Import new patch from ungoogled-chromium
       that zaps glic, screen_ai, and various other adjacent AI-based features.
     - ungoogled/disable-mei-preload.patch: Import patch to allow building
       without *.pb files.
     - ungoogled/disable-privacy-sandbox.patch: Update imported patch.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0005-blink-add-audio-vector-support.patch: Fix FBTFS from
       upstream adding vector-accelerated audio delay functions
 .
   [ Jianfeng Liu ]
   * d/patches/upstream:
     - Fix-blink-compilation-for-platforms-other-than-x86-and-arm.patch: Fix
       FBTFS from upstream for blink audio delay function on loong64
chromium (146.0.7680.164-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-4673: Heap buffer overflow in WebAudio.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-4674: Out of bounds read in CSS. Reported by Syn4pse.
     - CVE-2026-4675: Heap buffer overflow in WebGL.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-4676: Use after free in Dawn.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-4677: Out of bounds read in WebAudio.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-4678: Use after free in WebGPU. Reported by Google.
     - CVE-2026-4679: Integer overflow in Fonts.
       Reported by GF, Un3xploitable Of DeadSec.
     - CVE-2026-4680: Use after free in FedCM. Reported by Shaheen Fazim.
chromium (146.0.7680.164-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-4673: Heap buffer overflow in WebAudio.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-4674: Out of bounds read in CSS. Reported by Syn4pse.
     - CVE-2026-4675: Heap buffer overflow in WebGL.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-4676: Use after free in Dawn.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-4677: Out of bounds read in WebAudio.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-4678: Use after free in WebGPU. Reported by Google.
     - CVE-2026-4679: Integer overflow in Fonts.
       Reported by GF, Un3xploitable Of DeadSec.
     - CVE-2026-4680: Use after free in FedCM. Reported by Shaheen Fazim.
chromium (146.0.7680.164-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-4673: Heap buffer overflow in WebAudio.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-4674: Out of bounds read in CSS. Reported by Syn4pse.
     - CVE-2026-4675: Heap buffer overflow in WebGL.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-4676: Use after free in Dawn.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-4677: Out of bounds read in WebAudio.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-4678: Use after free in WebGPU. Reported by Google.
     - CVE-2026-4679: Integer overflow in Fonts.
       Reported by GF, Un3xploitable Of DeadSec.
     - CVE-2026-4680: Use after free in FedCM. Reported by Shaheen Fazim.
chromium (146.0.7680.153-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream (security?) release.
   * d/patches/disable/glic.patch: refresh for upstream tab nudging changes
 .
   [ Jianfeng Liu ]
   * add upstreamed patch of boringssl to fix loong64 build (closes: #1130569)
chromium (146.0.7680.153-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-4439: Out of bounds memory access in WebGL.
       Reported by Goodluck.
     - CVE-2026-4440: Out of bounds read and write in WebGL.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-4441: Use after free in Base. Reported by Google.
     - CVE-2026-4442: Heap buffer overflow in CSS. Reported by Syn4pse.
     - CVE-2026-4443: Heap buffer overflow in WebAudio.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-4444: Stack buffer overflow in WebRTC.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-4445: Use after free in WebRTC.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-4446: Use after free in WebRTC.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-4447: Inappropriate implementation in V8. Reported by Erge.
     - CVE-2026-4448: Heap buffer overflow in ANGLE.
       Reported by M. Fauzan Wijaya (Gh05t666nero).
     - CVE-2026-4449: Use after free in Blink. Reported by Syn4pse.
     - CVE-2026-4450: Out of bounds write in V8. Reported by qymag1c.
     - CVE-2026-4451: Insufficient validation of untrusted input in
       Navigation. Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-4452: Integer overflow in ANGLE. Reported by cinzinga.
     - CVE-2026-4453: Integer overflow in Dawn. Reported by sweetchip.
     - CVE-2026-4454: Use after free in Network.
       Reported by heapracer (@heapracer).
     - CVE-2026-4455: Heap buffer overflow in PDFium.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-4456: Use after free in Digital Credentials API.
       Reported by sean wong.
     - CVE-2026-4457: Type Confusion in V8.
       Reported by Zhenpeng (Leo) Lin at depthfirst.
     - CVE-2026-4458: Use after free in Extensions. Reported by Shaheen Fazim.
     - CVE-2026-4459: Out of bounds read and write in WebAudio. Reported by
       Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern)
     - CVE-2026-4460: Out of bounds read in Skia.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-4461: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-4462: Out of bounds read in Blink.
       Reported by heapracer (@heapracer).
     - CVE-2026-4463: Heap buffer overflow in WebRTC.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-4464: Integer overflow in ANGLE. Reported by heesun.
   * d/patches/disable/glic.patch: refresh for upstream tab nudging changes
 .
   [ Jianfeng Liu ]
   * add upstreamed patch of boringssl to fix loong64 build (closes: #1130569)
chromium (146.0.7680.153-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-4439: Out of bounds memory access in WebGL.
       Reported by Goodluck.
     - CVE-2026-4440: Out of bounds read and write in WebGL.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-4441: Use after free in Base. Reported by Google.
     - CVE-2026-4442: Heap buffer overflow in CSS. Reported by Syn4pse.
     - CVE-2026-4443: Heap buffer overflow in WebAudio.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-4444: Stack buffer overflow in WebRTC.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-4445: Use after free in WebRTC.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-4446: Use after free in WebRTC.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-4447: Inappropriate implementation in V8. Reported by Erge.
     - CVE-2026-4448: Heap buffer overflow in ANGLE.
       Reported by M. Fauzan Wijaya (Gh05t666nero).
     - CVE-2026-4449: Use after free in Blink. Reported by Syn4pse.
     - CVE-2026-4450: Out of bounds write in V8. Reported by qymag1c.
     - CVE-2026-4451: Insufficient validation of untrusted input in
       Navigation. Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-4452: Integer overflow in ANGLE. Reported by cinzinga.
     - CVE-2026-4453: Integer overflow in Dawn. Reported by sweetchip.
     - CVE-2026-4454: Use after free in Network.
       Reported by heapracer (@heapracer).
     - CVE-2026-4455: Heap buffer overflow in PDFium.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-4456: Use after free in Digital Credentials API.
       Reported by sean wong.
     - CVE-2026-4457: Type Confusion in V8.
       Reported by Zhenpeng (Leo) Lin at depthfirst.
     - CVE-2026-4458: Use after free in Extensions. Reported by Shaheen Fazim.
     - CVE-2026-4459: Out of bounds read and write in WebAudio. Reported by
       Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern)
     - CVE-2026-4460: Out of bounds read in Skia.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-4461: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-4462: Out of bounds read in Blink.
       Reported by heapracer (@heapracer).
     - CVE-2026-4463: Heap buffer overflow in WebRTC.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-4464: Integer overflow in ANGLE. Reported by heesun.
   * d/patches/disable/glic.patch: refresh for upstream tab nudging changes
 .
   [ Jianfeng Liu ]
   * add upstreamed patch of boringssl to fix loong64 build (closes: #1130569)
chromium (146.0.7680.80-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-3909: Out of bounds write in Skia.
       Reported by Google Threat Analysis Group.
     - CVE-2026-3910: Inappropriate implementation in V8.
       Reported by Google Threat Analysis Group.
   * d/patches/disable/glic.patch: drop an unnecessary pieces of the patch.
chromium (146.0.7680.80-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-3909: Out of bounds write in Skia.
       Reported by Google Threat Analysis Group.
     - CVE-2026-3910: Inappropriate implementation in V8.
       Reported by Google Threat Analysis Group.
   * d/patches/disable/glic.patch: drop an unnecessary pieces of the patch.
chromium (146.0.7680.80-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-3909: Out of bounds write in Skia.
       Reported by Google Threat Analysis Group.
     - CVE-2026-3910: Inappropriate implementation in V8.
       Reported by Google Threat Analysis Group.
   * d/patches/disable/glic.patch: drop an unnecessary pieces of the patch.
chromium (146.0.7680.71-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream stable release.
     - CVE-2026-3913: Heap buffer overflow in WebML. Reported by Tobias Wienand
     - CVE-2026-3914: Integer overflow in WebML. Reported by cinzinga.
     - CVE-2026-3915: Heap buffer overflow in WebML. Reported by Tobias Wienand
     - CVE-2026-3916: Out of bounds read in Web Speech.
       Reported by Grischa Hauser.
     - CVE-2026-3917: Use after free in Agents. Reported by Syn4pse.
     - CVE-2026-3918: Use after free in WebMCP. Reported by Syn4pse.
     - CVE-2026-3919: Use after free in Extensions. Reported by Huinian Yang
       (@vmth6) of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd
     - CVE-2026-3920: Out of bounds memory access in WebML. Reported by Google.
     - CVE-2026-3921: Use after free in TextEncoding.
       Reported by Pranamya Keshkamat & Cantina.xyz.
     - CVE-2026-3922: Use after free in MediaStream.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-3923: Use after free in WebMIDI.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-3924: Use after free in WindowDialog.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-3925: Incorrect security UI in LookalikeChecks.
       Reported by NDevTK and Alesandro Ortiz.
     - CVE-2026-3926: Out of bounds read in V8. Reported by qymag1c.
     - CVE-2026-3927: Incorrect security UI in PictureInPicture.
       Reported by Barath Stalin K.
     - CVE-2026-3928: Insufficient policy enforcement in Extensions.
       Reported by portsniffer443.
     - CVE-2026-3929: Side-channel information leakage in ResourceTiming.
       Reported by Povcfe of Tencent Security Xuanwu Lab.
     - CVE-2026-3930: Unsafe navigation in Navigation.
       Reported by Povcfe of Tencent Security Xuanwu Lab.
     - CVE-2026-3931: Heap buffer overflow in Skia. Reported by Huinian Yang
       (@vmth6) of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd
     - CVE-2026-3932: Insufficient policy enforcement in PDF.
       Reported by Ayato Shitomi.
     - CVE-2026-3934: Insufficient policy enforcement in ChromeDriver.
       Reported by Povcfe of Tencent Security Xuanwu Lab.
     - CVE-2026-3935: Incorrect security UI in WebAppInstalls.
       Reported by Barath Stalin K.
     - CVE-2026-3936: Use after free in WebView. Reported by Am4deu$.
     - CVE-2026-3937: Incorrect security UI in Downloads.
       Reported by Abhishek Kumar.
     - CVE-2026-3938: Insufficient policy enforcement in Clipboard.
       Reported by vicevirus.
     - CVE-2026-3939: Insufficient policy enforcement in PDF. Reported by NDevTK
     - CVE-2026-3940: Insufficient policy enforcement in DevTools.
       Reported by Jorian Woltjer, Mian, bug_blitzer.
     - CVE-2026-3941: Insufficient policy enforcement in DevTools.
       Reported by Lyra Rebane (rebane2001).
     - CVE-2026-3942: Incorrect security UI in PictureInPicture.
       Reported by Barath Stalin K.
   * d/rules: update rustc version string for new upstream expectations of
     no spaces.
   * d/patches:
     - upstream/disable-unrar.patch: drop, merged upstream.
     - disable/signin.patch: drop part of the patch. This patch should be
       reviewed in the future and coordinated w/ ungoogled-chromium, since
       it originally came from them.
     - disable/glic.patch: add a bunch more glic removals.
     - disable/license-headless-shell.patch: refresh.
     - disable/unrar.patch: refresh.
     - system/rollup.patch: refresh.
     - bookworm/foreach.patch: refresh.
     - ungoogled/disable-privacy-sandbox.patch: sync from ungoogled-chromium.
     - disable/catapult.patch: update to remove some more catapult deps.
     - fixes/force-rust-nightly.patch: drop, no longer needed.
     - llvm-22/ignore-for-ubsan.patch: add a build fix for a compiler
       flag/feature added to llvm-23.
     - fixes/bytemuck.patch: add rust build fix in bytemuck.
     - llvm-19/clang-19-crash.patch: add build fix; delete code that makes
       clang-19++ crash.
     - llvm-19/keyfactory.patch: add build fix for what I suspect is a clang-19
       issue.
     - loongarch64/0018-fix-study-crash.patch: refresh.
     - ppc64le/breakpad/0001-Implement-support-for-ppc64-on-Linux.patch:
       refresh.
     - ppc64le/fixes/fix-study-crash.patch: refresh.
     - llvm-19/clone-traits.patch: add patch to remove a static assertion.
     - llvm-19/octal.patch: add patch to work around 0o666 vs 0666 support.
     - upstream/profile.patch: add header inclusion build fix from upstream.
     - trixie/value-or.patch: move to llvm-19/ directory & also add another
       place that clang-19 gets confused during build.
     - rust-1.85/jxl-features.patch: refresh [trixie, bookworm].
     - rust-1.85/jxl-simd-avx512.patch: update for (numerous) upstream
       changes, and added unsafe{} blocks to the macro definitions to shrink
       this patch in the future [trixie, bookworm].
     - fixes/missing-dep.patch: add patch for dependency-related build failure
       that only happens sometimes.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0001-Add-PPC64-support-for-boringssl.patch: refresh
       for upstream changes
     - third_party/0002-third_party-libvpx-Remove-bad-ppc64-config.patch:
       refresh for upstream changes
 .
   [ Daniel Richard G. ]
   * d/patches:
     - disable/lint.patch: New patch to disable CSS/JS linting tools.
     - bookworm/node18-compat.patch: New patch to fix various compatibility
       issues with nodejs 18 [bookworm].
     - trixie/gn-len.patch: Zap another instance of len() for older GN
       [trixie, bookworm].
chromium (146.0.7680.71-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream stable release.
     - CVE-2026-3913: Heap buffer overflow in WebML. Reported by Tobias Wienand
     - CVE-2026-3914: Integer overflow in WebML. Reported by cinzinga.
     - CVE-2026-3915: Heap buffer overflow in WebML. Reported by Tobias Wienand
     - CVE-2026-3916: Out of bounds read in Web Speech.
       Reported by Grischa Hauser.
     - CVE-2026-3917: Use after free in Agents. Reported by Syn4pse.
     - CVE-2026-3918: Use after free in WebMCP. Reported by Syn4pse.
     - CVE-2026-3919: Use after free in Extensions. Reported by Huinian Yang
       (@vmth6) of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd
     - CVE-2026-3920: Out of bounds memory access in WebML. Reported by Google.
     - CVE-2026-3921: Use after free in TextEncoding.
       Reported by Pranamya Keshkamat & Cantina.xyz.
     - CVE-2026-3922: Use after free in MediaStream.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-3923: Use after free in WebMIDI.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-3924: Use after free in WindowDialog.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-3925: Incorrect security UI in LookalikeChecks.
       Reported by NDevTK and Alesandro Ortiz.
     - CVE-2026-3926: Out of bounds read in V8. Reported by qymag1c.
     - CVE-2026-3927: Incorrect security UI in PictureInPicture.
       Reported by Barath Stalin K.
     - CVE-2026-3928: Insufficient policy enforcement in Extensions.
       Reported by portsniffer443.
     - CVE-2026-3929: Side-channel information leakage in ResourceTiming.
       Reported by Povcfe of Tencent Security Xuanwu Lab.
     - CVE-2026-3930: Unsafe navigation in Navigation.
       Reported by Povcfe of Tencent Security Xuanwu Lab.
     - CVE-2026-3931: Heap buffer overflow in Skia. Reported by Huinian Yang
       (@vmth6) of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd
     - CVE-2026-3932: Insufficient policy enforcement in PDF.
       Reported by Ayato Shitomi.
     - CVE-2026-3934: Insufficient policy enforcement in ChromeDriver.
       Reported by Povcfe of Tencent Security Xuanwu Lab.
     - CVE-2026-3935: Incorrect security UI in WebAppInstalls.
       Reported by Barath Stalin K.
     - CVE-2026-3936: Use after free in WebView. Reported by Am4deu$.
     - CVE-2026-3937: Incorrect security UI in Downloads.
       Reported by Abhishek Kumar.
     - CVE-2026-3938: Insufficient policy enforcement in Clipboard.
       Reported by vicevirus.
     - CVE-2026-3939: Insufficient policy enforcement in PDF. Reported by NDevTK
     - CVE-2026-3940: Insufficient policy enforcement in DevTools.
       Reported by Jorian Woltjer, Mian, bug_blitzer.
     - CVE-2026-3941: Insufficient policy enforcement in DevTools.
       Reported by Lyra Rebane (rebane2001).
     - CVE-2026-3942: Incorrect security UI in PictureInPicture.
       Reported by Barath Stalin K.
   * d/rules: update rustc version string for new upstream expectations of
     no spaces.
   * d/patches:
     - upstream/disable-unrar.patch: drop, merged upstream.
     - disable/signin.patch: drop part of the patch. This patch should be
       reviewed in the future and coordinated w/ ungoogled-chromium, since
       it originally came from them.
     - disable/glic.patch: add a bunch more glic removals.
     - disable/license-headless-shell.patch: refresh.
     - disable/unrar.patch: refresh.
     - system/rollup.patch: refresh.
     - bookworm/foreach.patch: refresh.
     - ungoogled/disable-privacy-sandbox.patch: sync from ungoogled-chromium.
     - disable/catapult.patch: update to remove some more catapult deps.
     - fixes/force-rust-nightly.patch: drop, no longer needed.
     - llvm-22/ignore-for-ubsan.patch: add a build fix for a compiler
       flag/feature added to llvm-23.
     - fixes/bytemuck.patch: add rust build fix in bytemuck.
     - llvm-19/clang-19-crash.patch: add build fix; delete code that makes
       clang-19++ crash.
     - llvm-19/keyfactory.patch: add build fix for what I suspect is a clang-19
       issue.
     - loongarch64/0018-fix-study-crash.patch: refresh.
     - ppc64le/breakpad/0001-Implement-support-for-ppc64-on-Linux.patch:
       refresh.
     - ppc64le/fixes/fix-study-crash.patch: refresh.
     - llvm-19/clone-traits.patch: add patch to remove a static assertion.
     - llvm-19/octal.patch: add patch to work around 0o666 vs 0666 support.
     - upstream/profile.patch: add header inclusion build fix from upstream.
     - trixie/value-or.patch: move to llvm-19/ directory & also add another
       place that clang-19 gets confused during build.
     - rust-1.85/jxl-features.patch: refresh [trixie, bookworm].
     - rust-1.85/jxl-simd-avx512.patch: update for (numerous) upstream
       changes, and added unsafe{} blocks to the macro definitions to shrink
       this patch in the future [trixie, bookworm].
     - fixes/missing-dep.patch: add patch for dependency-related build failure
       that only happens sometimes.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0001-Add-PPC64-support-for-boringssl.patch: refresh
       for upstream changes
     - third_party/0002-third_party-libvpx-Remove-bad-ppc64-config.patch:
       refresh for upstream changes
 .
   [ Daniel Richard G. ]
   * d/patches:
     - disable/lint.patch: New patch to disable CSS/JS linting tools.
     - bookworm/node18-compat.patch: New patch to fix various compatibility
       issues with nodejs 18 [bookworm].
     - trixie/gn-len.patch: Zap another instance of len() for older GN
       [trixie, bookworm].
chromium (146.0.7680.71-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream stable release.
     - CVE-2026-3913: Heap buffer overflow in WebML. Reported by Tobias Wienand
     - CVE-2026-3914: Integer overflow in WebML. Reported by cinzinga.
     - CVE-2026-3915: Heap buffer overflow in WebML. Reported by Tobias Wienand
     - CVE-2026-3916: Out of bounds read in Web Speech.
       Reported by Grischa Hauser.
     - CVE-2026-3917: Use after free in Agents. Reported by Syn4pse.
     - CVE-2026-3918: Use after free in WebMCP. Reported by Syn4pse.
     - CVE-2026-3919: Use after free in Extensions. Reported by Huinian Yang
       (@vmth6) of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd
     - CVE-2026-3920: Out of bounds memory access in WebML. Reported by Google.
     - CVE-2026-3921: Use after free in TextEncoding.
       Reported by Pranamya Keshkamat & Cantina.xyz.
     - CVE-2026-3922: Use after free in MediaStream.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-3923: Use after free in WebMIDI.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-3924: Use after free in WindowDialog.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-3925: Incorrect security UI in LookalikeChecks.
       Reported by NDevTK and Alesandro Ortiz.
     - CVE-2026-3926: Out of bounds read in V8. Reported by qymag1c.
     - CVE-2026-3927: Incorrect security UI in PictureInPicture.
       Reported by Barath Stalin K.
     - CVE-2026-3928: Insufficient policy enforcement in Extensions.
       Reported by portsniffer443.
     - CVE-2026-3929: Side-channel information leakage in ResourceTiming.
       Reported by Povcfe of Tencent Security Xuanwu Lab.
     - CVE-2026-3930: Unsafe navigation in Navigation.
       Reported by Povcfe of Tencent Security Xuanwu Lab.
     - CVE-2026-3931: Heap buffer overflow in Skia. Reported by Huinian Yang
       (@vmth6) of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd
     - CVE-2026-3932: Insufficient policy enforcement in PDF.
       Reported by Ayato Shitomi.
     - CVE-2026-3934: Insufficient policy enforcement in ChromeDriver.
       Reported by Povcfe of Tencent Security Xuanwu Lab.
     - CVE-2026-3935: Incorrect security UI in WebAppInstalls.
       Reported by Barath Stalin K.
     - CVE-2026-3936: Use after free in WebView. Reported by Am4deu$.
     - CVE-2026-3937: Incorrect security UI in Downloads.
       Reported by Abhishek Kumar.
     - CVE-2026-3938: Insufficient policy enforcement in Clipboard.
       Reported by vicevirus.
     - CVE-2026-3939: Insufficient policy enforcement in PDF. Reported by NDevTK
     - CVE-2026-3940: Insufficient policy enforcement in DevTools.
       Reported by Jorian Woltjer, Mian, bug_blitzer.
     - CVE-2026-3941: Insufficient policy enforcement in DevTools.
       Reported by Lyra Rebane (rebane2001).
     - CVE-2026-3942: Incorrect security UI in PictureInPicture.
       Reported by Barath Stalin K.
   * d/rules: update rustc version string for new upstream expectations of
     no spaces.
   * d/patches:
     - upstream/disable-unrar.patch: drop, merged upstream.
     - disable/signin.patch: drop part of the patch. This patch should be
       reviewed in the future and coordinated w/ ungoogled-chromium, since
       it originally came from them.
     - disable/glic.patch: add a bunch more glic removals.
     - disable/license-headless-shell.patch: refresh.
     - disable/unrar.patch: refresh.
     - system/rollup.patch: refresh.
     - bookworm/foreach.patch: refresh.
     - ungoogled/disable-privacy-sandbox.patch: sync from ungoogled-chromium.
     - disable/catapult.patch: update to remove some more catapult deps.
     - fixes/force-rust-nightly.patch: drop, no longer needed.
     - llvm-22/ignore-for-ubsan.patch: add a build fix for a compiler
       flag/feature added to llvm-23.
     - fixes/bytemuck.patch: add rust build fix in bytemuck.
     - llvm-19/clang-19-crash.patch: add build fix; delete code that makes
       clang-19++ crash.
     - llvm-19/keyfactory.patch: add build fix for what I suspect is a clang-19
       issue.
     - loongarch64/0018-fix-study-crash.patch: refresh.
     - ppc64le/breakpad/0001-Implement-support-for-ppc64-on-Linux.patch:
       refresh.
     - ppc64le/fixes/fix-study-crash.patch: refresh.
     - llvm-19/clone-traits.patch: add patch to remove a static assertion.
     - llvm-19/octal.patch: add patch to work around 0o666 vs 0666 support.
     - upstream/profile.patch: add header inclusion build fix from upstream.
     - trixie/value-or.patch: move to llvm-19/ directory & also add another
       place that clang-19 gets confused during build.
     - rust-1.85/jxl-features.patch: refresh [trixie, bookworm].
     - rust-1.85/jxl-simd-avx512.patch: update for (numerous) upstream
       changes, and added unsafe{} blocks to the macro definitions to shrink
       this patch in the future [trixie, bookworm].
     - fixes/missing-dep.patch: add patch for dependency-related build failure
       that only happens sometimes.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0001-Add-PPC64-support-for-boringssl.patch: refresh
       for upstream changes
     - third_party/0002-third_party-libvpx-Remove-bad-ppc64-config.patch:
       refresh for upstream changes
 .
   [ Daniel Richard G. ]
   * d/patches:
     - disable/lint.patch: New patch to disable CSS/JS linting tools.
     - bookworm/node18-compat.patch: New patch to fix various compatibility
       issues with nodejs 18 [bookworm].
     - trixie/gn-len.patch: Zap another instance of len() for older GN
       [trixie, bookworm].
chromium (145.0.7632.159-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-3536: Integer overflow in ANGLE. Reported by cinzinga.
     - CVE-2026-3537: Object lifecycle issue in PowerVR.
       Reported by Zhihua Yao of KunLun Lab.
     - CVE-2026-3538: Integer overflow in Skia.
       Reported by Symeon Paraschoudis.
     - CVE-2026-3539: Object lifecycle issue in DevTools.
       Reported by Zhenpeng (Leo) Lin at depthfirst.
     - CVE-2026-3540: Inappropriate implementation in WebAudio.
       Reported by Davi Antônio Cruz.
     - CVE-2026-3541: Inappropriate implementation in CSS. Reported by Syn4pse.
     - CVE-2026-3542: Inappropriate implementation in WebAssembly.
       Reported by qymag1c.
     - CVE-2026-3543: Inappropriate implementation in V8. Reported by qymag1c.
     - CVE-2026-3544: Heap buffer overflow in WebCodecs.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-3545: Insufficient data validation in Navigation.
       Reported by Google.
 .
   [ Daniel Richard G. ]
   * Re-bundle libxslt, to fix crashes due to an ABI incompatibility between
     the bundled libxml2 and the system libxml2 used by the system libxslt.
     - d/clean, d/control, d/copyright: Remove libxslt references.
     - d/scripts/unbundle: Add entry for libxslt.

cimg (3.5.2+dfsg-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-42144: Integer overflow in PNM size check
   * CVE-2026-42146: OOM on crafted BMP
   * (Closes: #1135778)

cockpit (337-1+deb13u1) trixie; urgency=medium
 .
   * ws: Be more explicit when handling hostnames on cli.
     [CVE-2026-4631] (Closes: #1133022, #1133122)

composer (2.8.8-1+deb13u2) trixie; urgency=medium
 .
   * Fix command injection via malicious Perforce repository definition
     [CVE-2026-40261]
   * Fix command injection via malicious Perforce source reference/url
     [CVE-2026-40176]

corosync (3.1.9-2+deb13u1) trixie-security; urgency=high
 .
   * [128a6c1] New patch: totemsrp: Return error if sanity check fails.
     Fixes CVE-2026-35091. Thanks to Jan Friesse (Closes: #1133838)
   * [f46d7eb] New patch: totemsrp: Fix integer overflow in memb_join_sanity.
     Fixes CVE-2026-35092. Thanks to Jan Friesse (Closes: #1133837)

cpp-httplib (0.18.7-1+deb13u1) trixie-security; urgency=medium
 .
   * fix CVE-2025-46728 (DoS via unbounded request line length).
     While this patch intended to enforce request body size limits for
     chunked Transfer-Encoding, it actually adds size limits for a unique
     lines read from HTTP requests, solving another kind of DoS.
     See the GHSA-px83-72rx-v57c GitHub advisory for more details.
     Thanks to Yang Wang for the patch!
     Closes: #1104926
 .
   * fix CVE-2025-52887 (Unlimited number of HTTP headers causes memory leak).
     This patch adds a limit to the number of headers which
     can be passed in an HTTP request, mitigating a possible DoS due to memory
     exhaustion.
     See bug #1109340 and the GHSA-xjhg-gf59-p92h GitHub advisory for more
     details.
 .
   * fix CVE-2025-53629 (Unbounded Memory Allocation in Chunked Requests).
     This patch complements the fix for CVE-2025-46728, actually solving
     memory exhaustion attacks via chucked HTTP requests.
     See bug #1109340 and the GHSA-qjmq-h3cc-qv6w GitHub advisory for more
     details.

curl (8.14.1-2+deb13u3) trixie; urgency=medium
 .
   * Team upload.
   * d/p/CVE-2025-13034.patch: cherry-pick from upstream

debian-installer (20250803+deb13u5) trixie; urgency=medium
 .
   * Bump Linux kernel ABI to 6.12.86+deb13.
   * Adjust linux-image build-deps accordingly.

debian-installer-netboot-images (20250803+deb13u5) trixie; urgency=medium
 .
   * Update to 20250803+deb13u5, from trixie-proposed-updates.

debmirror (1:2.47+deb13u1) trixie; urgency=medium
 .
   [ Raphaël Halimi ]
   * Add debmirror-specific User-Agent header (closes: #1135891).

distribution-gpg-keys (1.119+ds-1~deb13u1) trixie; urgency=medium
 .
   * Merge tag 'debian/1.119+ds-1' into debian/trixie
 .
 distribution-gpg-keys (1.119+ds-1) unstable; urgency=medium
 .
   * Update upstream source from tag 'upstream/1.119+ds'
 .
 distribution-gpg-keys (1.118+ds-1) unstable; urgency=medium
 .
   * Update upstream source from tag 'upstream/1.118+ds'
distribution-gpg-keys (1.119+ds-1~deb13u1~bpo12+1) bookworm-backports; urgency=medium
 .
   * Rebuild for bookworm-backports.
 .
 distribution-gpg-keys (1.119+ds-1~deb13u1) trixie; urgency=medium
 .
   * Merge tag 'debian/1.119+ds-1' into debian/trixie
 .
 distribution-gpg-keys (1.119+ds-1) unstable; urgency=medium
 .
   * Update upstream source from tag 'upstream/1.119+ds'
 .
 distribution-gpg-keys (1.118+ds-1) unstable; urgency=medium
 .
   * Update upstream source from tag 'upstream/1.118+ds'
distribution-gpg-keys (1.118+ds-1) unstable; urgency=medium
 .
   * Update upstream source from tag 'upstream/1.118+ds'
distribution-gpg-keys (1.117+ds-1) unstable; urgency=high
 .
   * Update upstream source from tag 'upstream/1.117+ds'

distro-info-data (0.66+deb13u2) trixie; urgency=medium
 .
   * Add Ubuntu 26.10 "Stonking Stingray" (LP: #2150234).

dnsdist (1.9.14-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 1.9.14, fixing (from 1.9.13) CVE-2026-33257,
     CVE-2026-33260, CVE-2026-33596, CVE-2026-33597, CVE-2026-33598,
     CVE-2026-33599, CVE-2026-33602, CVE-2026-33595, CVE-2026-33254,
     CVE-2026-33594, CVE-2026-33593, (from 1.9.12) CVE-2026-0396,
     CVE-2026-0397, CVE-2026-24028, CVE-2026-24029, CVE-2026-24030,
     CVE-2026-27853, CVE-2026-27854.
   * Drop upstream-applied patches.

dnsmasq (2.91-1+deb13u1) trixie-security; urgency=high
 .
   * d/p/*:
     - CVE-2026-2291.patch: Fix buffer overflow in struct bigname.
     - CVE-2026-4890.patch: Fix NSEC bitmap parsing infinite loop.
     - CVE-2026-4891.patch: Verify rdlen field in RRSIG packets.
     - CVE-2026-4892.patch: Fix buffer overflow in helper.c with large CLIDs.
     - CVE-2026-4893.patch: Fix broken client subnet validation.
     - CVE-2026-5172.patch: Fix buffer overflow vulnerability in
       extract_addresses().

dovecot (1:2.4.1+dfsg1-6+deb13u5) trixie; urgency=medium
 .
   * [b357180] autopkgtests: Add managesieved authentication test
   * [c9d69a1] Fix memory leak in CVE-2026-27857 fix
dovecot (1:2.4.1+dfsg1-6+deb13u4) trixie-security; urgency=medium
 .
   * [bc29057] CVE-2025-59028: auth: Don't disconnect auth client when
     invalid base64 SASL input is received
   * [fee7a9a] CVE-2025-59031: stop shipping the decode2text shell script
   * [9a4442e] CVE-2025-59032: managesieve-login: Fix crash when command
     didn't finish on the first call
   * [2711b3e] CVE-2026-24031, CVE-2026-27860: auth: fix ldap and sql
     injection
   * [d30f1c3] CVE-2026-27855: fix OTP authentication reply vulnerability
   * [e1b0ff7] CVE-2026-27856: doveadm: fix timing oracle attack
   * [b8a69bf] CVE-2026-27857: fix resource exhaustion DoS in NOOP command
     parsing
   * [85dd068] CVE-2026-27858: fix pre-authentication managesieve memory
     consumption issue
   * [880e332] CVE-2026-27859: fix uncontrolled resource allocation when
     delivering specially crafted email messages

ejabberd (24.12-3+deb13u2) trixie; urgency=medium
 .
   [ Holger Weiss ]
   * Ignore cert purpose for incoming s2s connections

ejabberd-contrib (0.2025.01.11~dfsg0-2+deb13u2) trixie; urgency=medium
 .
   * Build for ejabberd 24.12-3+deb13u2

epics-base (7.0.8.1+dfsg1-7+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * Skip testChannelAccess. Closes: #1108052.

erlang (1:27.3.4.1+dfsg-1+deb13u2) trixie; urgency=medium
 .
   [ Lucas Kanashiro ]
   * Fix CVE-2026-21620.
     Relative Path Traversal, Improper Isolation or Compartmentalization
     vulnerability in Erlang OTP (tftp_file modules). Closes: #1128651
   * Fix CVE-2026-23941.
     Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
     vulnerability in Erlang OTP (inets httpd module) allows HTTP Request
     Smuggling.
     - d/p/CVE-2026-23941.patch
   * Fix CVE-2026-23942.
     Improper Limitation of a Pathname to a Restricted Directory ('Path
     Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path
     Traversal.
     - d/p/CVE-2026-23942.patch
   * Fix CVE-2026-23943.
     Improper Handling of Highly Compressed Data (Compression Bomb)
     vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of
     Service via Resource Depletion.
     - d/p/CVE-2026-23943.patch
     Closes: #1130912

erlang-p1-tls (1.1.22-1+deb13u1) trixie; urgency=medium
 .
   * Add upstream commit which allows accepting client certificates without
     the sslclient purpose flag (Closes: #1127369)

exim4 (4.98.2-1+deb13u2) trixie-security; urgency=high
 .
   * Backport fix for Use-After-Free in GnuTLS BDAT/CHUNKING code path.
     This is Exim-Security-2026-05-01.1, fixed upstream in 4.99.3.
exim4 (4.98.2-1+deb13u1) trixie; urgency=medium
 .
   * Fix GnuTLS hostname verify of a server certificate with a zero-length
     Subject. Patch from upstream GIT master (Closes: #1134984)
   * Pull CVE-fixes from 4.99.2
     +CVE-2026-40684  Possible crash with malicious DNS data when using musl
      libc On systems using musl libc (not glibc) due to an oddity in octal
      printing it is possible to crash the connection instance when malformed
      DNS data is present in PTR records.
     +CVE-2026-40685  Possible OOB read/write on corrupt JSON in header
      configurations using json operators on invalid externally-provided input
      could trigger heap corruption.
     +CVE-2026-40686  Possible OOB read with large UTF8 trailing characters
      configurations using utf8 operators on malformed utf8 in headers could
      trigger OOB reads and might trigger some data leak if error messages are
      required for subsequent emails in the current connection and similar
      malformed headers are present.
     +CVE-2026-40687  Possible OOB read/write with SPA authenticator in
      configurations using the SPA authentication driver to a
      hostile/compromised external SPA/NTLM connection it is possible to
      trigger an OOB read/write and crash the connection instance or possibly
      leak heap data to the instance.

feed2toot (0.17-1+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * debian/patches/fix-compatibility-with-py3.13.patch: add new patch so
     feed2toot works again. (Closes: #1118778)
   * debian/tests/control: add superficial test to catch problems.

firefox-esr (140.10.2esr-1~deb13u1) trixie-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-41, also known as:
     CVE-2026-8090, CVE-2026-8094, CVE-2026-8092.
firefox-esr (140.10.2esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-41, also known as:
     CVE-2026-8090, CVE-2026-8094, CVE-2026-8092.
firefox-esr (140.10.1esr-1) unstable; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-36, also known as:
     CVE-2026-7320, CVE-2026-7321, CVE-2026-7322, CVE-2026-7323.
firefox-esr (140.10.1esr-1~deb13u1) trixie-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-36, also known as:
     CVE-2026-7320, CVE-2026-7321, CVE-2026-7322, CVE-2026-7323.
firefox-esr (140.10.1esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-36, also known as:
     CVE-2026-7320, CVE-2026-7321, CVE-2026-7322, CVE-2026-7323.
firefox-esr (140.10.0esr-1) unstable; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-32, also known as:
     CVE-2026-6746, CVE-2026-6747, CVE-2026-6748, CVE-2026-6749,
     CVE-2026-6750, CVE-2026-6751, CVE-2026-6752, CVE-2026-6753,
     CVE-2026-6754, CVE-2026-6757, CVE-2026-6761, CVE-2026-6762,
     CVE-2026-6763, CVE-2026-6764, CVE-2026-6765, CVE-2026-6769,
     CVE-2026-6770, CVE-2026-6771, CVE-2026-6776, CVE-2026-6785,
     CVE-2026-6786.
firefox-esr (140.10.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-32, also known as:
     CVE-2026-6746, CVE-2026-6747, CVE-2026-6748, CVE-2026-6749,
     CVE-2026-6750, CVE-2026-6751, CVE-2026-6752, CVE-2026-6753,
     CVE-2026-6754, CVE-2026-6757, CVE-2026-6761, CVE-2026-6762,
     CVE-2026-6763, CVE-2026-6764, CVE-2026-6765, CVE-2026-6766,
     CVE-2026-6767, CVE-2026-6769, CVE-2026-6770, CVE-2026-6771,
     CVE-2026-6772, CVE-2026-6776, CVE-2026-6785, CVE-2026-6786.
firefox-esr (140.10.0esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-32, also known as:
     CVE-2026-6746, CVE-2026-6747, CVE-2026-6748, CVE-2026-6749,
     CVE-2026-6750, CVE-2026-6751, CVE-2026-6752, CVE-2026-6753,
     CVE-2026-6754, CVE-2026-6757, CVE-2026-6761, CVE-2026-6762,
     CVE-2026-6763, CVE-2026-6764, CVE-2026-6765, CVE-2026-6766,
     CVE-2026-6767, CVE-2026-6769, CVE-2026-6770, CVE-2026-6771,
     CVE-2026-6772, CVE-2026-6776, CVE-2026-6785, CVE-2026-6786.
firefox-esr (140.9.1esr-1) unstable; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-27, also known as:
     CVE-2026-5732, CVE-2026-5731, CVE-2026-5734.
firefox-esr (140.9.1esr-1~deb13u1) trixie-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-27, also known as:
     CVE-2026-5732, CVE-2026-5731, CVE-2026-5734.
firefox-esr (140.9.1esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-27, also known as:
     CVE-2026-5732, CVE-2026-5731, CVE-2026-5734.
firefox-esr (140.9.0esr-1) unstable; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-22, also known as:
     CVE-2026-4684, CVE-2026-4685, CVE-2026-4686, CVE-2026-4688,
     CVE-2026-4689, CVE-2026-4690, CVE-2026-4691, CVE-2026-4692,
     CVE-2026-4693, CVE-2026-4694, CVE-2026-4695, CVE-2026-4696,
     CVE-2026-4697, CVE-2026-4698, CVE-2026-4699, CVE-2026-4700,
     CVE-2026-4701, CVE-2026-4702, CVE-2026-4704, CVE-2026-4705,
     CVE-2026-4706, CVE-2026-4707, CVE-2026-4708, CVE-2026-4709,
     CVE-2026-4710, CVE-2026-4713, CVE-2026-4714, CVE-2026-4715,
     CVE-2026-4716, CVE-2026-4717, CVE-2025-59375, CVE-2026-4718,
     CVE-2026-4719, CVE-2026-4720, CVE-2026-4721.
firefox-esr (140.9.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-22, also known as:
     CVE-2026-4684, CVE-2026-4685, CVE-2026-4686, CVE-2026-4688,
     CVE-2026-4689, CVE-2026-4690, CVE-2026-4691, CVE-2026-4692,
     CVE-2026-4693, CVE-2026-4694, CVE-2026-4695, CVE-2026-4696,
     CVE-2026-4697, CVE-2026-4698, CVE-2026-4699, CVE-2026-4700,
     CVE-2026-4701, CVE-2026-4702, CVE-2026-4704, CVE-2026-4705,
     CVE-2026-4706, CVE-2026-4707, CVE-2026-4708, CVE-2026-4709,
     CVE-2026-4710, CVE-2026-4713, CVE-2026-4714, CVE-2026-4715,
     CVE-2026-4716, CVE-2026-4717, CVE-2025-59375, CVE-2026-4718,
     CVE-2026-4719, CVE-2026-4720, CVE-2026-4721.
firefox-esr (140.9.0esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-22, also known as:
     CVE-2026-4684, CVE-2026-4685, CVE-2026-4686, CVE-2026-4688,
     CVE-2026-4689, CVE-2026-4690, CVE-2026-4691, CVE-2026-4692,
     CVE-2026-4693, CVE-2026-4694, CVE-2026-4695, CVE-2026-4696,
     CVE-2026-4697, CVE-2026-4698, CVE-2026-4699, CVE-2026-4700,
     CVE-2026-4701, CVE-2026-4702, CVE-2026-4704, CVE-2026-4705,
     CVE-2026-4706, CVE-2026-4707, CVE-2026-4708, CVE-2026-4709,
     CVE-2026-4710, CVE-2026-4713, CVE-2026-4714, CVE-2026-4715,
     CVE-2026-4716, CVE-2026-4717, CVE-2025-59375, CVE-2026-4718,
     CVE-2026-4719, CVE-2026-4720, CVE-2026-4721.
firefox-esr (140.8.0esr-1) unstable; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-15, also known as:
     CVE-2026-2757, CVE-2026-2758, CVE-2026-2759, CVE-2026-2760,
     CVE-2026-2761, CVE-2026-2762, CVE-2026-2763, CVE-2026-2764,
     CVE-2026-2765, CVE-2026-2766, CVE-2026-2767, CVE-2026-2768,
     CVE-2026-2769, CVE-2026-2770, CVE-2026-2771, CVE-2026-2772,
     CVE-2026-2773, CVE-2026-2774, CVE-2026-2775, CVE-2026-2777,
     CVE-2026-2778, CVE-2026-2779, CVE-2026-2780, CVE-2026-2781,
     CVE-2026-2782, CVE-2026-2783, CVE-2026-2784, CVE-2026-2785,
     CVE-2026-2786, CVE-2026-2787, CVE-2026-2788, CVE-2026-2789,
     CVE-2026-2790, CVE-2026-2791, CVE-2026-2792, CVE-2026-2793.

firewalld (2.3.1-1+deb13u1) trixie; urgency=medium
 .
   * fix(policy): use PK_ACTION_CONFIG for set{ZoneSettings2,PolicySettings}
     This prevents local users from being able to modify runtime firewall state
     without prior authentication if the desktop policy is active.
     (CVE-2026-4948)

flatpak (1.16.6-1~deb13u1) trixie-security; urgency=high
 .
   * Backport new upstream stable release for Debian 13
     - Fix a sandbox escape involving symlinks passed to flatpak-portal.
       A malicious or compromised Flatpak app could exploit this to achieve
       arbitrary code execution on the host.
       (CVE-2026-34078, GHSA-cc2q-qc34-jprg) (Closes: #1132943)
     - Prevent arbitrary file deletion outside the sandbox by a malicious or
       compromised Flatpak app
       (CVE-2026-34079, GHSA-p29x-r292-46pp) (Closes: #1132944)
     - Prevent a local user from reading any file that is readable by the
       _flatpak system user. A mitigation is that it would be very unusual
       for these files not to be readable by the original local user as well.
       (No CVE ID, GHSA-2fxp-43j9-pwvc) (Closes: #1132946)
     - Prevent a local user from making another local user unable to cancel
       an ongoing download of apps or runtimes installed system-wide
       via the system helper.
       (No CVE ID, GHSA-89xm-3m96-w3jg) (Closes: #1132945)
     - Various fixes for regressions caused when fixing CVE-2026-34078
   * Revert changes that are not appropriate for a stable update:
     - Revert "d/watch: Convert to v5 format, only watch stable
       (even-numbered) releases"
     - Revert "Standards-Version: 4.7.3"
flatpak (1.16.6-1~deb13u1~bpo12+1) bookworm-backports; urgency=high
 .
   * Merge trixie security update 1.16.6-1~deb13u1
     - Fix a sandbox escape involving symlinks passed to flatpak-portal.
       A malicious or compromised Flatpak app could exploit this to achieve
       arbitrary code execution on the host.
       (CVE-2026-34078, GHSA-cc2q-qc34-jprg) (Closes: #1132943)
     - Prevent arbitrary file deletion outside the sandbox by a malicious or
       compromised Flatpak app
       (CVE-2026-34079, GHSA-p29x-r292-46pp) (Closes: #1132944)
     - Prevent a local user from reading any file that is readable by the
       _flatpak system user. A mitigation is that it would be very unusual
       for these files not to be readable by the original local user as well.
       (No CVE ID, GHSA-2fxp-43j9-pwvc) (Closes: #1132946)
     - Prevent a local user from making another local user unable to cancel
       an ongoing download of apps or runtimes installed system-wide
       via the system helper.
       (No CVE ID, GHSA-89xm-3m96-w3jg) (Closes: #1132945)
     - Various fixes for regressions caused when fixing CVE-2026-34078
   * Remaining changes for bookworm-backports:
     - d/control, d/gbp.conf: Branch for Debian 12 'bookworm' backports
     - d/control, d/p/debian/build-Relax-bubblewrap-dependency.patch:
       Relax bubblewrap dependency to the version from bookworm-security
     - Revert "d/control: Build-depend on required GIR XML files"
     - Revert "Install systemd system unit into /usr/lib/systemd/system"
flatpak (1.16.5-1) unstable; urgency=high
 .
   * New upstream release fixing some of the regressions in 1.16.4
     (Closes: #1132960, #1132968)
   * Drop patches that were applied upstream
   * d/p/utils-Add-flatpak_set_cloexec.patch,
     d/p/run-context-Mark-fd-arguments-as-close-on-exec.patch:
     Add proposed patches to fix another regression in 1.16.4 for
     Chromium-based browsers
     (Closes: #1132968)
   * d/p/run-Cope-with-an-empty-runtime.patch,
     d/p/dir-In-apply_extra_data-don-t-assume-there-is-always-a-ru.patch:
     Add proposed patches to fix regression in 1.16.4 when installing
     apps/runtimes/extensions that use a statically-linked extra-data helper
   * d/p/utils-Move-flatpak_get_path_for_fd-to-here.patch,
     d/p/portal-Avoid-crash-if-sandbox-expose-ro-fd-is-out-of-rang.patch,
     d/p/portal-Log-and-ignore-unusable-sandbox-expose-fds-instead.patch,
     d/p/portal-Reinstate-flatpak_get_path_for_fd-checks.patch:
     Add proposed patches to fix regression in 1.16.4 for Epiphany and
     possibly other WebKitGTK-based apps
   * d/p/libtest-Allow-adding-a-new-ref-to-an-existing-temporary-o.patch:
     Add proposed patch to fix autopkgtest failure
flatpak (1.16.4-2) unstable; urgency=medium
 .
   * d/p/run-Fix-checking-wrong-variable-in-runtime-fd-selection.patch,
     d/p/run-Mount-original-app-on-run-parent-app-when-using-app-p.patch:
     Add proposed patches fixing regression for unofficial Steam Flatpak app
     (Closes: #1132960)
   * Mention Debian bug numbers in previous changelog entry
flatpak (1.16.4-1) unstable; urgency=high
 .
   * New upstream security release
     - Fix a sandbox escape involving symlinks passed to flatpak-portal.
       A malicious or compromised Flatpak app could exploit this to achieve
       arbitrary code execution on the host.
       (CVE-2026-34078, GHSA-cc2q-qc34-jprg)
     - Prevent arbitrary file deletion outside the sandbox by a malicious or
       compromised Flatpak app
       (CVE-2026-34079, GHSA-p29x-r292-46pp)
     - Prevent a local user from reading any file that is readable by the
       _flatpak system user. A mitigation is that it would be very unusual
       for these files not to be readable by the original local user as well.
       (No CVE ID, GHSA-2fxp-43j9-pwvc)
     - Prevent a local user from making another local user unable to cancel
       an ongoing download of apps or runtimes installed system-wide
       via the system helper.
       (No CVE ID, GHSA-89xm-3m96-w3jg)
flatpak (1.16.3-1) unstable; urgency=medium
 .
   * New upstream stable release
     - In flatpak-build(1), only provide /run/host/font-dirs.xml if the
       calling process has not already added it, fixing a regression for
       users of GNOME Builder and Foundry (flatpak#6450 upstream)
   * Standards-Version: 4.7.3
     - Remove Priority: optional, unnecessary since Debian 13
   * d/watch: Convert to v5 format
   * d/watch: Only watch stable (even-numbered) releases
     - d/watch.devel: Add a second watch file for development
       (odd-numbered) releases

freeciv (3.1.4+ds-2+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2026-33250

freerdp3 (3.15.0+dfsg-2.1+deb13u3) trixie; urgency=medium
 .
   * security fix from 3.25.0:
 .
     CVE-2026-40254 off-by-one in the path traversal filter in
       channels/drive/client/drive_file.c:contains_dotdot()
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3xpj-m4hx-8vmx
       clang-warnings-fix-Wjump-misses-init.patch
       channels-drive-refine-bounds-checks-CVE-2026-40254.patch
freerdp3 (3.15.0+dfsg-2.1+deb13u2) trixie; urgency=medium
 .
   * security fixes for client from 3.24.0 (medium):
 .
     CVE-2026-29774 Heap-buffer-overflow in avc420_yuv_to_rgb via OOB regionRects
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5q35-hv9x-7794
       codec-h264-validate-rectangles-before-use-CVE-2026-29774.patch
     CVE-2026-29775 Heap-buffer-overflow in bitmap_cache_put via OOB cacheId
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h666-rfw3-jhvj
       cache-bitmap-overallocate-bitmap-cache-CVE-2026-29775.patch
     CVE-2026-29776 Integer Underflow in update_read_cache_bitmap_order
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c747-x4wf-cqrr
       core-order-fix-const-correctness.patch
       core-orders-improve-input-validation-CVE-2026-29776.patch
     CVE-2026-31806 Heap Buffer Overflow in nsc_process_message() via Unchecked
       SURFACE_BITS_COMMAND Bitmap Dimensions
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rrqm-46rj-cmx2
       codec-nsc-bounds-checks-and-doxygen.patch
       codec-nsc-log-decoder-function-parameter-issues.patch
       codec-nsc-fix-use-of-nsc_process_message.patch
       codec-nsc-limit-copy-area-in-nsc_process_message-CVE-2026-31806.patch
     CVE-2026-31883 `size_t` underflow in ADPCM decoder leads to
       heap-buffer-overflow write
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-85x9-4xxp-xhm5
     CVE-2026-31885 Out-of-bounds read in ADPCM decoders due to
       missing predictor/step_index bounds checks
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-85x9-4xxp-xhm5
       codec-dsp-fix-array-bounds-checks-CVE-2026-31883-CVE-2026-31885.patch
     CVE-2026-31884 Division-by-zero in ADPCM decoders when `nBlockAlign` is 0
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jp7m-94ww-p56r
       codec-dsp-add-format-checks-CVE-2026-31884.patch
     CVE-2026-31897 Out-of-bounds read in `freerdp_bitmap_decompress_planar`
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xgv6-r22m-7c9x
       codec-planar-add-early-length-check-to-avoid-oob-rea-CVE-2026-31897.patch
 .
   * security fixes for client from 3.24.2 (medium):
 .
     CVE-2026-33952 DoS via WINPR_ASSERT in
       rts_read_auth_verifier_no_checks (rts.c:282)
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4v4p-9v5x-hc93
       core-gateway-Check-rpcconn_common_hdr_t-auth_length--CVE-2026-33952.patch
     CVE-2026-33977 DoS via WINPR_ASSERT in IMA ADPCM audio decoder (dsp.c:331)
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8f2g-3q27-6xm5
       codec-dsp-fix-IMA-ADPCM-sample-clamping-CVE-2026-33977.patch
     CVE-2026-33995 double free in kerberos_AcceptSecurityContext
       and kerberos_IntitalizeSecurityContextA
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mv25-f4p2-5mxx
       winpr-sspi-Fix-context-nullptr-handling-CVE-2026-33995.patch
     CVE-2026-33984 ClearCodec resize_vbar_entry() Heap OOB Write
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8469-2xcx-frf6
       codec-clear-update-CLEAR_VBAR_ENTRY-size-after-alloc-CVE-2026-33984.patch
     CVE-2026-33983 Progressive Codec Quant BYTE Underflow - UB + CPU DoS
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4gfm-4p52-h478
       codec-progressive-Fail-progressive_rfx_quant_sub-on--CVE-2026-33983.patch
     CVE-2026-33985 ClearCodec Glyph Cache Count Desync - Heap OOB Read
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x6gr-8p7h-5h85
       codec-clear-Update-CLEAR_GLYPH_ENTRY-count-after-all-CVE-2026-33985.patch
     CVE-2026-33986 H.264 YUV Buffer Dimension Desync - Heap OOB Write
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h6qw-wxvm-hf97
       codec-h264-update-H264_CONTEXT-width-height-after-al-CVE-2026-33986.patch
     CVE-2026-33987 Persistent Cache bmpSize Desync - Heap OOB Write
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ff8h-p5vc-wcwc
       cache-persistent-update-PERSISTENT_CACHE_ENTRY-size--CVE-2026-33987.patch
     CVE-2026-33982 Persistent Cache Allocator Mismatch - Heap OOB Read
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8jm9-2925-g4v2
       cache-persist-use-winpr_aligned_calloc-CVE-2026-33982.patch
freerdp3 (3.15.0+dfsg-2.1+deb13u1) trixie; urgency=medium
 .
   * two patches from upstream (from 3.16) (Closes: #1112191):
     core-redirection-Ensure-stream-has-space-for-cert.patch
     core-redirection-Ensure-stream-has-space-for-all-params.patch
   * client-x11-fix-clipboard-issues.patch (Closes: #1121299)
   * client-desktop-fix-StartupWMClass-setting.patch:
     restore x11 desktop icon for xfreerdp3
   * d/patches/README: remove obsolete file
 .
   * security fixes for client from 3.20.1 (medium):
 .
     CVE-2026-22851: RDPGFX ResetGraphics race leads to use after free
       in SDL3 client (sdl->primary)
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8g87-6pvc-wh99
       client-sdl-lock-primary-while-used-CVE-2026-22851.patch
     CVE-2026-22852: Heap buffer overflow in audin_process_formats
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9chc-g79v-4qq4
       channels-audin-free-up-old-audio-formats-CVE-2026-22852.patch
     CVE-2026-22853: Heap buffer overflow in ndr_read_uint8Array
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-47v9-p4gp-w5ch
       channels-rdpear-add-checks-for-itemSize-CVE-2026-22853.patch
     CVE-2026-22854: Heap buffer overflow in drive_process_irp_read
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-47vj-g3c3-3rmf
       channels-drive-fix-constant-type-CVE-2026-22854.patch
     CVE-2026-22855: Heap buffer overflow in smartcard_unpack_set_attrib_call
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rwp3-g84r-6mx9
       utils-smartcard-add-length-validity-checks-CVE-2026-22855.patch
       also pick:
         utils-smartcard-handle-output-buffer-too-small.patch
         utils-smartcard-improve-trace-log.patch
         utils-smartcard-better-logging-and-error-checks.patch
     CVE-2026-22856: Heap use after free in create_irp_thread
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-w842-c386-fxhv
       channels-serial-explicitly-lock-serial-IrpThreads-CVE-2026-22856.patch
     CVE-2026-22857: Heap use after free in irp_thread_func
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4gxq-jhq6-4cr8
       channels-serial-fix-use-after-free-CVE-2026-22857.patch
     CVE-2026-22858: Global buffer overflow in crypto_base64_decode
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qmqf-m84q-x896
       (this also affects freerdp proxy, not just client)
       crypto-base64-do-proper-length-checks-CVE-2026-22858.patch
       also pick:
         crypto-base64-ensure-char-is-singend.patch
     CVE-2026-22859: Heap buffer overflow in urb_select_configuration
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-56f5-76qv-2r36
       channels-urbdrc-check-interface-indices-before-use-CVE-2026-22859.patch
 .
   * security fixes for client from 3.21 (medium):
 .
     CVE-2026-23530: Heap buffer overflow in planar_decompress_plane_rle
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r4hv-852m-fq7p
       codec-planar-fix-decoder-length-checks-CVE-2026-23530.patch
     CVE-2026-23531: Heap buffer overflow in clear_decompress
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xj5h-9cr5-23c5
       codec-clear-fix-missing-length-checks-CVE-2026-23531.patch
     CVE-2026-23532: Heap buffer overflow in gdi_SurfaceToSurface
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fq8c-87hj-7gvr
       gdi-gfx-properly-clamp-SurfaceToSurface-CVE-2026-23532.patch
     CVE-2026-23533: Heap buffer overflow in clear_decompress_residual_data
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-32q9-m5qr-9j2v
       codec-clear-fix-clear_resize_buffer-checks-CVE-2026-23533.patch
     CVE-2026-23534: Heap buffer overflow in clear_decompress_bands_data
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3frr-mp8w-4599
       codec-clear-fix-off-by-one-length-check-CVE-2026-23534.patch
     CVE-2026-23732: Heap buffer overflow in Glyph_Alloc
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7qxp-j2fj-c3pp
       codec-color-add-freerdp_glyph_convert_ex-CVE-2026-23732.patch
       gdi-graphics-Use-freerdp_glyph_convert_ex-CVE-2026-23732.patch
     CVE-2026-23883: Heap use after free in update_pointer_new
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qcrr-85qx-4p6x
       client-x11-fix-double-free-in-case-of-invalid-pointe-CVE-2026-23883.patch
     CVE-2026-23884: Heap use after free in gdi_set_bounds
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cfgj-vc84-f3pp
       cache-offscreen-invalidate-bitmap-before-free-CVE-2026-23884.patch
 .
   * security fixes for client from 3.22 (medium):
 .
     CVE-2026-23948: NULL Pointer Dereference in rdp_write_logon_info_v2()
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6f3c-qvqq-2px5
       core-info-fix-missing-NULL-check-CVE-2026-23948.patch
     CVE-2026-24491: Heap-use-after-free in video_timer
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4x6j-w49r-869g
       channels-drdynvc-reset-channel_callback-before-close-CVE-2026-24491.patch
       also pick:
         clang-warnings-fix-Wjump-misses-init-drdynvc_main.patch
         channels-drdynvc-check-pointer-before-reset.patch (fixup on top)
     CVE-2026-24675: Heap-use-after-free in urb_select_interface
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x9jr-99h2-g7mj
       channels-urbdrc-do-not-free-MsConfig-on-failure-CVE-2026-24491.patch
     CVE-2026-24676: Heap-use-after-free in audio_format_compatible
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qh5p-frq4-pgxj
       channels-audin-reset-audin-format-CVE-2026-24676.patch
     CVE-2026-24677: Heap-buffer-overflow in ecam_encoder_compress_h264
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xw37-j744-f8v7
       channels-rdpecam-ensure-sws-context-size-matches-CVE-2026-24677.patch
       also pick:
         clang-warnings-fix-Wjump-misses-init-remdesk_main.patch
         channels-rdpecam-improve-log-messages.patch
         rdpecam-fix-camera-sample-grabbing.patch
         channels-rpdecam-log-dropped-samples.patch
       fix-camera-sample-grabbing is a separate bugfix, but it also
       removes the need to back-port the main fix to 3.15
     CVE-2026-24678: Heap-use-after-free in cam_v4l_stream_capture_thread
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6gvg-29wx-6v7h
       channels-rdpecam-ensure-all-streams-are-stopped-CVE-2026-24678.patch
     CVE-2026-24679: Heap-buffer-overflow in urb_select_interface
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2jp4-67x6-gv7x
       channels-urbdrc-ensure-InterfaceNumber-is-within-ran-CVE-2026-24679.patch
     CVE-2026-24680: Heap-use-after-free in update_pointer_new(SDL)
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-j893-9wg8-33rc
       client-sdl-reset-pointer-after-memory-release-CVE-2026-24680.patch
     CVE-2026-24681: Heap-use-after-free in urb_bulk_transfer_cb
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ccvv-hg2w-6x9j
       channels-urbdrc-cancel-all-usb-transfers-on-channel--CVE-2026-24681.patch
     CVE-2026-24682: Heap-buffer-overflow in audio_formats_free
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vcw2-pqgw-mx6g
       channels-audin-fix-audin_server_recv_formats-cleanup-CVE-2026-24682.patch
     CVE-2026-24683: Heap-use-after-free in ainput_send_input_event
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-45pf-68pj-fg8q
       channels-ainput-lock-context-when-updating-listener-CVE-2026-24683.patch
     CVE-2026-24684: Heap-use-after-free in play_thread
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vcgv-xgjp-h83q
       channel-rdpsnd-only-clean-up-thread-before-free-CVE-2026-24684.patch
       channels-rdpsnd-terminate-thread-before-free-CVE-2026-24684.patch
 .
   * security fixes for client from 3.23 (medium):
 .
     CVE-2026-25941 Out-of-bounds read in rdpgfx_recv_wire_to_surface_2_pdu
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3546-x645-5cf8
       channels-rdpgfx-check-available-stream-length-CVE-2026-25941.patch
     CVE-2026-25942 Global-buffer-overflow in xf_rail_server_execute_result
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78q6-67m7-wwf6
       client-x11-stringfiy-functions-for-RAILS-CVE-2026-25942.patch
     CVE-2026-25952 CVE-2026-25953 CVE-2026-25954
       Heap-use-after-free in xf_SetWindowMinMaxInfo
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cgqm-cwjg-7w9x
       Heap-use-after-free in xf_AppUpdateWindowFromSurface (freed appWindow)
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-p6rq-rxpc-rh3p
       Heap-use-after-free in xf_rail_server_local_move_size
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cc88-4j37-mw6j
       client-x11-lock-appWindow-CVE-2026-25952-CVE-2026-25953-CVE-2026-25954.patch
     CVE-2026-25955 Heap-use-after-free in xf_AppUpdateWindowFromSurface
       (stale XImage)
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4g54-x8v7-559x
       client-x11-destroy-XImage-on-window-unmap-CVE-2026-25955.patch
       (also client-x11-fix-missing-includes.patch)
     CVE-2026-25959 Heap-use-after-free in xf_cliprdr_provide_data_
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78xg-v4p2-4w3c
       client-x11-lock-cache-when-providing-data-CVE-2026-25959.patch
     CVE-2026-25997 Heap-use-after-free in xf_clipboard_format_equal
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q5j3-m6jf-3jq4
       client-X11-fix-clipboard-update-CVE-2026-25997.patch
     CVE-2026-26271 Buffer Overread in FreeRDP Icon Processing
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hr4m-ph4g-48j6
       codec-color-fix-input-length-checks-CVE-2026-26271.patch
     CVE-2026-26986 Heap-use-after-free in rail_window_free
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-crqx-g6x5-rx47
       client-x11-fix-xf_rail_window_common-cleanup-CVE-2026-26986.patch
     CVE-2026-27015 Smartcard NDR Alignment Padding Triggers Reachable
       WINPR_ASSERT Abort (Client DoS)
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7g72-39pq-4725
       utils-smartcard-check-stream-length-on-padding-CVE-2026-27015.patch
     CVE-2026-26955 Heap Out-of-Bounds Write in ClearCodec Surface Command
       Handler via Missing Bounds Validation
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mr6w-ch7c-mqqj
       codec-clear-fix-missing-destination-boundary-checks.patch
       codec-clear-fix-destination-checks-CVE-2026-26955.patch
     CVE-2026-26965 Heap Out-of-Bounds Write in Planar Bitmap RLE Decompression
       via Destination Offset
       https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5vgf-mw4f-r33h
       codec-planar-fix-missing-destination-bounds-checks-CVE-2026-26965.patch
 .
   * These fixes introduces symbols into libfreerdp3, which don't exist in
     versions before 3.21.0, - add them to this version with a virtual package
     libfreerdp3-partial-api-3-21, with an alternative Depends field:
        libfreerdp3-partial-api-3-21 | libfreerdp3-3 (>>3.21.0)
     so apt dependency solver does the right thing for users of these symbols.
     This virtual package (libfreerdp3-partial-api-3-21) exists in trixie only.
 .
   * additional 4 upstream patches fixing a range of issues in rdpecam
 .
     winpr-wlog-Add-specialized-text-log-functions.patch -
      preparational (two new log functions, libwinpr3-partial-api-3-17)
     warnings-Fix-format-string-errors-partial.patch -
      printf string fixes in existing code after the above patch
      (partial, only hunks which applies cleanly are kept,
      no attempt to back-port other hunks)
     channels-rdpecam-add-value-range-checks.patch -
      missing range checking in rdpecam code
     channels-rdpecam-fix-PROPERTY_DESCRIPTION-parsing.patch -
      additional fix for CVE-2026-24677 fix
 .
   * CVE-2025-4478.patch: add DEP-3 headers

freetype (2.13.3+dfsg-1+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2026-23865 (Closes: #1129606)

fwupd (2.0.8-3+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * thunderbolt: Fix deploying the thunderbolt controller on the X280 (closes: #1123749)

gdk-pixbuf (2.42.12+dfsg-4+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * jpeg: Reject unsupported number of components (CVE-2026-5201)
     (Closes: #1132501)

gimp (3.0.4-3+deb13u8) trixie-security; urgency=medium
 .
   * CVE-2026-4150
   * CVE-2026-4151
   * CVE-2026-4152
   * CVE-2026-4153

git-lfs (3.6.1-1+deb13u1) trixie; urgency=medium
 .
   * CVE-2025-26625 (Closes: #1118339)

glance (2:30.0.0-3+deb13u2) trixie; urgency=medium
 .
   * Add No_DNS_resolution_in_test.patch, otherwise Glance cannot be build in
     the buildd.
glance (2:30.0.0-3+deb13u1) trixie; urgency=medium
 .
   * CVE-2026-34881 / OSSA-2026-004:
     Server-Side Request Forgery (SSRF) vulnerabilities in Glance image import.
     By use of HTTP redirects, an authenticated user can bypass URL validation
     checks and redirect to internal services. Add upstream patch:
     - OSSA-2026-004_Fix_SSRF_vulnerabilities_in_image_import_API.patch.
     (Closes: #1131274).
   * Refreshed debian/patches/sql_conn-registry.patch.

glib2.0 (2.84.4-3~deb13u3) trixie; urgency=medium
 .
   * Non-maintainer upload by the LTS Security Team.
   * Add patch to fix timezone handling with Debian & Ubuntu's symlinks
     (Closes: #1119919) (LP: #2130378)
   * CVE-2026-0988: Missing input validation in g_buffered_input_stream_peek
     (Closes: #1125752)
   * CVE-2026-1484: Integer overflow in base64 encoding can cause memory
     corruption. (Closes: #1126551)
   * CVE-2026-1485: Buffer underflow vulnerability in content type parsing
     caused by (signed) integer wrap for large inputs. (Closes: #1126550)
   * CVE-2026-1489: Integer overflow in unicode conversion
     can lead to memory corruption. (Closes: #1126549)

glibc (2.41-12+deb13u3) trixie; urgency=medium
 .
   * debian/control.in/libc: ensure that libdpkg-perl is fixed wrt symbol
     versions used as ABI flag.
   * Stop reverting the following patches now that dpkg-shlibdeps in trixie
     supports symbol versions used as ABI flag (see #1122107):
     - local-revert-x86-64-add-GLIBC_ABI_DT_X86_64_PLT-version.diff
     - local-revert-x86-64-add-GLIBC_ABI_GNU2_TLS-version.diff
     - local-revert-i386-add-GLIBC_ABI_GNU2_TLS-version.diff
     - local-revert-i386-add-GLIBC_ABI_GNU_TLS-version.diff
   * debian/symbols.wildcards: define the GLIBC_ABI_DT_X86_64_PLT,
     GLIBC_ABI_GNU_TLS and GLIBC_ABI_GNU2_TLS symbol versions.
   * debian/patches/git-updates.diff: update from upstream stable branch:
     - Fix a null pointer dereference in the nss_database_check_reload_and_get
       function.
     - Fix tst-preadvwritev2 and tst-preadvwritev64v2 with recent kernels.
     - Fix invalid pointer arithmetic in ANSI_X3.110 iconv module
     - Fix a typo preventing new tst-wordexp-reuse-mem to run
     - Fix incorrect handling of DNS responses in gethostbyaddr and
       gethostbyaddr_r (CVE-2026-4437).  Closes: #1131435.
     - Fix invalid DNS hostnames returned by gethostbyaddr and
       gethostbyaddr_r (CVE-2026-4438).  Closes: #1131887.
     - Fix random failure of tst-link-map-contiguous-ldso.
     - Fix tst-rseq with Linux 7.0.
     - Fix a possible crash due to an assertion failure when converting
       inputs from the IBM139x character sets (CVE-2026-4046).  Closes:
       #1132499.

gnutls28 (3.8.9-3+deb13u3) trixie; urgency=medium
 .
   [ Simon McVittie ]
   * d/p/51_handshake-only-shuffle-extensions-in-the-first-Client-Hel.patch:
     Preserve extension order across client Hello retry.
     This resolves an interop regression in 3.8.5 with servers that enforce
     the RFC requirement that the Client Hello after a Hello Retry Request
     has the same extensions as the original Client Hello, in the same order
     (Closes: #1130152)

grub-efi-amd64-signed (1+2.12+9+deb13u2) trixie; urgency=medium
 .
   * Update to grub2 2.12-9+deb13u2

grub-efi-arm64-signed (1+2.12+9+deb13u2) trixie; urgency=medium
 .
   * Update to grub2 2.12-9+deb13u2

grub-efi-ia32-signed (1+2.12+9+deb13u2) trixie; urgency=medium
 .
   * Update to grub2 2.12-9+deb13u2

grub2 (2.12-9+deb13u2) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Apply patch from upstream to fix an illegal instruction on riscv64 in
     grub.efi (Closes: #1108898)

gst-plugins-bad1.0 (1.26.2-3+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2026-2923
   * CVE-2026-3081
   * CVE-2026-3082
   * CVE-2026-3084
   * CVE-2026-3086

gst-plugins-base1.0 (1.26.2-1+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2026-2921

gst-plugins-ugly1.0 (1.26.3-4+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2026-2920
   * CVE-2026-2922

gvfs (1.57.2-2+deb13u1) trixie; urgency=high
 .
   * Non-maintainer upload by the LTS Security Team.
   * CVE-2026-28295 ftp: Use control connection address for PASV data
     (Closes: #1129285)
   * CVE-2026-28296 ftp: Reject paths containing CR/LF characters
     (Closes: #1129286)
   * debian/gbp.conf: Set debian branch to debian/trixie

harfbuzz (10.2.0-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-22693: Null Pointer Dereference in SubtableUnicodesCache::create
     (Closes: #1125189)

heimdal (7.8.git20221117.28daf24+dfsg-9+deb13u1) trixie; urgency=medium
 .
   * Fix memory leak in heimdal-clients by applying upstream patch from
   https://github.com/heimdal/heimdal/commit/739f7e0484e412de7de6d5ef1100fcc20836d19d
   Closes: #1130242.
   * Explicitly depend on libcrypt-dev. (Closes: #1102912)

imagemagick (8:7.1.1.43+dfsg1-1+deb13u8) trixie-security; urgency=high
 .
   * Fix CVE-2026-32636:
     The NewXMLTree method contains a bug that could result
     in a crash due to an out of write bounds of a single zero byte
   * Fix CVE-2026-33535:
     An out-of-bounds write of a zero byte exists in the X11 `display`
     interaction path that could lead to a crash.
   * Fix CVE-2026-33536:
     Due to an incorrect return value on certain platforms a pointer is
     incremented past the end of a buffer that is on the stack and
     that could result in an out of bounds write.
   * Fix CVE-2026-33899:
     When `Magick` parses an XML file it is possible that a single
     zero byte is written out of the bounds
   * Fix CVE-2026-33900:
     The viff encoder contains an integer truncation/wraparound issue
     on 32-bit builds that could trigger an out of bounds heap write,
     potentially causing a crash
   * Fix CVE-2026-33901:
     a heap buffer overflow occurs in the MVG decoder that
     could result in an out of bounds write when processing a
     crafted image.
   * Fix CVE-2026-33902:
     a stack overflow vulnerability in ImageMagick's FX expression
     parser allows an attacker to crash the process by providing a
     deeply nested expression.
   * Fix CVE-2026-33905:
     The -sample operation has an out of bounds read when
     an specific offset is set through the `sample:offset`
     define that could lead to an out of bounds read.
   * Fix CVE-2026-33908:
     Magick frees the memory of the XML tree via the `DestroyXMLTree()`
     function; however, this process is executed recursively with no
     depth limit imposed. When Magick processes an XML file with
     deeply nested structures, it will exhaust the stack memory,
     resulting in a Denial of Service (DoS) attack
   * Fix CVE-2026-34238:
     An integer overflow in the despeckle operation causes
     a heap buffer overflow on 32-bit builds that will result
     in an out of bounds write.
   * Fix CVE-2026-40169:
     A crafted image could result in an out of bounds heap write
     when writing a yaml or json output, resulting in a crash.
   * Fix CVE-2026-40183:
     The JXL encoder has an heap write overflow when a user specifies
     that the image should be encoded as 16 bit floats.
   * Fix CVE-2026-40310:
     A heap out-of-bounds write was found in the JP2 encoder when a user
     specifies an invalid sampling index.
   * Fix CVE-2026-40311:
     A heap use-after-free vulnerability was found that can cause a
     crash when reading and printing values from an invalid XMP profile.
   * Fix CVE-2026-40312:
     An off by one error in the MSL decoder could result in a crash
     when a malicous MSL file is read.
imagemagick (8:7.1.1.43+dfsg1-1+deb13u7) trixie-security; urgency=high
 .
   * Fix CVE-2026-28493:
     An integer overflow vulnerability exists in the SIXEL decoder.
   * Fix CVE-2026-28494:
     A stack buffer overflow exists in ImageMagick's morphology
     kernel parsing functions. User-controlled kernel strings
     exceeding a buffer are copied into fixed-size stack buffers
     via memcpy without bounds checking, resulting in stack
     corruption.
   * Fix CVE-2026-28686:
     A heap-buffer-overflow vulnerability exists in the PCL
     encoder due to an undersized output buffer allocation
   * Fix CVE-2026-28687:
     A heap use-after-free vulnerability in ImageMagick's
     MSL decoder allows an attacker to trigger access to
     freed memory by crafting an MSL file.
   * Fix CVE-2026-28688:
     A heap-use-after-free vulnerability exists in the MSL encoder,
     where a cloned image is destroyed twice. The MSL coder does not support
     writing MSL so the write capability has been removed.
   * Fix CVE-2026-28689:
     domain="path" authorization is checked before final
     file open/use. A symlink swap between check-time and use
     time bypasses policy-denied read/write
   * Fix CVE-2026-28690:
     a stack buffer overflow vulnerability exists in the
     MNG encoder. There is a bounds checks missing that could
     corrupting the stack with attacker-controlled data.
   * Fix CVE-2026-28691:
     An uninitialized pointer dereference vulnerability exists
     in the JBIG decoder due to a missing check
   * Fix CVE-2026-28692:
     The MAT decoder uses 32-bit arithmetic due to incorrect
     parenthesization resulting in a heap over-read.
   * Fix CVE-2026-28693:
     An integer overflow in DIB coder can result in out of
     bounds read or write
   * Fix CVE-2026-30883:
     An extremely large image profile could result in a heap
     overflow when encoding a PNG image.
   * Fix CVE-2026-30929:
     MagnifyImage uses a fixed-size stack buffer.
     When using a specific image it is possible to overflow
     this buffer and corrupt the stack.
   * Fix CVE-2026-30931
     A heap-based buffer overflow in the UHDR encoder
     can happen due to truncation of a value and it would
     allow an out of bounds write.
   * Fix CVE-2026-30935:
     BilateralBlurImage contains a heap buffer over-read caused
     by an incorrect conversion. When processing a crafted image
     with the -bilateral-blur operation an out of bounds read
     can occur.
   * Fix CVE-2026-30936:
     A crafted image could cause an out of bounds heap write inside the
     WaveletDenoiseImage method. When processing a crafted image with
     the -wavelet-denoise operation an out of bounds write can occur.
   * Fix CVE-2026-30937:
     A 32-bit unsigned integer overflow in the XWD (X Windows)
     encoder can cause an undersized heap buffer allocation.
     When writing a extremely large image an out of bounds heap
     write can occur
   * Fix CVE-2026-31853:
     An overflow on 32-bit systems can cause a crash in the
     SFW decoder when processing extremely large images.
   * Fix CVE-2026-32259:
     When a memory allocation fails in the sixel encoder it would
     be possible to write past the end of a buffer on the stack
   * Port SVG and MSL coder to 7.1.2-16
imagemagick (8:7.1.1.43+dfsg1-1+deb13u6) trixie-security; urgency=high
 .
   * Fix CVE-2026-24481:
     A heap information disclosure vulnerability exists
     in ImageMagick's PSD (Adobe Photoshop) format handler.
     When processing a maliciously crafted PSD file containing
     ZIP-compressed layer data that decompresses to less than
     the expected size, uninitialized heap memory is leaked
     into the output image.
   * Fix CVE-2026-24484:
     Magick fails to check for multi-layer nested mvg
     conversions to svg, leading to DoS.
   * Fix CVE-2026-24485:
     When a PCD file does not contain a valid Sync marker, the
     DecodeImage() function becomes trapped in an infinite loop while
     searching for the Sync marker, causing the program to become
     unresponsive and continuously consume CPU resources, ultimately
     leading to system resource exhaustion and Denial of Service
     (DoS)
   * Fix CVE-2026-25576:
     A heap buffer over-read vulnerability exists in multiple
     raw image format handles. The vulnerability occurs when
     processing images with -extract dimensions larger than
     -size dimensions, causing out-of-bounds memory reads
     from a heap-allocated buffer.
   * Fix CVE-2026-25637:
     A memory leak in the ASHLAR image writer allows an attacker to exhaust
     process memory by providing a crafted image that results in small
     objects that are allocated but never freed.
   * Fix CVE-2026-25638:
     A memory leak exists in `coders/msl.c`. In the `WriteMSLImage`
     function of the `msl.c` file, resources are allocated. But the
     function returns early without releasing these allocated resources.
   * Fix CVE-2026-25794:
     `WriteUHDRImage` in `coders/uhdr.c` uses `int` arithmetic to compute
     the pixel buffer size. Prior to version 7.1.2-15, when image
     dimensions are large, the multiplication overflows 32-bit `int`,
     causing an undersized heap allocation followed by an out-of-bounds
     write.
   * Fix CVE-2026-25795:
     `ReadSFWImage()` (`coders/sfw.c`), when temporary file
     creation fails, `read_info` is destroyed before its `filename`
     member is accessed, causing a NULL pointer dereference and crash.
   * Fix CVE-2026-25796:
     In `ReadSTEGANOImage()` (`coders/stegano.c`), the `watermark` Image
     object is not freed on three early-return paths, resulting in a
     definite memory leak (~13.5KB+ per invocation) that can be exploited
     for denial of service.
   * Fix CVE-2026-25797:
     The ps coders, responsible for writing PostScript files, fails to
     sanitize the input before writing it into the PostScript header. An
     attacker can provide a malicious file and inject arbitrary PostScript
     code. When the resulting file is processed by a printer or a viewer
     (like Ghostscript), the injected code is interpreted and executed. The
     html encoder does not properly escape strings that are written to in
     the html document. An attacker can provide a malicious file and
     injection arbitrary html code.
   * Fix CVE-2026-25798:
     A NULL pointer dereference in ClonePixelCacheRepository allows a
     remote attacker to crash any application linked against ImageMagick by
     supplying a crafted image file, resulting in denial of service.
   * Fix CVE-2026-25799:
     A logic error in YUV sampling factor validation allows an invalid
     sampling factor to bypass checks and trigger a division-by-zero during
     image loading, resulting in a reliable denial-of-service.
   * Fix CVE-2026-25897:
     An Integer Overflow vulnerability exists in the sun decoder. On 32-bit
     systems/builds, a carefully crafted image can lead to an out of bounds
     heap write.
   * Fix CVE-2026-25898:
     The UIL and XPM image encoder do not validate the
     pixel index value returned by `GetPixelIndex()` before using it as an
     array subscript. In HDRI builds, `Quantum` is a floating-point type,
     so pixel index values can be negative. An attacker can craft an image
     with negative pixel index values to trigger a global buffer overflow
     read during conversion, leading to information disclosure or a process
     crash.
   * Fix CVE-2026-25965:
     ImageMagick’s path security policy is enforced on the raw filename
     string before the filesystem resolves it. As a result, a policy rule
     such as /etc/* can be bypassed by a path traversal. The OS resolves
     the traversal and opens the sensitive file, but the policy matcher
     only sees the unnormalized path and therefore allows the read. This
     enables local file disclosure (LFI) even when policy-secure.xml is
     applied.
   * Fix CVE-2026-25966:
     The shipped "secure" security policy includes a rule intended to
     prevent reading/writing from standard streams. However, ImageMagick
     also supports fd:<n> pseudo-filenames (e.g., fd:0, fd:1).
     This path form is not blocked by the
     secure policy templates, and therefore bypasses the protection goal of
     "no stdin/stdout."
   * Fix CVE-2026-25967:
     A stack-based buffer overflow exists in the ImageMagick FTXT image
     reader. A crafted FTXT file can cause out-of-bounds writes on the
     stack, leading to a crash.
   * Fix CVE-2026-25968:
     A stack buffer overflow occurs when processing the an attribute in
     msl.c. A long value overflows a fixed-size stack buffer, leading to
     memory corruption.
   * Fix CVE-2026-25969:
     A memory leak exists in `coders/ashlar.c`. The `WriteASHLARImage`
     allocates a structure. However, when an exception is thrown, the
     allocated memory is not properly released, resulting in a potential
     memory leak.
   * Fix CVE-2026-25970:
     A signed integer overflow vulnerability in ImageMagick's SIXEL decoder
     allows an attacker to trigger memory corruption and denial of service
     when processing a maliciously crafted SIXEL image file. The
     vulnerability occurs during buffer reallocation operations where
     pointer arithmetic using signed 32-bit integers overflows.
   * Fix CVE-2026-25971:
     Magick fails to check for circular references between two MSLs,
     leading to a stack overflow.
   * Fix CVE-2026-25982:
     A heap out-of-bounds read vulnerability exists in the `coders/dcm.c`
     module. When processing DICOM files with a specific configuration, the
     decoder loop incorrectly reads bytes per iteration. This causes the
     function to read past the end of the allocated buffer, potentially
     leading to a Denial of Service or Information Disclosure.
   * Fix CVE-2026-25983:
     A crafted MSL script triggers a heap-use-after-free. The operation
     element handler replaces and frees the image while the parser
     continues reading from it, leading to a UAF in ReadBlobString during
     further parsing.
   * Fix CVE-2026-25985:
     A crafted SVG file containing an malicious element causes ImageMagick
     to attempt to allocate ~674 GB of memory, leading to an out-of-memory
     abort.
   * Fix CVE-2026-25986:
     A heap buffer overflow write vulnerability exists in ReadYUVImage()
     (coders/yuv.c) when processing malicious YUV 4:2:2 (NoInterlace)
     images. The pixel-pair loop writes one pixel beyond the allocated row
     buffer.
   * Fix CVE-2026-25987:
     A heap buffer over-read vulnerability exists in the MAP image decoder
     when processing crafted MAP files, potentially leading to crashes or
     unintended memory disclosure during image decoding.
   * Fix CVE-2026-25988:
     Sometimes msl.c fails to update the stack index, so an image is stored
     in the wrong slot and never freed on error, causing leaks.
   * Fix CVE-2026-25989:
     A crafted SVG file can cause a denial of service. An off-by-one
     boundary check (`>` instead of `>=`) that allows bypass the guard and
     reach an undefined `(size_t)` cast.
   * Fix CVE-2026-26066:
     A crafted profile contain invalid IPTC data may cause an infinite loop
     when writing it with `IPTCTEXT`.
   * Fix CVE-2026-26283:
     A `continue` statement in the JPEG extent binary search loop in the
     jpeg encoder causes an infinite loop when writing persistently fails.
   * Fix CVE-2026-26284:
     ImageMagick lacks proper boundary checking when processing
     Huffman-coded data from PCD (Photo CD) files. The decoder contains an
     function that has an incorrect initialization that could cause an out
     of bounds read.
   * Fix CVE-2026-26983:
     The MSL interpreter crashes when processing a invalid `<map>` element
     that causes it to use an image after it has been freed.
   * Fix CVE-2026-27798:
     A heap buffer over-read vulnerability occurs when processing an image
     with small dimension using the `-wavelet-denoise` operator.
   * Fix CVE-2026-27799:
     A heap buffer over-read vulnerability exists in the DJVU image format
     handler. The vulnerability occurs due to integer truncation when
     calculating the stride (row size) for pixel buffer allocation. The
     stride calculation overflows a 32-bit signed integer, resulting in an
     out-of-bounds memory reads.

incus (6.0.4-2+deb13u7) trixie-security; urgency=high
 .
   * Cherry-pick fixes for the following security issues:
     - CVE-2026-40195 / GHSA-gc7j-g665-rxr9
     - CVE-2026-40197 / GHSA-r7w7-mmxr-47r9
     - CVE-2026-40243 / GHSA-c839-4qxr-j4x3
     - CVE-2026-40251 / GHSA-4m88-wxj4-9qj6
     - CVE-2026-41647 / GHSA-fwj8-62r8-8p8m
     - CVE-2026-41648 / GHSA-67wx-r9xr-x75x
     - CVE-2026-41684 / GHSA-x5r6-jr56-89pv
     - CVE-2026-41685 / GHSA-98vh-x9cx-9cfp
incus (6.0.4-2+deb13u7~bpo12+1) bookworm-backports; urgency=medium
 .
   * Rebuild for bookworm-backports.
     - Drop dependency on virtiofsd, as it isn't available for bookworm
     - Drop apparmor 4.x patch
     - Relax dependency on lxcfs, since runit scripts aren't expected for
       bookworm
     - Add patch to remove dependency on go-criu
     - Add patch to build with older version of openfga-go-sdk
     - Add patch backporting RemoveAll from newer sftp
incus (6.0.4-2+deb13u6) trixie-security; urgency=high
 .
   * Cherry-pick fixes for the following security issues:
     - CVE-2026-34178 / GHSA-q96j-3fmm-7fv4
     - CVE-2026-34179 / GHSA-c3h3-89qf-jqm5
incus (6.0.4-2+deb13u6~bpo12+1) bookworm-backports; urgency=medium
 .
   * Rebuild for bookworm-backports.
     - Drop dependency on virtiofsd, as it isn't available for bookworm
     - Drop apparmor 4.x patch
     - Relax dependency on lxcfs, since runit scripts aren't expected for
       bookworm
     - Add patch to remove dependency on go-criu
     - Add patch to build with older version of openfga-go-sdk
     - Add patch backporting RemoveAll from newer sftp
incus (6.0.4-2+deb13u5) trixie-security; urgency=high
 .
   * Cherry-pick fixes for the following security issues:
     - CVE-2026-28384 / GHSA-4rmf-rcp8-2r9g
     - CVE-2026-33542 / GHSA-p8mm-23gg-jc9r
     - CVE-2026-33743 / GHSA-vg76-xmhg-j5x3
     - CVE-2026-33897 / GHSA-83xr-5xxr-mh92
incus (6.0.4-2+deb13u5~bpo12+1) bookworm-backports; urgency=medium
 .
   * Rebuild for bookworm-backports.
     - Drop dependency on virtiofsd, as it isn't available for bookworm
     - Drop apparmor 4.x patch
     - Relax dependency on lxcfs, since runit scripts aren't expected for
       bookworm
     - Add patch to remove dependency on go-criu
     - Add patch to build with older version of openfga-go-sdk
     - Add patch backporting RemoveAll from newer sftp

inetutils (2:2.6-3+deb13u3) trixie-security; urgency=high
 .
   * Add patches from upstream:
     - Ignore all environment options from clients unless the variable was
       listed in the new --accept-env telnetd option. This mitigates privilege
       escalation using environment variables.
       This is the complete fix for CVE-2026-24061, with its own CVE pending.
     - Fix stack buffer overflow processing SLC suboption triplets.
       Reported by Adiel Sol, Arad Inbar, Erez Cohen, Nir Somech, Ben Grinberg,
       Daniel Lubel at DREAM Security Research Team.
       Fixes CVE-2026-32746. (Closes: #1130742)
   * Add the hashcode-string1 module from forky/sid gnulib, required by the
     --accept-env patch.
   * Adapt netkit-telnet patch to not leak unexported environment variables to
     telnetd. Reported by Justin Swartz <justin.swartz@risingedge.co.za>.
     Fixes CVE-2026-32772. (Closes: #1130741)
   * Prevent user local privilege escalation using --debug, which was
     susceptible to symlink attacks, or leaking on-wire credentials to a
     user that had pre-created the file and kept it open. Fix by switching
     from /tmp/telnet.debug to /run/telnet/debug.<pid>, and making the
     setup error checks fatal.
     Partially reported by Justin Swartz <justin.swartz@risingedge.co.za>.
   * Update local telnetd man page to match new --debug behavior.

initramfs-tools (0.148.4) trixie; urgency=medium
 .
   [ Aurelien Jarno ]
   * [8e1a6f5] d/salsa-ci.yml: Set RELEASE to trixie
 .
   [ E Shattow ]
   * [2331eab] hook-functions: Add Cadence USB driver to base (Closes:
     #1108924)
 .
   [ Ben Hutchings ]
   * [45d5661] unmkinitramfs: Accept lower-case hex digits in cpio headers

jpeg-xl (0.11.2-0.1~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie.
     - Revert the test timeout increase.
 .
 jpeg-xl (0.11.2-0.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * New upstream release.
     - CVE-2025-12474: Decoder read from uninitialized (but allocated)
       memory (Closes: #1128068)
     - CVE-2026-1837: Decoder write to uninitialized unallocated memory
       (Closes: #1128067)
   * Disable a failing test. (Closes: #1123400)
   * Increase the test timeout. (Closes: #1114914)
   * Backport a loong64 FTBFS fix.
 .
 jpeg-xl (0.11.1-6) unstable; urgency=medium
 .
   [ Helmut Grohne ]
   * Fix FTCBFS: Depend on a native JDK (Closes: #1110508)
   * Fix the nojava build profile
 .
 jpeg-xl (0.11.1-5) unstable; urgency=medium
 .
   * Cherry-pick patch to fix big-endian build
   * Remove obsolete bigendian patch
   * Stop using gcc-13 for big endian architectures (Closes: #1092659, #1110520)
jpeg-xl (0.11.1-6) unstable; urgency=medium
 .
   [ Helmut Grohne ]
   * Fix FTCBFS: Depend on a native JDK (Closes: #1110508)
   * Fix the nojava build profile
jpeg-xl (0.11.1-5) unstable; urgency=medium
 .
   * Cherry-pick patch to fix big-endian build
   * Remove obsolete bigendian patch
   * Stop using gcc-13 for big endian architectures (Closes: #1092659, #1110520)

jq (1.7.1-6+deb13u2) trixie; urgency=medium
 .
   * Cherry-pick upstream commit for the following:
     * CVE-2026-32316
     * CVE-2026-33947
     * CVE-2026-33948
     * CVE-2026-39956
     * CVE-2026-39979
     * CVE-2026-40164

jtreg7 (7.5.2+1+ds2-3~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie, needed by the latest OpenJDK 21 security release
jtreg7 (7.5.2+1+ds2-3~deb12u1) bookworm-security; urgency=medium
 .
   * Rebuild for Bookworm, required by the latest OpenJDK 17 security
     release
jtreg7 (7.5.2+1+ds2-2) unstable; urgency=medium
 .
   * d/p/codetools-7904152.patch: skip security policy tests
     with Java 25 (CODETOOLS-7904152).
jtreg7 (7.5.2+1+ds2-1) unstable; urgency=medium
 .
   * d/{control, copyright,p/testng-build-with-gradle.patch}: drop
     snakeyaml dependency (Closes: #1117950).
   * Add patches to resolve test ftbfs (Closes: #1115694):
     - d/p/codetools-7904101.patch: capture all stdout/stderr output
       from the agent vm to the log file.
     - d/p/codetools-7904104-proposed.patch: do not interrupt main
       thread if the agent process is killed.
     - d/p/codetools-7904105-proposed.patch: synchronize test result
       updates.
     - d/p/codetools-7904106-proposed.patch: use different work
       directories for TestNativePath.
     - d/p/codetools-7904107-proposed.patch: add a separate target to
       filter log files.
   * d/flush_stream.patch: drop patch, it is replaced by
     d/p/codetools-7904101.patch.
   * d/watch: update repack version.
jtreg7 (7.5.2+1+ds1-2) unstable; urgency=medium
 .
   * d/copyright: revert FSF address change.
   * d/s/lintian-overrides, d/jtreg7.lintian-overrides: add override for
     the old FSF address.
jtreg7 (7.5.2+1+ds1-1) unstable; urgency=medium
 .
   [ Vladimir Petko ]
   * New upstream release 7.5.2+1.
     - d/watch: set major jtreg version to 7, update junit5 download
       url.
     - refresh patches.
     - d/picocli/maven.rules: replace groovy version with 'debian'.
     - d/p/preview-test.patch: enable --enable-preview tests for
       Java > 11.
   * d/control: update Standards Version to 4.7.2 (no changes).
   * Add lintian overrides.
   * d/copyright: update FSF address.
 .
   [ tony mancill ]
   * Add flush-alarm.patch

kissfft (131.1.0-4.1~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie.
     - Drop the CMake 4 fix.
 .
 kissfft (131.1.0-4.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2025-34297: Integer Overflow on 32-bit Systems
     (Closes: #1131147)
   * CVE-2026-41445: Integer Overflow in kiss_fftndr_alloc()
     (Closes: #1134493)
 .
 kissfft (131.1.0-4) unstable; urgency=medium
 .
   * Team upload.
 .
   [ Vasyl Gello ]
   * Fix lintian warnings
 .
   [ Dylan Aïssi ]
   * Cherry-pick upstream patch to improve compatibility with cmake 4
   * Update debian/salsa-ci.yml
   * Switch Build-Dep from pkg-config to pkgconf
   * Standards-Version: 4.7.2 (routine-update)
kissfft (131.1.0-4.1~deb12u1) bookworm; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for bookworm.
     - Drop the CMake 4 fix.
 .
 kissfft (131.1.0-4.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2025-34297: Integer Overflow on 32-bit Systems
     (Closes: #1131147)
   * CVE-2026-41445: Integer Overflow in kiss_fftndr_alloc()
     (Closes: #1134493)
 .
 kissfft (131.1.0-4) unstable; urgency=medium
 .
   * Team upload.
 .
   [ Vasyl Gello ]
   * Fix lintian warnings
 .
   [ Dylan Aïssi ]
   * Cherry-pick upstream patch to improve compatibility with cmake 4
   * Update debian/salsa-ci.yml
   * Switch Build-Dep from pkg-config to pkgconf
   * Standards-Version: 4.7.2 (routine-update)
kissfft (131.1.0-4) unstable; urgency=medium
 .
   * Team upload.
 .
   [ Vasyl Gello ]
   * Fix lintian warnings
 .
   [ Dylan Aïssi ]
   * Cherry-pick upstream patch to improve compatibility with cmake 4
   * Update debian/salsa-ci.yml
   * Switch Build-Dep from pkg-config to pkgconf
   * Standards-Version: 4.7.2 (routine-update)

kpackage (5.116.0-1+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * Skip flaky test plasma-querytest. Closes: #1031061.

lcms2 (2.16-2+deb13u2) trixie-security; urgency=medium
 .
   * CVE-2026-42798 (Closes: #1135320)
lcms2 (2.16-2+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2026-41254 (Closes: #1134335)

lemonldap-ng (2.21.2+ds-1+deb13u2) trixie; urgency=medium
 .
   * Import main 2.21.4 changes:
     - OIDC ignored non default signature algorithm
     - OIDC dynamic registration didn't register Front-Channel-Logout URL when
       set
     - Really hide passwords in session-explorer when stored in session
     - Update documentation to avoid using unsecured Nginx variable

libarchive (3.7.4-4+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload by the LTS team.
 .
   [ Bastien Roucaries ]
   * Fix CVE-2025-5918 (Closes: #1107624)
     A vulnerability has been identified in the libarchive library. This flaw
     can be triggered when file streams are piped into bsdtar, potentially
     allowing for reading past the end of the file.  This out-of-bounds read
     can lead to unintended consequences, including unpredictable program
     behavior, memory corruption, or a denial-of-service condition.
 .
   [ Arnaud Rebillout ]
   * Fix CVE-2026-4111 (Closes: #1130753)
     A flaw was identified in the RAR5 archive decompression logic of the
     libarchive library, specifically within the archive_read_data() processing
     path. When a specially crafted RAR5 archive is processed, the
     decompression routine may enter a state where internal logic prevents
     forward progress.  This condition results in an infinite loop that
     continuously consumes CPU resources. Because the archive passes checksum
     validation and appears structurally valid, affected applications cannot
     detect the issue before processing. This can allow attackers to cause
     persistent denial-of-service conditions in services that automatically
     process archives.
   * Fix CVE-2026-4424 (Closes: #1131446)
     A flaw was found in libarchive. This heap out-of-bounds read vulnerability
     exists in the RAR archive processing logic due to improper validation of
     the LZSS sliding window size after transitions between compression
     methods. A remote attacker can exploit this by providing a specially
     crafted RAR archive, leading to the disclosure of sensitive heap memory
     information without requiring authentication or user interaction.
   * Fix CVE-2026-4426 (Closes: #1131444)
     A flaw was found in libarchive. An Undefined Behavior vulnerability exists
     in the zisofs decompression logic, caused by improper validation of a
     field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote
     attacker can exploit this by supplying a specially crafted ISO file. This
     can lead to incorrect memory allocation and potential application crashes,
     resulting in a denial-of-service (DoS) condition.
   * Fix CVE-2026-5121 (Closes: #1133002)
     A flaw was found in libarchive. On 32-bit systems, an integer overflow
     vulnerability exists in the zisofs block pointer allocation logic. A
     remote attacker can exploit this by providing a specially crafted ISO9660
     image, which can lead to a heap buffer overflow. This could potentially
     allow for arbitrary code execution on the affected system.

libcap2 (1:2.75-10+deb13u1) trixie; urgency=medium
 .
   * Add patch fixing CVE-2026-4878 (TOCTOU race condition)

libcdio (2.2.0-4.1~deb13u1) trixie; urgency=medium
 .
   * Rebuild for trixie
 .
 libcdio (2.2.0-4.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * Fix buffer overrun for Joliet filenames (CVE-2024-36600) (Closes: #1129256)

libcoap3 (4.3.4-1.1+deb13u3) trixie; urgency=medium
 .
   * CVE-2026-29013 (Closes: #1134340)
     fix out-of-bounds read
   * CVE-2025-34468 (Closes: #1124407)
     fix stack-based buffer overflow

libcryptx-perl (0.085-1+deb13u1) trixie; urgency=medium
 .
   * Crypt::PK key generation is not fork safe and will generate identical keys
     (CVE-2026-41564)

libdatetime-timezone-perl (1:2.65-1+2026b) trixie; urgency=medium
 .
   * Update data to Olson database version 2026b.
     This update contains contemporary changes for British Columbia, CA.
 .
 libdatetime-timezone-perl (1:2.65-1+2026a) trixie; urgency=medium
 .
   * Update data to Olson database version 2026a.
     This update contains contemporary changes for Moldova.
libdatetime-timezone-perl (1:2.65-1+2026a) trixie; urgency=medium
 .
   * Update data to Olson database version 2026a.
     This update contains contemporary changes for Moldova.

libexif (0.6.25-1+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * d/patches/CVE-2026-40386.patch Add patch for CVE-2026-40386.
     - An integer underflow in size checking for Fuji and Olympus MakerNote
       decoding could be used by attackers to crash or leak information out
       of libexif-using programs (Closes: #1133923).
   * d/patches/CVE-2026-40385.patch: Add patch for CVE-2026-40385.
     - An unsigned 32bit integer overflow in Nikon MakerNote handling could
       be used by local attackers to cause crashes or information leaks.
       (Closes: #1133922).
   * d/patches/CVE-2026-32775.patch: Add patch for CVE-2026-32775.patch.
     - If the exif_mnote_data_get_value function in MakerNotes gets passed
       in a 0 size, the passed in-buffer would be overwritten due to an
       integer underflow (Closes: #1131116).

libfinance-quote-perl (1.65-1+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * xetra-date.patch: new patch, fixes date in quotes retrieved from XETRA
     source (Closes: #1132870)

libnet-cidr-lite-perl (0.22-3~deb13u1) trixie; urgency=medium
 .
   * Rebuild for trixie
 .
 libnet-cidr-lite-perl (0.22-3) unstable; urgency=medium
 .
   * Team upload.
   * CVE-2026-40198: Reject invalid uncompressed IPv6
   * CVE-2026-40198: Add tests
   * CVE-2026-40199: Fix IPv4 mapped IPv6 packed length
   * CVE-2026-40199: Add tests
libnet-cidr-lite-perl (0.22-3~deb12u1) bookworm; urgency=medium
 .
   * Rebuild for bookworm
 .
 libnet-cidr-lite-perl (0.22-3) unstable; urgency=medium
 .
   * Team upload.
   * CVE-2026-40198: Reject invalid uncompressed IPv6
   * CVE-2026-40198: Add tests
   * CVE-2026-40199: Fix IPv4 mapped IPv6 packed length
   * CVE-2026-40199: Add tests

libpng1.6 (1.6.48-1+deb13u5) trixie-security; urgency=high
 .
   * Security upload targeting trixie.
   * CVE-2026-34757 - Use after free. (Closes: #1133051)
   * Cherry-pick upstream regression fix for previously fixed CVE 2026-33416.
libpng1.6 (1.6.48-1+deb13u4) trixie-security; urgency=medium
 .
   * Security upload targeting trixie.
     - CVE-2026-33416 - Use-after-free (Closes: #1132012)
     - CVE-2026-33636 - OOB read/write on ARM plattforms (Closes: #1132013)

libreoffice (4:25.2.3-2+deb13u4) trixie-security; urgency=medium
 .
   * debian/patches/Conform-AlignEngine-parsing-to-spec.diff: as name says;
     from libreoffice-26-2 branch; fixes CVE-2026-4430

libreoffice-texmaths (0.49-1.1~deb13u1) stable; urgency=medium
 .
   * Upload to stable
libreoffice-texmaths (0.49-1.1~deb12u1) oldstable; urgency=medium
 .
   * Upload to oldstable

libtext-csv-xs-perl (1.60-1+deb13u1) trixie; urgency=medium
 .
   * Fix possible stack corruption: CVE-2026-7111.
     Patch taken from upstream Git commit, as released in 1.62.
     (Closes: #1135232)

libvncserver (0.9.15+dfsg-1+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * debian/patches:
     + CVE-2026-32853: Add 0001_CVE-2026-32853.patch fixing a heap out-of-bounds
       read (Closes: #1132016).
     + CVE-2026-32854: Add 0002_CVE-2026-32854.patch fixing NULL pointer
       dereferences in httpd proxy handlers (Closes: #1132017).

libxml-parser-perl (2.47-2~deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Rebuild for trixie-security
 .
 libxml-parser-perl (2.47-2) unstable; urgency=medium
 .
   * Team upload.
   * Fix buffer overflow in parse_stream when filehandle has :utf8 layer.
     This improves the fix for CVE-2006-10002.
   * fix: off-by-one heap buffer overflow in st_serial_stack growth check
     (CVE-2006-10003) (Closes: #378412)

libxml-security-java (2.1.8-1.1~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie.
 .
 libxml-security-java (2.1.8-1.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2023-44483: Private Key disclosure in debug-log output
     (Closes: #1059313)

libxslt (1.1.35-1.2+deb13u3) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Fix deterministic generate-id() regression introduced in previous fix by
     moving the stable ID generation into a per-transform, per-document hash
     table. (Closes: #1114928)

libyaml-syck-perl (1.34-2+deb13u2) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * fix: address all 4 C-layer audit findings from issue #67 (CVE-2026-4177)

linux (6.12.86-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.86
     - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
     - ALSA: usb-audio: Avoid false E-MU sample-rate notifications
     - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch
     - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable()
     - usb: chipidea: otg: not wait vbus drop if use role_switch
     - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change
     - ALSA: usb-audio: Evaluate packsize caps at the right place
     - LoongArch: Add spectre boundry for syscall dispatch table
     - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
     - leds: qcom-lpg: Check for array overflow when selecting the high
       resolution
     - greybus: gb-beagleplay: bound bootloader receive buffering
     - greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames()
     - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()
     - ibmasm: fix OOB reads in command_file_write due to missing size checks
     - ibmasm: fix heap over-read in ibmasm_send_i2o_message()
     - driver core: Don't let a device probe until it's ready
     - drm/nouveau: fix nvkm_device leak on aperture removal failure
     - kbuild: rust: allow `clippy::uninlined_format_args`
     - firmware: google: framebuffer: Do not mark framebuffer as busy
     - arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
     - padata: Fix pd UAF once and for all (CVE-2025-38584)
     - padata: Remove comment for reorder_work
     - rust: init: fix `clippy::undocumented_unsafe_blocks` warnings
     - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array
     - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion
       (CVE-2026-23468)
     - device property: Make modifications of fwnode "flags" thread safe
     - ocfs2: split transactions in dio completion to avoid credit exhaustion
     - zram: do not forget to endio for partial discard requests
     - wifi: rtw88: check for PCI upstream bridge existence
     - vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex
     - vfio/cdx: Fix NULL pointer dereference in interrupt trigger path
     - um: drivers: call kernel_strrchr() explicitly in cow_user.c
     - spi: imx: fix use-after-free on unbind
     - spi: ch341: fix memory leaks on probe failures
     - mm/memory_hotplug: fix hwpoisoned large folio handling in
       do_migrate_range()
     - crypto: pcrypt - Fix handling of MAY_BACKLOG requests
     - of: unittest: fix use-after-free in of_unittest_changeset()
     - of: unittest: fix use-after-free in testdrv_probe()
     - hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt
     - media: amphion: Fix race between m2m job_abort and device_run
     - ALSA: control: Validate buf_len before strnlen() in
       snd_ctl_elem_init_enum_names()
     - net: caif: clear client service pointer on teardown
     - net: strparser: fix skb_head leak in strp_abort_strp()
     - media: mtk-jpeg: fix use-after-free in release path due to uncancelled
       work
     - crypto: atmel-sha204a - Fix OTP sysfs read and error handling
     - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown
     - Revert "ALSA: usb: Increase volume range that triggers a warning"
     - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete
     - lib/ts_kmp: fix integer overflow in pattern length calculation
     - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in
       imx219_probe()
     - net: qrtr: ns: Fix use-after-free in driver remove()
     - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
     - ALSA: aoa: i2sbus: fix OF node lifetime handling
     - ALSA: ctxfi: Add fallback to default RSR for S/PDIF
     - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes
     - erofs: fix the out-of-bounds nameoff handling for trailing dirents
     - jbd2: fix deadlock in jbd2_journal_cancel_revoke()
     - md/raid10: fix deadlock with check operation and nowait requests
     - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused
     - mtd: docg3: fix use-after-free in docg3_release()
     - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4
     - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set
     - parisc: _llseek syscall is only available for 32-bit userspace
     - remoteproc: xlnx: Only access buffer information if IPI is buffered
     - sched: Use u64 for bandwidth ratio calculations
     - rbd: fix null-ptr-deref when device_add_disk() fails
     - block: fix zone write plugs refcount handling in
       disk_zone_wplug_schedule_bio_work()
     - io_uring/timeout: check unused sqe fields
     - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned()
     - io_uring/poll: fix signed comparison in io_poll_get_ownership()
     - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE
     - ALSA: core: Fix potential data race at fasync handling
     - ALSA: caiaq: Fix control_put() result and cache rollback
     - ALSA: caiaq: Handle probe errors properly
     - ALSA: 6fire: Fix input volume change detection
     - ALSA: pcmtest: fix reference leak on failed device registration
     - ALSA: pcmtest: Fix resource leaks in module init error paths
     - iio: adc: ad7768-1: fix one-shot mode data acquisition
     - rxrpc: Fix memory leaks in rxkad_verify_response()
     - rxrpc: Fix rxkad crypto unalignment handling
     - rxrpc: Fix re-decryption of RESPONSE packets
     - tools/accounting: handle truncated taskstats netlink messages
     - arm64: dts: marvell: uDPU: add ethernet aliases
     - net: qrtr: ns: Free the node during ctrl_cmd_bye()
     - net: rds: fix MR cleanup on copy error
     - net: txgbe: fix firmware version check
     - net/smc: avoid early lgr access in smc_clc_wait_msg
     - net: ks8851: Reinstate disabling of BHs around IRQ handler
     - netconsole: avoid out-of-bounds access on empty string in trim_newline()
     - net: ks8851: Avoid excess softirq scheduling
     - drm/arcpgu: fix device node leak
     - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
     - ipv4: icmp: validate reply type before using icmp_pointers
     - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()
     - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE'
     - tpm: avoid -Wunused-but-set-variable
     - LoongArch: Show CPU vulnerabilites correctly
     - power: supply: axp288_charger: Do not cancel work before initializing it
     - hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data()
     - randomize_kstack: Maintain kstack_offset per task
     - mmc: block: use single block write in retry
     - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration
     - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins
     - xfs: fix a resource leak in xfs_alloc_buftarg()
     - firmware: google: framebuffer: Do not unregister platform device
     - crypto: talitos - fix SEC1 32k ahash request limitation
     - crypto: talitos - rename first/last to first_desc/last_desc
     - pwm: imx-tpm: Count the number of enabled channels in probe
     - tpm: Fix auth session leak in tpm2_get_random() error path
     - tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()
     - tpm: tpm_tis: add error logging for data transfer
     - tpm: tpm_tis: stop transmit if retries are exhausted
     - rtc: ntxec: fix OF node reference imbalance
     - mm/damon/core: use time_in_range_open() for damos quota window start
     - userfaultfd: allow registration of ranges below mmap_min_addr
     - KVM: x86: Defer non-architectural deliver of exception payload to
       userspace read
     - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state
     - KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2
     - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
     - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0
     - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts
     - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode
     - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT
     - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN
     - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID)
     - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT
     - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT
     - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS
     - KVM: nSVM: Add missing consistency check for nCR3 validity
     - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
     - KVM: nSVM: Always intercept VMMCALL when L2 is active
     - io_uring/poll: fix multishot recv missing EOF on wakeup race
     - perf annotate: Use jump__delete when freeing LoongArch jumps
     - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access
     - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()
     - mtd: spi-nor: sst: Fix write enable before AAI sequence
     - amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2
     - md/raid5: fix soft lockup in retry_aligned_read()
     - md/raid5: validate payload size before accessing journal metadata
     - check-uapi: link into shared objects
     - HID: apple: ensure the keyboard backlight is off if suspending
     - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails
     - x86/cpu: Disable FRED when PTI is forced on
     - wifi: rtl8xxxu: fix potential use of uninitialized value
     - tcp: call sk_data_ready() after listener migration
     - taskstats: set version in TGID exit notifications
     - mfd: core: Preserve OF node when ACPI handle is present
     - apparmor: use target task's context in apparmor_getprocattr()
     - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
     - bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays
     - can: ucan: fix devres lifetime
     - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit
     - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup
     - crypto: atmel-ecc - Release client on allocation failure
     - crypto: hisilicon - Fix dma_unmap_single() direction
     - crypto: ccree - fix a memory leak in cc_mac_digest()
     - crypto: atmel-tdes - fix DMA sync direction
     - crypto: atmel-sha204a - Fix error codes in OTP reads
     - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path
     - crypto: atmel-sha204a - Fix uninitialized data access on OTP read error
     - crypto: nx - Fix packed layout in struct nx842_crypto_header
     - dm mirror: fix integer overflow in create_dirty_log()
     - ceph: only d_add() negative dentries when they are unhashed
     - IB/core: Fix zero dmac race in neighbor resolution
     - ktest: Fix the month in the name of the failure directory
     - ntfs3: add buffer boundary checks to run_unpack()
     - ntfs3: fix integer overflow in run_unpack() volume boundary check
     - rtmutex: Use waiter::task instead of current in remove_waiter()
     - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails
     - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode
     - smb: client: validate the whole DACL before rewriting it in cifsacl
       (CVE-2026-31709)
     - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in
       f2fs_write_end_io() (CVE-2026-31715)
     - lib: test_hmm: evict device pages on file close to avoid use-after-free
     - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally
     - ksmbd: use msleep instaed of schedule_timeout_interruptible()
     - ksmbd: replace connection list with hash table
     - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id()
     - thermal: core: Fix thermal zone governor cleanup issues
     - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor
     - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling
     - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
     - mm/migrate: factor out movable_ops page handling into
       migrate_movable_ops_page()
     - mm/migrate: move movable_ops page handling out of move_to_new_folio()
     - mm: migrate: requeue destination folio on deferred split queue
     - ALSA: aoa: Use guard() for mutex locks
     - ALSA: aoa: i2sbus: clear stale prepared state
     - mm/zsmalloc: copy KMSAN metadata in zs_page_migrate()
     - media: rc: ttusbir: respect DMA coherency rules
     - ALSA: aoa: Skip devices with no codecs in i2sbus_resume()
     - media: rc: igorplugusb: heed coherency rules
     - RDMA/mana_ib: Disable RX steering on RSS QP destroy
     - block: relax pgmap check in bio_add_page for compatible zone device pages
     - iio: frequency: admv1013: add dev variable
     - iio: frequency: admv1013: fix NULL pointer dereference on str
     - rxrpc: Fix potential UAF after skb_unshare() failure
     - net: qrtr: ns: Limit the maximum server registration per node
     - net: qrtr: ns: Limit the maximum number of lookups
     - net: bridge: use a stable FDB dst snapshot in RCU readers
     - net: mctp: fix don't require received header reserved bits to be zero
     - net: qrtr: ns: Limit the total number of nodes
     - spi: fix resource leaks on device setup failure
     - mm: prevent droppable mappings from being locked
     - crypto: authencesn - reject short ahash digests during instance creation
     - net: bonding: fix use-after-free in bond_xmit_broadcast() (CVE-2026-31419)
     - driver core: Add kernel-doc for DEV_FLAG_COUNT enum value
     - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path
     - ALSA: caiaq: Don't abort when no input device is available
     - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
     - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
     - drm/amdgpu: fix zero-size GDS range init on RDNA4
     - ALSA: caiaq: fix usb_dev refcount leak on probe failure
     - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
     - netfilter: reject zero shift in nft_bitwise
 .
   [ Ben Hutchings ]
   * Fix ordering of kernel version strings for multiple Debian revisions
     (Closes: #1113728)
   * rxrpc: Fix conn-level packet handling to unshare RESPONSE packets
 .
   [ Salvatore Bonaccorso ]
   * xfrm: esp: avoid in-place decrypt on shared skb frags
   * rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
linux (6.12.86-1~bpo12+1) bookworm-backports; urgency=high
 .
   * Rebuild for bookworm-backports
 .
 linux (6.12.86-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.86
     - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
     - ALSA: usb-audio: Avoid false E-MU sample-rate notifications
     - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch
     - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable()
     - usb: chipidea: otg: not wait vbus drop if use role_switch
     - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change
     - ALSA: usb-audio: Evaluate packsize caps at the right place
     - LoongArch: Add spectre boundry for syscall dispatch table
     - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
     - leds: qcom-lpg: Check for array overflow when selecting the high
       resolution
     - greybus: gb-beagleplay: bound bootloader receive buffering
     - greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames()
     - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()
     - ibmasm: fix OOB reads in command_file_write due to missing size checks
     - ibmasm: fix heap over-read in ibmasm_send_i2o_message()
     - driver core: Don't let a device probe until it's ready
     - drm/nouveau: fix nvkm_device leak on aperture removal failure
     - kbuild: rust: allow `clippy::uninlined_format_args`
     - firmware: google: framebuffer: Do not mark framebuffer as busy
     - arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
     - padata: Fix pd UAF once and for all (CVE-2025-38584)
     - padata: Remove comment for reorder_work
     - rust: init: fix `clippy::undocumented_unsafe_blocks` warnings
     - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array
     - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion
       (CVE-2026-23468)
     - device property: Make modifications of fwnode "flags" thread safe
     - ocfs2: split transactions in dio completion to avoid credit exhaustion
     - zram: do not forget to endio for partial discard requests
     - wifi: rtw88: check for PCI upstream bridge existence
     - vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex
     - vfio/cdx: Fix NULL pointer dereference in interrupt trigger path
     - um: drivers: call kernel_strrchr() explicitly in cow_user.c
     - spi: imx: fix use-after-free on unbind
     - spi: ch341: fix memory leaks on probe failures
     - mm/memory_hotplug: fix hwpoisoned large folio handling in
       do_migrate_range()
     - crypto: pcrypt - Fix handling of MAY_BACKLOG requests
     - of: unittest: fix use-after-free in of_unittest_changeset()
     - of: unittest: fix use-after-free in testdrv_probe()
     - hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt
     - media: amphion: Fix race between m2m job_abort and device_run
     - ALSA: control: Validate buf_len before strnlen() in
       snd_ctl_elem_init_enum_names()
     - net: caif: clear client service pointer on teardown
     - net: strparser: fix skb_head leak in strp_abort_strp()
     - media: mtk-jpeg: fix use-after-free in release path due to uncancelled
       work
     - crypto: atmel-sha204a - Fix OTP sysfs read and error handling
     - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown
     - Revert "ALSA: usb: Increase volume range that triggers a warning"
     - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete
     - lib/ts_kmp: fix integer overflow in pattern length calculation
     - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in
       imx219_probe()
     - net: qrtr: ns: Fix use-after-free in driver remove()
     - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
     - ALSA: aoa: i2sbus: fix OF node lifetime handling
     - ALSA: ctxfi: Add fallback to default RSR for S/PDIF
     - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes
     - erofs: fix the out-of-bounds nameoff handling for trailing dirents
     - jbd2: fix deadlock in jbd2_journal_cancel_revoke()
     - md/raid10: fix deadlock with check operation and nowait requests
     - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused
     - mtd: docg3: fix use-after-free in docg3_release()
     - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4
     - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set
     - parisc: _llseek syscall is only available for 32-bit userspace
     - remoteproc: xlnx: Only access buffer information if IPI is buffered
     - sched: Use u64 for bandwidth ratio calculations
     - rbd: fix null-ptr-deref when device_add_disk() fails
     - block: fix zone write plugs refcount handling in
       disk_zone_wplug_schedule_bio_work()
     - io_uring/timeout: check unused sqe fields
     - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned()
     - io_uring/poll: fix signed comparison in io_poll_get_ownership()
     - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE
     - ALSA: core: Fix potential data race at fasync handling
     - ALSA: caiaq: Fix control_put() result and cache rollback
     - ALSA: caiaq: Handle probe errors properly
     - ALSA: 6fire: Fix input volume change detection
     - ALSA: pcmtest: fix reference leak on failed device registration
     - ALSA: pcmtest: Fix resource leaks in module init error paths
     - iio: adc: ad7768-1: fix one-shot mode data acquisition
     - rxrpc: Fix memory leaks in rxkad_verify_response()
     - rxrpc: Fix rxkad crypto unalignment handling
     - rxrpc: Fix re-decryption of RESPONSE packets
     - tools/accounting: handle truncated taskstats netlink messages
     - arm64: dts: marvell: uDPU: add ethernet aliases
     - net: qrtr: ns: Free the node during ctrl_cmd_bye()
     - net: rds: fix MR cleanup on copy error
     - net: txgbe: fix firmware version check
     - net/smc: avoid early lgr access in smc_clc_wait_msg
     - net: ks8851: Reinstate disabling of BHs around IRQ handler
     - netconsole: avoid out-of-bounds access on empty string in trim_newline()
     - net: ks8851: Avoid excess softirq scheduling
     - drm/arcpgu: fix device node leak
     - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
     - ipv4: icmp: validate reply type before using icmp_pointers
     - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()
     - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE'
     - tpm: avoid -Wunused-but-set-variable
     - LoongArch: Show CPU vulnerabilites correctly
     - power: supply: axp288_charger: Do not cancel work before initializing it
     - hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data()
     - randomize_kstack: Maintain kstack_offset per task
     - mmc: block: use single block write in retry
     - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration
     - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins
     - xfs: fix a resource leak in xfs_alloc_buftarg()
     - firmware: google: framebuffer: Do not unregister platform device
     - crypto: talitos - fix SEC1 32k ahash request limitation
     - crypto: talitos - rename first/last to first_desc/last_desc
     - pwm: imx-tpm: Count the number of enabled channels in probe
     - tpm: Fix auth session leak in tpm2_get_random() error path
     - tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()
     - tpm: tpm_tis: add error logging for data transfer
     - tpm: tpm_tis: stop transmit if retries are exhausted
     - rtc: ntxec: fix OF node reference imbalance
     - mm/damon/core: use time_in_range_open() for damos quota window start
     - userfaultfd: allow registration of ranges below mmap_min_addr
     - KVM: x86: Defer non-architectural deliver of exception payload to
       userspace read
     - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state
     - KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2
     - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
     - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0
     - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts
     - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode
     - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT
     - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN
     - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID)
     - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT
     - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT
     - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS
     - KVM: nSVM: Add missing consistency check for nCR3 validity
     - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
     - KVM: nSVM: Always intercept VMMCALL when L2 is active
     - io_uring/poll: fix multishot recv missing EOF on wakeup race
     - perf annotate: Use jump__delete when freeing LoongArch jumps
     - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access
     - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()
     - mtd: spi-nor: sst: Fix write enable before AAI sequence
     - amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2
     - md/raid5: fix soft lockup in retry_aligned_read()
     - md/raid5: validate payload size before accessing journal metadata
     - check-uapi: link into shared objects
     - HID: apple: ensure the keyboard backlight is off if suspending
     - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails
     - x86/cpu: Disable FRED when PTI is forced on
     - wifi: rtl8xxxu: fix potential use of uninitialized value
     - tcp: call sk_data_ready() after listener migration
     - taskstats: set version in TGID exit notifications
     - mfd: core: Preserve OF node when ACPI handle is present
     - apparmor: use target task's context in apparmor_getprocattr()
     - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
     - bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays
     - can: ucan: fix devres lifetime
     - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit
     - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup
     - crypto: atmel-ecc - Release client on allocation failure
     - crypto: hisilicon - Fix dma_unmap_single() direction
     - crypto: ccree - fix a memory leak in cc_mac_digest()
     - crypto: atmel-tdes - fix DMA sync direction
     - crypto: atmel-sha204a - Fix error codes in OTP reads
     - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path
     - crypto: atmel-sha204a - Fix uninitialized data access on OTP read error
     - crypto: nx - Fix packed layout in struct nx842_crypto_header
     - dm mirror: fix integer overflow in create_dirty_log()
     - ceph: only d_add() negative dentries when they are unhashed
     - IB/core: Fix zero dmac race in neighbor resolution
     - ktest: Fix the month in the name of the failure directory
     - ntfs3: add buffer boundary checks to run_unpack()
     - ntfs3: fix integer overflow in run_unpack() volume boundary check
     - rtmutex: Use waiter::task instead of current in remove_waiter()
     - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails
     - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode
     - smb: client: validate the whole DACL before rewriting it in cifsacl
       (CVE-2026-31709)
     - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in
       f2fs_write_end_io() (CVE-2026-31715)
     - lib: test_hmm: evict device pages on file close to avoid use-after-free
     - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally
     - ksmbd: use msleep instaed of schedule_timeout_interruptible()
     - ksmbd: replace connection list with hash table
     - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id()
     - thermal: core: Fix thermal zone governor cleanup issues
     - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor
     - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling
     - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
     - mm/migrate: factor out movable_ops page handling into
       migrate_movable_ops_page()
     - mm/migrate: move movable_ops page handling out of move_to_new_folio()
     - mm: migrate: requeue destination folio on deferred split queue
     - ALSA: aoa: Use guard() for mutex locks
     - ALSA: aoa: i2sbus: clear stale prepared state
     - mm/zsmalloc: copy KMSAN metadata in zs_page_migrate()
     - media: rc: ttusbir: respect DMA coherency rules
     - ALSA: aoa: Skip devices with no codecs in i2sbus_resume()
     - media: rc: igorplugusb: heed coherency rules
     - RDMA/mana_ib: Disable RX steering on RSS QP destroy
     - block: relax pgmap check in bio_add_page for compatible zone device pages
     - iio: frequency: admv1013: add dev variable
     - iio: frequency: admv1013: fix NULL pointer dereference on str
     - rxrpc: Fix potential UAF after skb_unshare() failure
     - net: qrtr: ns: Limit the maximum server registration per node
     - net: qrtr: ns: Limit the maximum number of lookups
     - net: bridge: use a stable FDB dst snapshot in RCU readers
     - net: mctp: fix don't require received header reserved bits to be zero
     - net: qrtr: ns: Limit the total number of nodes
     - spi: fix resource leaks on device setup failure
     - mm: prevent droppable mappings from being locked
     - crypto: authencesn - reject short ahash digests during instance creation
     - net: bonding: fix use-after-free in bond_xmit_broadcast() (CVE-2026-31419)
     - driver core: Add kernel-doc for DEV_FLAG_COUNT enum value
     - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path
     - ALSA: caiaq: Don't abort when no input device is available
     - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
     - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
     - drm/amdgpu: fix zero-size GDS range init on RDNA4
     - ALSA: caiaq: fix usb_dev refcount leak on probe failure
     - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
     - netfilter: reject zero shift in nft_bitwise
 .
   [ Ben Hutchings ]
   * Fix ordering of kernel version strings for multiple Debian revisions
     (Closes: #1113728)
   * rxrpc: Fix conn-level packet handling to unshare RESPONSE packets
 .
   [ Salvatore Bonaccorso ]
   * xfrm: esp: avoid in-place decrypt on shared skb frags
   * rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
linux (6.12.85-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.75
     - RDMA/siw: Fix potential NULL pointer dereference in header processing
     - RDMA/umad: Reject negative data_len in ib_umad_write
     - auxdisplay: arm-charlcd: fix release_mem_region() size
     - hfsplus: return error when node already exists in hfs_bnode_create
     - rcu: Refactor expedited handling check in rcu_read_unlock_special()
     - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler()
     - rcu: Fix rcu_read_unlock() deadloop due to softirq
     - audit: move the compat_xxx_class[] extern declarations to audit_arch.h
     - i3c: Move device name assignment after i3c_bus_init
     - fs: add <linux/init_task.h> for 'init_fs'
     - i3c: master: Update hot-join flag only on success
     - gfs2: Retries missing in gfs2_{rename,exchange}
     - gfs2: Fix slab-use-after-free in qd_put
     - gfs2: Fix use-after-free in iomap inline data write path
     - i3c: dw: Initialize spinlock to avoid upsetting lockdep
     - i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers()
     - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure
     - tpm: st33zp24: Fix missing cleanup on get_burstcount() error
     - erofs: get rid of raw bi_end_io() usage
     - erofs: handle end of filesystem properly for file-backed mounts
     - btrfs: qgroup: return correct error when deleting qgroup relation item
     - btrfs: fix block_group_tree dirty_list corruption
     - smb: client: fix potential UAF and double free in smb2_open_file()
     - block: add a bio_add_virt_nofail helper
     - rnbd-srv: use bio_add_virt_nofail
     - rnbd-srv: Fix server side setting of bi_size for special IOs
     - xen/virtio: Don't use grant-dma-ops when running as Dom0
     - io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED
     - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()
     - io_uring/sync: validate passed in offset
     - cpuidle: governors: menu: Always check timers with tick stopped
     - thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature
     - md/raid5: fix raid5_run() to return error when log_init() fails
     - md/raid10: fix any_working flag handling in raid10_sync_request
     - OPP: Return correct value in dev_pm_opp_get_level
     - cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id()
     - iomap: fix submission side handling of completion side errors
     - thermal/of: Fix reference leak in thermal_of_cm_lookup()
     - ublk: Validate SQE128 flag before accessing the cmd
     - Partial revert "x86/xen: fix balloon target initialization for PVH dom0"
     - md/raid1: fix memory leak in raid1_run() if no active rdev
     - md/raid1: fix memory leak in raid1_run()
     - PM: wakeup: Handle empty list in wakeup_sources_walk_start()
     - perf: arm_spe: Properly set hw.state on failures
     - cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not
       possible
     - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races
     - [s390x] cio: Fix device lifecycle handling in css_alloc_subchannel()
     - [amd64] perf/x86/core: Do not set bit width for unavailable counters
     - crypto: qat - fix warning on adf_pfvf_pf_proto.c
     - libbpf: Fix OOB read in btf_dump_get_bitfield_value
     - [armhf] VDSO: Patch out __vdso_clock_getres() if unavailable
     - [arm64] crypto: cavium - fix dma_free_coherent() size
     - bpf: Preserve id of register in sync_linked_regs()
     - hrtimer: Fix trace oddity
     - [amd64] crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls
     - [amd64] crypto: ccp - narrow scope of snp_range_list
     - bpf, sockmap: Fix incorrect copied_seq calculation
     - bpf, sockmap: Fix FIONREAD for sockmap
     - tracing: Add a comment about ftrace_regs definition
     - ftrace: Make ftrace_regs abstract from direct use
     - ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs
     - ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros
     - ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value
     - fgraph: Replace fgraph_ret_regs with ftrace_regs
     - tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs
     - tracing: Add ftrace_fill_perf_regs() for perf event
     - [amd64] x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return
       probe
     - [amd64] x86/fgraph,bpf: Switch kprobe_multi program stack unwind to
       hw_regs path
     - [arm64] crypto: caam - fix netdev memory leak in dpaa2_caam_probe
     - bpf: Fix bpf_xdp_store_bytes proto for read-only arg
     - genirq: Set IRQF_COND_ONESHOT in devm_request_irq().
     - [amd64] platform/x86: int0002: Remove IRQF_ONESHOT from request_irq()
     - Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler
     - scsi: efct: Use IRQF_ONESHOT and default primary handler
     - EDAC/altera: Remove IRQF_ONESHOT
     - mfd: wm8350-core: Use IRQF_ONESHOT
     - media: pci: mg4b: Use IRQF_NO_THREAD
     - sched/deadline: Clear the defer params
     - sched/rt: Skip currently executing CPU in rto_next_cpu()
     - hwrng: core - Allow runtime disabling of the HW RNG
     - hwrng: core - use RCU and work_struct to fix race condition
     - pstore/ram: fix buffer overflow in persistent_ram_save_old()
     - soc: qcom: smem: handle ENOMEM error during probe
     - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size()
     - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size()
     - firmware: arm_ffa: Correct 32-bit response handling in
       NOTIFICATION_INFO_GET
     - [arm64] dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings
     - [arm64] dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings
     - [arm64] clk: qcom: Return correct error code in qcom_cc_probe_by_index()
     - [arm64] dts: qcom: sdm630: fix gpu_speed_bin size
     - [arm64] dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on
     - [arm64] dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on
     - [arm64] dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks
     - [arm64] dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of
       AD7147
     - [armhf] dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property
     - [powerpc*] uaccess: Move barrier_nospec() out of
       allow_read_{from/write}_user()
     - [arm64] soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in
       cmd_db_dev_probe
     - [arm64] soc: mediatek: svs: Fix memory leak in svs_enable_debug_write()
     - [powerpc*] eeh: fix recursive pci_lock_rescan_remove locking in EEH event
       handling
     - [arm64] dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node
     - [arm64] dts: amlogic: s4: assign mmc b clock to 24MHz
     - [arm64] dts: amlogic: s4: fix mmc clock assignment
     - [arm64] dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order
     - [arm64] dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog
       instances for j784s4
     - hwspinlock: omap: Handle devm_pm_runtime_enable() errors
     - [arm64] dts: amlogic: c3: assign the MMC signal clocks
     - [arm64] dts: amlogic: axg: assign the MMC signal clocks
     - [arm64] dts: amlogic: gx: assign the MMC signal clocks
     - [arm64] dts: amlogic: g12: assign the MMC B and C signal clocks
     - [arm64] dts: amlogic: g12: assign the MMC A signal clock
     - [arm64] dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm
     - [arm64] dts: qcom: sdm845-db845c: drop CS from SPIO0
     - [arm64] dts: qcom: sdm845-db845c: specify power for WiFi CH1
     - [arm64] dts: qcom: x1e: bus is 40-bits (fix 64GB models)
     - [arm64] dts: qcom: agatti: Add CX_MEM/DBGC GPU regions
     - [arm64] dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions
     - [arm64] drm/panthor: Recover from panthor_gpu_flush_caches() failures
     - [arm64] drm/panthor: Fix the full_tick check
     - [arm64] drm/panthor: Fix the group priority rotation logic
     - [arm64] drm/panthor: Fix immediate ticking on a disabled tick
     - [arm64] drm/panthor: Fix the logic that decides when to stop ticking
     - [arm64] drm/panthor: Make sure we resume the tick when new jobs are
       submitted
     - workqueue: Factor out assign_rescuer_work()
     - workqueue: Only assign rescuer work when really needed
     - workqueue: Process rescuer work items one-by-one using a cursor
     - drm/panel: sw43408: Remove manual invocation of unprepare at remove
     - ALSA: pcm: use new array-copying-wrapper
     - ALSA: pcm: Relax __free() variable declarations
     - ALSA: vmaster: Relax __free() variable declarations
     - [arm64] drm/panthor: Evict groups before VM termination
     - [amd64] ASoC: nau8821: Consistently clear interrupts before unmasking
     - [amd64] ASoC: nau8821: Avoid unnecessary blocking in IRQ handler
     - [amd64] ASoC: nau8821: Fixup nau8821_enable_jack_detect()
     - media: chips-media: wave5: Fix memory leak on codec_info allocation
       failure
     - drm/amd: Drop "amdgpu kernel modesetting enabled" message
     - drm/amdkfd: Fix signal_eviction_fence() bool return value
     - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init
     - [arm64] drm/msm/disp/dpu: add merge3d support for sc7280
     - [arm64] drm/msm/dpu: Set vsync source irrespective of mdp top support
     - [arm64] drm/msm/dpu: fix WD timer handling on DPU 8.x
     - regulator: core: move supply check earlier in set_machine_constraints()
     - HID: playstation: Add missing check for input_ff_create_memless
     - [arm64] drm/msm/disp: set num_planes to 1 for interleaved YUV formats
     - [arm64] drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x
     - media: ccs: Accommodate C-PHY into the calculation
     - [arm64] drm/msm/a2xx: fix pixel shader start on A225
     - drm/buddy: release free_trees array on buddy mm teardown
     - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev
     - media: uvcvideo: Fix allocation for small frame sizes
     - evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac()
     - drm/xe: Unregister drm device on probe error
     - platform/chrome: cros_ec_lightbar: Fix response size initialization
     - HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients
     - spi: tools: Add include folder to .gitignore
     - Revert "hwmon: (ibmpex) fix use-after-free in high/low store"
     - hwmon: pmbus: mpq8785: Prepare driver for multiple device support
     - hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio
       configuration
     - hwmon: pmbus: mpq8785: Add support for MPM82504
     - hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification
     - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails
     - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors
     - PCI/PM: Avoid redundant delays on D3hot->D3cold
     - wifi: cfg80211: Fix use_for flag update on BSS refresh
     - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails
     - docs: fix WARNING document not included in any toctree
     - Documentation: trace: Refactor toctree
     - Documentation: tracing: Add PCI tracepoint documentation
     - PCI: Do not attempt to set ExtTag for VFs
     - PCI/portdrv: Fix potential resource leak
     - dm: fix unlocked test for dm_suspended_md
     - dm: use READ_ONCE in dm_blk_report_zones
     - quota: fix livelock between quotactl and freeze_super
     - net: mctp-i2c: fix duplicate reception of old data
     - mctp i2c: initialise event handler read bytes
     - wifi: cfg80211: stop NAN and P2P in cfg80211_leave
     - netfilter: nf_tables: reset table validation state on abort
     - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH
     - netfilter: nf_conncount: increase the connection clean up limit to 64
     - netfilter: nft_compat: add more restrictions on netlink attributes
     - netfilter: nf_conncount: fix tracking of connections from localhost
     - module: add helper function for reading module_buildid()
     - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup()
     - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken
     - [amd64] iommu/vt-d: Flush cache for PASID table before using it
     - [amd64] iommu/vt-d: Separate page request queue from SVM
     - [amd64] iommu/vt-d: Drain PRQs when domain removed from RID
     - [amd64] iommu/vt-d: Avoid draining PRQ in sva mm release path
     - [amd64] iommu/vt-d: Clear Present bit before tearing down PASID entry
     - dm: use bio_clone_blkg_association
     - xdrgen: Fix struct prefix for typedef types in program wrappers
     - NFS: NFSERR_INVAL is not defined by NFSv2
     - xdrgen: Initialize data pointer for zero-length items
     - nfsd: never defer requests during idmap lookup
     - fat: avoid parent link count underflow in rmdir
     - tcp: tcp_tx_timestamp() must look at the rtx queue
     - PCI: Check parent for NULL in of_pci_bus_release_domain_nr()
     - wifi: ath10k: sdio: add missing lock protection in
       ath10k_sdio_fw_crashed_dump()
     - PCI: Initialize RCB from pci_configure_device()
     - PCI: Add defines for bridge window indexing
     - PCI/ACPI: Restrict program_hpx_type2() to AER bits
     - ipc: don't audit capability check in ipc_permissions()
     - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit()
     - mptcp: fix receive space timestamp initialization
     - octeontx2-af: Fix PF driver crash with kexec kernel booting
     - bonding: only set speed/duplex to unknown, if getting speed failed
     - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
     - nfc: hci: shdlc: Stop timers and work before freeing context
     - netfilter: nfnetlink_queue: optimize verdict lookup with hash table
     - netfilter: nfnetlink_queue: do shared-unconfirmed check before
       segmentation
     - netfilter: nft_set_hash: fix get operation on big endian
     - netfilter: nft_counter: fix reset of counters on 32bit archs
     - netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null
       interval
     - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets
     - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404]
     - [arm64] net: hns3: fix double free issue for tx spare buffer
     - procfs: fix missing RCU protection when reading real_parent in
       do_task_stat()
     - smb: client: correct value for smbd_max_fragmented_recv_size
     - net: atm: fix crash due to unvalidated vcc pointer in sigd_send()
     - net: sunhme: Fix sbus regression
     - net: Add skb_dstref_steal and skb_dstref_restore
     - net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input
       callers
     - xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path
     - serial: caif: fix use-after-free in caif_serial ldisc_close()
     - octeon_ep: disable per ring interrupts
     - octeon_ep: ensure dbell BADDR updation
     - octeon_ep_vf: ensure dbell BADDR updation
     - ionic: Rate limit unknown xcvr type messages
     - octeontx2-pf: Unregister devlink on probe failure
     - RDMA/rtrs: server: remove dead code
     - IB/cache: update gid cache on client reregister event
     - RDMA/hns: Fix WQ_MEM_RECLAIM warning
     - RDMA/hns: Fix RoCEv1 failure due to DSCP
     - RDMA/hns: Notify ULP of remaining soft-WCs during reset
     - power: supply: ab8500: Fix use-after-free in power_supply_changed()
     - power: supply: act8945a: Fix use-after-free in power_supply_changed()
     - power: supply: bq256xx: Fix use-after-free in power_supply_changed()
     - power: supply: bq25980: Fix use-after-free in power_supply_changed()
     - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed()
     - power: supply: goldfish: Fix use-after-free in power_supply_changed()
     - power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed()
     - power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed()
     - power: supply: rt9455: Fix use-after-free in power_supply_changed()
     - power: supply: sbs-battery: Fix use-after-free in power_supply_changed()
     - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write
     - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported
     - power: supply: wm97xx: Fix NULL pointer dereference in
       power_supply_changed()
     - RDMA/rtrs-srv: fix SG mapping
     - RDMA/rxe: Fix double free in rxe_srq_from_init
     - RDMA/iwcm: Fix workqueue list corruption by removing work_list
     - tools/power/x86/intel-speed-select: Fix file descriptor leak in
       isolate_cpus()
     - RDMA/mlx5: Fix UMR hang in LAG error state unload
     - IB/mlx5: Fix port speed query for representors
     - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper
     - vfio/pci: Lock upstream bridge for vfio_pci_core_disable()
     - [amd64] platform/x86/amd/pmf: Prevent TEE errors after hibernate
     - [amd64] crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails
     - [amd64] crypto: ccp - Add an S4 restore flow
     - [amd64] crypto: ccp - Factor out ring destroy handling to a helper
     - [amd64] crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when
       PSP_CMD_TEE_RING_INIT fails
     - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse()
     - nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx
     - NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit
     - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send
     - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler
     - RDMA/rxe: Fix race condition in QP timer handlers
     - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing
     - cxl: Fix premature commit_end increment on decoder commit failure
     - mtd: parsers: ofpart: fix OF node refcount leak in
       parse_fixed_partitions()
     - mtd: spinand: Fix kernel doc
     - power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler
     - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer
     - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc
     - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN
     - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()
     - scsi: ufs: host: mediatek: Require CONFIG_PM
     - scsi: csiostor: Fix dereference of null pointer rn
     - nvdimm: virtio_pmem: serialize flush requests
     - fs/nfs: Fix readdir slow-start regression
     - tracing: Properly process error handling in event_hist_trigger_parse()
     - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros
     - fbdev: of_display_timing: Fix device node reference leak in
       of_get_display_timings()
     - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()
     - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs
     - clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs
     - clk: qcom: rcg2: compute 2d using duty fraction directly
     - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs
     - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc
     - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc
     - clk: qcom: gcc-ipq5018: flag sleep clock as critical
     - clk: Move clk_{save,restore}_context() to COMMON_CLK section
     - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks
     - clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src
     - clk: qcom: gfx3d: add parent to parent request map
     - clk: mediatek: Fix error handling in runtime PM setup
     - interconnect: mediatek: Don't hijack parent device
     - interconnect: mediatek: Aggregate bandwidth with saturating add
     - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX
     - dma: dma-axi-dmac: fix SW cyclic transfers
     - dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue
     - soundwire: intel_ace2x: add SND_HDA_CORE dependency
     - iio: test: drop dangling symbol in gain-time-scale helpers
     - staging: greybus: lights: avoid NULL deref
     - serial: imx: change SERIAL_IMX_CONSOLE to bool
     - serial: SH_SCI: improve "DMA support" prompt
     - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms
     - iio: pressure: mprls0025pa: fix spi_transfer struct initialisation
     - iio: pressure: mprls0025pa: fix SPI CS delay violation
     - iio: pressure: mprls0025pa: fix interrupt flag
     - iio: pressure: mprls0025pa: fix scan_type struct
     - iio: pressure: mprls0025pa: fix pressure calculation
     - watchdog: starfive-wdt: Fix PM reference leak in probe error path
     - coresight: etm3x: Fix cpulocked warning on cpuhp
     - phy: freescale: imx8qm-hsio: fix NULL pointer dereference
     - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms"
     - mfd: arizona: Fix regulator resource leak on
       wm5102_clear_write_sequencer() failure
     - mfd: simple-mfd-i2c: Add MAX77705 support
     - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA
     - mfd: simple-mfd-i2c: Add SpacemiT P1 support
     - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order
     - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support
     - drivers: iio: mpu3050: use dev_err_probe for regulator request
     - usb: bdc: fix sleep during atomic
     - pinctrl: equilibrium: Fix device node reference leak in pinbank_init()
     - ovl: Fix uninit-value in ovl_fill_real
     - iio: sca3000: Fix a resource leak in sca3000_probe()
     - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition
     - pinctrl: single: fix refcount leak in pcs_add_gpio_func()
     - leds: qcom-lpg: Check the return value of regmap_bulk_write()
     - backlight: qcom-wled: Support ovp values for PMI8994
     - backlight: qcom-wled: Change PM8950 WLED configurations
     - dmaengine: fsl-edma: don't explicitly disable clocks in .remove()
     - drbd: always set BLK_FEAT_STABLE_WRITES
     - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data
     - fs/ntfs3: Initialize new folios before use
     - fs/ntfs3: prevent infinite loops caused by the next valid being the same
     - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot
     - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs
     - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check
     - kbuild: Add objtool to top-level clean target
     - objpool: fix the overestimation of object pooling metadata size
     - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO
     - cpuidle: Skip governor when only one idle state is available
     - net: sparx5/lan969x: fix DWRR cost max to match hardware register width
     - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper
     - net: mscc: ocelot: split xmit into FDMA and register injection paths
     - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()
     - ipv6: Fix out-of-bound access in fib6_add_rt2node().
     - net: sparx5/lan969x: fix PTP clock max_adj value
     - net: usb: catc: enable basic endpoint checking
     - xen-netback: reject zero-queue configuration from guest
     - net/rds: rds_sendmsg should not discard payload_len
     - net: bridge: mcast: always update mdb_n_entries for vlan contexts
     - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value
     - ipvs: do not keep dest_dst if dev is going down
     - net: remove WARN_ON_ONCE when accessing forward path array
     - netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
       (CVE-2026-23231)
     - ipv6: fix a race in ip6_sock_set_v6only()
     - bpftool: Fix truncated netlink dumps
     - ping: annotate data-races in ping_lookup()
     - macvlan: observe an RCU grace period in macvlan_common_newlink() error
       path
     - icmp: prevent possible overflow in icmp_global_allow()
     - inet: move icmp_global_{credit,stamp} to a separate cache line
     - octeontx2-af: Fix default entries mcam entry action
     - bonding: alb: fix UAF in rlb_arp_recv during bond up/down
     - net/mlx5: Fix multiport device check over light SFs
     - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels
     - apparmor: fix NULL sock in aa_sock_file_perm
     - AppArmor: Allow apparmor to handle unaligned dfa tables
     - apparmor: Fix & Optimize table creation from possibly unaligned memory
     - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure
     - apparmor: fix rlimit for posix cpu timers
     - apparmor: remove apply_modes_to_perms from label_match
     - apparmor: make label_match return a consistent value
     - apparmor: avoid per-cpu hold underflow in aa_get_buffer
     - apparmor: fix invalid deref of rawdata when export_binary is unset
     - apparmor: fix aa_label to return state from compount and component match
     - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()
     - drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()
     - drm/amdgpu: Fix memory leak in amdgpu_ras_init()
     - ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put()
     - [amd64] drm/i915/acpi: free _DSM package when no connectors
     - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init
     - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2
     - drm/amd/display: Reject cursor plane on DCE when scaled differently than
       primary
     - drm/amd/display: Fix out-of-bounds stream encoder index v3
     - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe()
     - [s390x] kexec: Make KEXEC_SIG available when CONFIG_MODULES=n
     - drm/xe: Move forcewake to 'gt.pm' substructure
     - drm/xe: Create dedicated xe_mmio structure
     - drm/xe: Clarify size of MMIO region
     - drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio'
     - drm/xe: Populate GT's mmio iomap from tile during init
     - drm/xe: Switch mmio_ext to use 'struct xe_mmio'
     - drm/xe: Add xe_tile backpointer to xe_mmio
     - drm/xe: Adjust mmio code to pass VF substructure to SRIOV code
     - drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt
     - drm/xe/mmio: Avoid double-adjust in 64-bit reads
     - drm/xe/ptl: Apply Wa_13011645652
     - drm/xe/xe2_hpg: Add set of workarounds
     - drm/xe/xe2_hpg: Fix handling of Wa_14019988906 & Wa_14019877138
     - efi: Fix reservation of unaccepted memory table
     - btrfs: use the correct type to initialize block reserve for delayed refs
     - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not
       found
     - [amd64] x86/hyperv: Fix error pointer dereference
     - [arm64] ASoC: rockchip: i2s-tdm: Use param rate if not provided by
       set_sysclk
     - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats
     - ext4: subdivide EXT4_EXT_DATA_VALID1
     - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1
     - ext4: don't cache extent during splitting extent
     - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout
     - ext4: drop extent cache when splitting extent fails
     - ext4: fix memory leak in ext4_ext_shift_extents()
     - ext4: fix e4b bitmap inconsistency reports
     - ext4: fix dirtyclusters double decrement on fs shutdown
     - ext4: use optimized mballoc scanning regardless of inode format
     - ata: pata_ftide010: Fix some DMA timings
     - ata: libata-scsi: refactor ata_scsi_translate()
     - Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT
     - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths
     - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path
     - dt-bindings: phy: qcom-edp: Add missing clock for X Elite
     - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false
     - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names
     - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names
     - perf test stat: Update test expectations and events
     - perf test stat tests: Fix for virtualized machines
     - perf unwind-libdw: Fix invalid reference counts
     - perf callchain: Fix srcline printing with inlines
     - libsubcmd: Fix null intersection case in exclude_cmds()
     - perf maps: Fix reference count leak in maps__find_ams()
     - perf annotate: Fix memcpy size in arch__grow_instructions()
     - perf vendor events amd: Fix Zen 5 MAB allocation events
     - libperf: Don't remove -g when EXTRA_CFLAGS are used
     - libperf build: Always place libperf includes first
     - rtc: interface: Alarm race handling should not discard preceding error
     - statmount: permission check should return EPERM
     - audit: add fchmodat2() to change attributes class
     - hfsplus: fix volume corruption issue for generic/498
     - fs/buffer: add alert in try_to_free_buffers() for folios without buffers
     - audit: add missing syscalls to read class
     - hfsplus: pretend special inodes as regular files
     - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr()
     - i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init
     - minix: Add required sanity checking to minix_check_superblock()
     - dlm: validate length in dlm_search_rsb_tree
     - btrfs: fallback to buffered IO if the data profile has duplication
     - btrfs: handle user interrupt properly in btrfs_trim_fs()
     - smb: client: add proper locking around ses->iface_last_update
     - gfs2: fiemap page fault fix
     - smb: client: prevent races in ->query_interfaces()
     - tools/power cpupower: Reset errno before strtoull()
     - [s390x] purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
     - [arm64] Add support for TSV110 Spectre-BHB mitigation
     - rnbd-srv: Zero the rsp buffer before using it
     - [amd64] x86/xen/pvh: Enable PAE mode for 32-bit guest only when
       CONFIG_X86_PAE is set
     - EFI/CPER: don't dump the entire memory region
     - APEI/GHES: ensure that won't go past CPER allocated record
     - APEI/GHES: ARM processor Error: don't go past allocated memory
     - EFI/CPER: don't go past the ARM processor CPER record buffer
     - ACPI: processor: Fix NULL-pointer dereference in
       acpi_processor_errata_piix4()
     - ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[]
     - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP
     - powercap: intel_rapl: Add PL4 support for Ice Lake
     - alpha: fix user-space corruption during memory compaction
     - md-cluster: fix NULL pointer dereference in process_metadata_update
     - cpufreq: dt-platdev: Block the driver from probing on more QC platforms
     - [s390x] perf: Disable register readout on sampling events
     - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD
     - ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display)
     - ACPI: battery: fix incorrect charging status when current is zero
     - xenbus: Use .freeze/.thaw to handle xenbus devices
     - blk-mq-debugfs: add missing debugfs_mutex in
       blk_mq_debugfs_register_hctxs()
     - block: decouple secure erase size limit from discard size limit
     - bpf: verifier improvement in 32bit shift sign extension pattern
     - [amd64] perf/x86/msr: Add Airmont NP
     - [amd64] perf/x86/cstate: Add Airmont NP
     - bpf: crypto: Use the correct destructor kfunc type
     - bpf: Recognize special arithmetic shift in the verifier
     - clocksource/drivers/sh_tmu: Always leave device running after probe
     - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on
       OF
     - PCI/MSI: Unmap MSI-X region on error
     - crypto: hisilicon/qm - move the barrier before writing to the mailbox
       register
     - mailbox: bcm-ferxrm-mailbox: Use default primary handler
     - char: tpm: cr50: Remove IRQF_ONESHOT
     - sched/debug: Fix updating of ppos on server write ops
     - pstore: ram_core: fix incorrect success return when vmap() fails
     - firmware: arm_ffa: Unmap Rx/Tx buffers on init failure
     - [arm64] Revert "arm64: zynqmp: Add an OP-TEE node to the device tree"
     - [arm64] tegra: smaug: Add usb-role-switch support
     - drm/display/dp_mst: Add protection against 0 vcpi
     - gpu/panel-edp: add AUO panel entry for B140HAN06.4
     - drm/amdgpu: fix NULL pointer issue buffer funcs
     - drm/amdkfd: Handle GPU reset and drain retry fault race
     - spi-geni-qcom: initialize mode related registers to 0
     - spi-geni-qcom: use xfer->bits_per_word for can_dma()
     - drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32
     - [amd64] ASoC: SOF: ipc4: Support for sending payload along with
       LARGE_CONFIG_GET
     - media: dvb-core: dmxdevfilter must always flush bufs
     - spi: stm32: fix Overrun issue at < 8bpw
     - drm/v3d: Set DMA segment size to avoid debug warnings
     - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes
     - media: omap3isp: isppreview: always clamp in preview_try_format()
     - media: omap3isp: set initial format
     - media: chips-media: wave5: Fix conditional in start_streaming
     - media: chips-media: wave5: Process ready frames when CMD_STOP sent to
       Encoder
     - media: mediatek: vcodec: Don't try to decode 422/444 VP9
     - drm/amdgpu: add support for HDP IP version 6.1.1
     - drm/amd/display: Fix dsc eDP issue
     - drm/amdgpu: avoid a warning in timedout job handler
     - drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src
     - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards
     - drm/amdgpu: Skip loading SDMA_RS64 in VF
     - drm/amd/display: only power down dig on phy endpoints
     - drm/xe: Only toggle scheduling in TDR if GuC is running
     - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask
     - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug
     - spi: spi-mem: Limit octal DTR constraints to octal DTR situations
     - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START
     - drm/panel: Fix a possible null-pointer dereference in
       jdi_panel_dsi_remove()
     - media: adv7180: fix frame interval in progressive mode
     - media: pvrusb2: fix URB leak in pvr2_send_request_ex
     - media: solo6x10: Check for out of bounds chip_id
     - media: cx25821: Fix a resource leak in cx25821_dev_setup()
     - media: v4l2-async: Fix error handling on steps after finding a match
     - media: mt9m114: Avoid a reset low spike during probe()
     - media: mt9m114: Return -EPROBE_DEFER if no endpoint is found
     - media: ipu6: Ensure stream_mutex is acquired when dealing with node list
     - media: ipu6: Close firmware streams on streaming enable failure
     - media: ipu6: Always close firmware stream
     - ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk
     - drm/amdkfd: Relax size checking during queue buffer get
     - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map()
     - drm: Account property blob allocations to memcg
     - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed
     - virt: vbox: uapi: Mark inner unions in packed structs as packed
     - [amd64] ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to
       aggregated
     - PCI: Add Intel Nova Lake audio Device ID
     - drm/amd/display: Disable FEC when powering down encoders
     - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback
     - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional
       parts
     - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release
     - media: rkisp1: Fix filter mode register configuration
     - HID: multitouch: add eGalaxTouch EXC3188 support
     - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK
     - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro
     - ALSA: hda/realtek: fix LG Gram Style 14 speakers
     - gpio: aspeed-sgpio: Change the macro to support deferred probe
     - [arm64] ASoC: sunxi: sun50i-dmic: Add missing check for
       devm_regmap_init_mmio
     - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end
     - drm/amd/display: Fix GFX12 family constant checks
     - drm/amd/display: avoid dig reg access timeout on usb4 link training fail
     - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in
       max98390_i2c_probe()
     - hwmon: (dell-smm) Add support for Dell OptiPlex 7080
     - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE
     - hwmon: (f71882fg) Add F81968 support
     - HID: logitech-hidpp: Add support for Logitech K980
     - ASoC: es8328: Add error unwind in resume
     - modpost: Amend ppc64 save/restfpr symnames for -Os build
     - power: sequencing: fix missing state_lock in pwrseq_power_on() error path
     - [amd64] ASoC: SOF: Intel: hda: Fix NULL pointer dereference
     - spi: geni-qcom: Fix abort sequence execution for serial engine errors
     - ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe
     - ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx
     - ALSA: mixer: oss: Add card disconnect checkpoints
     - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio
     - jfs: Add missing set_freezable() for freezable kthread
     - jfs: nlink overflow in jfs_rename
     - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero
     - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()
     - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H
     - wifi: rtw89: 8922a: set random mac if efuse contains zeroes
     - wifi: rtw89: ser: enable error IMR after recovering from L1
     - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()
     - wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band
       data
     - dm: replace -EEXIST with -EBUSY
     - dm: remove fake timeout to avoid leak request
     - [arm64] iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency
     - net: wwan: mhi: Add network support for Foxconn T99W760
     - wifi: libertas: fix WARNING in usb_tx_block
     - [amd64] iommu/amd: move wait_on_sem() out of spinlock
     - wifi: rtw89: mac: correct page number for CSI response
     - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode
     - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1
     - wifi: ath11k: Fix failure to connect to a 6 GHz AP
     - wifi: ath12k: fix preferred hardware mode calculation
     - wifi: cfg80211: allow only one NAN interface, also in multi radio
     - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}()
     - ipv6: annotate data-races over sysctl.flowlabel_reflect
     - ipv6: exthdrs: annotate data-race over multiple sysctl
     - ext4: mark group add fast-commit ineligible
     - ext4: move ext4_percpu_param_init() before ext4_mb_init()
     - ext4: mark group extend fast-commit ineligible
     - ext4: use reserved metadata blocks when splitting extent on endio
     - netfilter: nf_conntrack: Add allow_clash to generic protocol handler
     - netfilter: xt_tcpmss: check remaining length before reading optlen
     - net: usb: r8152: fix transmit queue timeout
     - wifi: iwlwifi: mvm: check the validity of noa_len
     - wifi: rtw89: fix unable to receive probe responses under MLO connection
     - wifi: rtw89: 8922a: add digital compensation for 2GHz
     - net/rds: No shortcut out of RDS_CONN_ERROR
     - ext4: propagate flags to convert_initialized_extent()
     - gro: change the BUG_ON() in gro_pull_from_frag0()
     - ipv4: igmp: annotate data-races around idev->mr_maxdelay
     - [arm64] net: hns3: extend HCLGE_FD_AD_QID to 11 bits
     - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power()
     - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement()
     - ipv4: fib: Annotate access to struct fib_alias.fa_state.
     - Bluetooth: btusb: Add support for MediaTek7920 0489:e158
     - Bluetooth: hci_conn: Set link_policy on incoming ACL connections
     - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
     - Bluetooth: btusb: Add new VID/PID for RTL8852CE
     - Bluetooth: btusb: Add device ID for Realtek RTL8761BU
     - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky
     - net: sfp: add quirk for Lantech 8330-265D
     - wifi: rtw89: pci: restore LDO setting after device resume
     - wifi: ath10k: fix lock protection in
       ath10k_wmi_event_peer_sta_ps_state_chg()
     - bnxt_en: Allow ntuple filters for drops
     - net: usb: sr9700: remove code to drive nonexistent multicast filter
     - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16
     - net/rds: Clear reconnect pending bit
     - PCI: Mark ASM1164 SATA controller to avoid bus reset
     - PCI/AER: Clear stale errors on reporting agents upon probe
     - PCI: Fix pci_slot_lock () device locking
     - PCI: Enable ACS after configuring IOMMU for OF platforms
     - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur
     - PCI: Mark Nvidia GB10 to avoid bus reset
     - myri10ge: avoid uninitialized variable use
     - nfc: nxp-nci: remove interrupt trigger type
     - RDMA/rtrs-clt: For conn rejection use actual err number
     - ata: libata: avoid long timeouts on hot-unplugged SATA DAS
     - hisi_acc_vfio_pci: update status after RAS error
     - scsi: buslogic: Reduce stack usage
     - vhost: fix caching attributes of MMIO regions by setting them explicitly
     - scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event
     - [riscv64] vector: init vector context with proper vlenb
     - tracing: Fix false sharing in hwlat get_sample()
     - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX
       channel is uninitialized
     - mailbox: pcc: Remove spurious IRQF_ONESHOT usage
     - mailbox: imx: Skip the suspend flag for i.MX7ULP
     - mailbox: sprd: mask interrupts that are not handled
     - remoteproc: mediatek: Break lock dependency to `prepare_lock`
     - mailbox: sprd: clear delivery flag before handling TX done
     - clk: microchip: core: correct return value on *_get_parent()
     - HID: i2c-hid: Add FocalTech FT8112
     - 9p/xen: protect xen_9pfs_front_free against concurrent calls
     - dmaengine: stm32-dma3: use module_platform_driver
     - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15)
     - soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list
     - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure
     - serial: 8250_dw: handle clock enable errors in runtime_resume
     - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs
     - fpga: of-fpga-region: Fail if any bridge is missing
     - most: core: fix resource leak in most_register_interface error paths
     - dmaengine: sun6i: Choose appropriate burst length under maxburst
     - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings
     - phy: ti: phy-j721e-wiz: restore mux selection during resume
     - phy: cadence-torrent: restore parent clock for refclk during resume
     - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()
     - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66
     - usb: gadget: f_fs: fix DMA-BUF OUT queues
     - usb: gadget: f_fs: Fix ioctl error handling
     - usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()
     - staging: rtl8723bs: fix memory leak on failure path
     - serial: 8250: 8250_omap.c: Add support for handling UART error conditions
     - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA
       termination is done
     - fix it87_wdt early reboot by reporting running timer
     - [arm*] binder: don't use %pK through printk
     - watchdog: imx7ulp_wdt: handle the nowayout option
     - phy: mvebu-cp110-utmi: fix dr_mode property read from dts
     - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature
     - Revert "mfd: da9052-spi: Change read-mask to write-mask"
     - mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs
     - iio: Use IRQF_NO_THREAD
     - iio: magnetometer: Remove IRQF_ONESHOT
     - fs: ntfs3: check return value of indx_find to avoid infinite loop
     - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent
       metadata
     - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST
     - fs/ntfs3: drop preallocated clusters for sparse and compressed files
     - fs/ntfs3: avoid calling run_get_entry() when run == NULL in
       ntfs_read_run_nb_ra()
     - ceph: supply snapshot context in ceph_uninline_data()
     - libceph: define and enforce CEPH_MAX_KEY_LEN
     - thermal: int340x: Fix sysfs group leak on DLVR registration failure
     - [amd64] ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90
     - include: uapi: netfilter_bridge.h: Cover for musl libc
     - drm/amd/display: Fix writeback on DCN 3.2+
     - drm/amd/display: Fix system resume lag issue
     - drm/amd/display: Avoid updating surface with the same surface under MPO
     - drm/amdgpu: Adjust usleep_range in fence wait
     - ALSA: usb-audio: Update the number of packets properly at receiving
     - drm/amdgpu: Add HAINAN clock adjustment
     - drm/amd/display: bypass post csc for additional color spaces in dal
     - spi: spidev: fix lock inversion between spi_lock and buf_lock
     - drm/radeon: Add HAINAN clock adjustment
     - ALSA: usb-audio: Add sanity check for OOB writes at silencing
     - btrfs: replace BUG() with error handling in __btrfs_balance()
     - [arm64] hugetlbpage: avoid unused-but-set-parameter warning (gcc-16)
     - drm/amd/display: Remove conditional for shaper 3DLUT power-on
     - rtc: zynqmp: correct frequency value
     - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
     - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
     - xfrm6: fix uninitialized saddr in xfrm6_get_saddr()
     - xfrm: skip templates check for packet offload tunnel mode
     - ipmi: ipmb: initialise event handler read bytes
     - xfrm: always flush state and policy upon NETDEV_UNREGISTER event
     - espintcp: Fix race condition in espintcp_close() (CVE-2026-23239)
     - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
     - net: usb: lan78xx: scan all MDIO addresses on LAN7801
     - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set()
     - net: ethernet: xscale: Check for PTP support properly
     - bnxt_en: Fix RSS context delete logic
     - bnxt_en: Fix deleting of Ntuple filters
     - wifi: cfg80211: wext: fix IGTK key ID off-by-one
     - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option
     - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ
     - Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short
     - Bluetooth: hci_qca: Cleanup on all setup failures
     - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ
     - Bluetooth: L2CAP: Fix not checking output MTU is acceptable on
       L2CAP_ECRED_CONN_REQ
     - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
     - tls: Fix race condition in tls_sw_cancel_work_tx() (CVE-2026-23240)
     - kcm: fix zero-frag skb in frag_list on partial sendmsg error
     - tipc: fix duplicate publication key in tipc_service_insert_publ()
     - RDMA/core: Fix stale RoCE GIDs during netdev events at registration
     - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets
     - RDMA/efa: Fix typo in efa_alloc_mr()
     - net: usb: pegasus: enable basic endpoint checking
     - RDMA/umem: Fix double dma_buf_unpin in failure path
     - net/mlx5: DR, Fix circular locking dependency in dump
     - net/mlx5: E-switch, Clear legacy flag when moving to switchdev
     - net/mlx5: Fix missing devlink lock in SRIOV enable error path
     - net/mlx5e: Separate address related variables to be in struct
     - net/mlx5e: Support routed networks during IPsec MACs initialization
     - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query
     - net: consume xmit errors of GSO frames
     - dpaa2-switch: validate num_ifs to prevent out-of-bounds write
     - netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
     - rpmsg: core: fix race in driver_override_show() and use core helper
     - [arm64] clk: renesas: rzg2l: Fix intin variable size
     - [arm64] clk: renesas: rzg2l: Select correct div round macro
     - [amd64] ASoC: SOF: ipc4-control: If there is no data do not send bytes
       update
     - [amd64] ASoC: SOF: ipc4-topology: Correct the allocation size for bytes
       controls
     - [amd64] ASoC: SOF: ipc4-control: Use the correct size for
       scontrol->ipc_control_data
     - [amd64] ASoC: SOF: ipc4-control: Keep the payload size up to date
     - fpga: dfl: use subsys_initcall to allow built-in drivers to be added
     - Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global
       IRQ' is supported"
     - phy: qcom: edp: Make the number of clocks flexible
     - dm-verity: correctly handle dm_bufio_client_create() failure
     - media: mediatek: encoder: Fix uninitialized scalar variable issue
     - media: mtk-mdp: Fix error handling in probe function
     - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove()
     - media: chips-media: wave5: Fix kthread worker destruction in polling mode
     - media: chips-media: wave5: Fix device cleanup order to prevent kernel
       panic
     - media: verisilicon: AV1: Fix enable cdef computation
     - media: verisilicon: AV1: Fix tx mode bit setting
     - [arm64] dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs
     - [armhf] omap2: Fix reference count leaks in omap_control_init()
     - [amd64] KVM: x86: Return "unsupported" instead of "invalid" on access to
       unsupported PV MSR
     - [amd64] KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3()
       succeeding
     - [arm64] Disable branch profiling for all arm64 code
     - HID: hid-pl: handle probe errors
     - HID: magicmouse: Do not crash on missing msc->input
     - HID: prodikeys: Check presence of pm->input_ep82
     - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()
     - [arm64] dts: apple: t8112-j473: Keep the HDMI port powered on
     - media: amphion: Drop min_queued_buffers assignment
     - media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init()
     - media: verisilicon: AV1: Set IDR flag for intra_only frame type
     - media: radio-keene: fix memory leak in error path
     - media: cx88: Add missing unmap in snd_cx88_hw_params()
     - media: cx23885: Add missing unmap in snd_cx23885_hw_params()
     - media: cx25821: Add missing unmap in snd_cx25821_hw_params()
     - media: i2c/tw9903: Fix potential memory leak in tw9903_probe()
     - media: i2c/tw9906: Fix potential memory leak in tw9906_probe()
     - media: i2c: ov01a10: Fix the horizontal flip control
     - media: i2c: ov01a10: Fix reported pixel-rate value
     - media: i2c: ov01a10: Fix analogue gain range
     - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls
     - media: i2c: ov01a10: Fix passing stream instead of pad to
       v4l2_subdev_state_get_format()
     - media: i2c: ov01a10: Fix test-pattern disabling
     - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()
     - media: ccs: Avoid possible division by zero
     - media: i2c: ov5647: Initialize subdev before controls
     - media: i2c: ov5647: Correct pixel array offset
     - media: i2c: ov5647: Correct minimum VBLANK value
     - media: i2c: ov5647: Sensor should report RAW color space
     - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode
     - media: ccs: Fix setting initial sub-device state
     - media: i2c: ov5647: use our own mutex for the ctrl lock
     - media: ipu6: Fix typo and wrong constant in ipu6-mmu.c
     - media: ipu6: Fix RPM reference leak in probe error paths
     - [amd64] platform/x86: ISST: Add missing write block check
     - dm-integrity: fix a typo in the code for write/discard race
     - dm: clear cloned request bio pointer when last clone bio completes
     - [arm64] soc: ti: k3-socinfo: Fix regmap leak on probe failure
     - [arm64] soc: ti: pruss: Fix double free in pruss_clk_mux_setup()
     - [amd64] KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
     - bus: omap-ocp2scp: fix OF populate on driver rebind
     - clk: clk-apple-nco: Add "apple,t8103-nco" compatible
     - [arm64,armhf] soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON
       definition
     - [arm64,armhf] soc: rockchip: grf: Support multiple grf to be handled
     - media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop
     - media: i2c: ov01a10: Fix digital gain range
     - clk: tegra: tegra124-emc: Fix potential memory leak in
       tegra124_clk_register_emc()
     - [s390x] pci: Handle futile config accesses of disabled devices directly
     - reset: gpio: suppress bind attributes in sysfs
     - dm-integrity: fix recalculation in bitmap mode
     - dm-unstripe: fix mapping bug when there are multiple targets in a table
     - [arm64] dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro
     - media: venus: vdec: fix error state assignment for zero bytesused
     - media: venus: vdec: restrict EOS addr quirk to IRIS2 only
     - drm: of: drm_of_panel_bridge_remove(): fix device_node leak
     - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations
     - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs
     - drm/buddy: Prevent BUG_ON by validating rounded allocation
     - drm/bridge: anx7625: Fix invalid EDID size
     - xfs: mark data structures corrupt on EIO and ENODATA
     - xfs: remove xfs_attr_leaf_hasname
     - media: verisilicon: AV1: Fix tile info buffer size
     - [amd64] iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in
       scalable mode
     - mfd: core: Add locking around 'mfd_of_node_list'
     - mfd: qcom-pm8xxx: Fix OF populate on driver rebind
     - mfd: omap-usb-host: Fix OF populate on driver rebind
     - iio: accel: adxl380: Avoid reading more entries than present in FIFO
     - xfs: delete attr leaf freemap entries when empty
     - xfs: fix freemap adjustments when adding xattrs to leaf blocks
     - xfs: fix the xattr scrub to detect freemap/entries array collisions
     - xfs: fix remote xattr valuelblk check
     - [amd64] KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()
     - PCI: endpoint: Fix swapped parameters in
       pci_{primary/secondary}_epc_epf_unlink() functions
     - pinctrl: intel: Add code name documentation
     - xfs: only call xf{array,blob}_destroy if we have a valid pointer
     - xfs: check return value of xchk_scrub_create_subord
     - xfs: check for deleted cursors when revalidating two btrees
     - md/bitmap: fix GPF in write_page caused by resize race
     - nfsd: fix return error code for nfsd_map_name_to_[ug]id
     - nvmem: Drop OF node reference on nvmem_add_one_cell() failure
     - [amd64] x86/kexec: add a sanity check on previous kernel's ima kexec
       buffer
     - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node
     - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN
     - io_uring/net: don't continue send bundle if poll was required for retry
     - bus: fsl-mc: fix an error handling in fsl_mc_device_add()
     - dm mpath: make pg_init_delay_msecs settable
     - [arm64] poe: fix stale POR_EL0 values for ptrace
     - tools: Fix bitfield dependency failure
     - vhost: move vdpa group bound check to vhost_vdpa
     - [powerpc*] smp: Add check for kcalloc() failure in parse_thread_groups()
     - iio: gyro: itg3200: Fix unchecked return value in read_raw
     - mtd: spinand: Disable continuous read during probe
     - mm/highmem: fix __kmap_to_page() build error
     - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()
     - ocfs2: fix reflink preserve cleanup issue
     - kexec: derive purgatory entry from symbol
     - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling
       SR-IOV"
     - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug
     - [arm64] Fix non-atomic __READ_ONCE() with CONFIG_LTO=y
     - clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841
     - btrfs: continue trimming remaining devices on failure
     - remoteproc: imx_rproc: Fix invalid loaded resource table detection
     - perf/arm-cmn: Reject unsupported hardware configurations
     - scsi: ufs: core: Flush exception handling work when RPM level is zero
     - mm/slab: use unsigned long for orig_size to ensure proper metadata align
     - PCI: dwc: Fix msg_atu_index assignment
     - usb: dwc3: gadget: Move vbus draw to workqueue context
     - usb: dwc2: fix resume failure if dr_mode is host
     - mtd: rawnand: pl353: Fix software ECC support
     - tipc: fix RCU dereference race in tipc_aead_users_dec()
     - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
     - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error
       path
     - PCI: Fix pci_slot_trylock() error handling
     - staging: rtl8723bs: fix null dereference in find_network
     - kcsan, compiler_types: avoid duplicate type issues in BPF Type Format
     - watchdog/softlockup: fix sample ring index wrap in need_counting_irqs()
     - cifs: Fix locking usage for tcon fields
     - ceph: supply snapshot context in ceph_zero_partial_object()
     - rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0
     - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID
     - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean()
     - octeontx2-af: CGX: fix bitmap leaks
     - net: ti: icssg-prueth: Add optional dependency on HSR
     - net: macb: Fix tx/rx malfunction after phy link down and up
     - tracing: Fix to set write permission to per-cpu buffer_size_kb
     - io_uring/filetable: clamp alloc_hint to the configured alloc range
     - drm/amd/display: Increase DCN35 SR enter/exit latency
     - drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify
     - procfs: fix possible double mmput() in do_procmap_query()
     - net: intel: fix PCI device ID conflict between i40e and ipw2200
     - atm: fore200e: fix use-after-free in tasklets during device removal
     - function_graph: Restore direct mode when callbacks drop to one
     - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
     - mm: numa_memblks: Identify the accurate NUMA ID of CFMW
     - fbcon: check return value of con2fb_acquire_newinfo()
     - fbdev: vt8500lcdfb: fix missing dma_free_coherent()
     - fbdev: of: display_timing: fix refcount leak in of_get_display_timings()
     - fbdev: ffb: fix corrupted video output on Sun FFB1
     - fbcon: Remove struct fbcon_display.inverse
     - cifs: some missing initializations on replay
     - [amd64] ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR
     - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle
     - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash()
     - [amd64] x86/kexec: Copy ACPI root pointer address from config table
     - [arm64] Force the use of CNTVCT_EL0 in __delay()
     - drm/amdgpu: keep vga memory on MacBooks with switchable graphics
     - net: nfc: nci: Fix parameter validation for packet data
     - tracing: ring-buffer: Fix to check event length before using
     - fgraph: Do not call handlers direct when not using ftrace_ops
     - tracing: Fix checking of freed trace_event_file for hist files
     - tracing: Wake up poll waiters for hist files when removing an event
     - NTB: ntb_transport: Fix too small buffer for debugfs_name
     - ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl()
     - [amd64] drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros
     - xfs: fix copy-paste error in previous fix
     - [arm64] Fix sampling the "stable" virtual counter in preemptible section
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.76
     - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec
       buffer"
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.77
     - drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release
     - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
     - drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse()
     - [arm64] KVM: arm64: Hide S1POE from guests when not supported by the host
     - [riscv64] irqchip/sifive-plic: Fix frozen interrupt due to affinity
       setting
     - scsi: lpfc: Properly set WC for DPP mapping
     - scsi: pm8001: Fix use-after-free in pm8001_queue_command()
     - ALSA: scarlett2: Fix redeclaration of loop variable
     - ALSA: scarlett2: Fix DSP filter control array handling
     - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices
     - [amd64] x86/fred: Correct speculative safety in fred_extint()
     - rseq: Clarify rseq registration rseq_size bound check comment
     - cgroup/cpuset: Fix incorrect use of cpuset_update_tasks_cpumask() in
       update_cpumasks_hier()
     - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume
     - ALSA: usb-audio: Cap the packet size pre-calculations
     - ALSA: usb-audio: Use inclusive terms
     - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
     - [s390x] idle: Fix cpu idle exit cpu time accounting
     - [s390x] vtime: Fix virtual timer forwarding
     - PCI: endpoint: Introduce pci_epc_function_is_valid()
     - PCI: endpoint: Introduce pci_epc_mem_map()/unmap()
     - [arm64] PCI: dwc: endpoint: Implement the pci_epc_ops::align_addr()
       operation
     - [arm64] PCI: dwc: ep: Use align addr function for
       dw_pcie_ep_raise_{msi,msix}_irq()
     - [arm64] PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry
     - drm/amdgpu: Unlock a mutex before destroying it
     - drm/amdgpu: Replace kzalloc + copy_from_user with memdup_user
     - drm/amdgpu: Fix locking bugs in error paths
     - ALSA: pci: hda: use snd_kcontrol_chip()
     - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put()
     - btrfs: fix incorrect key offset in error message in
       check_dev_extent_item()
     - btrfs: fix objectid value in error message in check_extent_data_ref()
     - btrfs: fix warning in scrub_verify_one_metadata()
     - btrfs: print correct subvol num if active swapfile prevents deletion
     - btrfs: fix compat mask in error messages in btrfs_check_features()
     - [arm64] bpf, arm64: Force 8-byte alignment for JIT buffer to prevent
       atomic tearing
     - bpf: Fix stack-out-of-bounds write in devmap
     - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value
     - [amd64] x86/acpi/boot: Correct acpi_is_processor_usable() check again
     - [arm64] memory: mtk-smi: fix device leaks on common probe
     - [arm64] memory: mtk-smi: fix device leak on larb probe
     - resource: Add resource set range and size helpers
     - PCI: Use resource_set_range() that correctly sets ->end
     - media: tegra-video: Fix memory leak in __tegra_channel_try_format()
     - media: dw9714: move power sequences to dedicated functions
     - media: dw9714: add support for powerdown pin
     - media: dw9714: Fix powerup sequence
     - [amd64] KVM: x86: Ignore -EBUSY when checking nested events from
       vcpu_block()
     - ata: libata-scsi: Refactor ata_scsi_simulate()
     - ata: libata-scsi: Refactor ata_scsiop_read_cap()
     - ata: libata-scsi: Refactor ata_scsiop_maint_in()
     - ata: libata-scsi: Document all VPD page inquiry actors
     - ata: libata-scsi: Remove struct ata_scsi_args
     - ata: libata: Remove ATA_DFLAG_ZAC device flag
     - ata: libata: Introduce ata_port_eh_scheduled()
     - ata: libata-scsi: avoid Non-NCQ command starvation
     - [arm64,armhf] drm/tegra: dsi: fix device leak on probe
     - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT
     - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting
       I/O
     - mailbox: don't protect of_parse_phandle_with_args with con_mutex
     - mailbox: sort headers alphabetically
     - mailbox: remove unused header files
     - mailbox: Use dev_err when there is error
     - mailbox: Use guard/scoped_guard for con_mutex
     - mailbox: Allow controller specific mapping using fwnode
     - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
     - ext4: add ext4_try_lock_group() to skip busy groups
     - ext4: factor out __ext4_mb_scan_group()
     - ext4: factor out ext4_mb_might_prefetch()
     - ext4: factor out ext4_mb_scan_group()
     - ext4: convert free groups order lists to xarrays
     - ext4: refactor choose group to scan group
     - ext4: implement linear-like traversal across order xarrays
     - ext4: always allocate blocks only from groups inode can use
     - workqueue: Add system_percpu_wq and system_dfl_wq
     - Input: synaptics_i2c - replace use of system_wq with system_dfl_wq
     - Input: synaptics_i2c - guard polling restart in resume
     - [amd64] iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device
       without scalable mode
     - [arm64] dts: rockchip: Fix rk356x PCIe range mappings
     - [arm64] dts: rockchip: Fix rk3588 PCIe range mappings
     - [armhf] clk: tegra: tegra124-emc: fix device leak on set_rate()
     - ima: kexec: silence RCU list traversal warning
     - ima: rename variable the seq_file "file" to "ima_kexec_file"
     - ima: define and call ima_alloc_kexec_file_buf()
     - kexec: define functions to map and unmap segments
     - ima: kexec: define functions to copy IMA log at soft boot
     - ima: verify the previous kernel's IMA buffer lies in addressable RAM
     - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range()
     - drm/exynos: vidi: fix to avoid directly dereferencing user pointer
     - drm/exynos/vidi: Remove redundant error handling in vidi_get_modes()
     - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member
       variables related to memory alloc/free (CVE-2026-23227)
     - uprobes: switch to RCU Tasks Trace flavor for better performance
     - uprobes: Fix incorrect lockdep condition in filter_chain()
     - btrfs: drop unused parameter fs_info from do_reclaim_sweep()
     - btrfs: get used bytes while holding lock at btrfs_reclaim_bgs_work()
     - btrfs: fix reclaimed bytes accounting after automatic block group reclaim
     - btrfs: fix periodic reclaim condition
     - btrfs: zoned: fix alloc_offset calculation for partly conventional block
       groups
     - btrfs: zoned: fixup last alloc pointer after extent removal for RAID1
     - btrfs: zoned: fixup last alloc pointer after extent removal for DUP
     - btrfs: zoned: fix stripe width calculation
     - btrfs: define the AUTO_KFREE/AUTO_KVFREE helper macros
     - btrfs: zoned: fixup last alloc pointer after extent removal for RAID0/10
     - [riscv64] usb: cdns3: remove redundant if branch
     - [riscv64] usb: cdns3: call cdns_power_is_lost() only once in cdns_resume()
     - [riscv64] usb: cdns3: fix role switching during resume
     - drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected()
       (Closes: #1130930)
     - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
     - hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization
       induced race
     - ksmbd: check return value of xa_store() in krb5_authenticate
     - ksmbd: add chann_lock to protect ksmbd_chann_list xarray (CVE-2026-23226)
     - ALSA: hda/realtek: Add quirk for Gigabyte G5 KF5 (2023)
     - ALSA: hda/realtek: Add quirk for Samsung Galaxy Book3 Pro 360 (NP965QFG)
     - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314
     - net: arcnet: com20020-pci: fix support for 2.5Mbit cards
     - eventpoll: Fix integer overflow in ep_loop_check_proc()
     - namespace: fix proc mount iteration
     - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
     - nfc: pn533: properly drop the usb interface reference on disconnect
     - net: usb: kaweth: validate USB endpoints
     - net: usb: kalmia: validate USB endpoints
     - net: usb: pegasus: validate USB endpoints
     - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a
       message
     - can: usb: f81604: correctly anchor the urb in the read bulk callback
     - can: ucan: Fix infinite loop from zero-length messages
     - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
     - can: usb: f81604: handle short interrupt urb messages properly
     - can: usb: f81604: handle bulk write errors properly
     - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them
     - [amd64] x86/efi: defer freeing of boot services memory
     - [amd64] platform/x86: dell-wmi-sysman: Don't hex dump plaintext password
       data
     - [amd64] platform/x86: dell-wmi: Add audio/mic mute key codes
     - ALSA: usb-audio: Use correct version for UAC3 header validation
     - wifi: radiotap: reject radiotap with unknown bits
     - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
     - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration
     - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
     - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
     - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
     - net/sched: ets: fix divide by zero in the offload path
     - nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
     - tracing: Fix WARN_ON in tracing_buffers_mmap_close
     - scsi: target: Fix recursive locking in __configfs_open_file()
     - Squashfs: check metadata block offset is within range
     - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
     - drbd: fix null-pointer dereference on local read error
     - smb: client: fix cifs_pick_channel when channels are equally loaded
     - smb: client: fix broken multichannel with krb5+signing
     - smb: client: Don't log plaintext credentials in cifs_set_cifscreds
     - scsi: core: Fix refcount leak for tagset_refcnt
     - xattr: switch to CLASS(fd) (CVE-2024-14027)
     - btrfs: always fallback to buffered write if the inode requires checksum
     - ACPI: APEI: GHES: Disable KASAN instrumentation when compile testing with
       clang < 18
     - nvme: fix admin queue leak on controller reset
     - hwmon: (aht10) Add support for dht20
     - hwmon: (aht10) Fix initialization commands for AHT20
     - pinctrl: equilibrium: rename irq_chip function callbacks
     - pinctrl: equilibrium: fix warning trace on load
     - [amd64] platform/x86: thinkpad_acpi: Fix errors reading battery thresholds
     - HID: multitouch: add quirks for Lenovo Yoga Book 9i
     - HID: multitouch: new class MT_CLS_EGALAX_P80H84
     - [amd64] pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe()
     - hwmon: (it87) Check the it87_lock() return value
     - [amd64,arm64] idpf: change IRQ naming to match netdev and ethtool queue
       numbering
     - i40e: Fix preempt count leak in napi poll tracepoint
     - e1000e: clear DPG_EN after reset to avoid autonomous power-gating
     - drm/solomon: Fix page start when updating rectangle in page addressing
       mode
     - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling
       in ALE table
     - xsk: Get rid of xdp_buff_xsk::xskb_list_node
     - xsk: s/free_list_node/list_node/
     - xsk: Fix fragment node deletion to prevent buffer leak
     - xsk: Fix zero-copy AF_XDP fragment drop
     - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
     - [arm64] net: ti: icssg-prueth: Fix ping failure after offload mode setup
       when link speed is not 1G
     - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds
     - can: bcm: fix locking for bcm_op runtime updates
     - can: mcp251x: fix deadlock in error path of mcp251x_open
     - wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config
     - drm/xe: Do not preempt fence signaling CS instructions
     - kunit: tool: copy caller args in run_kernel to prevent mutation
     - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
     - octeon_ep: Relocate counter updates before NAPI
     - octeon_ep: avoid compiler and IQ/OQ reordering
     - octeon_ep_vf: Relocate counter updates before NAPI
     - octeon_ep_vf: avoid compiler and IQ/OQ reordering
     - wifi: cw1200: Fix locking in error paths
     - wifi: wlcore: Fix a locking bug
     - wifi: mt76: mt7996: Fix possible oob access in
       mt7996_mac_write_txwi_80211()
     - wifi: mt76: mt7925: Fix possible oob access in
       mt7925_mac_write_txwi_80211()
     - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()
     - indirect_call_wrapper: do not reevaluate function pointer
     - net/rds: Fix circular locking dependency in rds_tcp_tune
     - xen/acpi-processor: fix _CST detection using undersized evaluation buffer
     - iavf: fix netdev->max_mtu to respect actual hardware limit
     - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim
     - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op()
     - smb/client: fix buffer size for smb311_posix_qinfo in
       SMB311_posix_query_info()
     - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
     - net: ipv4: fix ARM64 alignment fault in multipath hash seed
     - amd-xgbe: fix sleep while atomic on suspend/resume
     - drm/sched: Fix kernel-doc warning for drm_sched_job_done()
     - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock"
     - drm/xe/reg_sr: Fix leak on xa_store failure
     - nvme: reject invalid pr_read_keys() num_keys values
     - nvme: fix memory allocation in nvme_pr_read_keys()
     - hwmon: (max6639) : Configure based on DT property
     - hwmon: (max6639) fix inverted polarity
     - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless
       qdiscs
     - net: nfc: nci: Fix zero-length proprietary notifications
     - net_sched: sch_fq: clear q->band_pkt_count[] in fq_reset()
     - nfc: nci: free skb on nci_transceive early error paths
     - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback
     - nfc: rawsock: cancel tx_work before socket teardown
     - net: stmmac: Fix error handling in VLAN add and delete paths
     - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
     - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in
       mtk_xdp_setup()
     - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
     - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
     - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
     - net/sched: act_ife: Fix metalist update behavior
     - xdp: use modulo operation to calculate XDP frag tailroom
     - xsk: introduce helper to determine rxq->frag_size
     - i40e: fix registering XDP RxQ info
     - i40e: use xdp.frame_sz as XDP RxQ info frag_size
     - xdp: produce a warning when calculated tailroom is negative
     - tracing: Add NULL pointer check to trigger_data_free()
     - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared
       blocks
     - ext4: fix potential null deref in ext4_mb_init()
     - ata: libata-core: fix cancellation of a port deferred qc work
     - ata: libata-eh: correctly handle deferred qc timeouts
     - ata: libata: cancel pending work after clearing deferred_qc
     - ata: libata-eh: Fix detection of deferred qc timeouts
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.78
     - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
     - [amd64] ACPI: PM: Save NVS memory on Lenovo G70-35
     - scsi: mpi3mr: Add NULL checks when resetting request and reply queues
     - ALSA: hda/realtek: Fix speaker pop on Star Labs StarFighter
     - unshare: fix unshare_fs() handling
     - wifi: mac80211: set default WMM parameters on all links
     - ACPI: OSI: Add DMI quirk for Acer Aspire One D255
     - scsi: ses: Fix devices attaching to different hosts
     - [amd64] ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table
     - [amd64] ASoC: cs42l43: Report insert for exotic peripherals
     - scsi: ufs: core: Fix possible NULL pointer dereference in
       ufshcd_add_command_trace()
     - scsi: ufs: core: Fix shift out of bounds when MAXQ=32
     - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0
     - drm/amdgpu/vcn5: Add SMU dpm interface type
     - ALSA: usb-audio: Check max frame size for implicit feedback mode, too
     - kexec: Consolidate machine_kexec_mask_interrupts() implementation
     - kexec: Include kernel-end even without crashkernel
     - [powerpc*] kexec/core: use big-endian types for crash variables
     - [powerpc*] crash: adjust the elfcorehdr size
     - remoteproc: sysmon: Correct subsys_name_len type in QMI request
     - remoteproc: mediatek: Unprepare SCP clock during system suspend
     - [powerpc*] 83xx: km83xx: Fix keymile vendor prefix
     - smb/server: Fix another refcount leak in smb2_open()
     - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
     - [arm64] drm/msm/dsi: fix hdisplay calculation when programming dsi
       registers
     - xprtrdma: Decrement re_receiving on the early exit paths
     - btrfs: hold space_info->lock when clearing periodic reclaim ready
     - workqueue: Use POOL_BH instead of WQ_BH when checking pool flags
     - perf disasm: Fix off-by-one bug in outside check
     - [arm64] drm/msm/dsi: fix pclk rate calculation for bonded dsi
     - drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v14
     - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states
     - net/mlx5: IFC updates for disabled host PF
     - net/mlx5: Query to see if host PF is disabled
     - net/mlx5: Fix deadlock between devlink lock and esw->wq
     - net/mlx5: Fix crash when moving to switchdev mode
     - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
     - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL
       slave xmit (CVE-2026-23277)
     - ASoC: soc-core: drop delayed_work_pending() check before flush
     - ASoC: soc-core: flush delayed work before removing DAIs and widgets
     - ASoC: simple-card-utils: use __free(device_node) for device node
     - ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays
     - net: sfp: improve Huawei MA5671a fixup
     - serial: caif: hold tty->link reference in ldisc_open and ser_release
     - bnxt_en: Fix RSS table size check when changing ethtool channels
     - mctp: i2c: fix skb memory leak in receive path
     - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return
       value
     - bonding: add ESP offload features when slaves support
     - bonding: Correctly support GSO ESP offload
     - net: add a common function to compute features for upper devices
     - bonding: use common function to compute the features
     - bonding: fix type confusion in bond_setup_by_slave()
     - mctp: route: hold key->lock in mctp_flow_prepare_output()
     - [amd64,arm64] amd-xgbe: fix link status handling in xgbe_rx_adaptation
     - [amd64,arm64] amd-xgbe: prevent CRC errors during RX adaptation with AN
       disabled
     - xdp: allow attaching already registered memory model to xdp_rxq_info
     - xdp: register system page pool as an XDP memory model
     - net: add xmit recursion limit to tunnel xmit functions (CVE-2026-23276)
     - netfilter: nf_tables: always walk all pending catchall elements
       (CVE-2026-23278)
     - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
     - netfilter: x_tables: guard option walkers against 1-byte tail reads
     - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
     - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
     - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
       (CVE-2026-23274)
     - perf annotate: Fix hashmap__new() error checking
     - regulator: pca9450: Correct interrupt type
     - perf ftrace: Fix hashmap__new() error checking
     - sched: idle: Make skipping governor callbacks more consistent
     - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
     - nvme-pci: Fix race bug in nvme_poll_irqdisable()
     - i40e: fix src IP mask checks and memcpy argument names in cloud filter
     - e1000/e1000e: Fix leak in DMA error cleanup
     - net: bcmgenet: fix broken EEE by converting to phylib-managed state
     - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()
     - [amd64] ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock
       acquisition
     - ASoC: detect empty DMI strings
     - drm/amdkfd: Unreserve bo if queue update failed
     - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled
     - [arm64] octeontx2-af: devlink: fix NIX RAS reporter recovery condition
     - [arm64] octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt
       status
     - net: prevent NULL deref in ip[6]tunnel_xmit()
     - iio: imu: inv-mpu9150: fix irq ack preventing irq storms
     - usb: gadget: f_mass_storage: Fix potential integer overflow in
       check_command_size_in_blocks()
     - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on"
     - cgroup: fix race between task migration and iteration
     - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
     - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer
       interfaces
     - net: usb: lan78xx: fix silent drop of packets with checksum errors
     - net: usb: lan78xx: fix TX byte statistics for small packets
     - net: usb: lan78xx: skip LTM configuration for LAN7850
     - ata: libata-core: Add BRIDGE_OK quirk for QEMU drives
     - [amd64] ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA
     - [amd64] KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with
       in-kernel APIC
     - USB: add QUIRK_NO_BOS for video capture several devices
     - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
     - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed
     - usb: xhci: Fix memory leak in xhci_disable_slot()
     - usb: xhci: Prevent interrupt storm on host controller error (HCE)
     - usb: yurex: fix race in probe
     - usb: dwc3: pci: add support for the Intel Nova Lake -H
     - usb: misc: uss720: properly clean up reference in uss720_probe()
     - usb: core: don't power off roothub PHYs if phy_set_mode() fails
     - usb: cdc-acm: Restore CAP_BRK functionnality to CH343
     - usb: roles: get usb role switch from parent only for usb-b-connector
     - usb: typec: altmode/displayport: set displayport signaling rate in
       configure message
     - USB: usbcore: Introduce usb_bulk_msg_killable()
     - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts
     - USB: core: Limit the length of unkillable synchronous timeouts
     - usb: class: cdc-wdm: fix reordering issue in read code path
     - usb: mdc800: handle signal and read racing
     - usb: image: mdc800: kill download URB on timeout
     - mm/tracing: rss_stat: ensure curr is false from kthread context
     - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
     - mm/kfence: disable KFENCE upon KASAN HW tags enablement
     - mmc: core: Avoid bitfield RMW for claim/retune flags
     - [arm64] ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and
       start
     - tipc: fix divide-by-zero in tipc_sk_filter_connect()
     - kprobes: avoid crash when rmmod/insmod after ftrace killed
     - ceph: add a bunch of missing ceph_path_info initializers
     - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
     - libceph: reject preamble if control segment is empty
     - libceph: prevent potential out-of-bounds reads in process_message_header()
     - libceph: Use u32 for non-negative values in ceph_monmap_decode()
     - libceph: admit message frames only in CEPH_CON_S_OPEN state
     - ceph: fix i_nlink underrun during async unlink
     - ceph: fix memory leaks in ceph_mdsc_build_path()
     - time/jiffies: Mark jiffies_64_to_clock_t() notrace
     - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach
     - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend
     - scsi: hisi_sas: Add time interval between two H2D FIS following soft reset
       spec
     - scsi: hisi_sas: Use macro instead of magic number
     - scsi: hisi_sas: Fix NULL pointer exception during user_scan()
     - kbuild: Disable CC_HAS_ASM_GOTO_OUTPUT on clang < 17
     - Fix CC_HAS_ASM_GOTO_OUTPUT on non-x86 architectures
     - Revert "tcpm: allow looking for role_sw device in the main node"
     - drm/amd: Disable MES LR compute W/A
     - drm/bridge: samsung-dsim: Fix memory leak in error path
     - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used
     - [s390x] pfault: Fix virtual vs physical address confusion
     - nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().
     - device property: Allow secondary lookup in fwnode_get_next_child_node()
     - [arm64,armhf] irqchip/gic-v3-its: Limit number of per-device MSIs to the
       range the ITS supports
     - btrfs: fix chunk map leak in btrfs_map_block() after
       btrfs_chunk_map_num_copies()
     - ice: reintroduce retry mechanism for indirect AQ
     - ixgbevf: fix link setup issue
     - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
     - staging: rtl8723bs: fix potential out-of-bounds read in
       rtw_restruct_wmm_ie
     - media: dvb-net: fix OOB access in ULE extension header tables
     - [amd64,arm64] net: mana: Ring doorbell at 4 CQ wraparounds
     - ice: fix retry for AQ command 0x06EE
     - tracing: Fix syscall events activation by ensuring refcount hits zero
     - net/tcp-ao: Fix MAC comparison to be constant-time
     - batman-adv: Avoid double-rtnl_lock ELP metric worker
     - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
     - [arm64] mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
     - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read
     - [arm64] contpte: fix set_access_flags() no-op check for SMMU/ATS faults
     - pmdomain: bcm: bcm2835-power: Fix broken reset status read
     - ata: libata-core: Disable LPM on ST1000DM010-2EP102
     - drm/amd/display: Fallback to boot snapshot for dispclk
     - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()
     - smb: server: fix use-after-free in smb2_open()
     - ksmbd: fix use-after-free by using call_rcu() for oplock_info
     - net: nexthop: fix percpu use-after-free in remove_nh_grp_entry
     - net: ncsi: fix skb leak in error paths
     - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
     - net: dsa: microchip: Fix error path in PTP IRQ setup
     - drm/amd/pm: remove invalid gpu_metrics.energy_accumulator on smu v13.0.x
     - drm/amdgpu: Fix use-after-free race in VM acquire
     - drm/amd: Set num IP blocks to 0 if discovery fails
     - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding
     - [amd64] drm/i915: Fix potential overflow of shmem scatterlist length
     - [arm64] drm/msm: Fix dma_free_attrs() buffer size
     - tracing: Fix enabling multiple events on the kernel command line and
       bootconfig
     - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G
     - qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size
     - cifs: make default value of retrans as zero
     - xfs: fix returned valued from xfs_defer_can_append
     - xfs: fix undersized l_iclog_roundoff values
     - xfs: ensure dquot item is deleted from AIL only after log shutdown
     - [s390x] dasd: Move quiesce state with pprc swap
     - [s390x] dasd: Copy detected format information to secondary device
     - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error
     - scsi: core: Fix error handling for scsi_alloc_sdev()
     - [amd64] x86/apic: Disable x2apic on resume if the kernel expects so
     - lib/bootconfig: fix snprintf truncation check in
       xbc_node_compose_key_after()
     - lib/bootconfig: check bounds before writing in __xbc_open_brace()
     - smb: client: fix atomic open with O_DIRECT & O_SYNC
     - smb: client: fix in-place encryption corruption in SMB2_write()
     - smb: client: fix iface port assignment in parse_server_interfaces
     - btrfs: fix transaction abort on file creation due to name hash collision
     - btrfs: fix transaction abort on set received ioctl due to item overflow
     - btrfs: abort transaction on failure to update root in the received subvol
       ioctl
     - iio: dac: ds4424: reject -128 RAW value
     - iio: frequency: adf4377: Fix duplicated soft reset mask
     - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas()
     - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
     - iio: potentiometer: mcp4131: fix double application of wiper shift
     - iio: chemical: bme680: Fix measurement wait duration calculation
     - iio: buffer: Fix wait_queue not being removed
     - iio: gyro: mpu3050-core: fix pm_runtime error handling
     - iio: gyro: mpu3050-i2c: fix pm_runtime error handling
     - iio: imu: inv_icm42600: fix odr switch to the same value
     - iio: imu: inv_icm42600: fix odr switch when turning buffer off
     - iio: proximity: hx9023s: Protect against division by zero in set_samp_freq
     - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors
     - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort
     - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor
     - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD
     - net/tcp-md5: Fix MAC comparison to be constant-time
     - ksmbd: Compare MACs in constant time (CVE-2026-23364)
     - smb: client: Compare MACs in constant time
     - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()
     - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths
     - spi: cadence-quadspi: Implement refcount to handle unbind during busy
       (CVE-2025-40005)
     - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL
       (CVE-2026-23386)
     - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
       (CVE-2026-23368)
     - [amd64] x86/sev: Allow IBPB-on-Entry feature for SNP guests
     - [amd64] platform/x86: hp-bioscfg: Support allocations of larger data
       (Closes: #1127612)
     - wifi: libertas: fix use-after-free in lbs_free_adapter() (CVE-2026-23281)
     - [amd64] perf/x86/intel/uncore: Support more units on Granite Rapids
     - [amd64] perf/x86/intel/uncore: Add per-scheduler IMC CAS count events
     - mptcp: pm: in-kernel: always mark signal+subflow endp as used
     - mptcp: pm: avoid sending RM_ADDR over same subflow
     - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink
     - kbuild: Leave objtool binary around with 'make clean'
     - net/sched: act_gate: snapshot parameters with RCU on replace
       (CVE-2026-23245)
     - xfs: Fix error pointer dereference
     - can: gs_usb: gs_can_open(): always configure bitrates before starting
       device
     - cleanup: Provide retain_and_null_ptr()
     - usb: gadget: f_ncm: Fix net_device lifecycle with device_move
     - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling
     - [amd64] KVM: SVM: Limit AVIC physical max index based on configured
       max_vcpu_ids
     - [amd64] KVM: SVM: Add a helper to look up the max physical ID for AVIC
     - [amd64] KVM: SVM: Set/clear CR8 write interception when AVIC is
       (de)activated
     - [arm64,armhf] mmc: dw_mmc-rockchip: use modern PM macros
     - [arm64,armhf] mmc: dw_mmc-rockchip: Add memory clock auto-gating support
     - [arm64,armhf] mmc: dw_mmc-rockchip: Fix runtime PM support for internal
       phase support
     - mm/page_alloc: move set_page_refcounted() to callers of post_alloc_hook()
     - mm/page_alloc: sort out the alloc_contig_range() gfp flags mess
     - mm/page_alloc: forward the gfp flags from alloc_contig_range() to
       post_alloc_hook()
     - mm/kfence: fix KASAN hardware tag faults during late enablement
     - nsfs: tighten permission checks for ns iteration ioctls
     - sched_ext: Disable preemption between scx_claim_exit() and kicking helper
       work
     - sched_ext: Fix starvation of scx_enable() under fair-class saturation
     - iomap: reject delalloc mappings during writeback
     - fgraph: Fix thresh_return clear per-task notrace
     - [amd64] KVM: x86: Co-locate initialization of feature MSRs in
       kvm_arch_vcpu_create()
     - [amd64] KVM: x86: Quirk initialization of feature MSRs to KVM's max
       configuration
     - [amd64] KVM: x86: do not allow re-enabling quirks
     - [amd64] KVM: x86: Allow vendor code to disable quirks
     - [amd64] KVM: x86: Introduce supported_quirks to block disabling quirks
     - [amd64] KVM: x86: Introduce Intel specific quirk
       KVM_X86_QUIRK_IGNORE_GUEST_PAT
     - [amd64] KVM: nVMX: Add consistency checks for CR0.WP and CR4.CET
     - [amd64] KVM: x86: Introduce KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM
     - ksmbd: Don't log keys in SMB3 signing and encryption key generation
     - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output
     - net: macb: Shuffle the tx ring before enabling tx
     - cifs: open files should not hold ref on superblock
     - xfs: fix integer overflow in bmap intent sort comparator
     - drm/xe/sync: Cleanup partially initialized sync on parse failure
     - ipv6: use RCU in ip6_xmit() (CVE-2025-40135)
     - dm-verity: disable recursive forward error correction (CVE-2025-71161)
     - rxrpc: Fix recvmsg() unconditional requeue
     - btrfs: do not strictly require dirty metadata threshold for metadata
       writepages (CVE-2026-23157)
     - ice: fix devlink reload call trace (CVE-2026-23104)
     - tracing: Add recursion protection in kernel stack trace recording
       (CVE-2026-23138)
     - [amd64] Octeontx2-af: Add proper checks for fwdata (CVE-2026-23070)
     - io_uring/uring_cmd: fix too strict requirement on ioctl
     - [amd64] x86/uprobes: Fix XOL allocation failure for 32-bit tasks
     - [amd64] platform/x86/amd/pmc: Add support for Van Gogh SoC
       (CVE-2025-68334)
     - mptcp: pm: in-kernel: always set ID as avail when rm endp
     - net: stmmac: remove support for lpi_intr_o
     - f2fs: compress: change the first parameter of page_array_{alloc,free} to
       sbi
     - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic
       (CVE-2025-38627)
     - f2fs: fix to avoid migrating empty section (CVE-2025-40150)
     - blk-throttle: fix access race during throttle policy activation
       (CVE-2025-40147)
     - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
       (CVE-2025-71221)
     - net: dsa: properly keep track of conduit reference (CVE-2025-71152)
     - binfmt_misc: restore write access before closing files opened by
       open_exec() (CVE-2025-68239)
     - xfs: get rid of the xchk_xfile_*_descr calls
     - erofs: fix inline data read failure for ztailpacking pclusters
     - mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375)
     - sched_ext: Remove redundant css_put() in scx_cgroup_init()
     - io_uring/kbuf: check if target buffer list is still legacy on recycle
     - sched/fair: Fix zero_vruntime tracking
     - [s390x] stackleak: Fix __stackleak_poison() inline assembly constraint
     - [s390x] xor: Fix xor_xc_2() inline assembly constraints
     - [amd64] drm/i915/alpm: ALPM disable fixes
     - [amd64] drm/i915/psr: Repeat Selective Update area alignment
     - drm/amd/display: Add pixel_clock to amd_pp_display_configuration
     - drm/amd/pm: Use pm_display_cfg in legacy DPM (v2)
     - drm/amdgpu: Add basic validation for RAS header (CVE-2025-38426)
     - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
     - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
     - HID: bpf: prevent buffer overflow in hid_hw_request
     - sunrpc: fix cache_request leak in cache_release
     - nvdimm/bus: Fix potential use after free in asynchronous initialization
     - NFC: nxp-nci: allow GPIOs to sleep
     - net: macb: fix use-after-free access to PTP clock
     - mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations
     - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
     - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
     - smb: client: fix krb5 mount with username option
     - ksmbd: unset conn->binding on failed binding request
     - ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION
     - [amd64] drm/i915/dsc: Add Selective Update register definitions
     - [amd64] drm/i915/dsc: Add helper for writing DSC Selective Update ET
       parameters
     - [amd64] drm/i915/psr: Write DSC parameters on Selective Update in ET mode
     - [s390x] zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute
     - kprobes: Remove unneeded goto
     - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace()
     - btrfs: fix transaction abort when snapshotting received subvolumes
     - batman-adv: avoid OGM aggregation when skb tailroom is insufficient
     - net: macb: Introduce gem_init_rx_ring()
     - net: macb: Reinitialize tx/rx queue pointer registers and rx ring during
       resume
     - ata: libata-core: disable LPM on ADATA SU680 SSD
     - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption
     - mmc: sdhci: fix timing selection for 1-bit bus width
     - pmdomain: bcm: bcm2835-power: Increase ASB control timeout
     - spi: fix use-after-free on controller registration failure
     - spi: fix statistics allocation
     - mtd: rawnand: pl353: make sure optimal timings are applied
     - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in
       cadence_nand_init()
     - mtd: Avoid boot crash in RedBoot partition table parser
     - [amd64] iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry
     - serial: 8250_pci: add support for the AX99100
     - serial: 8250: Fix TX deadlock when using DMA
     - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART
       BUSY
     - serial: uartlite: fix PM runtime usage count underflow on probe
     - io_uring/kbuf: propagate BUF_MORE through early buffer commit path
     - drm: Fix use-after-free on framebuffers and property blobs when calling
       drm_dev_unplug
     - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START,
       END}
     - drm/amdgpu/gmc9.0: add bounds checking for cid
     - drm/amdgpu/mmhub2.0: add bounds checking for cid
     - drm/amdgpu/mmhub2.3: add bounds checking for cid
     - drm/amdgpu/mmhub3.0.1: add bounds checking for cid
     - drm/amdgpu/mmhub3.0.2: add bounds checking for cid
     - drm/amdgpu/mmhub3.0: add bounds checking for cid
     - drm/amdgpu/mmhub4.1.0: add bounds checking for cid
     - drm/imagination: Fix deadlock in soft reset sequence
     - drm/radeon: apply state adjust rules to some additional HAINAN vairants
     - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants
     - drm/xe/oa: Allow reading after disabling OA stream
     - drm/xe: Open-code GGTT MMIO access protection
     - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
       (CVE-2026-23395)
     - ata: libata-scsi: Return residual for emulated SCSI commands
     - ata: libata-scsi: report correct sense field pointer in
       ata_scsiop_maint_in()
     - btrfs: log new dentries when logging parent dir of a conflicting inode
     - btrfs: tree-checker: fix misleading root drop_level error message
     - [riscv64] soc: microchip: mpfs: Fix memory leak in
       mpfs_sys_controller_probe()
     - [riscv64] cache: starfive: fix device node leak in starlink_cache_init()
     - [arm64,armhf] soc: rockchip: grf: Add missing of_node_put() when returning
     - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.
     - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
     - [arm64] dts: renesas: r9a09g057: Add RTC node
     - [arm64] dts: renesas: r9a09g057: Remove wdt{0,2,3} nodes
     - [arm64] firmware: arm_scpi: Fix device_node reference leak in probe path
     - Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
     - Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
     - Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
     - Bluetooth: ISO: Fix defer tests being unstable
     - Bluetooth: hci_sync: Fix hci_le_create_conn_sync
     - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
     - Bluetooth: HIDP: Fix possible UAF
     - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
     - Bluetooth: qca: fix ROM version reading on WCN3998 chips
     - bridge: cfm: Fix race condition in peer_mep deletion (CVE-2026-23393)
     - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
     - mpls: add missing unregister_netdevice_notifier to mpls_init
     - netfilter: ctnetlink: remove refcounting in expectation dumpers
       (CVE-2025-39764)
     - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
     - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in
       sip_help_tcp()
     - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
     - nf_tables: nft_dynset: fix possible stateful expression memleak in error
       path (CVE-2026-23399)
     - netfilter: nft_ct: drop pending enqueued packets on removal
     - netfilter: xt_CT: drop pending enqueued packets on template removal
       (CVE-2026-23391)
     - netfilter: xt_time: use unsigned int for monthday bit shift
     - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
     - net: bcmgenet: increase WoL poll timeout
     - [amd64,arm64] net: mana: fix use-after-free in mana_hwc_destroy_channel()
       by reordering teardown
     - sched: idle: Consolidate the handling of two special cases
     - PM: runtime: Fix a race condition related to device removal
     - bonding: prevent potential infinite loop in bond_header_parse()
     - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
     - net/sched: teql: Fix double-free in teql_master_xmit
     - net: airoha: read default PSE reserved pages value before updating
     - net: airoha: fix PSE memory configuration in airoha_fe_pse_ports_init()
     - net: airoha: Read completion queue data in airoha_qdma_tx_napi_poll()
     - net: airoha: Remove airoha_dev_stop() in airoha_remove()
     - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check
     - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
     - clsact: Fix use-after-free in init/destroy rollback asymmetry
     - net: usb: aqc111: Do not perform PM inside suspend callback
     - igc: fix missing update of skb->tail in igc_xmit_frame()
     - igc: fix page fault in XDP TX timestamps handling
     - iavf: fix VLAN filter lost on add/delete race
     - wifi: mac80211: fix NULL deref in mesh_matches_local() (CVE-2026-23396)
     - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough
       headroom
     - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix
     - net: macb: fix uninitialized rx_fs_lock
     - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle
     - net/mlx5e: Prevent concurrent access to IPSec ASO context
     - net/mlx5e: Fix race condition during IPSec ESN update
     - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
     - net: bonding: fix NULL deref in bond_debug_rlb_hash_show
     - netfilter: bpf: defer hook memory release until rcu readers are done
     - netfilter: nf_tables: release flowtable after rcu grace period on error
       (CVE-2026-23392)
     - nfnetlink_osf: validate individual option lengths in fingerprints
       (CVE-2026-23397)
     - [arm64,armhf] net: mvpp2: guard flow control update with global_tx_fc in
       buffer switching
     - [armhf] net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error
       paths
     - icmp: fix NULL pointer dereference in icmp_tag_validation()
       (CVE-2026-23398)
     - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return
       value
     - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit()
     - [amd64] drm/i915/psr: Compute PSR entry_setup_frames into intel_crtc_state
     - USB: serial: f81232: fix incomplete serial port generation
     - i2c: cp2615: fix serial string NULL-deref at probe
     - i2c: fsi: Fix a potential leak in fsi_i2c_probe()
     - i2c: pxa: defer reset on Armada 3700 when recovery is used
     - ring-buffer: Fix to update per-subbuf entries of persistent ring buffer
     - [amd64] x86/platform/uv: Handle deconfigured sockets
     - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode
     - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode
     - mm: shmem: fix potential data corruption during shmem swapin
     - mm: shmem: avoid unpaired folio_unlock() in shmem_swapin_folio()
     - mm/shmem, swap: improve cached mTHP handling and fix potential hang
     - mm/shmem, swap: avoid redundant Xarray lookup during swapin
     - mtd: rawnand: serialize lock/unlock against other NAND operations
     - mtd: rawnand: brcmnand: skip DMA during panic write
     - drm/amd/display: Fix DisplayID not-found handling in
       parse_edid_displayid_vrr()
     - drm/amd: fix dcn 2.01 check
     - ksmbd: fix use-after-free of share_conf in compound request
     - ksmbd: fix use-after-free in durable v2 replay of active file handles
     - [amd64] drm/i915/gt: Check set_default_submission() before deferencing
     - lib/bootconfig: check xbc_init_node() return in override path
     - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure
     - hwmon: (max6639) Fix pulses-per-revolution implementation
     - [amd64] perf/x86/intel: Add missing branch counters constraint apply
     - xen/privcmd: restrict usage in unprivileged domU (CVE-2026-31788)
     - xen/privcmd: add boot control for restricted usage in domU
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.79
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.80
     - cxl/port: Fix use after free of parent_port in cxl_detach_ep()
     - bpf: Fix constant blinding for PROBE_MEM32 stores (CVE-2026-23417)
       (Closes: #1132622)
     - perf: Make sure to use pmu_ctx->pmu for groups
     - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled
     - hwmon: axi-fan: don't use driver_override as IRQ name
     - driver core: generalize driver_override in struct device
     - driver core: platform: use generic driver_override infrastructure
     - bpf: Release module BTF IDR before module unload
     - bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN
     - bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR
     - HID: asus: avoid memory leak in asus_report_fixup()
     - [amd64] platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to
       dmi_vgbs_allow_list
     - nvme-pci: cap queue creation to used queues
     - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets
     - [amd64] platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold
       16 Gen 1
     - [amd64] platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix
       touchscreen on SUPI S10
     - nvme-pci: ensure we're polling a polled queue
     - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2
     - HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
     - HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list
     - net: usb: r8152: add TRENDnet TUC-ET2G
     - kbuild: install-extmod-build: Package resolve_btfids if necessary
     - HID: mcp2221: cancel last I2C command on read error
     - HID: asus: add xg mobile 2023 external hardware support
     - module: Fix kernel panic when a symbol st_shndx is out of bounds
     - scsi: mpi3mr: Clear reset history on ready and recheck state after timeout
     - scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP
     - dma-buf: Include ioctl.h in UAPI header
     - ALSA: hda/senary: Ensure EAPD is enabled during init
     - HID: apple: avoid memory leak in apple_report_fixup()
     - sched_ext: Use WRITE_ONCE() for the write side of dsq->seq update
     - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create
     - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk
     - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390
     - objtool: Handle Clang RSP musical chairs
     - nvmet: move async event work off nvmet-wq
     - drm/amdgpu: fix gpu idle power consumption issue for gfx v12
     - usb: core: new quirk to handle devices with zero configurations
     - spi: intel-pci: Add support for Nova Lake mobile SPI flash
     - ALSA: hda/realtek: add quirk for ASUS UM6702RC
     - i3c: master: dw-i3c: Fix missing of_node for virtual I2C adapter
     - xfrm: add missing extack for XFRMA_SA_PCPU in add_acquire and allocspi
     - xfrm: fix the condition on x->pcpu_num in xfrm_sa_len
     - xfrm: call xdo_dev_state_delete during state update
     - xfrm: Fix the usage of skb->sk
     - esp: fix skb leak with espintcp and async crypto
     - xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini()
     - xfrm: prevent policy_hthresh.work from racing with netns teardown
     - af_key: validate families in pfkey_send_migrate()
     - dma: swiotlb: add KMSAN annotations to swiotlb_bounce()
     - erofs: set fileio bio failed in short read case
     - can: statistics: add missing atomic access in hot path
     - Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
     - Bluetooth: L2CAP: Validate PDU length before reading SDU length in
       l2cap_ecred_data_rcv()
     - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing
       sock_hold
     - Bluetooth: MGMT: Fix dangling pointer on
       mgmt_add_adv_patterns_monitor_complete
     - Bluetooth: hci_ll: Fix firmware leak on error path
     - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
     - [arm64] pinctrl: mediatek: common: Fix probe failure for devices without
       EINT
     - ionic: fix persistent MAC address override on PF
     - nfc: nci: fix circular locking dependency in nci_close_device
     - net: openvswitch: Avoid releasing netdev before teardown completes
     - openvswitch: defer tunnel netdev_put to RCU release
     - openvswitch: validate MPLS set/set_masked payload length
     - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe
       buffer
     - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
     - net: bcm: asp2: fix LPI timer handling
     - net: bcm: asp2: remove tx_lpi_enabled
     - net: bcm: asp2: convert to phylib managed EEE
     - net: bcmasp: Remove support for asp-v2.0
     - net: bcmasp: streamline early exit in probe
     - net: bcmasp: fix double free of WoL irq
     - net: bcmasp: Add support for asp-v3.0
     - net: bcmasp: fix double disable of clk
     - [armhf] platform/olpc: olpc-xo175-ec: Fix overflow error message to print
       inlen
     - [amd64] platform/x86: intel-hid: disable wakeup_mode during hibernation
     - ice: fix inverted ready check for VF representors
     - ice: use ice_update_eth_stats() for representor stats
     - iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
     - ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions
       expire.
     - ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist.
     - net: fix fanout UAF in packet_release() via NETDEV_UP race
     - tcp: optimize inet_use_bhash2_on_bind()
     - udp: Fix wildcard bind conflict check when using hash2
     - net: enetc: fix the output issue of 'ethtool --show-ring'
     - team: fix header_ops type confusion with non-Ethernet ports
     - net: lan743x: fix duplex configuration in mac_link_up
     - dma-mapping: add missing `inline` for `dma_free_attrs`
     - Bluetooth: L2CAP: Fix send LE flow credits in ACL link
     - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock
     - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
     - Bluetooth: btusb: clamp SCO altsetting table indices
     - tls: Purge async_hold in tls_decrypt_async_wait() (CVE-2026-23414)
     - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
     - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
     - netfilter: nf_conntrack_expect: skip expectations in other netns via proc
     - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in
       process_sdp
     - netfilter: ctnetlink: use netlink policy range checks
     - net: macb: use the current queue number for stats
     - regmap: Synchronize cache for the page selector
     - ALSA: hda/realtek: Sequence GPIO2 on Star Labs StarFighter
     - RDMA/rw: Fall back to direct SGE on MR pool exhaustion
     - RDMA/irdma: Initialize free_qp completion before using it
     - RDMA/irdma: Update ibqp state to error if QP is already in error state
     - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce()
     - RDMA/irdma: Clean up unnecessary dereference of event->cm_node
     - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err()
     - RDMA/irdma: Fix deadlock during netdev reset with active connections
     - RDMA/irdma: Return EINVAL for invalid arp index error
     - scsi: scsi_transport_sas: Fix the maximum channel scanning issue
     - [amd64] x86/efi: efi_unmap_boot_services: fix calculation of
       ranges_to_free size
     - [amd64] drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
     - PM: hibernate: Drain trailing zero pages on userspace restore
     - spi: sn-f-ospi: Fix resource leak in f_ospi_probe()
     - [amd64] ASoC: Intel: catpt: Fix the device initialization
     - [arm64,armhf] spi: meson-spicc: Fix double-put in remove path
     - drm/amd/display: Do not skip unrelated mode changes in DSC validation
     - spi: Group CS related fields in struct spi_device
     - spi: use generic driver_override infrastructure
     - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
     - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib
     - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion
     - hwmon: (pmbus/core) Fix various coding style issues
     - hwmon: (pmbus) Mark lowest/average/highest/rated attributes as read-only
     - hwmon: (pmbus) Introduce the concept of "write-only" attributes
     - sysctl: fix uninitialized variable in proc_do_large_bitmap
     - [s390x] syscalls: Add spectre boundary for syscall dispatch table
     - [s390x] barrier: Make array_index_mask_nospec() __always_inline
     - [s390x] entry: Scrub r12 register on kernel entry
     - ksmbd: replace hardcoded hdr2_len with offsetof() in
       smb2_calc_max_out_buf_len()
     - ksmbd: fix potencial OOB in get_file_all_info() for compound requests
     - ksmbd: fix memory leaks and NULL deref in smb2_lock()
     - ksmbd: do not expire session on binding failure
     - ALSA: firewire-lib: fix uninitialized local variable
     - [amd64] ASoC: SOF: ipc4-topology: Allow bytes controls without initial
       payload
     - can: gw: fix OOB heap access in cgw_csum_crc8_rel()
     - can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
     - cpufreq: conservative: Reset requested_freq on limits change
     - [amd64] platform/x86: ISST: Correct locked bit width
     - [arm64] KVM: arm64: Discard PC update state on vcpu reset
     - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs
       attributes
     - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute
       temperature
     - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible()
     - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
     - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and
       napi_tx is false
     - erofs: add GFP_NOIO in the bio completion if needed
     - alarmtimer: Fix argument order in alarm_timer_forward()
     - [amd64] x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling()
     - [amd64] x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask
     - [arm64] phy: qcom: qmp-ufs: Fix SM8650 PCS table for Gear 4
     - ovl: fix wrong detection of 32bit inode numbers
     - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
     - scsi: ses: Handle positive SCSI error from ses_recv_diag()
     - net: macb: Move devm_{free,request}_irq() out of spin lock area
     - net: macb: Protect access to net_device::ip_ptr with RCU lock
     - net: macb: Use dev_consume_skb_any() to free TX SKBs
     - [amd64] KVM: x86/mmu: Drop/zap existing present SPTE even when creating an
       MMIO SPTE (CVE-2026-23401)
     - jbd2: gracefully abort on checkpointing state corruptions
     - [arm64] irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment
     - futex: Clear stale exiting pointer in futex_lock_pi() retry path
     - dmaengine: fsl-edma: fix channel parameter config for fixed channel
       requests
     - dmaengine: sh: rz-dmac: Protect the driver specific lists
     - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock
     - drm/amdgpu: prevent immediate PASID reuse case
     - [amd64] drm/i915/dp_tunnel: Fix error handling when clearing stream BW in
       atomic state
     - xfs: stop reclaim before pushing AIL during unmount
     - xfs: save ailp before dropping the AIL lock in push callbacks
     - xfs: scrub: unlock dquot before early return in quota scrub
     - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2
     - xfs: don't irele after failing to iget in xfs_attri_recover_work
     - xfs: remove file_path tracepoint data
     - ext4: fix journal credit check when setting fscrypt context
     - ext4: convert inline data to extents when truncate exceeds inline size
     - ext4: fix stale xarray tags after writeback
     - ext4: fix fsync(2) for nojournal mode
     - ext4: make recently_deleted() properly work with lazy itable
       initialization
     - ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio
     - ext4: validate p_idx bounds in ext4_ext_correct_indexes
     - ext4: avoid infinite loops caused by residual data
     - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
     - ext4: reject mount if bigalloc with s_first_data_block != 0
     - ext4: fix use-after-free in update_super_work when racing with umount
     - ext4: fix the might_sleep() warnings in kvfree()
     - ext4: handle wraparound when searching for blocks for indirect mapped
       blocks
     - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
     - ext4: always drain queued discard work in ext4_mb_release()
     - [arm64] dts: imx8mn-tqma8mqnl: fix LDO5 power off
     - [powerpc*] powerpc64/bpf: do not increment tailcall count when prog is
       NULL
     - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()
     - tracing: Switch trace_osnoise.c code over to use guard() and __free()
     - tracing: Fix potential deadlock in cpu hotplug with osnoise
     - drm/xe: always keep track of remap prev/next
     - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]
     - ovl: Use str_on_off() helper in ovl_show_options()
     - ovl: make fsync after metadata copy-up opt-in mount option
     - xfs: avoid dereferencing log items after push callbacks
     - virt: tdx-guest: Fix handling of host controlled 'quote' buffer length
     - net: add proper RCU protection to /proc/net/ptype (CVE-2026-23255)
     - landlock: Optimize file path walks and prepare for audit support
     - landlock: Fix handling of disconnected directories (CVE-2025-68736)
     - ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw()
       (CVE-2025-22117)
     - ice: Fix PTP NULL pointer dereference during VSI rebuild (CVE-2026-23210)
     - [amd64,arm64] idpf: check error for register_netdev() on init
     - [amd64,arm64] idpf: detach and close netdevs while handling a reset
       (CVE-2026-22981)
     - [amd64,arm64] idpf: Fix RSS LUT NULL pointer crash on early ethtool
       operations (CVE-2026-22985)
     - [amd64,arm64] idpf: Fix RSS LUT NULL ptr issue after soft reset
       (CVE-2026-22993)
     - [amd64] dmaengine: idxd: Fix not releasing workqueue on .release()
     - [amd64] dmaengine: idxd: Fix memory leak when a wq is reset
     - [amd64] dmaengine: idxd: Fix freeing the allocated ida too late
     - phy: ti: j721e-wiz: Fix device node reference leak in
       wiz_get_lane_phy_types()
     - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and
       CYCLE_BIT bits for HDMA.
     - netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators
     - [amd64] dmaengine: idxd: fix possible wrong descriptor completion in
       llist_abort_desc()
     - btrfs: fix super block offset in error message in btrfs_validate_super()
     - btrfs: fix leak of kobject name for sub-group space_info
     - btrfs: fix lost error when running device stats on multiple devices fs
     - xen/privcmd: unregister xenstore notifier on module exit
     - futex: Require sys_futex_requeue() to have identical flags
     - [amd64] dmaengine: idxd: Fix leaking event log memory
     - net: bcmasp: Restore programming of TX map vector register
     - net: bcmasp: Fix network filter wake for asp-3.0
     - [amd64,arm64] idpf: nullify pointers after they are freed
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.81
     - io_uring/kbuf: remove legacy kbuf bulk allocation
     - io_uring/kbuf: remove legacy kbuf kmem cache
     - io_uring/kbuf: simplify __io_put_kbuf
     - io_uring/kbuf: remove legacy kbuf caching
     - io_uring/kbuf: open code __io_put_kbuf()
     - io_uring/kbuf: introduce io_kbuf_drop_legacy()
     - io_uring/kbuf: uninline __io_put_kbufs
     - io_uring/kbuf: drop 'issue_flags' from io_put_kbuf(s)() arguments
     - io_uring/net: don't use io_net_kbuf_recyle() for non-provided cases
     - io_uring/net: clarify io_recv_buf_select() return value
     - io_uring/kbuf: pass in struct io_buffer_list to commit/recycle helpers
     - io_uring/kbuf: introduce struct io_br_sel
     - io_uring/kbuf: use struct io_br_sel for multiple buffers picking
     - io_uring/net: use struct io_br_sel->val as the recv finish value
     - io_uring/net: use struct io_br_sel->val as the send finish value
     - io_uring/kbuf: switch to storing struct io_buffer_list locally
     - io_uring: remove async/poll related provided buffer recycles
     - io_uring/net: correct type for min_not_zero() cast
     - io_uring/rw: check for NULL io_br_sel when putting a buffer
     - io_uring/kbuf: enable bundles for incrementally consumed buffers
     - io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths
     - io_uring/kbuf: use READ_ONCE() for userspace-mapped memory
     - io_uring/kbuf: use WRITE_ONCE() for userspace-shared buffer ring fields
     - io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF
     - io_uring/kbuf: propagate BUF_MORE through early buffer commit path
     - HID: logitech-hidpp: Enable MX Master 4 over bluetooth
     - wifi: mac80211: check tdls flag in ieee80211_tdls_oper
     - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
     - atm: lec: fix use-after-free in sock_def_readable()
     - btrfs: don't take device_list_mutex when querying zone info
     - tg3: replace placeholder MAC address with device property
     - HID: logitech-hidpp: Prevent use-after-free on force feedback
       initialisation failure
     - HID: multitouch: Check to ensure report responses match the request
     - btrfs: reserve enough transaction items for qgroup ioctls
     - [arm64,armhf] i2c: tegra: Don't mark devices with pins as IRQ safe
     - btrfs: reject root items with drop_progress and zero drop_level
     - [arm64] spi: geni-qcom: Check DMA interrupts early in ISR
     - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common
       property warning
     - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU
       session
     - [arm64,armhf] crypto: caam - fix DMA corruption on long hmac keys
     - [arm64,armhf] crypto: caam - fix overflow on long hmac keys
     - crypto: af-alg - fix NULL pointer dereference in scatterwalk
     - [arm64,armhf] net: fec: fix the PTP periodic output sysfs interface
     - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak
     - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields
       to zero to prevent an info-leak
     - net/ipv6: ioam6: prevent schema length wraparound in trace fill
     - tg3: Fix race for querying speed/duplex
     - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
     - ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
     - bridge: br_nd_send: linearize skb before parsing ND options
     - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
     - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta
     - [arm64] net: enetc: check whether the RSS algorithm is Toeplitz
     - ipv6: prevent possible UaF in addrconf_permanent_addr()
     - net: airoha: Add missing cleanup bits in airoha_qdma_cleanup_rx_queue()
     - net: introduce mangleid_features
     - net: use skb_header_pointer() for TCPv4 GSO frag_off check
     - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero
       to prevent an info-leak
     - NFC: pn533: bound the UART receive buffer
     - ASoC: Intel: boards: fix unmet dependency on PINCTRL
     - bpf: Fix regsafe() for pointers to packet
     - net: ipv6: flowlabel: defer exclusive option free until RCU teardown
     - netfilter: flowtable: strictly check for maximum number of actions
     - netfilter: nfnetlink_log: account for netlink header size
     - netfilter: x_tables: ensure names are nul-terminated
     - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
     - netfilter: nf_conntrack_helper: pass helper to expect cleanup
     - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
     - netfilter: nf_conntrack_expect: honor expectation helper field
     - netfilter: nf_conntrack_expect: use expect->helper
     - netfilter: nf_conntrack_expect: store netns and zone in expectation
     - netfilter: ctnetlink: ignore explicit helper on new expectations
     - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions
       for NFPROTO_ARP
     - netfilter: nf_tables: reject immediate NF_QUEUE verdict
     - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate
     - Bluetooth: SCO: fix race conditions in sco_sock_connect()
     - Bluetooth: MGMT: validate LTK enc_size on load
     - Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
     - Bluetooth: hci_event: fix potential UAF in
       hci_le_remote_conn_param_req_evt
     - Bluetooth: MGMT: validate mesh send advertising payload length
     - rds: ib: reject FRMR registration before IB connection is established
     - bpf: sockmap: Fix use-after-free of sk->sk_socket in
       sk_psock_verdict_data_ready().
     - net/sched: sch_netem: fix out-of-bounds access in packet corruption
     - net: macb: fix clk handling on PCI glue driver removal
     - net: macb: properly unregister fixed rate clocks
     - net/mlx5: lag: Check for LAG device before creating debugfs
     - net/mlx5: Avoid "No data available" when FW version queries fail
     - net/mlx5: Fix switchdev mode rollback in case of failure
     - bnxt_en: Restore default stat ctxs for ULP when resource is available
     - net/x25: Fix potential double free of skb
     - net/x25: Fix overflow when accumulating packets
     - net/sched: cls_fw: fix NULL pointer dereference on shared blocks
     - net/sched: cls_flow: fix NULL pointer dereference on shared blocks
     - net: hsr: fix VLAN add unwind on slave errors
     - ipv6: avoid overflows in ip6_datagram_send_ctl()
     - bpf: reject direct access to nullable PTR_TO_BUF pointers
     - Revert "drm: Fix use-after-free on framebuffers and property blobs when
       calling drm_dev_unplug"
     - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
     - hwmon: (pxe1610) Check return value of page-select write in probe
     - hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS")
     - dt-bindings: gpio: fix microchip #interrupt-cells
     - hwmon: (tps53679) Fix device ID comparison and printing in
       tps53676_identify()
     - [armhf] hwmon: (occ) Fix missing newline in occ_show_extended()
     - sched/fair: Use protect_slice() instead of direct comparison
     - sched/fair: Fix zero_vruntime tracking fix
     - [amd64,arm64] drm/ioc32: stop speculation on the drm_compat_ioctl path
     - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
     - wifi: iwlwifi: mvm: fix potential out-of-bounds read in
       iwl_mvm_nd_match_info_handler()
     - USB: serial: option: add MeiG Smart SRM825WN
     - ALSA: caiaq: fix stack out-of-bounds read in init_card
     - ALSA: ctxfi: Fix missing SPDIFI1 index handling
     - io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()
     - Bluetooth: SMP: derive legacy responder STK authentication from MITM state
     - Bluetooth: SMP: force responder MITM requirements before building the
       pairing response
     - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
     - ksmbd: fix OOB write in QUERY_INFO for compound requests
     - [armhf] hwmon: (occ) Fix division by zero in occ_show_power_1()
     - drm/amdgpu: fix the idr allocation flags
     - iio: adc: ti-adc161s626: fix buffer read on big-endian
     - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read()
     - drm/ast: dp501: Fix initialization of SCU2C
     - [amd64] drm/i915/dsi: Don't do DSC horizontal timing adjustments in
       command mode
     - [amd64] drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw
       CPU eDP
     - drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB
     - drm/amdgpu/pm: drop SMU driver if version not matched messages
     - USB: serial: io_edgeport: add support for Blackbox IC135A
     - USB: serial: option: add support for Rolling Wireless RW135R-GL
     - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
     - Input: synaptics-rmi4 - fix a locking bug in an error path
     - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk
       table
     - Input: bcm5974 - recover from failed mode switch
     - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode
     - Input: xpad - add support for Razer Wolverine V3 Pro
     - iio: adc: aspeed: clear reference voltage bits before configuring vref
     - iio: accel: fix ADXL355 temperature signature value
     - iio: accel: adxl380: fix FIFO watermark bit 8 always written as 0
     - iio: dac: ad5770r: fix error return in ad5770r_read_raw()
     - iio: light: vcnl4035: fix scan buffer on big-endian
     - iio: imu: bmi160: Remove potential undefined behavior in
       bmi160_config_pin()
     - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only
     - iio: gyro: mpu3050: Fix incorrect free_irq() variable
     - iio: gyro: mpu3050: Fix irq resource leak
     - iio: gyro: mpu3050: Move iio_device_register() to correct location
     - iio: gyro: mpu3050: Fix out-of-sequence free_irq()
     - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
     - usb: ulpi: fix double free in ulpi_register_interface() error path
     - usb: usbtmc: Flush anchored URBs in usbtmc_release
     - usb: ehci-brcm: fix sleep during atomic
     - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()
     - usb: core: phy: avoid double use of 'usb3-phy'
     - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
     - usb: cdns3: gadget: fix state inconsistency on gadget init failure
     - bridge: br_nd_send: validate ND option lengths
     - cdc-acm: new quirk for EPSON HMD
     - [amd64] comedi: Reinit dev->spinlock between attachments to low-level
       drivers
     - [amd64] comedi: me_daq: Fix potential overrun of firmware buffer
     - [amd64] comedi: me4000: Fix potential overrun of firmware buffer
     - [riscv64] firmware: microchip: fail auto-update probe if no flash found
     - dt-bindings: connector: add pd-disable dependency
     - nvmem: imx: assign nvmem_cell_info::raw_len
     - nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy
     - netfilter: ipset: drop logically empty buckets in mtype_del
     - vxlan: validate ND option lengths in vxlan_na_create
     - net: ftgmac100: fix ring allocation unwind on open failure
     - [arm64] net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled
     - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error
       path
     - gpio: mxc: map Both Edge pad wakeup to Rising Edge
     - thermal: core: Fix thermal zone device registration error path
     - misc: fastrpc: possible double-free of cctx->remote_heap
     - [amd64] thunderbolt: Fix property read in nhi_wake_supported()
     - USB: dummy-hcd: Fix locking/synchronization error
     - USB: dummy-hcd: Fix interrupt synchronization error
     - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows
       partial transfer
     - usb: typec: ucsi: validate connector number in ucsi_notify_common()
     - ice: Fix memory leak in ice_set_ringparam() (CVE-2026-23389)
     - btrfs: fix the qgroup data free range for inline data extents
     - btrfs: do not free data reservation in fallback from inline due to -ENOSPC
       (CVE-2025-71269)
     - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
     - usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo
     - usb: gadget: uvc: fix NULL pointer dereference during unbind race
     - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
     - usb: gadget: f_rndis: Protect RNDIS options with mutex
     - usb: gadget: f_ecm: Fix net_device lifecycle with device_move
     - usb: gadget: f_eem: Fix net_device lifecycle with device_move
     - usb: gadget: f_subset: Fix net_device lifecycle with device_move
     - usb: gadget: f_rndis: Fix net_device lifecycle with device_move
     - usb: gadget: f_hid: move list and spinlock inits from bind to alloc
     - usb: gadget: f_uac1_legacy: validate control request size
     - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
     - spi: cadence-qspi: Fix exec_mem_op error handling
     - net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback
     - [amd64,arm64] net: mana: fix use-after-free in add_adev() error path
     - scsi: target: tcm_loop: Drain commands in target_reset handler
     - [amd64] x86/fred: Fix early boot failures on SEV-ES/SNP guests
     - mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
     - mm: replace READ_ONCE() with standard page table accessors
     - mm/memory: fix PMD/PUD checks in follow_pfnmap_start()
     - drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13
     - ext4: publish jinode after initialization
     - [s390x] perf_cpum_sf: Convert to use try_cmpxchg128()
     - [s390x] cpum_sf: Cap sampling rate to prevent lsctl exception
     - MPTCP: fix lock class name family in pm_nl_create_listen_socket
     - [amd64] x86/CPU/AMD: Add additional fixed RDSEED microcode revisions
     - drm/amd/amdgpu: decouple ASPM with pcie dpm
     - drm/amd/amdgpu: disable ASPM in some situations
     - drm/amd/display: Disable fastboot on DCE 6 too
     - drm/amd/display: Keep PLL0 running on DCE 6.0 and 6.4
     - drm/amd/display: Fix DCE 6.0 and 6.4 PLL programming.
     - drm/amd/display: Adjust DCE 8-10 clock, don't overclock by 15%
     - drm/amd/display: Disable scaling on DCE6 for now
     - drm/amd: Disable ASPM on SI
     - drm/amd/display: Correct logic check error for fastboot
     - bpf: Improve bounds when s64 crosses sign boundary
     - bpf: Add third round of bounds deduction
     - bpf: Fix u32/s32 bounds when ranges cross min/max boundary
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.82
     - lib/crypto: chacha: Zeroize permuted_state before it leaves scope
     - usb: typec: ucsi: skip connector validation before init
     - wifi: rt2x00usb: fix devres lifetime
     - xfrm_user: fix info leak in build_report()
     - net: rfkill: prevent unlimited numbers of rfkill events from being created
     - mptcp: fix slab-use-after-free in __inet_lookup_established
     - seg6: separate dst_cache for input and output paths in seg6 lwtunnel
     - Input: uinput - fix circular locking dependency with ff-core
     - Input: uinput - take event lock when submitting FF request "event"
     - ASoC: simple-card-utils: Don't use __free(device_node) at
       graph_util_parse_dai()
     - btrfs: make wait_on_extent_buffer_writeback() static inline
     - btrfs: remove unused define WAIT_PAGE_LOCK for extent io
     - btrfs: split waiting from read_extent_buffer_pages(), drop parameter wait
     - btrfs: remove unused flag EXTENT_BUFFER_READAHEAD
     - btrfs: remove unused flag EXTENT_BUFFER_CORRUPT
     - btrfs: remove pointless out labels from extent-tree.c
     - btrfs: fix incorrect return value after changing leaf in
       lookup_extent_data_ref()
     - blktrace: fix __this_cpu_read/write in preemptible context
     - nfc: nci: complete pending data exchange on device close
     - misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe
     - Revert "mptcp: add needs_id for netlink appending addr"
     - net: annotate data-races around sk->sk_{data_ready,write_space}
     - netfilter: nft_ct: fix use-after-free in timeout object destroy
     - workqueue: Add pool_workqueue to pending_pwqs list when unplugging
       multiple inactive works
     - xfrm: clear trailing padding in build_polexpire()
     - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
     - wifi: brcmsmac: Fix dma_free_coherent() size
     - [amd64] platform/x86/intel-uncore-freq: Handle autonomous UFS status bit
     - [arm64] Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower"
     - [arm64] dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V
     - [arm64] dts: hisilicon: poplar: Correct PCIe reset GPIO polarity
     - [arm64] dts: hisilicon: hi3798cv200: Add missing dma-ranges
     - nfc: pn533: allocate rx skb before consuming bytes
     - batman-adv: reject oversized global TT response buffers
     - X.509: Fix out-of-bounds access when parsing extensions
     - [amd64,arm64] EDAC/mc: Fix error path ordering in edac_mc_alloc()
     - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
     - batman-adv: hold claim backbone gateways by reference
     - [amd64] drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat
     - [amd64] drm/i915/psr: Do not use pipe_src as borders for SU area
     - net/mlx5: Update the list of the PCI supported devices
     - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled
     - mmc: vub300: fix NULL-deref on disconnect
     - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation
       failure
     - net: stmmac: fix integer underflow in chain mode
     - mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()
     - [amd64,arm64] idpf: improve locking around idpf_vc_xn_push_free()
     - [amd64,arm64] idpf: set the payload size before calling the async handler
     - rxrpc: Fix anonymous key handling
     - rxrpc: Fix call removal to use RCU safe deletion
     - rxrpc: Fix key reference count leak from call->key
     - rxrpc: Only put the call ref if one was acquired
     - rxrpc: reject undecryptable rxkad response tickets
     - rxrpc: fix reference count leak in rxrpc_server_keyring()
     - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)
     - rxrpc: Fix missing error checks for rxkad encryption/decryption failure
     - net: skb: fix cross-cache free of KFENCE-allocated skb head
     - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6
     - [amd64] x86/CPU: Fix FPDSS on Zen1 (CVE-2026-31628)
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.83
     - RDMA/irdma: Fix double free related to rereg_user_mr
     - [amd64] ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA
     - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk
     - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC
     - [arm64,armhf] media: rkvdec: reduce stack usage in
       rkvdec_init_v4l2_vp9_count_tbl()
     - ALSA: asihpi: avoid write overflow check warning
     - Bluetooth: hci_sync: annotate data-races around hdev->req_status
     - [amd64] ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF
     - [amd64,arm64] ASoC: SOF: topology: reject invalid vendor array size in
       token parser
     - can: mcp251x: add error handling for power enable in open and resume
     - [amd64] platform/x86: asus-nb-wmi: add DMI quirk for ASUS ROG Flow Z13-KJP
       GZ302EAC
     - btrfs: tracepoints: get correct superblock from dentry in event
       btrfs_sync_file()
     - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx
     - drm/amdgpu: Handle GPU page faults correctly on non-4K page systems
     - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
     - ALSA: hda/realtek: add quirk for Framework F111:000F
     - wifi: wl1251: validate packet IDs before indexing tx_frames
     - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list
     - ALSA: hda/realtek: Add quirk for Samsung Book2 Pro 360 (NP950QED)
     - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex
     - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
     - [amd64] ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx
     - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IMH9
     - [amd64] pinctrl: intel: Fix the revision for new features (1kOhm PD, HW
       debouncer)
     - [amd64] platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug
     - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3
     - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10
     - HID: roccat: fix use-after-free in roccat_report_event
     - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585
     - wifi: brcmfmac: validate bsscfg indices in IF events
     - net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules
     - [armhf] ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J
     - [armhf] soc: aspeed: socinfo: Mask table entries for accurate SoC ID
       matching
     - [arm64] dts: qcom: hamoa/x1: fix idle exit latency
     - [arm64] dts: imx8mq: Set the correct gpu_ahb clock frequency
     - [arm64] dts: imx93-9x9-qsb: change usdhc tuning step for eMMC and SD
     - [arm64] dts: imx93-tqma9352: improve eMMC pad configuration
     - [arm64] soc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei
     - tools/power/turbostat: Fix microcode patch level output for AMD/Hygon
     - PCI: hv: Set default NUMA node to 0 for devices without affinity info
     - HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP
     - xfrm: account XFRMA_IF_ID in aevent size calculation
     - [arm*] drm/vc4: Release runtime PM reference after binding V3D
     - [arm*] drm/vc4: Fix memory leak of BO array in hang state
     - [arm*] drm/vc4: Fix a memory leak in hang state error path
     - [arm* drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock
     - eventpoll: defer struct eventpoll free to RCU grace period
     - net: sched: act_csum: validate nested VLAN headers
     - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE
     - ipv4: nexthop: avoid duplicate NHA_HW_STATS_ENABLE on nexthop group dump
     - ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()
       (CVE-2026-31531)
     - ipv4: icmp: fix null-ptr-deref in icmp_build_probe()
     - net: increase IP_TUNNEL_RECURSION_LIMIT to 5
     - nfc: s3fwrn5: allocate rx skb before consuming bytes
     - net: stmmac: Fix PTP ref clock for Tegra234
     - dt-bindings: net: Fix Tegra234 MGBE PTP clock
     - tracing/probe: reject non-closed empty immediate strings
     - ixgbevf: add missing negotiate_features op to Hyper-V ops table
     - e1000: check return value of e1000_read_eeprom
     - xsk: tighten UMEM headroom validation to account for tailroom and min
       frame
     - xsk: respect tailroom for ZC setups
     - xsk: fix XDP_UMEM_SG_FLAG issues
     - xsk: validate MTU against usable frame size on bind
     - xfrm: Wait for RCU readers during policy netns exit
     - xfrm: fix refcount leak in xfrm_migrate_policy_find
     - xfrm_user: fix info leak in build_mapping()
     - ipvs: fix NULL deref in ip_vs_add_service error path
     - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator
     - netfilter: xt_multiport: validate range encoding in checkentry
     - netfilter: ip6t_eui64: reject invalid MAC header for all packets
     - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC ->
       GFP_KERNEL_ACCOUNT allocation
     - netfilter: nfnetlink_queue: make hash table per queue
     - net: txgbe: leave space for null terminators on property_entry
     - af_unix: read UNIX_DIAG_VFS data under unix_state_lock
     - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
     - net: ipa: fix event ring index not programmed for IPA v5.0+
     - l2tp: Drop large packets with UDP encap
     - gpio: tegra: fix irq_release_resources calling enable instead of disable
     - crypto: af_alg - limit RX SG extraction by receive buffer budget
     - [amd64] perf/x86/intel/uncore: Skip discovery table for offline dies
     - sched/deadline: Use revised wakeup rule for dl_server
     - crypto: algif_aead - Fix minimum RX size check for decryption
     - netfilter: conntrack: add missing netlink policy validations
       (CVE-2026-31407)
     - Revert "drm/xe/mmio: Avoid double-adjust in 64-bit reads"
     - Revert "drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt"
     - thermal: core: Mark thermal zones as exiting before unregistration
     - thermal: core: Address thermal zone removal races with resume
     - ALSA: usb-audio: Improve Focusrite sample rate filtering
     - [amd64,arm64] idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC
       handling
     - nfc: llcp: add missing return after LLCP_CLOSED checks
     - can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)
     - i2c: s3c24xx: check the size of the SMBUS message before using it
     - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
     - HID: alps: fix NULL pointer dereference in alps_raw_event()
     - HID: core: clamp report_size in s32ton() to avoid undefined shift
     - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
     - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
     - [arm*] drm/vc4: platform_get_irq_byname() returns an int
     - ALSA: fireworks: bound device-supplied status before string array lookup
     - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
     - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()
     - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
     - usb: gadget: renesas_usb3: validate endpoint index in standard request
       handlers
     - smb: client: fix off-by-8 bounds check in check_wsl_eas()
     - ksmbd: validate EaNameLength in smb2_get_ea()
     - ksmbd: require 3 sub-authorities before reading sub_auth[2]
     - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc
     - usbip: validate number_of_packets in usbip_pack_ret_submit()
     - usb: storage: Expand range of matched versions for VL817 quirks entry
     - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen
     - usb: gadget: f_hid: don't call cdev_init while cdev in use
     - usb: port: add delay after usb_hub_set_port_power()
     - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
     - scripts: generate_rust_analyzer.py: avoid FD leak
     - wifi: rtw88: fix device leak on probe failure
     - staging: sm750fb: fix division by zero in ps_to_hz()
     - USB: serial: option: add Telit Cinterion FN990A MBIM composition
     - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates
       race
     - ALSA: ctxfi: Limit PTP to a single page
     - dcache: Limit the minimal number of bucket to two
     - media: vidtv: fix NULL pointer dereference in
       vidtv_channel_pmt_match_sections
     - ocfs2: fix possible deadlock between unlink and dio_end_io_write
     - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
     - ocfs2: handle invalid dinode in ocfs2_group_extend
     - PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup
     - [amd64] KVM: SEV: Reject attempts to sync VMSA of an
       already-launched/encrypted vCPU
     - [amd64] KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being
       created
     - [amd64] KVM: SEV: Drop WARN on large size for
       KVM_MEMORY_ENCRYPT_REG_REGION
     - gpiolib: unify two loops initializing GPIO descriptors
     - gpiolib: fix race condition for gdev->srcu (CVE-2026-22986)
     - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr()
     - kernel: be more careful about dup_mmap() failures and uprobe registering
     - KVM: Remove subtle "struct kvm_stats_desc" pseudo-overlay
     - [amd64] KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs
     - checkpatch: add support for Assisted-by tag
     - [amd64] x86-64: rename misleadingly named '__copy_user_nocache()' function
     - [amd64] x86: rename and clean up __copy_from_user_inatomic_nocache()
     - x86-64/arm64/powerpc: clean up and rename __copy_from_user_flushcache
     - [amd64] KVM: x86: Use scratch field in MMIO fragment to hold small write
       values
     - [arm64] ASoC: qcom: q6apm: move component registration to unmanaged
       version
     - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
     - media: vidtv: fix nfeeds state corruption on start_streaming failure
     - media: mediatek: vcodec: fix use-after-free in encoder release path
     - media: em28xx: fix use-after-free in em28xx_v4l2_open()
     - hwmon: (powerz) Fix use-after-free on USB disconnect
     - ALSA: 6fire: fix use-after-free on disconnect
     - bcache: fix cached_dev.sb_bio use-after-free and crash
     - media: as102: fix to not free memory after the device is registered in
       as102_usb_probe()
     - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map
     - media: vidtv: fix pass-by-value structs causing MSAN warnings
     - media: hackrf: fix to not free memory after the device is registered in
       hackrf_probe()
     - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block()
     - ocfs2: validate inline data i_size during inode read
     - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
     - rxrpc: Fix key quota calculation for multitoken keys
     - PCI: Fix placement of pci_save_state() in pci_bus_add_device()
     - ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)
     - PCI: Revert "Enable ACS after configuring IOMMU for OF platforms"
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.84
     - mm/userfaultfd: fix hugetlb fault mutex hash calculation
     - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown
     - ima: verify if the segment size has changed
     - ima: do not copy measurement list to kdump kernel
     - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
     - [arm64] net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU
       registers
     - drm/amdgpu: replace PASID IDR with XArray
     - mm/pagewalk: fix race between concurrent split and refault
     - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger
     - scripts/dtc: Remove unused dts_version in dtc-lexer.l
     - rxrpc: only handle RESPONSE during service challenge
     - fs/ntfs3: validate rec->used in journal-replay file record check
     - f2fs: fix to avoid memory leak in f2fs_rename()
     - fuse: reject oversized dirents in page cache
     - fuse: Check for large folio with SPLICE_F_MOVE
     - fuse: quiet down complaints in fuse_conn_limit_write
     - ksmbd: require minimum ACE size in smb_check_perm_dacl()
     - smb: server: fix active_num_conn leak on transport allocation failure
     - smb: server: fix max_connections off-by-one in tcp accept path
     - smb: client: require a full NFS mode SID before reading mode bits
     - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
     - ksmbd: validate response sizes in ipc_validate_msg()
     - ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()
     - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
     - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
     - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()
     - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu
     - ALSA: caiaq: take a reference on the USB device in create_card()
     - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
     - [amd64] crypto: ccp: Don't attempt to copy CSR to userspace if PSP command
       failed
     - [amd64] crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP
       command failed
     - [amd64] crypto: ccp: Don't attempt to copy ID to userspace if PSP command
       failed
     - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.85
     - crypto: scatterwalk - Backport memcpy_sglist()
     - crypto: algif_aead - use memcpy_sglist() instead of null skcipher
     - crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)
     - crypto: algif_aead - snapshot IV for async AEAD requests
     - crypto: authenc - use memcpy_sglist() instead of null skcipher
     - crypto: authencesn - Do not place hiseq at end of dst for out-of-place
       decryption
     - crypto: authencesn - Fix src offset when decrypting in-place
     - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
     - xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
     - Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)
linux (6.12.85-1~bpo12+1) bookworm-backports; urgency=high
 .
   * Rebuild for bookworm-backports
 .
 linux (6.12.85-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.75
     - RDMA/siw: Fix potential NULL pointer dereference in header processing
     - RDMA/umad: Reject negative data_len in ib_umad_write
     - auxdisplay: arm-charlcd: fix release_mem_region() size
     - hfsplus: return error when node already exists in hfs_bnode_create
     - rcu: Refactor expedited handling check in rcu_read_unlock_special()
     - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler()
     - rcu: Fix rcu_read_unlock() deadloop due to softirq
     - audit: move the compat_xxx_class[] extern declarations to audit_arch.h
     - i3c: Move device name assignment after i3c_bus_init
     - fs: add <linux/init_task.h> for 'init_fs'
     - i3c: master: Update hot-join flag only on success
     - gfs2: Retries missing in gfs2_{rename,exchange}
     - gfs2: Fix slab-use-after-free in qd_put
     - gfs2: Fix use-after-free in iomap inline data write path
     - i3c: dw: Initialize spinlock to avoid upsetting lockdep
     - i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers()
     - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure
     - tpm: st33zp24: Fix missing cleanup on get_burstcount() error
     - erofs: get rid of raw bi_end_io() usage
     - erofs: handle end of filesystem properly for file-backed mounts
     - btrfs: qgroup: return correct error when deleting qgroup relation item
     - btrfs: fix block_group_tree dirty_list corruption
     - smb: client: fix potential UAF and double free in smb2_open_file()
     - block: add a bio_add_virt_nofail helper
     - rnbd-srv: use bio_add_virt_nofail
     - rnbd-srv: Fix server side setting of bi_size for special IOs
     - xen/virtio: Don't use grant-dma-ops when running as Dom0
     - io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED
     - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()
     - io_uring/sync: validate passed in offset
     - cpuidle: governors: menu: Always check timers with tick stopped
     - thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature
     - md/raid5: fix raid5_run() to return error when log_init() fails
     - md/raid10: fix any_working flag handling in raid10_sync_request
     - OPP: Return correct value in dev_pm_opp_get_level
     - cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id()
     - iomap: fix submission side handling of completion side errors
     - thermal/of: Fix reference leak in thermal_of_cm_lookup()
     - ublk: Validate SQE128 flag before accessing the cmd
     - Partial revert "x86/xen: fix balloon target initialization for PVH dom0"
     - md/raid1: fix memory leak in raid1_run() if no active rdev
     - md/raid1: fix memory leak in raid1_run()
     - PM: wakeup: Handle empty list in wakeup_sources_walk_start()
     - perf: arm_spe: Properly set hw.state on failures
     - cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not
       possible
     - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races
     - [s390x] cio: Fix device lifecycle handling in css_alloc_subchannel()
     - [amd64] perf/x86/core: Do not set bit width for unavailable counters
     - crypto: qat - fix warning on adf_pfvf_pf_proto.c
     - libbpf: Fix OOB read in btf_dump_get_bitfield_value
     - [armhf] VDSO: Patch out __vdso_clock_getres() if unavailable
     - [arm64] crypto: cavium - fix dma_free_coherent() size
     - bpf: Preserve id of register in sync_linked_regs()
     - hrtimer: Fix trace oddity
     - [amd64] crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls
     - [amd64] crypto: ccp - narrow scope of snp_range_list
     - bpf, sockmap: Fix incorrect copied_seq calculation
     - bpf, sockmap: Fix FIONREAD for sockmap
     - tracing: Add a comment about ftrace_regs definition
     - ftrace: Make ftrace_regs abstract from direct use
     - ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs
     - ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros
     - ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value
     - fgraph: Replace fgraph_ret_regs with ftrace_regs
     - tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs
     - tracing: Add ftrace_fill_perf_regs() for perf event
     - [amd64] x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return
       probe
     - [amd64] x86/fgraph,bpf: Switch kprobe_multi program stack unwind to
       hw_regs path
     - [arm64] crypto: caam - fix netdev memory leak in dpaa2_caam_probe
     - bpf: Fix bpf_xdp_store_bytes proto for read-only arg
     - genirq: Set IRQF_COND_ONESHOT in devm_request_irq().
     - [amd64] platform/x86: int0002: Remove IRQF_ONESHOT from request_irq()
     - Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler
     - scsi: efct: Use IRQF_ONESHOT and default primary handler
     - EDAC/altera: Remove IRQF_ONESHOT
     - mfd: wm8350-core: Use IRQF_ONESHOT
     - media: pci: mg4b: Use IRQF_NO_THREAD
     - sched/deadline: Clear the defer params
     - sched/rt: Skip currently executing CPU in rto_next_cpu()
     - hwrng: core - Allow runtime disabling of the HW RNG
     - hwrng: core - use RCU and work_struct to fix race condition
     - pstore/ram: fix buffer overflow in persistent_ram_save_old()
     - soc: qcom: smem: handle ENOMEM error during probe
     - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size()
     - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size()
     - firmware: arm_ffa: Correct 32-bit response handling in
       NOTIFICATION_INFO_GET
     - [arm64] dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings
     - [arm64] dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings
     - [arm64] clk: qcom: Return correct error code in qcom_cc_probe_by_index()
     - [arm64] dts: qcom: sdm630: fix gpu_speed_bin size
     - [arm64] dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on
     - [arm64] dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on
     - [arm64] dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks
     - [arm64] dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of
       AD7147
     - [armhf] dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property
     - [powerpc*] uaccess: Move barrier_nospec() out of
       allow_read_{from/write}_user()
     - [arm64] soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in
       cmd_db_dev_probe
     - [arm64] soc: mediatek: svs: Fix memory leak in svs_enable_debug_write()
     - [powerpc*] eeh: fix recursive pci_lock_rescan_remove locking in EEH event
       handling
     - [arm64] dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node
     - [arm64] dts: amlogic: s4: assign mmc b clock to 24MHz
     - [arm64] dts: amlogic: s4: fix mmc clock assignment
     - [arm64] dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order
     - [arm64] dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog
       instances for j784s4
     - hwspinlock: omap: Handle devm_pm_runtime_enable() errors
     - [arm64] dts: amlogic: c3: assign the MMC signal clocks
     - [arm64] dts: amlogic: axg: assign the MMC signal clocks
     - [arm64] dts: amlogic: gx: assign the MMC signal clocks
     - [arm64] dts: amlogic: g12: assign the MMC B and C signal clocks
     - [arm64] dts: amlogic: g12: assign the MMC A signal clock
     - [arm64] dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm
     - [arm64] dts: qcom: sdm845-db845c: drop CS from SPIO0
     - [arm64] dts: qcom: sdm845-db845c: specify power for WiFi CH1
     - [arm64] dts: qcom: x1e: bus is 40-bits (fix 64GB models)
     - [arm64] dts: qcom: agatti: Add CX_MEM/DBGC GPU regions
     - [arm64] dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions
     - [arm64] drm/panthor: Recover from panthor_gpu_flush_caches() failures
     - [arm64] drm/panthor: Fix the full_tick check
     - [arm64] drm/panthor: Fix the group priority rotation logic
     - [arm64] drm/panthor: Fix immediate ticking on a disabled tick
     - [arm64] drm/panthor: Fix the logic that decides when to stop ticking
     - [arm64] drm/panthor: Make sure we resume the tick when new jobs are
       submitted
     - workqueue: Factor out assign_rescuer_work()
     - workqueue: Only assign rescuer work when really needed
     - workqueue: Process rescuer work items one-by-one using a cursor
     - drm/panel: sw43408: Remove manual invocation of unprepare at remove
     - ALSA: pcm: use new array-copying-wrapper
     - ALSA: pcm: Relax __free() variable declarations
     - ALSA: vmaster: Relax __free() variable declarations
     - [arm64] drm/panthor: Evict groups before VM termination
     - [amd64] ASoC: nau8821: Consistently clear interrupts before unmasking
     - [amd64] ASoC: nau8821: Avoid unnecessary blocking in IRQ handler
     - [amd64] ASoC: nau8821: Fixup nau8821_enable_jack_detect()
     - media: chips-media: wave5: Fix memory leak on codec_info allocation
       failure
     - drm/amd: Drop "amdgpu kernel modesetting enabled" message
     - drm/amdkfd: Fix signal_eviction_fence() bool return value
     - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init
     - [arm64] drm/msm/disp/dpu: add merge3d support for sc7280
     - [arm64] drm/msm/dpu: Set vsync source irrespective of mdp top support
     - [arm64] drm/msm/dpu: fix WD timer handling on DPU 8.x
     - regulator: core: move supply check earlier in set_machine_constraints()
     - HID: playstation: Add missing check for input_ff_create_memless
     - [arm64] drm/msm/disp: set num_planes to 1 for interleaved YUV formats
     - [arm64] drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x
     - media: ccs: Accommodate C-PHY into the calculation
     - [arm64] drm/msm/a2xx: fix pixel shader start on A225
     - drm/buddy: release free_trees array on buddy mm teardown
     - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev
     - media: uvcvideo: Fix allocation for small frame sizes
     - evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac()
     - drm/xe: Unregister drm device on probe error
     - platform/chrome: cros_ec_lightbar: Fix response size initialization
     - HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients
     - spi: tools: Add include folder to .gitignore
     - Revert "hwmon: (ibmpex) fix use-after-free in high/low store"
     - hwmon: pmbus: mpq8785: Prepare driver for multiple device support
     - hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio
       configuration
     - hwmon: pmbus: mpq8785: Add support for MPM82504
     - hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification
     - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails
     - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors
     - PCI/PM: Avoid redundant delays on D3hot->D3cold
     - wifi: cfg80211: Fix use_for flag update on BSS refresh
     - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails
     - docs: fix WARNING document not included in any toctree
     - Documentation: trace: Refactor toctree
     - Documentation: tracing: Add PCI tracepoint documentation
     - PCI: Do not attempt to set ExtTag for VFs
     - PCI/portdrv: Fix potential resource leak
     - dm: fix unlocked test for dm_suspended_md
     - dm: use READ_ONCE in dm_blk_report_zones
     - quota: fix livelock between quotactl and freeze_super
     - net: mctp-i2c: fix duplicate reception of old data
     - mctp i2c: initialise event handler read bytes
     - wifi: cfg80211: stop NAN and P2P in cfg80211_leave
     - netfilter: nf_tables: reset table validation state on abort
     - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH
     - netfilter: nf_conncount: increase the connection clean up limit to 64
     - netfilter: nft_compat: add more restrictions on netlink attributes
     - netfilter: nf_conncount: fix tracking of connections from localhost
     - module: add helper function for reading module_buildid()
     - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup()
     - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken
     - [amd64] iommu/vt-d: Flush cache for PASID table before using it
     - [amd64] iommu/vt-d: Separate page request queue from SVM
     - [amd64] iommu/vt-d: Drain PRQs when domain removed from RID
     - [amd64] iommu/vt-d: Avoid draining PRQ in sva mm release path
     - [amd64] iommu/vt-d: Clear Present bit before tearing down PASID entry
     - dm: use bio_clone_blkg_association
     - xdrgen: Fix struct prefix for typedef types in program wrappers
     - NFS: NFSERR_INVAL is not defined by NFSv2
     - xdrgen: Initialize data pointer for zero-length items
     - nfsd: never defer requests during idmap lookup
     - fat: avoid parent link count underflow in rmdir
     - tcp: tcp_tx_timestamp() must look at the rtx queue
     - PCI: Check parent for NULL in of_pci_bus_release_domain_nr()
     - wifi: ath10k: sdio: add missing lock protection in
       ath10k_sdio_fw_crashed_dump()
     - PCI: Initialize RCB from pci_configure_device()
     - PCI: Add defines for bridge window indexing
     - PCI/ACPI: Restrict program_hpx_type2() to AER bits
     - ipc: don't audit capability check in ipc_permissions()
     - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit()
     - mptcp: fix receive space timestamp initialization
     - octeontx2-af: Fix PF driver crash with kexec kernel booting
     - bonding: only set speed/duplex to unknown, if getting speed failed
     - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
     - nfc: hci: shdlc: Stop timers and work before freeing context
     - netfilter: nfnetlink_queue: optimize verdict lookup with hash table
     - netfilter: nfnetlink_queue: do shared-unconfirmed check before
       segmentation
     - netfilter: nft_set_hash: fix get operation on big endian
     - netfilter: nft_counter: fix reset of counters on 32bit archs
     - netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null
       interval
     - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets
     - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404]
     - [arm64] net: hns3: fix double free issue for tx spare buffer
     - procfs: fix missing RCU protection when reading real_parent in
       do_task_stat()
     - smb: client: correct value for smbd_max_fragmented_recv_size
     - net: atm: fix crash due to unvalidated vcc pointer in sigd_send()
     - net: sunhme: Fix sbus regression
     - net: Add skb_dstref_steal and skb_dstref_restore
     - net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input
       callers
     - xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path
     - serial: caif: fix use-after-free in caif_serial ldisc_close()
     - octeon_ep: disable per ring interrupts
     - octeon_ep: ensure dbell BADDR updation
     - octeon_ep_vf: ensure dbell BADDR updation
     - ionic: Rate limit unknown xcvr type messages
     - octeontx2-pf: Unregister devlink on probe failure
     - RDMA/rtrs: server: remove dead code
     - IB/cache: update gid cache on client reregister event
     - RDMA/hns: Fix WQ_MEM_RECLAIM warning
     - RDMA/hns: Fix RoCEv1 failure due to DSCP
     - RDMA/hns: Notify ULP of remaining soft-WCs during reset
     - power: supply: ab8500: Fix use-after-free in power_supply_changed()
     - power: supply: act8945a: Fix use-after-free in power_supply_changed()
     - power: supply: bq256xx: Fix use-after-free in power_supply_changed()
     - power: supply: bq25980: Fix use-after-free in power_supply_changed()
     - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed()
     - power: supply: goldfish: Fix use-after-free in power_supply_changed()
     - power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed()
     - power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed()
     - power: supply: rt9455: Fix use-after-free in power_supply_changed()
     - power: supply: sbs-battery: Fix use-after-free in power_supply_changed()
     - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write
     - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported
     - power: supply: wm97xx: Fix NULL pointer dereference in
       power_supply_changed()
     - RDMA/rtrs-srv: fix SG mapping
     - RDMA/rxe: Fix double free in rxe_srq_from_init
     - RDMA/iwcm: Fix workqueue list corruption by removing work_list
     - tools/power/x86/intel-speed-select: Fix file descriptor leak in
       isolate_cpus()
     - RDMA/mlx5: Fix UMR hang in LAG error state unload
     - IB/mlx5: Fix port speed query for representors
     - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper
     - vfio/pci: Lock upstream bridge for vfio_pci_core_disable()
     - [amd64] platform/x86/amd/pmf: Prevent TEE errors after hibernate
     - [amd64] crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails
     - [amd64] crypto: ccp - Add an S4 restore flow
     - [amd64] crypto: ccp - Factor out ring destroy handling to a helper
     - [amd64] crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when
       PSP_CMD_TEE_RING_INIT fails
     - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse()
     - nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx
     - NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit
     - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send
     - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler
     - RDMA/rxe: Fix race condition in QP timer handlers
     - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing
     - cxl: Fix premature commit_end increment on decoder commit failure
     - mtd: parsers: ofpart: fix OF node refcount leak in
       parse_fixed_partitions()
     - mtd: spinand: Fix kernel doc
     - power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler
     - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer
     - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc
     - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN
     - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()
     - scsi: ufs: host: mediatek: Require CONFIG_PM
     - scsi: csiostor: Fix dereference of null pointer rn
     - nvdimm: virtio_pmem: serialize flush requests
     - fs/nfs: Fix readdir slow-start regression
     - tracing: Properly process error handling in event_hist_trigger_parse()
     - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros
     - fbdev: of_display_timing: Fix device node reference leak in
       of_get_display_timings()
     - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()
     - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs
     - clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs
     - clk: qcom: rcg2: compute 2d using duty fraction directly
     - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs
     - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc
     - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc
     - clk: qcom: gcc-ipq5018: flag sleep clock as critical
     - clk: Move clk_{save,restore}_context() to COMMON_CLK section
     - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks
     - clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src
     - clk: qcom: gfx3d: add parent to parent request map
     - clk: mediatek: Fix error handling in runtime PM setup
     - interconnect: mediatek: Don't hijack parent device
     - interconnect: mediatek: Aggregate bandwidth with saturating add
     - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX
     - dma: dma-axi-dmac: fix SW cyclic transfers
     - dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue
     - soundwire: intel_ace2x: add SND_HDA_CORE dependency
     - iio: test: drop dangling symbol in gain-time-scale helpers
     - staging: greybus: lights: avoid NULL deref
     - serial: imx: change SERIAL_IMX_CONSOLE to bool
     - serial: SH_SCI: improve "DMA support" prompt
     - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms
     - iio: pressure: mprls0025pa: fix spi_transfer struct initialisation
     - iio: pressure: mprls0025pa: fix SPI CS delay violation
     - iio: pressure: mprls0025pa: fix interrupt flag
     - iio: pressure: mprls0025pa: fix scan_type struct
     - iio: pressure: mprls0025pa: fix pressure calculation
     - watchdog: starfive-wdt: Fix PM reference leak in probe error path
     - coresight: etm3x: Fix cpulocked warning on cpuhp
     - phy: freescale: imx8qm-hsio: fix NULL pointer dereference
     - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms"
     - mfd: arizona: Fix regulator resource leak on
       wm5102_clear_write_sequencer() failure
     - mfd: simple-mfd-i2c: Add MAX77705 support
     - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA
     - mfd: simple-mfd-i2c: Add SpacemiT P1 support
     - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order
     - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support
     - drivers: iio: mpu3050: use dev_err_probe for regulator request
     - usb: bdc: fix sleep during atomic
     - pinctrl: equilibrium: Fix device node reference leak in pinbank_init()
     - ovl: Fix uninit-value in ovl_fill_real
     - iio: sca3000: Fix a resource leak in sca3000_probe()
     - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition
     - pinctrl: single: fix refcount leak in pcs_add_gpio_func()
     - leds: qcom-lpg: Check the return value of regmap_bulk_write()
     - backlight: qcom-wled: Support ovp values for PMI8994
     - backlight: qcom-wled: Change PM8950 WLED configurations
     - dmaengine: fsl-edma: don't explicitly disable clocks in .remove()
     - drbd: always set BLK_FEAT_STABLE_WRITES
     - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data
     - fs/ntfs3: Initialize new folios before use
     - fs/ntfs3: prevent infinite loops caused by the next valid being the same
     - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot
     - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs
     - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check
     - kbuild: Add objtool to top-level clean target
     - objpool: fix the overestimation of object pooling metadata size
     - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO
     - cpuidle: Skip governor when only one idle state is available
     - net: sparx5/lan969x: fix DWRR cost max to match hardware register width
     - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper
     - net: mscc: ocelot: split xmit into FDMA and register injection paths
     - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()
     - ipv6: Fix out-of-bound access in fib6_add_rt2node().
     - net: sparx5/lan969x: fix PTP clock max_adj value
     - net: usb: catc: enable basic endpoint checking
     - xen-netback: reject zero-queue configuration from guest
     - net/rds: rds_sendmsg should not discard payload_len
     - net: bridge: mcast: always update mdb_n_entries for vlan contexts
     - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value
     - ipvs: do not keep dest_dst if dev is going down
     - net: remove WARN_ON_ONCE when accessing forward path array
     - netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
       (CVE-2026-23231)
     - ipv6: fix a race in ip6_sock_set_v6only()
     - bpftool: Fix truncated netlink dumps
     - ping: annotate data-races in ping_lookup()
     - macvlan: observe an RCU grace period in macvlan_common_newlink() error
       path
     - icmp: prevent possible overflow in icmp_global_allow()
     - inet: move icmp_global_{credit,stamp} to a separate cache line
     - octeontx2-af: Fix default entries mcam entry action
     - bonding: alb: fix UAF in rlb_arp_recv during bond up/down
     - net/mlx5: Fix multiport device check over light SFs
     - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels
     - apparmor: fix NULL sock in aa_sock_file_perm
     - AppArmor: Allow apparmor to handle unaligned dfa tables
     - apparmor: Fix & Optimize table creation from possibly unaligned memory
     - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure
     - apparmor: fix rlimit for posix cpu timers
     - apparmor: remove apply_modes_to_perms from label_match
     - apparmor: make label_match return a consistent value
     - apparmor: avoid per-cpu hold underflow in aa_get_buffer
     - apparmor: fix invalid deref of rawdata when export_binary is unset
     - apparmor: fix aa_label to return state from compount and component match
     - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()
     - drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()
     - drm/amdgpu: Fix memory leak in amdgpu_ras_init()
     - ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put()
     - [amd64] drm/i915/acpi: free _DSM package when no connectors
     - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init
     - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2
     - drm/amd/display: Reject cursor plane on DCE when scaled differently than
       primary
     - drm/amd/display: Fix out-of-bounds stream encoder index v3
     - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe()
     - [s390x] kexec: Make KEXEC_SIG available when CONFIG_MODULES=n
     - drm/xe: Move forcewake to 'gt.pm' substructure
     - drm/xe: Create dedicated xe_mmio structure
     - drm/xe: Clarify size of MMIO region
     - drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio'
     - drm/xe: Populate GT's mmio iomap from tile during init
     - drm/xe: Switch mmio_ext to use 'struct xe_mmio'
     - drm/xe: Add xe_tile backpointer to xe_mmio
     - drm/xe: Adjust mmio code to pass VF substructure to SRIOV code
     - drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt
     - drm/xe/mmio: Avoid double-adjust in 64-bit reads
     - drm/xe/ptl: Apply Wa_13011645652
     - drm/xe/xe2_hpg: Add set of workarounds
     - drm/xe/xe2_hpg: Fix handling of Wa_14019988906 & Wa_14019877138
     - efi: Fix reservation of unaccepted memory table
     - btrfs: use the correct type to initialize block reserve for delayed refs
     - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not
       found
     - [amd64] x86/hyperv: Fix error pointer dereference
     - [arm64] ASoC: rockchip: i2s-tdm: Use param rate if not provided by
       set_sysclk
     - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats
     - ext4: subdivide EXT4_EXT_DATA_VALID1
     - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1
     - ext4: don't cache extent during splitting extent
     - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout
     - ext4: drop extent cache when splitting extent fails
     - ext4: fix memory leak in ext4_ext_shift_extents()
     - ext4: fix e4b bitmap inconsistency reports
     - ext4: fix dirtyclusters double decrement on fs shutdown
     - ext4: use optimized mballoc scanning regardless of inode format
     - ata: pata_ftide010: Fix some DMA timings
     - ata: libata-scsi: refactor ata_scsi_translate()
     - Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT
     - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths
     - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path
     - dt-bindings: phy: qcom-edp: Add missing clock for X Elite
     - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false
     - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names
     - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names
     - perf test stat: Update test expectations and events
     - perf test stat tests: Fix for virtualized machines
     - perf unwind-libdw: Fix invalid reference counts
     - perf callchain: Fix srcline printing with inlines
     - libsubcmd: Fix null intersection case in exclude_cmds()
     - perf maps: Fix reference count leak in maps__find_ams()
     - perf annotate: Fix memcpy size in arch__grow_instructions()
     - perf vendor events amd: Fix Zen 5 MAB allocation events
     - libperf: Don't remove -g when EXTRA_CFLAGS are used
     - libperf build: Always place libperf includes first
     - rtc: interface: Alarm race handling should not discard preceding error
     - statmount: permission check should return EPERM
     - audit: add fchmodat2() to change attributes class
     - hfsplus: fix volume corruption issue for generic/498
     - fs/buffer: add alert in try_to_free_buffers() for folios without buffers
     - audit: add missing syscalls to read class
     - hfsplus: pretend special inodes as regular files
     - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr()
     - i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init
     - minix: Add required sanity checking to minix_check_superblock()
     - dlm: validate length in dlm_search_rsb_tree
     - btrfs: fallback to buffered IO if the data profile has duplication
     - btrfs: handle user interrupt properly in btrfs_trim_fs()
     - smb: client: add proper locking around ses->iface_last_update
     - gfs2: fiemap page fault fix
     - smb: client: prevent races in ->query_interfaces()
     - tools/power cpupower: Reset errno before strtoull()
     - [s390x] purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
     - [arm64] Add support for TSV110 Spectre-BHB mitigation
     - rnbd-srv: Zero the rsp buffer before using it
     - [amd64] x86/xen/pvh: Enable PAE mode for 32-bit guest only when
       CONFIG_X86_PAE is set
     - EFI/CPER: don't dump the entire memory region
     - APEI/GHES: ensure that won't go past CPER allocated record
     - APEI/GHES: ARM processor Error: don't go past allocated memory
     - EFI/CPER: don't go past the ARM processor CPER record buffer
     - ACPI: processor: Fix NULL-pointer dereference in
       acpi_processor_errata_piix4()
     - ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[]
     - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP
     - powercap: intel_rapl: Add PL4 support for Ice Lake
     - alpha: fix user-space corruption during memory compaction
     - md-cluster: fix NULL pointer dereference in process_metadata_update
     - cpufreq: dt-platdev: Block the driver from probing on more QC platforms
     - [s390x] perf: Disable register readout on sampling events
     - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD
     - ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display)
     - ACPI: battery: fix incorrect charging status when current is zero
     - xenbus: Use .freeze/.thaw to handle xenbus devices
     - blk-mq-debugfs: add missing debugfs_mutex in
       blk_mq_debugfs_register_hctxs()
     - block: decouple secure erase size limit from discard size limit
     - bpf: verifier improvement in 32bit shift sign extension pattern
     - [amd64] perf/x86/msr: Add Airmont NP
     - [amd64] perf/x86/cstate: Add Airmont NP
     - bpf: crypto: Use the correct destructor kfunc type
     - bpf: Recognize special arithmetic shift in the verifier
     - clocksource/drivers/sh_tmu: Always leave device running after probe
     - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on
       OF
     - PCI/MSI: Unmap MSI-X region on error
     - crypto: hisilicon/qm - move the barrier before writing to the mailbox
       register
     - mailbox: bcm-ferxrm-mailbox: Use default primary handler
     - char: tpm: cr50: Remove IRQF_ONESHOT
     - sched/debug: Fix updating of ppos on server write ops
     - pstore: ram_core: fix incorrect success return when vmap() fails
     - firmware: arm_ffa: Unmap Rx/Tx buffers on init failure
     - [arm64] Revert "arm64: zynqmp: Add an OP-TEE node to the device tree"
     - [arm64] tegra: smaug: Add usb-role-switch support
     - drm/display/dp_mst: Add protection against 0 vcpi
     - gpu/panel-edp: add AUO panel entry for B140HAN06.4
     - drm/amdgpu: fix NULL pointer issue buffer funcs
     - drm/amdkfd: Handle GPU reset and drain retry fault race
     - spi-geni-qcom: initialize mode related registers to 0
     - spi-geni-qcom: use xfer->bits_per_word for can_dma()
     - drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32
     - [amd64] ASoC: SOF: ipc4: Support for sending payload along with
       LARGE_CONFIG_GET
     - media: dvb-core: dmxdevfilter must always flush bufs
     - spi: stm32: fix Overrun issue at < 8bpw
     - drm/v3d: Set DMA segment size to avoid debug warnings
     - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes
     - media: omap3isp: isppreview: always clamp in preview_try_format()
     - media: omap3isp: set initial format
     - media: chips-media: wave5: Fix conditional in start_streaming
     - media: chips-media: wave5: Process ready frames when CMD_STOP sent to
       Encoder
     - media: mediatek: vcodec: Don't try to decode 422/444 VP9
     - drm/amdgpu: add support for HDP IP version 6.1.1
     - drm/amd/display: Fix dsc eDP issue
     - drm/amdgpu: avoid a warning in timedout job handler
     - drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src
     - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards
     - drm/amdgpu: Skip loading SDMA_RS64 in VF
     - drm/amd/display: only power down dig on phy endpoints
     - drm/xe: Only toggle scheduling in TDR if GuC is running
     - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask
     - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug
     - spi: spi-mem: Limit octal DTR constraints to octal DTR situations
     - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START
     - drm/panel: Fix a possible null-pointer dereference in
       jdi_panel_dsi_remove()
     - media: adv7180: fix frame interval in progressive mode
     - media: pvrusb2: fix URB leak in pvr2_send_request_ex
     - media: solo6x10: Check for out of bounds chip_id
     - media: cx25821: Fix a resource leak in cx25821_dev_setup()
     - media: v4l2-async: Fix error handling on steps after finding a match
     - media: mt9m114: Avoid a reset low spike during probe()
     - media: mt9m114: Return -EPROBE_DEFER if no endpoint is found
     - media: ipu6: Ensure stream_mutex is acquired when dealing with node list
     - media: ipu6: Close firmware streams on streaming enable failure
     - media: ipu6: Always close firmware stream
     - ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk
     - drm/amdkfd: Relax size checking during queue buffer get
     - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map()
     - drm: Account property blob allocations to memcg
     - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed
     - virt: vbox: uapi: Mark inner unions in packed structs as packed
     - [amd64] ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to
       aggregated
     - PCI: Add Intel Nova Lake audio Device ID
     - drm/amd/display: Disable FEC when powering down encoders
     - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback
     - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional
       parts
     - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release
     - media: rkisp1: Fix filter mode register configuration
     - HID: multitouch: add eGalaxTouch EXC3188 support
     - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK
     - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro
     - ALSA: hda/realtek: fix LG Gram Style 14 speakers
     - gpio: aspeed-sgpio: Change the macro to support deferred probe
     - [arm64] ASoC: sunxi: sun50i-dmic: Add missing check for
       devm_regmap_init_mmio
     - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end
     - drm/amd/display: Fix GFX12 family constant checks
     - drm/amd/display: avoid dig reg access timeout on usb4 link training fail
     - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in
       max98390_i2c_probe()
     - hwmon: (dell-smm) Add support for Dell OptiPlex 7080
     - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE
     - hwmon: (f71882fg) Add F81968 support
     - HID: logitech-hidpp: Add support for Logitech K980
     - ASoC: es8328: Add error unwind in resume
     - modpost: Amend ppc64 save/restfpr symnames for -Os build
     - power: sequencing: fix missing state_lock in pwrseq_power_on() error path
     - [amd64] ASoC: SOF: Intel: hda: Fix NULL pointer dereference
     - spi: geni-qcom: Fix abort sequence execution for serial engine errors
     - ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe
     - ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx
     - ALSA: mixer: oss: Add card disconnect checkpoints
     - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio
     - jfs: Add missing set_freezable() for freezable kthread
     - jfs: nlink overflow in jfs_rename
     - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero
     - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()
     - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H
     - wifi: rtw89: 8922a: set random mac if efuse contains zeroes
     - wifi: rtw89: ser: enable error IMR after recovering from L1
     - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()
     - wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band
       data
     - dm: replace -EEXIST with -EBUSY
     - dm: remove fake timeout to avoid leak request
     - [arm64] iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency
     - net: wwan: mhi: Add network support for Foxconn T99W760
     - wifi: libertas: fix WARNING in usb_tx_block
     - [amd64] iommu/amd: move wait_on_sem() out of spinlock
     - wifi: rtw89: mac: correct page number for CSI response
     - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode
     - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1
     - wifi: ath11k: Fix failure to connect to a 6 GHz AP
     - wifi: ath12k: fix preferred hardware mode calculation
     - wifi: cfg80211: allow only one NAN interface, also in multi radio
     - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}()
     - ipv6: annotate data-races over sysctl.flowlabel_reflect
     - ipv6: exthdrs: annotate data-race over multiple sysctl
     - ext4: mark group add fast-commit ineligible
     - ext4: move ext4_percpu_param_init() before ext4_mb_init()
     - ext4: mark group extend fast-commit ineligible
     - ext4: use reserved metadata blocks when splitting extent on endio
     - netfilter: nf_conntrack: Add allow_clash to generic protocol handler
     - netfilter: xt_tcpmss: check remaining length before reading optlen
     - net: usb: r8152: fix transmit queue timeout
     - wifi: iwlwifi: mvm: check the validity of noa_len
     - wifi: rtw89: fix unable to receive probe responses under MLO connection
     - wifi: rtw89: 8922a: add digital compensation for 2GHz
     - net/rds: No shortcut out of RDS_CONN_ERROR
     - ext4: propagate flags to convert_initialized_extent()
     - gro: change the BUG_ON() in gro_pull_from_frag0()
     - ipv4: igmp: annotate data-races around idev->mr_maxdelay
     - [arm64] net: hns3: extend HCLGE_FD_AD_QID to 11 bits
     - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power()
     - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement()
     - ipv4: fib: Annotate access to struct fib_alias.fa_state.
     - Bluetooth: btusb: Add support for MediaTek7920 0489:e158
     - Bluetooth: hci_conn: Set link_policy on incoming ACL connections
     - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
     - Bluetooth: btusb: Add new VID/PID for RTL8852CE
     - Bluetooth: btusb: Add device ID for Realtek RTL8761BU
     - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky
     - net: sfp: add quirk for Lantech 8330-265D
     - wifi: rtw89: pci: restore LDO setting after device resume
     - wifi: ath10k: fix lock protection in
       ath10k_wmi_event_peer_sta_ps_state_chg()
     - bnxt_en: Allow ntuple filters for drops
     - net: usb: sr9700: remove code to drive nonexistent multicast filter
     - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16
     - net/rds: Clear reconnect pending bit
     - PCI: Mark ASM1164 SATA controller to avoid bus reset
     - PCI/AER: Clear stale errors on reporting agents upon probe
     - PCI: Fix pci_slot_lock () device locking
     - PCI: Enable ACS after configuring IOMMU for OF platforms
     - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur
     - PCI: Mark Nvidia GB10 to avoid bus reset
     - myri10ge: avoid uninitialized variable use
     - nfc: nxp-nci: remove interrupt trigger type
     - RDMA/rtrs-clt: For conn rejection use actual err number
     - ata: libata: avoid long timeouts on hot-unplugged SATA DAS
     - hisi_acc_vfio_pci: update status after RAS error
     - scsi: buslogic: Reduce stack usage
     - vhost: fix caching attributes of MMIO regions by setting them explicitly
     - scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event
     - [riscv64] vector: init vector context with proper vlenb
     - tracing: Fix false sharing in hwlat get_sample()
     - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX
       channel is uninitialized
     - mailbox: pcc: Remove spurious IRQF_ONESHOT usage
     - mailbox: imx: Skip the suspend flag for i.MX7ULP
     - mailbox: sprd: mask interrupts that are not handled
     - remoteproc: mediatek: Break lock dependency to `prepare_lock`
     - mailbox: sprd: clear delivery flag before handling TX done
     - clk: microchip: core: correct return value on *_get_parent()
     - HID: i2c-hid: Add FocalTech FT8112
     - 9p/xen: protect xen_9pfs_front_free against concurrent calls
     - dmaengine: stm32-dma3: use module_platform_driver
     - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15)
     - soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list
     - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure
     - serial: 8250_dw: handle clock enable errors in runtime_resume
     - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs
     - fpga: of-fpga-region: Fail if any bridge is missing
     - most: core: fix resource leak in most_register_interface error paths
     - dmaengine: sun6i: Choose appropriate burst length under maxburst
     - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings
     - phy: ti: phy-j721e-wiz: restore mux selection during resume
     - phy: cadence-torrent: restore parent clock for refclk during resume
     - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()
     - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66
     - usb: gadget: f_fs: fix DMA-BUF OUT queues
     - usb: gadget: f_fs: Fix ioctl error handling
     - usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()
     - staging: rtl8723bs: fix memory leak on failure path
     - serial: 8250: 8250_omap.c: Add support for handling UART error conditions
     - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA
       termination is done
     - fix it87_wdt early reboot by reporting running timer
     - [arm*] binder: don't use %pK through printk
     - watchdog: imx7ulp_wdt: handle the nowayout option
     - phy: mvebu-cp110-utmi: fix dr_mode property read from dts
     - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature
     - Revert "mfd: da9052-spi: Change read-mask to write-mask"
     - mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs
     - iio: Use IRQF_NO_THREAD
     - iio: magnetometer: Remove IRQF_ONESHOT
     - fs: ntfs3: check return value of indx_find to avoid infinite loop
     - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent
       metadata
     - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST
     - fs/ntfs3: drop preallocated clusters for sparse and compressed files
     - fs/ntfs3: avoid calling run_get_entry() when run == NULL in
       ntfs_read_run_nb_ra()
     - ceph: supply snapshot context in ceph_uninline_data()
     - libceph: define and enforce CEPH_MAX_KEY_LEN
     - thermal: int340x: Fix sysfs group leak on DLVR registration failure
     - [amd64] ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90
     - include: uapi: netfilter_bridge.h: Cover for musl libc
     - drm/amd/display: Fix writeback on DCN 3.2+
     - drm/amd/display: Fix system resume lag issue
     - drm/amd/display: Avoid updating surface with the same surface under MPO
     - drm/amdgpu: Adjust usleep_range in fence wait
     - ALSA: usb-audio: Update the number of packets properly at receiving
     - drm/amdgpu: Add HAINAN clock adjustment
     - drm/amd/display: bypass post csc for additional color spaces in dal
     - spi: spidev: fix lock inversion between spi_lock and buf_lock
     - drm/radeon: Add HAINAN clock adjustment
     - ALSA: usb-audio: Add sanity check for OOB writes at silencing
     - btrfs: replace BUG() with error handling in __btrfs_balance()
     - [arm64] hugetlbpage: avoid unused-but-set-parameter warning (gcc-16)
     - drm/amd/display: Remove conditional for shaper 3DLUT power-on
     - rtc: zynqmp: correct frequency value
     - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
     - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
     - xfrm6: fix uninitialized saddr in xfrm6_get_saddr()
     - xfrm: skip templates check for packet offload tunnel mode
     - ipmi: ipmb: initialise event handler read bytes
     - xfrm: always flush state and policy upon NETDEV_UNREGISTER event
     - espintcp: Fix race condition in espintcp_close() (CVE-2026-23239)
     - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
     - net: usb: lan78xx: scan all MDIO addresses on LAN7801
     - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set()
     - net: ethernet: xscale: Check for PTP support properly
     - bnxt_en: Fix RSS context delete logic
     - bnxt_en: Fix deleting of Ntuple filters
     - wifi: cfg80211: wext: fix IGTK key ID off-by-one
     - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option
     - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ
     - Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short
     - Bluetooth: hci_qca: Cleanup on all setup failures
     - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ
     - Bluetooth: L2CAP: Fix not checking output MTU is acceptable on
       L2CAP_ECRED_CONN_REQ
     - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
     - tls: Fix race condition in tls_sw_cancel_work_tx() (CVE-2026-23240)
     - kcm: fix zero-frag skb in frag_list on partial sendmsg error
     - tipc: fix duplicate publication key in tipc_service_insert_publ()
     - RDMA/core: Fix stale RoCE GIDs during netdev events at registration
     - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets
     - RDMA/efa: Fix typo in efa_alloc_mr()
     - net: usb: pegasus: enable basic endpoint checking
     - RDMA/umem: Fix double dma_buf_unpin in failure path
     - net/mlx5: DR, Fix circular locking dependency in dump
     - net/mlx5: E-switch, Clear legacy flag when moving to switchdev
     - net/mlx5: Fix missing devlink lock in SRIOV enable error path
     - net/mlx5e: Separate address related variables to be in struct
     - net/mlx5e: Support routed networks during IPsec MACs initialization
     - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query
     - net: consume xmit errors of GSO frames
     - dpaa2-switch: validate num_ifs to prevent out-of-bounds write
     - netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
     - rpmsg: core: fix race in driver_override_show() and use core helper
     - [arm64] clk: renesas: rzg2l: Fix intin variable size
     - [arm64] clk: renesas: rzg2l: Select correct div round macro
     - [amd64] ASoC: SOF: ipc4-control: If there is no data do not send bytes
       update
     - [amd64] ASoC: SOF: ipc4-topology: Correct the allocation size for bytes
       controls
     - [amd64] ASoC: SOF: ipc4-control: Use the correct size for
       scontrol->ipc_control_data
     - [amd64] ASoC: SOF: ipc4-control: Keep the payload size up to date
     - fpga: dfl: use subsys_initcall to allow built-in drivers to be added
     - Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global
       IRQ' is supported"
     - phy: qcom: edp: Make the number of clocks flexible
     - dm-verity: correctly handle dm_bufio_client_create() failure
     - media: mediatek: encoder: Fix uninitialized scalar variable issue
     - media: mtk-mdp: Fix error handling in probe function
     - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove()
     - media: chips-media: wave5: Fix kthread worker destruction in polling mode
     - media: chips-media: wave5: Fix device cleanup order to prevent kernel
       panic
     - media: verisilicon: AV1: Fix enable cdef computation
     - media: verisilicon: AV1: Fix tx mode bit setting
     - [arm64] dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs
     - [armhf] omap2: Fix reference count leaks in omap_control_init()
     - [amd64] KVM: x86: Return "unsupported" instead of "invalid" on access to
       unsupported PV MSR
     - [amd64] KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3()
       succeeding
     - [arm64] Disable branch profiling for all arm64 code
     - HID: hid-pl: handle probe errors
     - HID: magicmouse: Do not crash on missing msc->input
     - HID: prodikeys: Check presence of pm->input_ep82
     - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()
     - [arm64] dts: apple: t8112-j473: Keep the HDMI port powered on
     - media: amphion: Drop min_queued_buffers assignment
     - media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init()
     - media: verisilicon: AV1: Set IDR flag for intra_only frame type
     - media: radio-keene: fix memory leak in error path
     - media: cx88: Add missing unmap in snd_cx88_hw_params()
     - media: cx23885: Add missing unmap in snd_cx23885_hw_params()
     - media: cx25821: Add missing unmap in snd_cx25821_hw_params()
     - media: i2c/tw9903: Fix potential memory leak in tw9903_probe()
     - media: i2c/tw9906: Fix potential memory leak in tw9906_probe()
     - media: i2c: ov01a10: Fix the horizontal flip control
     - media: i2c: ov01a10: Fix reported pixel-rate value
     - media: i2c: ov01a10: Fix analogue gain range
     - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls
     - media: i2c: ov01a10: Fix passing stream instead of pad to
       v4l2_subdev_state_get_format()
     - media: i2c: ov01a10: Fix test-pattern disabling
     - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()
     - media: ccs: Avoid possible division by zero
     - media: i2c: ov5647: Initialize subdev before controls
     - media: i2c: ov5647: Correct pixel array offset
     - media: i2c: ov5647: Correct minimum VBLANK value
     - media: i2c: ov5647: Sensor should report RAW color space
     - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode
     - media: ccs: Fix setting initial sub-device state
     - media: i2c: ov5647: use our own mutex for the ctrl lock
     - media: ipu6: Fix typo and wrong constant in ipu6-mmu.c
     - media: ipu6: Fix RPM reference leak in probe error paths
     - [amd64] platform/x86: ISST: Add missing write block check
     - dm-integrity: fix a typo in the code for write/discard race
     - dm: clear cloned request bio pointer when last clone bio completes
     - [arm64] soc: ti: k3-socinfo: Fix regmap leak on probe failure
     - [arm64] soc: ti: pruss: Fix double free in pruss_clk_mux_setup()
     - [amd64] KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
     - bus: omap-ocp2scp: fix OF populate on driver rebind
     - clk: clk-apple-nco: Add "apple,t8103-nco" compatible
     - [arm64,armhf] soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON
       definition
     - [arm64,armhf] soc: rockchip: grf: Support multiple grf to be handled
     - media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop
     - media: i2c: ov01a10: Fix digital gain range
     - clk: tegra: tegra124-emc: Fix potential memory leak in
       tegra124_clk_register_emc()
     - [s390x] pci: Handle futile config accesses of disabled devices directly
     - reset: gpio: suppress bind attributes in sysfs
     - dm-integrity: fix recalculation in bitmap mode
     - dm-unstripe: fix mapping bug when there are multiple targets in a table
     - [arm64] dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro
     - media: venus: vdec: fix error state assignment for zero bytesused
     - media: venus: vdec: restrict EOS addr quirk to IRIS2 only
     - drm: of: drm_of_panel_bridge_remove(): fix device_node leak
     - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations
     - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs
     - drm/buddy: Prevent BUG_ON by validating rounded allocation
     - drm/bridge: anx7625: Fix invalid EDID size
     - xfs: mark data structures corrupt on EIO and ENODATA
     - xfs: remove xfs_attr_leaf_hasname
     - media: verisilicon: AV1: Fix tile info buffer size
     - [amd64] iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in
       scalable mode
     - mfd: core: Add locking around 'mfd_of_node_list'
     - mfd: qcom-pm8xxx: Fix OF populate on driver rebind
     - mfd: omap-usb-host: Fix OF populate on driver rebind
     - iio: accel: adxl380: Avoid reading more entries than present in FIFO
     - xfs: delete attr leaf freemap entries when empty
     - xfs: fix freemap adjustments when adding xattrs to leaf blocks
     - xfs: fix the xattr scrub to detect freemap/entries array collisions
     - xfs: fix remote xattr valuelblk check
     - [amd64] KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()
     - PCI: endpoint: Fix swapped parameters in
       pci_{primary/secondary}_epc_epf_unlink() functions
     - pinctrl: intel: Add code name documentation
     - xfs: only call xf{array,blob}_destroy if we have a valid pointer
     - xfs: check return value of xchk_scrub_create_subord
     - xfs: check for deleted cursors when revalidating two btrees
     - md/bitmap: fix GPF in write_page caused by resize race
     - nfsd: fix return error code for nfsd_map_name_to_[ug]id
     - nvmem: Drop OF node reference on nvmem_add_one_cell() failure
     - [amd64] x86/kexec: add a sanity check on previous kernel's ima kexec
       buffer
     - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node
     - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN
     - io_uring/net: don't continue send bundle if poll was required for retry
     - bus: fsl-mc: fix an error handling in fsl_mc_device_add()
     - dm mpath: make pg_init_delay_msecs settable
     - [arm64] poe: fix stale POR_EL0 values for ptrace
     - tools: Fix bitfield dependency failure
     - vhost: move vdpa group bound check to vhost_vdpa
     - [powerpc*] smp: Add check for kcalloc() failure in parse_thread_groups()
     - iio: gyro: itg3200: Fix unchecked return value in read_raw
     - mtd: spinand: Disable continuous read during probe
     - mm/highmem: fix __kmap_to_page() build error
     - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()
     - ocfs2: fix reflink preserve cleanup issue
     - kexec: derive purgatory entry from symbol
     - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling
       SR-IOV"
     - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug
     - [arm64] Fix non-atomic __READ_ONCE() with CONFIG_LTO=y
     - clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841
     - btrfs: continue trimming remaining devices on failure
     - remoteproc: imx_rproc: Fix invalid loaded resource table detection
     - perf/arm-cmn: Reject unsupported hardware configurations
     - scsi: ufs: core: Flush exception handling work when RPM level is zero
     - mm/slab: use unsigned long for orig_size to ensure proper metadata align
     - PCI: dwc: Fix msg_atu_index assignment
     - usb: dwc3: gadget: Move vbus draw to workqueue context
     - usb: dwc2: fix resume failure if dr_mode is host
     - mtd: rawnand: pl353: Fix software ECC support
     - tipc: fix RCU dereference race in tipc_aead_users_dec()
     - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
     - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error
       path
     - PCI: Fix pci_slot_trylock() error handling
     - staging: rtl8723bs: fix null dereference in find_network
     - kcsan, compiler_types: avoid duplicate type issues in BPF Type Format
     - watchdog/softlockup: fix sample ring index wrap in need_counting_irqs()
     - cifs: Fix locking usage for tcon fields
     - ceph: supply snapshot context in ceph_zero_partial_object()
     - rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0
     - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID
     - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean()
     - octeontx2-af: CGX: fix bitmap leaks
     - net: ti: icssg-prueth: Add optional dependency on HSR
     - net: macb: Fix tx/rx malfunction after phy link down and up
     - tracing: Fix to set write permission to per-cpu buffer_size_kb
     - io_uring/filetable: clamp alloc_hint to the configured alloc range
     - drm/amd/display: Increase DCN35 SR enter/exit latency
     - drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify
     - procfs: fix possible double mmput() in do_procmap_query()
     - net: intel: fix PCI device ID conflict between i40e and ipw2200
     - atm: fore200e: fix use-after-free in tasklets during device removal
     - function_graph: Restore direct mode when callbacks drop to one
     - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
     - mm: numa_memblks: Identify the accurate NUMA ID of CFMW
     - fbcon: check return value of con2fb_acquire_newinfo()
     - fbdev: vt8500lcdfb: fix missing dma_free_coherent()
     - fbdev: of: display_timing: fix refcount leak in of_get_display_timings()
     - fbdev: ffb: fix corrupted video output on Sun FFB1
     - fbcon: Remove struct fbcon_display.inverse
     - cifs: some missing initializations on replay
     - [amd64] ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR
     - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle
     - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash()
     - [amd64] x86/kexec: Copy ACPI root pointer address from config table
     - [arm64] Force the use of CNTVCT_EL0 in __delay()
     - drm/amdgpu: keep vga memory on MacBooks with switchable graphics
     - net: nfc: nci: Fix parameter validation for packet data
     - tracing: ring-buffer: Fix to check event length before using
     - fgraph: Do not call handlers direct when not using ftrace_ops
     - tracing: Fix checking of freed trace_event_file for hist files
     - tracing: Wake up poll waiters for hist files when removing an event
     - NTB: ntb_transport: Fix too small buffer for debugfs_name
     - ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl()
     - [amd64] drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros
     - xfs: fix copy-paste error in previous fix
     - [arm64] Fix sampling the "stable" virtual counter in preemptible section
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.76
     - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec
       buffer"
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.77
     - drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release
     - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
     - drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse()
     - [arm64] KVM: arm64: Hide S1POE from guests when not supported by the host
     - [riscv64] irqchip/sifive-plic: Fix frozen interrupt due to affinity
       setting
     - scsi: lpfc: Properly set WC for DPP mapping
     - scsi: pm8001: Fix use-after-free in pm8001_queue_command()
     - ALSA: scarlett2: Fix redeclaration of loop variable
     - ALSA: scarlett2: Fix DSP filter control array handling
     - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices
     - [amd64] x86/fred: Correct speculative safety in fred_extint()
     - rseq: Clarify rseq registration rseq_size bound check comment
     - cgroup/cpuset: Fix incorrect use of cpuset_update_tasks_cpumask() in
       update_cpumasks_hier()
     - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume
     - ALSA: usb-audio: Cap the packet size pre-calculations
     - ALSA: usb-audio: Use inclusive terms
     - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
     - [s390x] idle: Fix cpu idle exit cpu time accounting
     - [s390x] vtime: Fix virtual timer forwarding
     - PCI: endpoint: Introduce pci_epc_function_is_valid()
     - PCI: endpoint: Introduce pci_epc_mem_map()/unmap()
     - [arm64] PCI: dwc: endpoint: Implement the pci_epc_ops::align_addr()
       operation
     - [arm64] PCI: dwc: ep: Use align addr function for
       dw_pcie_ep_raise_{msi,msix}_irq()
     - [arm64] PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry
     - drm/amdgpu: Unlock a mutex before destroying it
     - drm/amdgpu: Replace kzalloc + copy_from_user with memdup_user
     - drm/amdgpu: Fix locking bugs in error paths
     - ALSA: pci: hda: use snd_kcontrol_chip()
     - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put()
     - btrfs: fix incorrect key offset in error message in
       check_dev_extent_item()
     - btrfs: fix objectid value in error message in check_extent_data_ref()
     - btrfs: fix warning in scrub_verify_one_metadata()
     - btrfs: print correct subvol num if active swapfile prevents deletion
     - btrfs: fix compat mask in error messages in btrfs_check_features()
     - [arm64] bpf, arm64: Force 8-byte alignment for JIT buffer to prevent
       atomic tearing
     - bpf: Fix stack-out-of-bounds write in devmap
     - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value
     - [amd64] x86/acpi/boot: Correct acpi_is_processor_usable() check again
     - [arm64] memory: mtk-smi: fix device leaks on common probe
     - [arm64] memory: mtk-smi: fix device leak on larb probe
     - resource: Add resource set range and size helpers
     - PCI: Use resource_set_range() that correctly sets ->end
     - media: tegra-video: Fix memory leak in __tegra_channel_try_format()
     - media: dw9714: move power sequences to dedicated functions
     - media: dw9714: add support for powerdown pin
     - media: dw9714: Fix powerup sequence
     - [amd64] KVM: x86: Ignore -EBUSY when checking nested events from
       vcpu_block()
     - ata: libata-scsi: Refactor ata_scsi_simulate()
     - ata: libata-scsi: Refactor ata_scsiop_read_cap()
     - ata: libata-scsi: Refactor ata_scsiop_maint_in()
     - ata: libata-scsi: Document all VPD page inquiry actors
     - ata: libata-scsi: Remove struct ata_scsi_args
     - ata: libata: Remove ATA_DFLAG_ZAC device flag
     - ata: libata: Introduce ata_port_eh_scheduled()
     - ata: libata-scsi: avoid Non-NCQ command starvation
     - [arm64,armhf] drm/tegra: dsi: fix device leak on probe
     - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT
     - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting
       I/O
     - mailbox: don't protect of_parse_phandle_with_args with con_mutex
     - mailbox: sort headers alphabetically
     - mailbox: remove unused header files
     - mailbox: Use dev_err when there is error
     - mailbox: Use guard/scoped_guard for con_mutex
     - mailbox: Allow controller specific mapping using fwnode
     - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
     - ext4: add ext4_try_lock_group() to skip busy groups
     - ext4: factor out __ext4_mb_scan_group()
     - ext4: factor out ext4_mb_might_prefetch()
     - ext4: factor out ext4_mb_scan_group()
     - ext4: convert free groups order lists to xarrays
     - ext4: refactor choose group to scan group
     - ext4: implement linear-like traversal across order xarrays
     - ext4: always allocate blocks only from groups inode can use
     - workqueue: Add system_percpu_wq and system_dfl_wq
     - Input: synaptics_i2c - replace use of system_wq with system_dfl_wq
     - Input: synaptics_i2c - guard polling restart in resume
     - [amd64] iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device
       without scalable mode
     - [arm64] dts: rockchip: Fix rk356x PCIe range mappings
     - [arm64] dts: rockchip: Fix rk3588 PCIe range mappings
     - [armhf] clk: tegra: tegra124-emc: fix device leak on set_rate()
     - ima: kexec: silence RCU list traversal warning
     - ima: rename variable the seq_file "file" to "ima_kexec_file"
     - ima: define and call ima_alloc_kexec_file_buf()
     - kexec: define functions to map and unmap segments
     - ima: kexec: define functions to copy IMA log at soft boot
     - ima: verify the previous kernel's IMA buffer lies in addressable RAM
     - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range()
     - drm/exynos: vidi: fix to avoid directly dereferencing user pointer
     - drm/exynos/vidi: Remove redundant error handling in vidi_get_modes()
     - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member
       variables related to memory alloc/free (CVE-2026-23227)
     - uprobes: switch to RCU Tasks Trace flavor for better performance
     - uprobes: Fix incorrect lockdep condition in filter_chain()
     - btrfs: drop unused parameter fs_info from do_reclaim_sweep()
     - btrfs: get used bytes while holding lock at btrfs_reclaim_bgs_work()
     - btrfs: fix reclaimed bytes accounting after automatic block group reclaim
     - btrfs: fix periodic reclaim condition
     - btrfs: zoned: fix alloc_offset calculation for partly conventional block
       groups
     - btrfs: zoned: fixup last alloc pointer after extent removal for RAID1
     - btrfs: zoned: fixup last alloc pointer after extent removal for DUP
     - btrfs: zoned: fix stripe width calculation
     - btrfs: define the AUTO_KFREE/AUTO_KVFREE helper macros
     - btrfs: zoned: fixup last alloc pointer after extent removal for RAID0/10
     - [riscv64] usb: cdns3: remove redundant if branch
     - [riscv64] usb: cdns3: call cdns_power_is_lost() only once in cdns_resume()
     - [riscv64] usb: cdns3: fix role switching during resume
     - drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected()
       (Closes: #1130930)
     - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
     - hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization
       induced race
     - ksmbd: check return value of xa_store() in krb5_authenticate
     - ksmbd: add chann_lock to protect ksmbd_chann_list xarray (CVE-2026-23226)
     - ALSA: hda/realtek: Add quirk for Gigabyte G5 KF5 (2023)
     - ALSA: hda/realtek: Add quirk for Samsung Galaxy Book3 Pro 360 (NP965QFG)
     - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314
     - net: arcnet: com20020-pci: fix support for 2.5Mbit cards
     - eventpoll: Fix integer overflow in ep_loop_check_proc()
     - namespace: fix proc mount iteration
     - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
     - nfc: pn533: properly drop the usb interface reference on disconnect
     - net: usb: kaweth: validate USB endpoints
     - net: usb: kalmia: validate USB endpoints
     - net: usb: pegasus: validate USB endpoints
     - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a
       message
     - can: usb: f81604: correctly anchor the urb in the read bulk callback
     - can: ucan: Fix infinite loop from zero-length messages
     - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
     - can: usb: f81604: handle short interrupt urb messages properly
     - can: usb: f81604: handle bulk write errors properly
     - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them
     - [amd64] x86/efi: defer freeing of boot services memory
     - [amd64] platform/x86: dell-wmi-sysman: Don't hex dump plaintext password
       data
     - [amd64] platform/x86: dell-wmi: Add audio/mic mute key codes
     - ALSA: usb-audio: Use correct version for UAC3 header validation
     - wifi: radiotap: reject radiotap with unknown bits
     - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
     - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration
     - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
     - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
     - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
     - net/sched: ets: fix divide by zero in the offload path
     - nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
     - tracing: Fix WARN_ON in tracing_buffers_mmap_close
     - scsi: target: Fix recursive locking in __configfs_open_file()
     - Squashfs: check metadata block offset is within range
     - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
     - drbd: fix null-pointer dereference on local read error
     - smb: client: fix cifs_pick_channel when channels are equally loaded
     - smb: client: fix broken multichannel with krb5+signing
     - smb: client: Don't log plaintext credentials in cifs_set_cifscreds
     - scsi: core: Fix refcount leak for tagset_refcnt
     - xattr: switch to CLASS(fd) (CVE-2024-14027)
     - btrfs: always fallback to buffered write if the inode requires checksum
     - ACPI: APEI: GHES: Disable KASAN instrumentation when compile testing with
       clang < 18
     - nvme: fix admin queue leak on controller reset
     - hwmon: (aht10) Add support for dht20
     - hwmon: (aht10) Fix initialization commands for AHT20
     - pinctrl: equilibrium: rename irq_chip function callbacks
     - pinctrl: equilibrium: fix warning trace on load
     - [amd64] platform/x86: thinkpad_acpi: Fix errors reading battery thresholds
     - HID: multitouch: add quirks for Lenovo Yoga Book 9i
     - HID: multitouch: new class MT_CLS_EGALAX_P80H84
     - [amd64] pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe()
     - hwmon: (it87) Check the it87_lock() return value
     - [amd64,arm64] idpf: change IRQ naming to match netdev and ethtool queue
       numbering
     - i40e: Fix preempt count leak in napi poll tracepoint
     - e1000e: clear DPG_EN after reset to avoid autonomous power-gating
     - drm/solomon: Fix page start when updating rectangle in page addressing
       mode
     - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling
       in ALE table
     - xsk: Get rid of xdp_buff_xsk::xskb_list_node
     - xsk: s/free_list_node/list_node/
     - xsk: Fix fragment node deletion to prevent buffer leak
     - xsk: Fix zero-copy AF_XDP fragment drop
     - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
     - [arm64] net: ti: icssg-prueth: Fix ping failure after offload mode setup
       when link speed is not 1G
     - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds
     - can: bcm: fix locking for bcm_op runtime updates
     - can: mcp251x: fix deadlock in error path of mcp251x_open
     - wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config
     - drm/xe: Do not preempt fence signaling CS instructions
     - kunit: tool: copy caller args in run_kernel to prevent mutation
     - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
     - octeon_ep: Relocate counter updates before NAPI
     - octeon_ep: avoid compiler and IQ/OQ reordering
     - octeon_ep_vf: Relocate counter updates before NAPI
     - octeon_ep_vf: avoid compiler and IQ/OQ reordering
     - wifi: cw1200: Fix locking in error paths
     - wifi: wlcore: Fix a locking bug
     - wifi: mt76: mt7996: Fix possible oob access in
       mt7996_mac_write_txwi_80211()
     - wifi: mt76: mt7925: Fix possible oob access in
       mt7925_mac_write_txwi_80211()
     - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()
     - indirect_call_wrapper: do not reevaluate function pointer
     - net/rds: Fix circular locking dependency in rds_tcp_tune
     - xen/acpi-processor: fix _CST detection using undersized evaluation buffer
     - iavf: fix netdev->max_mtu to respect actual hardware limit
     - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim
     - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op()
     - smb/client: fix buffer size for smb311_posix_qinfo in
       SMB311_posix_query_info()
     - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
     - net: ipv4: fix ARM64 alignment fault in multipath hash seed
     - amd-xgbe: fix sleep while atomic on suspend/resume
     - drm/sched: Fix kernel-doc warning for drm_sched_job_done()
     - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock"
     - drm/xe/reg_sr: Fix leak on xa_store failure
     - nvme: reject invalid pr_read_keys() num_keys values
     - nvme: fix memory allocation in nvme_pr_read_keys()
     - hwmon: (max6639) : Configure based on DT property
     - hwmon: (max6639) fix inverted polarity
     - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless
       qdiscs
     - net: nfc: nci: Fix zero-length proprietary notifications
     - net_sched: sch_fq: clear q->band_pkt_count[] in fq_reset()
     - nfc: nci: free skb on nci_transceive early error paths
     - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback
     - nfc: rawsock: cancel tx_work before socket teardown
     - net: stmmac: Fix error handling in VLAN add and delete paths
     - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
     - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in
       mtk_xdp_setup()
     - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
     - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
     - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
     - net/sched: act_ife: Fix metalist update behavior
     - xdp: use modulo operation to calculate XDP frag tailroom
     - xsk: introduce helper to determine rxq->frag_size
     - i40e: fix registering XDP RxQ info
     - i40e: use xdp.frame_sz as XDP RxQ info frag_size
     - xdp: produce a warning when calculated tailroom is negative
     - tracing: Add NULL pointer check to trigger_data_free()
     - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared
       blocks
     - ext4: fix potential null deref in ext4_mb_init()
     - ata: libata-core: fix cancellation of a port deferred qc work
     - ata: libata-eh: correctly handle deferred qc timeouts
     - ata: libata: cancel pending work after clearing deferred_qc
     - ata: libata-eh: Fix detection of deferred qc timeouts
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.78
     - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
     - [amd64] ACPI: PM: Save NVS memory on Lenovo G70-35
     - scsi: mpi3mr: Add NULL checks when resetting request and reply queues
     - ALSA: hda/realtek: Fix speaker pop on Star Labs StarFighter
     - unshare: fix unshare_fs() handling
     - wifi: mac80211: set default WMM parameters on all links
     - ACPI: OSI: Add DMI quirk for Acer Aspire One D255
     - scsi: ses: Fix devices attaching to different hosts
     - [amd64] ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table
     - [amd64] ASoC: cs42l43: Report insert for exotic peripherals
     - scsi: ufs: core: Fix possible NULL pointer dereference in
       ufshcd_add_command_trace()
     - scsi: ufs: core: Fix shift out of bounds when MAXQ=32
     - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0
     - drm/amdgpu/vcn5: Add SMU dpm interface type
     - ALSA: usb-audio: Check max frame size for implicit feedback mode, too
     - kexec: Consolidate machine_kexec_mask_interrupts() implementation
     - kexec: Include kernel-end even without crashkernel
     - [powerpc*] kexec/core: use big-endian types for crash variables
     - [powerpc*] crash: adjust the elfcorehdr size
     - remoteproc: sysmon: Correct subsys_name_len type in QMI request
     - remoteproc: mediatek: Unprepare SCP clock during system suspend
     - [powerpc*] 83xx: km83xx: Fix keymile vendor prefix
     - smb/server: Fix another refcount leak in smb2_open()
     - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
     - [arm64] drm/msm/dsi: fix hdisplay calculation when programming dsi
       registers
     - xprtrdma: Decrement re_receiving on the early exit paths
     - btrfs: hold space_info->lock when clearing periodic reclaim ready
     - workqueue: Use POOL_BH instead of WQ_BH when checking pool flags
     - perf disasm: Fix off-by-one bug in outside check
     - [arm64] drm/msm/dsi: fix pclk rate calculation for bonded dsi
     - drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v14
     - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states
     - net/mlx5: IFC updates for disabled host PF
     - net/mlx5: Query to see if host PF is disabled
     - net/mlx5: Fix deadlock between devlink lock and esw->wq
     - net/mlx5: Fix crash when moving to switchdev mode
     - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
     - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL
       slave xmit (CVE-2026-23277)
     - ASoC: soc-core: drop delayed_work_pending() check before flush
     - ASoC: soc-core: flush delayed work before removing DAIs and widgets
     - ASoC: simple-card-utils: use __free(device_node) for device node
     - ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays
     - net: sfp: improve Huawei MA5671a fixup
     - serial: caif: hold tty->link reference in ldisc_open and ser_release
     - bnxt_en: Fix RSS table size check when changing ethtool channels
     - mctp: i2c: fix skb memory leak in receive path
     - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return
       value
     - bonding: add ESP offload features when slaves support
     - bonding: Correctly support GSO ESP offload
     - net: add a common function to compute features for upper devices
     - bonding: use common function to compute the features
     - bonding: fix type confusion in bond_setup_by_slave()
     - mctp: route: hold key->lock in mctp_flow_prepare_output()
     - [amd64,arm64] amd-xgbe: fix link status handling in xgbe_rx_adaptation
     - [amd64,arm64] amd-xgbe: prevent CRC errors during RX adaptation with AN
       disabled
     - xdp: allow attaching already registered memory model to xdp_rxq_info
     - xdp: register system page pool as an XDP memory model
     - net: add xmit recursion limit to tunnel xmit functions (CVE-2026-23276)
     - netfilter: nf_tables: always walk all pending catchall elements
       (CVE-2026-23278)
     - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
     - netfilter: x_tables: guard option walkers against 1-byte tail reads
     - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
     - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
     - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
       (CVE-2026-23274)
     - perf annotate: Fix hashmap__new() error checking
     - regulator: pca9450: Correct interrupt type
     - perf ftrace: Fix hashmap__new() error checking
     - sched: idle: Make skipping governor callbacks more consistent
     - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
     - nvme-pci: Fix race bug in nvme_poll_irqdisable()
     - i40e: fix src IP mask checks and memcpy argument names in cloud filter
     - e1000/e1000e: Fix leak in DMA error cleanup
     - net: bcmgenet: fix broken EEE by converting to phylib-managed state
     - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()
     - [amd64] ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock
       acquisition
     - ASoC: detect empty DMI strings
     - drm/amdkfd: Unreserve bo if queue update failed
     - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled
     - [arm64] octeontx2-af: devlink: fix NIX RAS reporter recovery condition
     - [arm64] octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt
       status
     - net: prevent NULL deref in ip[6]tunnel_xmit()
     - iio: imu: inv-mpu9150: fix irq ack preventing irq storms
     - usb: gadget: f_mass_storage: Fix potential integer overflow in
       check_command_size_in_blocks()
     - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on"
     - cgroup: fix race between task migration and iteration
     - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
     - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer
       interfaces
     - net: usb: lan78xx: fix silent drop of packets with checksum errors
     - net: usb: lan78xx: fix TX byte statistics for small packets
     - net: usb: lan78xx: skip LTM configuration for LAN7850
     - ata: libata-core: Add BRIDGE_OK quirk for QEMU drives
     - [amd64] ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA
     - [amd64] KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with
       in-kernel APIC
     - USB: add QUIRK_NO_BOS for video capture several devices
     - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
     - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed
     - usb: xhci: Fix memory leak in xhci_disable_slot()
     - usb: xhci: Prevent interrupt storm on host controller error (HCE)
     - usb: yurex: fix race in probe
     - usb: dwc3: pci: add support for the Intel Nova Lake -H
     - usb: misc: uss720: properly clean up reference in uss720_probe()
     - usb: core: don't power off roothub PHYs if phy_set_mode() fails
     - usb: cdc-acm: Restore CAP_BRK functionnality to CH343
     - usb: roles: get usb role switch from parent only for usb-b-connector
     - usb: typec: altmode/displayport: set displayport signaling rate in
       configure message
     - USB: usbcore: Introduce usb_bulk_msg_killable()
     - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts
     - USB: core: Limit the length of unkillable synchronous timeouts
     - usb: class: cdc-wdm: fix reordering issue in read code path
     - usb: mdc800: handle signal and read racing
     - usb: image: mdc800: kill download URB on timeout
     - mm/tracing: rss_stat: ensure curr is false from kthread context
     - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
     - mm/kfence: disable KFENCE upon KASAN HW tags enablement
     - mmc: core: Avoid bitfield RMW for claim/retune flags
     - [arm64] ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and
       start
     - tipc: fix divide-by-zero in tipc_sk_filter_connect()
     - kprobes: avoid crash when rmmod/insmod after ftrace killed
     - ceph: add a bunch of missing ceph_path_info initializers
     - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
     - libceph: reject preamble if control segment is empty
     - libceph: prevent potential out-of-bounds reads in process_message_header()
     - libceph: Use u32 for non-negative values in ceph_monmap_decode()
     - libceph: admit message frames only in CEPH_CON_S_OPEN state
     - ceph: fix i_nlink underrun during async unlink
     - ceph: fix memory leaks in ceph_mdsc_build_path()
     - time/jiffies: Mark jiffies_64_to_clock_t() notrace
     - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach
     - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend
     - scsi: hisi_sas: Add time interval between two H2D FIS following soft reset
       spec
     - scsi: hisi_sas: Use macro instead of magic number
     - scsi: hisi_sas: Fix NULL pointer exception during user_scan()
     - kbuild: Disable CC_HAS_ASM_GOTO_OUTPUT on clang < 17
     - Fix CC_HAS_ASM_GOTO_OUTPUT on non-x86 architectures
     - Revert "tcpm: allow looking for role_sw device in the main node"
     - drm/amd: Disable MES LR compute W/A
     - drm/bridge: samsung-dsim: Fix memory leak in error path
     - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used
     - [s390x] pfault: Fix virtual vs physical address confusion
     - nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().
     - device property: Allow secondary lookup in fwnode_get_next_child_node()
     - [arm64,armhf] irqchip/gic-v3-its: Limit number of per-device MSIs to the
       range the ITS supports
     - btrfs: fix chunk map leak in btrfs_map_block() after
       btrfs_chunk_map_num_copies()
     - ice: reintroduce retry mechanism for indirect AQ
     - ixgbevf: fix link setup issue
     - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
     - staging: rtl8723bs: fix potential out-of-bounds read in
       rtw_restruct_wmm_ie
     - media: dvb-net: fix OOB access in ULE extension header tables
     - [amd64,arm64] net: mana: Ring doorbell at 4 CQ wraparounds
     - ice: fix retry for AQ command 0x06EE
     - tracing: Fix syscall events activation by ensuring refcount hits zero
     - net/tcp-ao: Fix MAC comparison to be constant-time
     - batman-adv: Avoid double-rtnl_lock ELP metric worker
     - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
     - [arm64] mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
     - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read
     - [arm64] contpte: fix set_access_flags() no-op check for SMMU/ATS faults
     - pmdomain: bcm: bcm2835-power: Fix broken reset status read
     - ata: libata-core: Disable LPM on ST1000DM010-2EP102
     - drm/amd/display: Fallback to boot snapshot for dispclk
     - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()
     - smb: server: fix use-after-free in smb2_open()
     - ksmbd: fix use-after-free by using call_rcu() for oplock_info
     - net: nexthop: fix percpu use-after-free in remove_nh_grp_entry
     - net: ncsi: fix skb leak in error paths
     - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
     - net: dsa: microchip: Fix error path in PTP IRQ setup
     - drm/amd/pm: remove invalid gpu_metrics.energy_accumulator on smu v13.0.x
     - drm/amdgpu: Fix use-after-free race in VM acquire
     - drm/amd: Set num IP blocks to 0 if discovery fails
     - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding
     - [amd64] drm/i915: Fix potential overflow of shmem scatterlist length
     - [arm64] drm/msm: Fix dma_free_attrs() buffer size
     - tracing: Fix enabling multiple events on the kernel command line and
       bootconfig
     - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G
     - qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size
     - cifs: make default value of retrans as zero
     - xfs: fix returned valued from xfs_defer_can_append
     - xfs: fix undersized l_iclog_roundoff values
     - xfs: ensure dquot item is deleted from AIL only after log shutdown
     - [s390x] dasd: Move quiesce state with pprc swap
     - [s390x] dasd: Copy detected format information to secondary device
     - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error
     - scsi: core: Fix error handling for scsi_alloc_sdev()
     - [amd64] x86/apic: Disable x2apic on resume if the kernel expects so
     - lib/bootconfig: fix snprintf truncation check in
       xbc_node_compose_key_after()
     - lib/bootconfig: check bounds before writing in __xbc_open_brace()
     - smb: client: fix atomic open with O_DIRECT & O_SYNC
     - smb: client: fix in-place encryption corruption in SMB2_write()
     - smb: client: fix iface port assignment in parse_server_interfaces
     - btrfs: fix transaction abort on file creation due to name hash collision
     - btrfs: fix transaction abort on set received ioctl due to item overflow
     - btrfs: abort transaction on failure to update root in the received subvol
       ioctl
     - iio: dac: ds4424: reject -128 RAW value
     - iio: frequency: adf4377: Fix duplicated soft reset mask
     - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas()
     - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
     - iio: potentiometer: mcp4131: fix double application of wiper shift
     - iio: chemical: bme680: Fix measurement wait duration calculation
     - iio: buffer: Fix wait_queue not being removed
     - iio: gyro: mpu3050-core: fix pm_runtime error handling
     - iio: gyro: mpu3050-i2c: fix pm_runtime error handling
     - iio: imu: inv_icm42600: fix odr switch to the same value
     - iio: imu: inv_icm42600: fix odr switch when turning buffer off
     - iio: proximity: hx9023s: Protect against division by zero in set_samp_freq
     - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors
     - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort
     - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor
     - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD
     - net/tcp-md5: Fix MAC comparison to be constant-time
     - ksmbd: Compare MACs in constant time (CVE-2026-23364)
     - smb: client: Compare MACs in constant time
     - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()
     - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths
     - spi: cadence-quadspi: Implement refcount to handle unbind during busy
       (CVE-2025-40005)
     - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL
       (CVE-2026-23386)
     - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
       (CVE-2026-23368)
     - [amd64] x86/sev: Allow IBPB-on-Entry feature for SNP guests
     - [amd64] platform/x86: hp-bioscfg: Support allocations of larger data
       (Closes: #1127612)
     - wifi: libertas: fix use-after-free in lbs_free_adapter() (CVE-2026-23281)
     - [amd64] perf/x86/intel/uncore: Support more units on Granite Rapids
     - [amd64] perf/x86/intel/uncore: Add per-scheduler IMC CAS count events
     - mptcp: pm: in-kernel: always mark signal+subflow endp as used
     - mptcp: pm: avoid sending RM_ADDR over same subflow
     - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink
     - kbuild: Leave objtool binary around with 'make clean'
     - net/sched: act_gate: snapshot parameters with RCU on replace
       (CVE-2026-23245)
     - xfs: Fix error pointer dereference
     - can: gs_usb: gs_can_open(): always configure bitrates before starting
       device
     - cleanup: Provide retain_and_null_ptr()
     - usb: gadget: f_ncm: Fix net_device lifecycle with device_move
     - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling
     - [amd64] KVM: SVM: Limit AVIC physical max index based on configured
       max_vcpu_ids
     - [amd64] KVM: SVM: Add a helper to look up the max physical ID for AVIC
     - [amd64] KVM: SVM: Set/clear CR8 write interception when AVIC is
       (de)activated
     - [arm64,armhf] mmc: dw_mmc-rockchip: use modern PM macros
     - [arm64,armhf] mmc: dw_mmc-rockchip: Add memory clock auto-gating support
     - [arm64,armhf] mmc: dw_mmc-rockchip: Fix runtime PM support for internal
       phase support
     - mm/page_alloc: move set_page_refcounted() to callers of post_alloc_hook()
     - mm/page_alloc: sort out the alloc_contig_range() gfp flags mess
     - mm/page_alloc: forward the gfp flags from alloc_contig_range() to
       post_alloc_hook()
     - mm/kfence: fix KASAN hardware tag faults during late enablement
     - nsfs: tighten permission checks for ns iteration ioctls
     - sched_ext: Disable preemption between scx_claim_exit() and kicking helper
       work
     - sched_ext: Fix starvation of scx_enable() under fair-class saturation
     - iomap: reject delalloc mappings during writeback
     - fgraph: Fix thresh_return clear per-task notrace
     - [amd64] KVM: x86: Co-locate initialization of feature MSRs in
       kvm_arch_vcpu_create()
     - [amd64] KVM: x86: Quirk initialization of feature MSRs to KVM's max
       configuration
     - [amd64] KVM: x86: do not allow re-enabling quirks
     - [amd64] KVM: x86: Allow vendor code to disable quirks
     - [amd64] KVM: x86: Introduce supported_quirks to block disabling quirks
     - [amd64] KVM: x86: Introduce Intel specific quirk
       KVM_X86_QUIRK_IGNORE_GUEST_PAT
     - [amd64] KVM: nVMX: Add consistency checks for CR0.WP and CR4.CET
     - [amd64] KVM: x86: Introduce KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM
     - ksmbd: Don't log keys in SMB3 signing and encryption key generation
     - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output
     - net: macb: Shuffle the tx ring before enabling tx
     - cifs: open files should not hold ref on superblock
     - xfs: fix integer overflow in bmap intent sort comparator
     - drm/xe/sync: Cleanup partially initialized sync on parse failure
     - ipv6: use RCU in ip6_xmit() (CVE-2025-40135)
     - dm-verity: disable recursive forward error correction (CVE-2025-71161)
     - rxrpc: Fix recvmsg() unconditional requeue
     - btrfs: do not strictly require dirty metadata threshold for metadata
       writepages (CVE-2026-23157)
     - ice: fix devlink reload call trace (CVE-2026-23104)
     - tracing: Add recursion protection in kernel stack trace recording
       (CVE-2026-23138)
     - [amd64] Octeontx2-af: Add proper checks for fwdata (CVE-2026-23070)
     - io_uring/uring_cmd: fix too strict requirement on ioctl
     - [amd64] x86/uprobes: Fix XOL allocation failure for 32-bit tasks
     - [amd64] platform/x86/amd/pmc: Add support for Van Gogh SoC
       (CVE-2025-68334)
     - mptcp: pm: in-kernel: always set ID as avail when rm endp
     - net: stmmac: remove support for lpi_intr_o
     - f2fs: compress: change the first parameter of page_array_{alloc,free} to
       sbi
     - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic
       (CVE-2025-38627)
     - f2fs: fix to avoid migrating empty section (CVE-2025-40150)
     - blk-throttle: fix access race during throttle policy activation
       (CVE-2025-40147)
     - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
       (CVE-2025-71221)
     - net: dsa: properly keep track of conduit reference (CVE-2025-71152)
     - binfmt_misc: restore write access before closing files opened by
       open_exec() (CVE-2025-68239)
     - xfs: get rid of the xchk_xfile_*_descr calls
     - erofs: fix inline data read failure for ztailpacking pclusters
     - mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375)
     - sched_ext: Remove redundant css_put() in scx_cgroup_init()
     - io_uring/kbuf: check if target buffer list is still legacy on recycle
     - sched/fair: Fix zero_vruntime tracking
     - [s390x] stackleak: Fix __stackleak_poison() inline assembly constraint
     - [s390x] xor: Fix xor_xc_2() inline assembly constraints
     - [amd64] drm/i915/alpm: ALPM disable fixes
     - [amd64] drm/i915/psr: Repeat Selective Update area alignment
     - drm/amd/display: Add pixel_clock to amd_pp_display_configuration
     - drm/amd/pm: Use pm_display_cfg in legacy DPM (v2)
     - drm/amdgpu: Add basic validation for RAS header (CVE-2025-38426)
     - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
     - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
     - HID: bpf: prevent buffer overflow in hid_hw_request
     - sunrpc: fix cache_request leak in cache_release
     - nvdimm/bus: Fix potential use after free in asynchronous initialization
     - NFC: nxp-nci: allow GPIOs to sleep
     - net: macb: fix use-after-free access to PTP clock
     - mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations
     - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
     - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
     - smb: client: fix krb5 mount with username option
     - ksmbd: unset conn->binding on failed binding request
     - ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION
     - [amd64] drm/i915/dsc: Add Selective Update register definitions
     - [amd64] drm/i915/dsc: Add helper for writing DSC Selective Update ET
       parameters
     - [amd64] drm/i915/psr: Write DSC parameters on Selective Update in ET mode
     - [s390x] zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute
     - kprobes: Remove unneeded goto
     - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace()
     - btrfs: fix transaction abort when snapshotting received subvolumes
     - batman-adv: avoid OGM aggregation when skb tailroom is insufficient
     - net: macb: Introduce gem_init_rx_ring()
     - net: macb: Reinitialize tx/rx queue pointer registers and rx ring during
       resume
     - ata: libata-core: disable LPM on ADATA SU680 SSD
     - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption
     - mmc: sdhci: fix timing selection for 1-bit bus width
     - pmdomain: bcm: bcm2835-power: Increase ASB control timeout
     - spi: fix use-after-free on controller registration failure
     - spi: fix statistics allocation
     - mtd: rawnand: pl353: make sure optimal timings are applied
     - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in
       cadence_nand_init()
     - mtd: Avoid boot crash in RedBoot partition table parser
     - [amd64] iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry
     - serial: 8250_pci: add support for the AX99100
     - serial: 8250: Fix TX deadlock when using DMA
     - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART
       BUSY
     - serial: uartlite: fix PM runtime usage count underflow on probe
     - io_uring/kbuf: propagate BUF_MORE through early buffer commit path
     - drm: Fix use-after-free on framebuffers and property blobs when calling
       drm_dev_unplug
     - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START,
       END}
     - drm/amdgpu/gmc9.0: add bounds checking for cid
     - drm/amdgpu/mmhub2.0: add bounds checking for cid
     - drm/amdgpu/mmhub2.3: add bounds checking for cid
     - drm/amdgpu/mmhub3.0.1: add bounds checking for cid
     - drm/amdgpu/mmhub3.0.2: add bounds checking for cid
     - drm/amdgpu/mmhub3.0: add bounds checking for cid
     - drm/amdgpu/mmhub4.1.0: add bounds checking for cid
     - drm/imagination: Fix deadlock in soft reset sequence
     - drm/radeon: apply state adjust rules to some additional HAINAN vairants
     - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants
     - drm/xe/oa: Allow reading after disabling OA stream
     - drm/xe: Open-code GGTT MMIO access protection
     - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
       (CVE-2026-23395)
     - ata: libata-scsi: Return residual for emulated SCSI commands
     - ata: libata-scsi: report correct sense field pointer in
       ata_scsiop_maint_in()
     - btrfs: log new dentries when logging parent dir of a conflicting inode
     - btrfs: tree-checker: fix misleading root drop_level error message
     - [riscv64] soc: microchip: mpfs: Fix memory leak in
       mpfs_sys_controller_probe()
     - [riscv64] cache: starfive: fix device node leak in starlink_cache_init()
     - [arm64,armhf] soc: rockchip: grf: Add missing of_node_put() when returning
     - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.
     - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
     - [arm64] dts: renesas: r9a09g057: Add RTC node
     - [arm64] dts: renesas: r9a09g057: Remove wdt{0,2,3} nodes
     - [arm64] firmware: arm_scpi: Fix device_node reference leak in probe path
     - Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
     - Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
     - Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
     - Bluetooth: ISO: Fix defer tests being unstable
     - Bluetooth: hci_sync: Fix hci_le_create_conn_sync
     - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
     - Bluetooth: HIDP: Fix possible UAF
     - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
     - Bluetooth: qca: fix ROM version reading on WCN3998 chips
     - bridge: cfm: Fix race condition in peer_mep deletion (CVE-2026-23393)
     - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
     - mpls: add missing unregister_netdevice_notifier to mpls_init
     - netfilter: ctnetlink: remove refcounting in expectation dumpers
       (CVE-2025-39764)
     - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
     - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in
       sip_help_tcp()
     - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
     - nf_tables: nft_dynset: fix possible stateful expression memleak in error
       path (CVE-2026-23399)
     - netfilter: nft_ct: drop pending enqueued packets on removal
     - netfilter: xt_CT: drop pending enqueued packets on template removal
       (CVE-2026-23391)
     - netfilter: xt_time: use unsigned int for monthday bit shift
     - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
     - net: bcmgenet: increase WoL poll timeout
     - [amd64,arm64] net: mana: fix use-after-free in mana_hwc_destroy_channel()
       by reordering teardown
     - sched: idle: Consolidate the handling of two special cases
     - PM: runtime: Fix a race condition related to device removal
     - bonding: prevent potential infinite loop in bond_header_parse()
     - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
     - net/sched: teql: Fix double-free in teql_master_xmit
     - net: airoha: read default PSE reserved pages value before updating
     - net: airoha: fix PSE memory configuration in airoha_fe_pse_ports_init()
     - net: airoha: Read completion queue data in airoha_qdma_tx_napi_poll()
     - net: airoha: Remove airoha_dev_stop() in airoha_remove()
     - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check
     - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
     - clsact: Fix use-after-free in init/destroy rollback asymmetry
     - net: usb: aqc111: Do not perform PM inside suspend callback
     - igc: fix missing update of skb->tail in igc_xmit_frame()
     - igc: fix page fault in XDP TX timestamps handling
     - iavf: fix VLAN filter lost on add/delete race
     - wifi: mac80211: fix NULL deref in mesh_matches_local() (CVE-2026-23396)
     - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough
       headroom
     - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix
     - net: macb: fix uninitialized rx_fs_lock
     - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle
     - net/mlx5e: Prevent concurrent access to IPSec ASO context
     - net/mlx5e: Fix race condition during IPSec ESN update
     - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
     - net: bonding: fix NULL deref in bond_debug_rlb_hash_show
     - netfilter: bpf: defer hook memory release until rcu readers are done
     - netfilter: nf_tables: release flowtable after rcu grace period on error
       (CVE-2026-23392)
     - nfnetlink_osf: validate individual option lengths in fingerprints
       (CVE-2026-23397)
     - [arm64,armhf] net: mvpp2: guard flow control update with global_tx_fc in
       buffer switching
     - [armhf] net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error
       paths
     - icmp: fix NULL pointer dereference in icmp_tag_validation()
       (CVE-2026-23398)
     - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return
       value
     - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit()
     - [amd64] drm/i915/psr: Compute PSR entry_setup_frames into intel_crtc_state
     - USB: serial: f81232: fix incomplete serial port generation
     - i2c: cp2615: fix serial string NULL-deref at probe
     - i2c: fsi: Fix a potential leak in fsi_i2c_probe()
     - i2c: pxa: defer reset on Armada 3700 when recovery is used
     - ring-buffer: Fix to update per-subbuf entries of persistent ring buffer
     - [amd64] x86/platform/uv: Handle deconfigured sockets
     - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode
     - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode
     - mm: shmem: fix potential data corruption during shmem swapin
     - mm: shmem: avoid unpaired folio_unlock() in shmem_swapin_folio()
     - mm/shmem, swap: improve cached mTHP handling and fix potential hang
     - mm/shmem, swap: avoid redundant Xarray lookup during swapin
     - mtd: rawnand: serialize lock/unlock against other NAND operations
     - mtd: rawnand: brcmnand: skip DMA during panic write
     - drm/amd/display: Fix DisplayID not-found handling in
       parse_edid_displayid_vrr()
     - drm/amd: fix dcn 2.01 check
     - ksmbd: fix use-after-free of share_conf in compound request
     - ksmbd: fix use-after-free in durable v2 replay of active file handles
     - [amd64] drm/i915/gt: Check set_default_submission() before deferencing
     - lib/bootconfig: check xbc_init_node() return in override path
     - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure
     - hwmon: (max6639) Fix pulses-per-revolution implementation
     - [amd64] perf/x86/intel: Add missing branch counters constraint apply
     - xen/privcmd: restrict usage in unprivileged domU (CVE-2026-31788)
     - xen/privcmd: add boot control for restricted usage in domU
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.79
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.80
     - cxl/port: Fix use after free of parent_port in cxl_detach_ep()
     - bpf: Fix constant blinding for PROBE_MEM32 stores (CVE-2026-23417)
       (Closes: #1132622)
     - perf: Make sure to use pmu_ctx->pmu for groups
     - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled
     - hwmon: axi-fan: don't use driver_override as IRQ name
     - driver core: generalize driver_override in struct device
     - driver core: platform: use generic driver_override infrastructure
     - bpf: Release module BTF IDR before module unload
     - bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN
     - bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR
     - HID: asus: avoid memory leak in asus_report_fixup()
     - [amd64] platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to
       dmi_vgbs_allow_list
     - nvme-pci: cap queue creation to used queues
     - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets
     - [amd64] platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold
       16 Gen 1
     - [amd64] platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix
       touchscreen on SUPI S10
     - nvme-pci: ensure we're polling a polled queue
     - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2
     - HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
     - HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list
     - net: usb: r8152: add TRENDnet TUC-ET2G
     - kbuild: install-extmod-build: Package resolve_btfids if necessary
     - HID: mcp2221: cancel last I2C command on read error
     - HID: asus: add xg mobile 2023 external hardware support
     - module: Fix kernel panic when a symbol st_shndx is out of bounds
     - scsi: mpi3mr: Clear reset history on ready and recheck state after timeout
     - scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP
     - dma-buf: Include ioctl.h in UAPI header
     - ALSA: hda/senary: Ensure EAPD is enabled during init
     - HID: apple: avoid memory leak in apple_report_fixup()
     - sched_ext: Use WRITE_ONCE() for the write side of dsq->seq update
     - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create
     - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk
     - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390
     - objtool: Handle Clang RSP musical chairs
     - nvmet: move async event work off nvmet-wq
     - drm/amdgpu: fix gpu idle power consumption issue for gfx v12
     - usb: core: new quirk to handle devices with zero configurations
     - spi: intel-pci: Add support for Nova Lake mobile SPI flash
     - ALSA: hda/realtek: add quirk for ASUS UM6702RC
     - i3c: master: dw-i3c: Fix missing of_node for virtual I2C adapter
     - xfrm: add missing extack for XFRMA_SA_PCPU in add_acquire and allocspi
     - xfrm: fix the condition on x->pcpu_num in xfrm_sa_len
     - xfrm: call xdo_dev_state_delete during state update
     - xfrm: Fix the usage of skb->sk
     - esp: fix skb leak with espintcp and async crypto
     - xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini()
     - xfrm: prevent policy_hthresh.work from racing with netns teardown
     - af_key: validate families in pfkey_send_migrate()
     - dma: swiotlb: add KMSAN annotations to swiotlb_bounce()
     - erofs: set fileio bio failed in short read case
     - can: statistics: add missing atomic access in hot path
     - Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
     - Bluetooth: L2CAP: Validate PDU length before reading SDU length in
       l2cap_ecred_data_rcv()
     - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing
       sock_hold
     - Bluetooth: MGMT: Fix dangling pointer on
       mgmt_add_adv_patterns_monitor_complete
     - Bluetooth: hci_ll: Fix firmware leak on error path
     - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
     - [arm64] pinctrl: mediatek: common: Fix probe failure for devices without
       EINT
     - ionic: fix persistent MAC address override on PF
     - nfc: nci: fix circular locking dependency in nci_close_device
     - net: openvswitch: Avoid releasing netdev before teardown completes
     - openvswitch: defer tunnel netdev_put to RCU release
     - openvswitch: validate MPLS set/set_masked payload length
     - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe
       buffer
     - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
     - net: bcm: asp2: fix LPI timer handling
     - net: bcm: asp2: remove tx_lpi_enabled
     - net: bcm: asp2: convert to phylib managed EEE
     - net: bcmasp: Remove support for asp-v2.0
     - net: bcmasp: streamline early exit in probe
     - net: bcmasp: fix double free of WoL irq
     - net: bcmasp: Add support for asp-v3.0
     - net: bcmasp: fix double disable of clk
     - [armhf] platform/olpc: olpc-xo175-ec: Fix overflow error message to print
       inlen
     - [amd64] platform/x86: intel-hid: disable wakeup_mode during hibernation
     - ice: fix inverted ready check for VF representors
     - ice: use ice_update_eth_stats() for representor stats
     - iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
     - ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions
       expire.
     - ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist.
     - net: fix fanout UAF in packet_release() via NETDEV_UP race
     - tcp: optimize inet_use_bhash2_on_bind()
     - udp: Fix wildcard bind conflict check when using hash2
     - net: enetc: fix the output issue of 'ethtool --show-ring'
     - team: fix header_ops type confusion with non-Ethernet ports
     - net: lan743x: fix duplex configuration in mac_link_up
     - dma-mapping: add missing `inline` for `dma_free_attrs`
     - Bluetooth: L2CAP: Fix send LE flow credits in ACL link
     - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock
     - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
     - Bluetooth: btusb: clamp SCO altsetting table indices
     - tls: Purge async_hold in tls_decrypt_async_wait() (CVE-2026-23414)
     - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
     - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
     - netfilter: nf_conntrack_expect: skip expectations in other netns via proc
     - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in
       process_sdp
     - netfilter: ctnetlink: use netlink policy range checks
     - net: macb: use the current queue number for stats
     - regmap: Synchronize cache for the page selector
     - ALSA: hda/realtek: Sequence GPIO2 on Star Labs StarFighter
     - RDMA/rw: Fall back to direct SGE on MR pool exhaustion
     - RDMA/irdma: Initialize free_qp completion before using it
     - RDMA/irdma: Update ibqp state to error if QP is already in error state
     - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce()
     - RDMA/irdma: Clean up unnecessary dereference of event->cm_node
     - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err()
     - RDMA/irdma: Fix deadlock during netdev reset with active connections
     - RDMA/irdma: Return EINVAL for invalid arp index error
     - scsi: scsi_transport_sas: Fix the maximum channel scanning issue
     - [amd64] x86/efi: efi_unmap_boot_services: fix calculation of
       ranges_to_free size
     - [amd64] drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
     - PM: hibernate: Drain trailing zero pages on userspace restore
     - spi: sn-f-ospi: Fix resource leak in f_ospi_probe()
     - [amd64] ASoC: Intel: catpt: Fix the device initialization
     - [arm64,armhf] spi: meson-spicc: Fix double-put in remove path
     - drm/amd/display: Do not skip unrelated mode changes in DSC validation
     - spi: Group CS related fields in struct spi_device
     - spi: use generic driver_override infrastructure
     - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
     - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib
     - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion
     - hwmon: (pmbus/core) Fix various coding style issues
     - hwmon: (pmbus) Mark lowest/average/highest/rated attributes as read-only
     - hwmon: (pmbus) Introduce the concept of "write-only" attributes
     - sysctl: fix uninitialized variable in proc_do_large_bitmap
     - [s390x] syscalls: Add spectre boundary for syscall dispatch table
     - [s390x] barrier: Make array_index_mask_nospec() __always_inline
     - [s390x] entry: Scrub r12 register on kernel entry
     - ksmbd: replace hardcoded hdr2_len with offsetof() in
       smb2_calc_max_out_buf_len()
     - ksmbd: fix potencial OOB in get_file_all_info() for compound requests
     - ksmbd: fix memory leaks and NULL deref in smb2_lock()
     - ksmbd: do not expire session on binding failure
     - ALSA: firewire-lib: fix uninitialized local variable
     - [amd64] ASoC: SOF: ipc4-topology: Allow bytes controls without initial
       payload
     - can: gw: fix OOB heap access in cgw_csum_crc8_rel()
     - can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
     - cpufreq: conservative: Reset requested_freq on limits change
     - [amd64] platform/x86: ISST: Correct locked bit width
     - [arm64] KVM: arm64: Discard PC update state on vcpu reset
     - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs
       attributes
     - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute
       temperature
     - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible()
     - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
     - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and
       napi_tx is false
     - erofs: add GFP_NOIO in the bio completion if needed
     - alarmtimer: Fix argument order in alarm_timer_forward()
     - [amd64] x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling()
     - [amd64] x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask
     - [arm64] phy: qcom: qmp-ufs: Fix SM8650 PCS table for Gear 4
     - ovl: fix wrong detection of 32bit inode numbers
     - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
     - scsi: ses: Handle positive SCSI error from ses_recv_diag()
     - net: macb: Move devm_{free,request}_irq() out of spin lock area
     - net: macb: Protect access to net_device::ip_ptr with RCU lock
     - net: macb: Use dev_consume_skb_any() to free TX SKBs
     - [amd64] KVM: x86/mmu: Drop/zap existing present SPTE even when creating an
       MMIO SPTE (CVE-2026-23401)
     - jbd2: gracefully abort on checkpointing state corruptions
     - [arm64] irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment
     - futex: Clear stale exiting pointer in futex_lock_pi() retry path
     - dmaengine: fsl-edma: fix channel parameter config for fixed channel
       requests
     - dmaengine: sh: rz-dmac: Protect the driver specific lists
     - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock
     - drm/amdgpu: prevent immediate PASID reuse case
     - [amd64] drm/i915/dp_tunnel: Fix error handling when clearing stream BW in
       atomic state
     - xfs: stop reclaim before pushing AIL during unmount
     - xfs: save ailp before dropping the AIL lock in push callbacks
     - xfs: scrub: unlock dquot before early return in quota scrub
     - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2
     - xfs: don't irele after failing to iget in xfs_attri_recover_work
     - xfs: remove file_path tracepoint data
     - ext4: fix journal credit check when setting fscrypt context
     - ext4: convert inline data to extents when truncate exceeds inline size
     - ext4: fix stale xarray tags after writeback
     - ext4: fix fsync(2) for nojournal mode
     - ext4: make recently_deleted() properly work with lazy itable
       initialization
     - ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio
     - ext4: validate p_idx bounds in ext4_ext_correct_indexes
     - ext4: avoid infinite loops caused by residual data
     - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
     - ext4: reject mount if bigalloc with s_first_data_block != 0
     - ext4: fix use-after-free in update_super_work when racing with umount
     - ext4: fix the might_sleep() warnings in kvfree()
     - ext4: handle wraparound when searching for blocks for indirect mapped
       blocks
     - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
     - ext4: always drain queued discard work in ext4_mb_release()
     - [arm64] dts: imx8mn-tqma8mqnl: fix LDO5 power off
     - [powerpc*] powerpc64/bpf: do not increment tailcall count when prog is
       NULL
     - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()
     - tracing: Switch trace_osnoise.c code over to use guard() and __free()
     - tracing: Fix potential deadlock in cpu hotplug with osnoise
     - drm/xe: always keep track of remap prev/next
     - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]
     - ovl: Use str_on_off() helper in ovl_show_options()
     - ovl: make fsync after metadata copy-up opt-in mount option
     - xfs: avoid dereferencing log items after push callbacks
     - virt: tdx-guest: Fix handling of host controlled 'quote' buffer length
     - net: add proper RCU protection to /proc/net/ptype (CVE-2026-23255)
     - landlock: Optimize file path walks and prepare for audit support
     - landlock: Fix handling of disconnected directories (CVE-2025-68736)
     - ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw()
       (CVE-2025-22117)
     - ice: Fix PTP NULL pointer dereference during VSI rebuild (CVE-2026-23210)
     - [amd64,arm64] idpf: check error for register_netdev() on init
     - [amd64,arm64] idpf: detach and close netdevs while handling a reset
       (CVE-2026-22981)
     - [amd64,arm64] idpf: Fix RSS LUT NULL pointer crash on early ethtool
       operations (CVE-2026-22985)
     - [amd64,arm64] idpf: Fix RSS LUT NULL ptr issue after soft reset
       (CVE-2026-22993)
     - [amd64] dmaengine: idxd: Fix not releasing workqueue on .release()
     - [amd64] dmaengine: idxd: Fix memory leak when a wq is reset
     - [amd64] dmaengine: idxd: Fix freeing the allocated ida too late
     - phy: ti: j721e-wiz: Fix device node reference leak in
       wiz_get_lane_phy_types()
     - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and
       CYCLE_BIT bits for HDMA.
     - netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators
     - [amd64] dmaengine: idxd: fix possible wrong descriptor completion in
       llist_abort_desc()
     - btrfs: fix super block offset in error message in btrfs_validate_super()
     - btrfs: fix leak of kobject name for sub-group space_info
     - btrfs: fix lost error when running device stats on multiple devices fs
     - xen/privcmd: unregister xenstore notifier on module exit
     - futex: Require sys_futex_requeue() to have identical flags
     - [amd64] dmaengine: idxd: Fix leaking event log memory
     - net: bcmasp: Restore programming of TX map vector register
     - net: bcmasp: Fix network filter wake for asp-3.0
     - [amd64,arm64] idpf: nullify pointers after they are freed
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.81
     - io_uring/kbuf: remove legacy kbuf bulk allocation
     - io_uring/kbuf: remove legacy kbuf kmem cache
     - io_uring/kbuf: simplify __io_put_kbuf
     - io_uring/kbuf: remove legacy kbuf caching
     - io_uring/kbuf: open code __io_put_kbuf()
     - io_uring/kbuf: introduce io_kbuf_drop_legacy()
     - io_uring/kbuf: uninline __io_put_kbufs
     - io_uring/kbuf: drop 'issue_flags' from io_put_kbuf(s)() arguments
     - io_uring/net: don't use io_net_kbuf_recyle() for non-provided cases
     - io_uring/net: clarify io_recv_buf_select() return value
     - io_uring/kbuf: pass in struct io_buffer_list to commit/recycle helpers
     - io_uring/kbuf: introduce struct io_br_sel
     - io_uring/kbuf: use struct io_br_sel for multiple buffers picking
     - io_uring/net: use struct io_br_sel->val as the recv finish value
     - io_uring/net: use struct io_br_sel->val as the send finish value
     - io_uring/kbuf: switch to storing struct io_buffer_list locally
     - io_uring: remove async/poll related provided buffer recycles
     - io_uring/net: correct type for min_not_zero() cast
     - io_uring/rw: check for NULL io_br_sel when putting a buffer
     - io_uring/kbuf: enable bundles for incrementally consumed buffers
     - io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths
     - io_uring/kbuf: use READ_ONCE() for userspace-mapped memory
     - io_uring/kbuf: use WRITE_ONCE() for userspace-shared buffer ring fields
     - io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF
     - io_uring/kbuf: propagate BUF_MORE through early buffer commit path
     - HID: logitech-hidpp: Enable MX Master 4 over bluetooth
     - wifi: mac80211: check tdls flag in ieee80211_tdls_oper
     - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
     - atm: lec: fix use-after-free in sock_def_readable()
     - btrfs: don't take device_list_mutex when querying zone info
     - tg3: replace placeholder MAC address with device property
     - HID: logitech-hidpp: Prevent use-after-free on force feedback
       initialisation failure
     - HID: multitouch: Check to ensure report responses match the request
     - btrfs: reserve enough transaction items for qgroup ioctls
     - [arm64,armhf] i2c: tegra: Don't mark devices with pins as IRQ safe
     - btrfs: reject root items with drop_progress and zero drop_level
     - [arm64] spi: geni-qcom: Check DMA interrupts early in ISR
     - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common
       property warning
     - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU
       session
     - [arm64,armhf] crypto: caam - fix DMA corruption on long hmac keys
     - [arm64,armhf] crypto: caam - fix overflow on long hmac keys
     - crypto: af-alg - fix NULL pointer dereference in scatterwalk
     - [arm64,armhf] net: fec: fix the PTP periodic output sysfs interface
     - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak
     - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields
       to zero to prevent an info-leak
     - net/ipv6: ioam6: prevent schema length wraparound in trace fill
     - tg3: Fix race for querying speed/duplex
     - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
     - ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
     - bridge: br_nd_send: linearize skb before parsing ND options
     - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
     - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta
     - [arm64] net: enetc: check whether the RSS algorithm is Toeplitz
     - ipv6: prevent possible UaF in addrconf_permanent_addr()
     - net: airoha: Add missing cleanup bits in airoha_qdma_cleanup_rx_queue()
     - net: introduce mangleid_features
     - net: use skb_header_pointer() for TCPv4 GSO frag_off check
     - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero
       to prevent an info-leak
     - NFC: pn533: bound the UART receive buffer
     - ASoC: Intel: boards: fix unmet dependency on PINCTRL
     - bpf: Fix regsafe() for pointers to packet
     - net: ipv6: flowlabel: defer exclusive option free until RCU teardown
     - netfilter: flowtable: strictly check for maximum number of actions
     - netfilter: nfnetlink_log: account for netlink header size
     - netfilter: x_tables: ensure names are nul-terminated
     - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
     - netfilter: nf_conntrack_helper: pass helper to expect cleanup
     - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
     - netfilter: nf_conntrack_expect: honor expectation helper field
     - netfilter: nf_conntrack_expect: use expect->helper
     - netfilter: nf_conntrack_expect: store netns and zone in expectation
     - netfilter: ctnetlink: ignore explicit helper on new expectations
     - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions
       for NFPROTO_ARP
     - netfilter: nf_tables: reject immediate NF_QUEUE verdict
     - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate
     - Bluetooth: SCO: fix race conditions in sco_sock_connect()
     - Bluetooth: MGMT: validate LTK enc_size on load
     - Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
     - Bluetooth: hci_event: fix potential UAF in
       hci_le_remote_conn_param_req_evt
     - Bluetooth: MGMT: validate mesh send advertising payload length
     - rds: ib: reject FRMR registration before IB connection is established
     - bpf: sockmap: Fix use-after-free of sk->sk_socket in
       sk_psock_verdict_data_ready().
     - net/sched: sch_netem: fix out-of-bounds access in packet corruption
     - net: macb: fix clk handling on PCI glue driver removal
     - net: macb: properly unregister fixed rate clocks
     - net/mlx5: lag: Check for LAG device before creating debugfs
     - net/mlx5: Avoid "No data available" when FW version queries fail
     - net/mlx5: Fix switchdev mode rollback in case of failure
     - bnxt_en: Restore default stat ctxs for ULP when resource is available
     - net/x25: Fix potential double free of skb
     - net/x25: Fix overflow when accumulating packets
     - net/sched: cls_fw: fix NULL pointer dereference on shared blocks
     - net/sched: cls_flow: fix NULL pointer dereference on shared blocks
     - net: hsr: fix VLAN add unwind on slave errors
     - ipv6: avoid overflows in ip6_datagram_send_ctl()
     - bpf: reject direct access to nullable PTR_TO_BUF pointers
     - Revert "drm: Fix use-after-free on framebuffers and property blobs when
       calling drm_dev_unplug"
     - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
     - hwmon: (pxe1610) Check return value of page-select write in probe
     - hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS")
     - dt-bindings: gpio: fix microchip #interrupt-cells
     - hwmon: (tps53679) Fix device ID comparison and printing in
       tps53676_identify()
     - [armhf] hwmon: (occ) Fix missing newline in occ_show_extended()
     - sched/fair: Use protect_slice() instead of direct comparison
     - sched/fair: Fix zero_vruntime tracking fix
     - [amd64,arm64] drm/ioc32: stop speculation on the drm_compat_ioctl path
     - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
     - wifi: iwlwifi: mvm: fix potential out-of-bounds read in
       iwl_mvm_nd_match_info_handler()
     - USB: serial: option: add MeiG Smart SRM825WN
     - ALSA: caiaq: fix stack out-of-bounds read in init_card
     - ALSA: ctxfi: Fix missing SPDIFI1 index handling
     - io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()
     - Bluetooth: SMP: derive legacy responder STK authentication from MITM state
     - Bluetooth: SMP: force responder MITM requirements before building the
       pairing response
     - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
     - ksmbd: fix OOB write in QUERY_INFO for compound requests
     - [armhf] hwmon: (occ) Fix division by zero in occ_show_power_1()
     - drm/amdgpu: fix the idr allocation flags
     - iio: adc: ti-adc161s626: fix buffer read on big-endian
     - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read()
     - drm/ast: dp501: Fix initialization of SCU2C
     - [amd64] drm/i915/dsi: Don't do DSC horizontal timing adjustments in
       command mode
     - [amd64] drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw
       CPU eDP
     - drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB
     - drm/amdgpu/pm: drop SMU driver if version not matched messages
     - USB: serial: io_edgeport: add support for Blackbox IC135A
     - USB: serial: option: add support for Rolling Wireless RW135R-GL
     - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
     - Input: synaptics-rmi4 - fix a locking bug in an error path
     - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk
       table
     - Input: bcm5974 - recover from failed mode switch
     - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode
     - Input: xpad - add support for Razer Wolverine V3 Pro
     - iio: adc: aspeed: clear reference voltage bits before configuring vref
     - iio: accel: fix ADXL355 temperature signature value
     - iio: accel: adxl380: fix FIFO watermark bit 8 always written as 0
     - iio: dac: ad5770r: fix error return in ad5770r_read_raw()
     - iio: light: vcnl4035: fix scan buffer on big-endian
     - iio: imu: bmi160: Remove potential undefined behavior in
       bmi160_config_pin()
     - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only
     - iio: gyro: mpu3050: Fix incorrect free_irq() variable
     - iio: gyro: mpu3050: Fix irq resource leak
     - iio: gyro: mpu3050: Move iio_device_register() to correct location
     - iio: gyro: mpu3050: Fix out-of-sequence free_irq()
     - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
     - usb: ulpi: fix double free in ulpi_register_interface() error path
     - usb: usbtmc: Flush anchored URBs in usbtmc_release
     - usb: ehci-brcm: fix sleep during atomic
     - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()
     - usb: core: phy: avoid double use of 'usb3-phy'
     - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
     - usb: cdns3: gadget: fix state inconsistency on gadget init failure
     - bridge: br_nd_send: validate ND option lengths
     - cdc-acm: new quirk for EPSON HMD
     - [amd64] comedi: Reinit dev->spinlock between attachments to low-level
       drivers
     - [amd64] comedi: me_daq: Fix potential overrun of firmware buffer
     - [amd64] comedi: me4000: Fix potential overrun of firmware buffer
     - [riscv64] firmware: microchip: fail auto-update probe if no flash found
     - dt-bindings: connector: add pd-disable dependency
     - nvmem: imx: assign nvmem_cell_info::raw_len
     - nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy
     - netfilter: ipset: drop logically empty buckets in mtype_del
     - vxlan: validate ND option lengths in vxlan_na_create
     - net: ftgmac100: fix ring allocation unwind on open failure
     - [arm64] net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled
     - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error
       path
     - gpio: mxc: map Both Edge pad wakeup to Rising Edge
     - thermal: core: Fix thermal zone device registration error path
     - misc: fastrpc: possible double-free of cctx->remote_heap
     - [amd64] thunderbolt: Fix property read in nhi_wake_supported()
     - USB: dummy-hcd: Fix locking/synchronization error
     - USB: dummy-hcd: Fix interrupt synchronization error
     - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows
       partial transfer
     - usb: typec: ucsi: validate connector number in ucsi_notify_common()
     - ice: Fix memory leak in ice_set_ringparam() (CVE-2026-23389)
     - btrfs: fix the qgroup data free range for inline data extents
     - btrfs: do not free data reservation in fallback from inline due to -ENOSPC
       (CVE-2025-71269)
     - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
     - usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo
     - usb: gadget: uvc: fix NULL pointer dereference during unbind race
     - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
     - usb: gadget: f_rndis: Protect RNDIS options with mutex
     - usb: gadget: f_ecm: Fix net_device lifecycle with device_move
     - usb: gadget: f_eem: Fix net_device lifecycle with device_move
     - usb: gadget: f_subset: Fix net_device lifecycle with device_move
     - usb: gadget: f_rndis: Fix net_device lifecycle with device_move
     - usb: gadget: f_hid: move list and spinlock inits from bind to alloc
     - usb: gadget: f_uac1_legacy: validate control request size
     - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
     - spi: cadence-qspi: Fix exec_mem_op error handling
     - net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback
     - [amd64,arm64] net: mana: fix use-after-free in add_adev() error path
     - scsi: target: tcm_loop: Drain commands in target_reset handler
     - [amd64] x86/fred: Fix early boot failures on SEV-ES/SNP guests
     - mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
     - mm: replace READ_ONCE() with standard page table accessors
     - mm/memory: fix PMD/PUD checks in follow_pfnmap_start()
     - drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13
     - ext4: publish jinode after initialization
     - [s390x] perf_cpum_sf: Convert to use try_cmpxchg128()
     - [s390x] cpum_sf: Cap sampling rate to prevent lsctl exception
     - MPTCP: fix lock class name family in pm_nl_create_listen_socket
     - [amd64] x86/CPU/AMD: Add additional fixed RDSEED microcode revisions
     - drm/amd/amdgpu: decouple ASPM with pcie dpm
     - drm/amd/amdgpu: disable ASPM in some situations
     - drm/amd/display: Disable fastboot on DCE 6 too
     - drm/amd/display: Keep PLL0 running on DCE 6.0 and 6.4
     - drm/amd/display: Fix DCE 6.0 and 6.4 PLL programming.
     - drm/amd/display: Adjust DCE 8-10 clock, don't overclock by 15%
     - drm/amd/display: Disable scaling on DCE6 for now
     - drm/amd: Disable ASPM on SI
     - drm/amd/display: Correct logic check error for fastboot
     - bpf: Improve bounds when s64 crosses sign boundary
     - bpf: Add third round of bounds deduction
     - bpf: Fix u32/s32 bounds when ranges cross min/max boundary
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.82
     - lib/crypto: chacha: Zeroize permuted_state before it leaves scope
     - usb: typec: ucsi: skip connector validation before init
     - wifi: rt2x00usb: fix devres lifetime
     - xfrm_user: fix info leak in build_report()
     - net: rfkill: prevent unlimited numbers of rfkill events from being created
     - mptcp: fix slab-use-after-free in __inet_lookup_established
     - seg6: separate dst_cache for input and output paths in seg6 lwtunnel
     - Input: uinput - fix circular locking dependency with ff-core
     - Input: uinput - take event lock when submitting FF request "event"
     - ASoC: simple-card-utils: Don't use __free(device_node) at
       graph_util_parse_dai()
     - btrfs: make wait_on_extent_buffer_writeback() static inline
     - btrfs: remove unused define WAIT_PAGE_LOCK for extent io
     - btrfs: split waiting from read_extent_buffer_pages(), drop parameter wait
     - btrfs: remove unused flag EXTENT_BUFFER_READAHEAD
     - btrfs: remove unused flag EXTENT_BUFFER_CORRUPT
     - btrfs: remove pointless out labels from extent-tree.c
     - btrfs: fix incorrect return value after changing leaf in
       lookup_extent_data_ref()
     - blktrace: fix __this_cpu_read/write in preemptible context
     - nfc: nci: complete pending data exchange on device close
     - misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe
     - Revert "mptcp: add needs_id for netlink appending addr"
     - net: annotate data-races around sk->sk_{data_ready,write_space}
     - netfilter: nft_ct: fix use-after-free in timeout object destroy
     - workqueue: Add pool_workqueue to pending_pwqs list when unplugging
       multiple inactive works
     - xfrm: clear trailing padding in build_polexpire()
     - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
     - wifi: brcmsmac: Fix dma_free_coherent() size
     - [amd64] platform/x86/intel-uncore-freq: Handle autonomous UFS status bit
     - [arm64] Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower"
     - [arm64] dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V
     - [arm64] dts: hisilicon: poplar: Correct PCIe reset GPIO polarity
     - [arm64] dts: hisilicon: hi3798cv200: Add missing dma-ranges
     - nfc: pn533: allocate rx skb before consuming bytes
     - batman-adv: reject oversized global TT response buffers
     - X.509: Fix out-of-bounds access when parsing extensions
     - [amd64,arm64] EDAC/mc: Fix error path ordering in edac_mc_alloc()
     - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
     - batman-adv: hold claim backbone gateways by reference
     - [amd64] drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat
     - [amd64] drm/i915/psr: Do not use pipe_src as borders for SU area
     - net/mlx5: Update the list of the PCI supported devices
     - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled
     - mmc: vub300: fix NULL-deref on disconnect
     - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation
       failure
     - net: stmmac: fix integer underflow in chain mode
     - mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()
     - [amd64,arm64] idpf: improve locking around idpf_vc_xn_push_free()
     - [amd64,arm64] idpf: set the payload size before calling the async handler
     - rxrpc: Fix anonymous key handling
     - rxrpc: Fix call removal to use RCU safe deletion
     - rxrpc: Fix key reference count leak from call->key
     - rxrpc: Only put the call ref if one was acquired
     - rxrpc: reject undecryptable rxkad response tickets
     - rxrpc: fix reference count leak in rxrpc_server_keyring()
     - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)
     - rxrpc: Fix missing error checks for rxkad encryption/decryption failure
     - net: skb: fix cross-cache free of KFENCE-allocated skb head
     - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6
     - [amd64] x86/CPU: Fix FPDSS on Zen1 (CVE-2026-31628)
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.83
     - RDMA/irdma: Fix double free related to rereg_user_mr
     - [amd64] ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA
     - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk
     - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC
     - [arm64,armhf] media: rkvdec: reduce stack usage in
       rkvdec_init_v4l2_vp9_count_tbl()
     - ALSA: asihpi: avoid write overflow check warning
     - Bluetooth: hci_sync: annotate data-races around hdev->req_status
     - [amd64] ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF
     - [amd64,arm64] ASoC: SOF: topology: reject invalid vendor array size in
       token parser
     - can: mcp251x: add error handling for power enable in open and resume
     - [amd64] platform/x86: asus-nb-wmi: add DMI quirk for ASUS ROG Flow Z13-KJP
       GZ302EAC
     - btrfs: tracepoints: get correct superblock from dentry in event
       btrfs_sync_file()
     - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx
     - drm/amdgpu: Handle GPU page faults correctly on non-4K page systems
     - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
     - ALSA: hda/realtek: add quirk for Framework F111:000F
     - wifi: wl1251: validate packet IDs before indexing tx_frames
     - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list
     - ALSA: hda/realtek: Add quirk for Samsung Book2 Pro 360 (NP950QED)
     - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex
     - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
     - [amd64] ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx
     - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IMH9
     - [amd64] pinctrl: intel: Fix the revision for new features (1kOhm PD, HW
       debouncer)
     - [amd64] platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug
     - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3
     - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10
     - HID: roccat: fix use-after-free in roccat_report_event
     - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585
     - wifi: brcmfmac: validate bsscfg indices in IF events
     - net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules
     - [armhf] ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J
     - [armhf] soc: aspeed: socinfo: Mask table entries for accurate SoC ID
       matching
     - [arm64] dts: qcom: hamoa/x1: fix idle exit latency
     - [arm64] dts: imx8mq: Set the correct gpu_ahb clock frequency
     - [arm64] dts: imx93-9x9-qsb: change usdhc tuning step for eMMC and SD
     - [arm64] dts: imx93-tqma9352: improve eMMC pad configuration
     - [arm64] soc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei
     - tools/power/turbostat: Fix microcode patch level output for AMD/Hygon
     - PCI: hv: Set default NUMA node to 0 for devices without affinity info
     - HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP
     - xfrm: account XFRMA_IF_ID in aevent size calculation
     - [arm*] drm/vc4: Release runtime PM reference after binding V3D
     - [arm*] drm/vc4: Fix memory leak of BO array in hang state
     - [arm*] drm/vc4: Fix a memory leak in hang state error path
     - [arm* drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock
     - eventpoll: defer struct eventpoll free to RCU grace period
     - net: sched: act_csum: validate nested VLAN headers
     - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE
     - ipv4: nexthop: avoid duplicate NHA_HW_STATS_ENABLE on nexthop group dump
     - ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()
       (CVE-2026-31531)
     - ipv4: icmp: fix null-ptr-deref in icmp_build_probe()
     - net: increase IP_TUNNEL_RECURSION_LIMIT to 5
     - nfc: s3fwrn5: allocate rx skb before consuming bytes
     - net: stmmac: Fix PTP ref clock for Tegra234
     - dt-bindings: net: Fix Tegra234 MGBE PTP clock
     - tracing/probe: reject non-closed empty immediate strings
     - ixgbevf: add missing negotiate_features op to Hyper-V ops table
     - e1000: check return value of e1000_read_eeprom
     - xsk: tighten UMEM headroom validation to account for tailroom and min
       frame
     - xsk: respect tailroom for ZC setups
     - xsk: fix XDP_UMEM_SG_FLAG issues
     - xsk: validate MTU against usable frame size on bind
     - xfrm: Wait for RCU readers during policy netns exit
     - xfrm: fix refcount leak in xfrm_migrate_policy_find
     - xfrm_user: fix info leak in build_mapping()
     - ipvs: fix NULL deref in ip_vs_add_service error path
     - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator
     - netfilter: xt_multiport: validate range encoding in checkentry
     - netfilter: ip6t_eui64: reject invalid MAC header for all packets
     - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC ->
       GFP_KERNEL_ACCOUNT allocation
     - netfilter: nfnetlink_queue: make hash table per queue
     - net: txgbe: leave space for null terminators on property_entry
     - af_unix: read UNIX_DIAG_VFS data under unix_state_lock
     - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
     - net: ipa: fix event ring index not programmed for IPA v5.0+
     - l2tp: Drop large packets with UDP encap
     - gpio: tegra: fix irq_release_resources calling enable instead of disable
     - crypto: af_alg - limit RX SG extraction by receive buffer budget
     - [amd64] perf/x86/intel/uncore: Skip discovery table for offline dies
     - sched/deadline: Use revised wakeup rule for dl_server
     - crypto: algif_aead - Fix minimum RX size check for decryption
     - netfilter: conntrack: add missing netlink policy validations
       (CVE-2026-31407)
     - Revert "drm/xe/mmio: Avoid double-adjust in 64-bit reads"
     - Revert "drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt"
     - thermal: core: Mark thermal zones as exiting before unregistration
     - thermal: core: Address thermal zone removal races with resume
     - ALSA: usb-audio: Improve Focusrite sample rate filtering
     - [amd64,arm64] idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC
       handling
     - nfc: llcp: add missing return after LLCP_CLOSED checks
     - can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)
     - i2c: s3c24xx: check the size of the SMBUS message before using it
     - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
     - HID: alps: fix NULL pointer dereference in alps_raw_event()
     - HID: core: clamp report_size in s32ton() to avoid undefined shift
     - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
     - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
     - [arm*] drm/vc4: platform_get_irq_byname() returns an int
     - ALSA: fireworks: bound device-supplied status before string array lookup
     - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
     - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()
     - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
     - usb: gadget: renesas_usb3: validate endpoint index in standard request
       handlers
     - smb: client: fix off-by-8 bounds check in check_wsl_eas()
     - ksmbd: validate EaNameLength in smb2_get_ea()
     - ksmbd: require 3 sub-authorities before reading sub_auth[2]
     - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc
     - usbip: validate number_of_packets in usbip_pack_ret_submit()
     - usb: storage: Expand range of matched versions for VL817 quirks entry
     - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen
     - usb: gadget: f_hid: don't call cdev_init while cdev in use
     - usb: port: add delay after usb_hub_set_port_power()
     - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
     - scripts: generate_rust_analyzer.py: avoid FD leak
     - wifi: rtw88: fix device leak on probe failure
     - staging: sm750fb: fix division by zero in ps_to_hz()
     - USB: serial: option: add Telit Cinterion FN990A MBIM composition
     - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates
       race
     - ALSA: ctxfi: Limit PTP to a single page
     - dcache: Limit the minimal number of bucket to two
     - media: vidtv: fix NULL pointer dereference in
       vidtv_channel_pmt_match_sections
     - ocfs2: fix possible deadlock between unlink and dio_end_io_write
     - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
     - ocfs2: handle invalid dinode in ocfs2_group_extend
     - PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup
     - [amd64] KVM: SEV: Reject attempts to sync VMSA of an
       already-launched/encrypted vCPU
     - [amd64] KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being
       created
     - [amd64] KVM: SEV: Drop WARN on large size for
       KVM_MEMORY_ENCRYPT_REG_REGION
     - gpiolib: unify two loops initializing GPIO descriptors
     - gpiolib: fix race condition for gdev->srcu (CVE-2026-22986)
     - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr()
     - kernel: be more careful about dup_mmap() failures and uprobe registering
     - KVM: Remove subtle "struct kvm_stats_desc" pseudo-overlay
     - [amd64] KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs
     - checkpatch: add support for Assisted-by tag
     - [amd64] x86-64: rename misleadingly named '__copy_user_nocache()' function
     - [amd64] x86: rename and clean up __copy_from_user_inatomic_nocache()
     - x86-64/arm64/powerpc: clean up and rename __copy_from_user_flushcache
     - [amd64] KVM: x86: Use scratch field in MMIO fragment to hold small write
       values
     - [arm64] ASoC: qcom: q6apm: move component registration to unmanaged
       version
     - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
     - media: vidtv: fix nfeeds state corruption on start_streaming failure
     - media: mediatek: vcodec: fix use-after-free in encoder release path
     - media: em28xx: fix use-after-free in em28xx_v4l2_open()
     - hwmon: (powerz) Fix use-after-free on USB disconnect
     - ALSA: 6fire: fix use-after-free on disconnect
     - bcache: fix cached_dev.sb_bio use-after-free and crash
     - media: as102: fix to not free memory after the device is registered in
       as102_usb_probe()
     - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map
     - media: vidtv: fix pass-by-value structs causing MSAN warnings
     - media: hackrf: fix to not free memory after the device is registered in
       hackrf_probe()
     - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block()
     - ocfs2: validate inline data i_size during inode read
     - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
     - rxrpc: Fix key quota calculation for multitoken keys
     - PCI: Fix placement of pci_save_state() in pci_bus_add_device()
     - ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)
     - PCI: Revert "Enable ACS after configuring IOMMU for OF platforms"
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.84
     - mm/userfaultfd: fix hugetlb fault mutex hash calculation
     - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown
     - ima: verify if the segment size has changed
     - ima: do not copy measurement list to kdump kernel
     - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
     - [arm64] net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU
       registers
     - drm/amdgpu: replace PASID IDR with XArray
     - mm/pagewalk: fix race between concurrent split and refault
     - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger
     - scripts/dtc: Remove unused dts_version in dtc-lexer.l
     - rxrpc: only handle RESPONSE during service challenge
     - fs/ntfs3: validate rec->used in journal-replay file record check
     - f2fs: fix to avoid memory leak in f2fs_rename()
     - fuse: reject oversized dirents in page cache
     - fuse: Check for large folio with SPLICE_F_MOVE
     - fuse: quiet down complaints in fuse_conn_limit_write
     - ksmbd: require minimum ACE size in smb_check_perm_dacl()
     - smb: server: fix active_num_conn leak on transport allocation failure
     - smb: server: fix max_connections off-by-one in tcp accept path
     - smb: client: require a full NFS mode SID before reading mode bits
     - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
     - ksmbd: validate response sizes in ipc_validate_msg()
     - ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()
     - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
     - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
     - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()
     - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu
     - ALSA: caiaq: take a reference on the USB device in create_card()
     - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
     - [amd64] crypto: ccp: Don't attempt to copy CSR to userspace if PSP command
       failed
     - [amd64] crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP
       command failed
     - [amd64] crypto: ccp: Don't attempt to copy ID to userspace if PSP command
       failed
     - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.85
     - crypto: scatterwalk - Backport memcpy_sglist()
     - crypto: algif_aead - use memcpy_sglist() instead of null skcipher
     - crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)
     - crypto: algif_aead - snapshot IV for async AEAD requests
     - crypto: authenc - use memcpy_sglist() instead of null skcipher
     - crypto: authencesn - Do not place hiseq at end of dst for out-of-place
       decryption
     - crypto: authencesn - Fix src offset when decrypting in-place
     - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
     - xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
     - Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)
linux (6.12.74-2) trixie-security; urgency=high
 .
   * Refresh patchset to address multiple vulnerabilities in AppArmor
linux (6.12.74-2~bpo12+1) bookworm-backports; urgency=high
 .
   * Rebuild for bookworm-backports
 .
 linux (6.12.74-2) trixie-security; urgency=high
 .
   * Refresh patchset to address multiple vulnerabilities in AppArmor
 .
 linux (6.12.74-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.74
     - scsi: qla2xxx: Fix bsg_done() causing double free
     - bnxt_en: Change FW message timeout warning
     - bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code
     - [arm64] bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs
       show functions
     - [arm64] bus: fsl-mc: fix use-after-free in driver_override_show()
       (CVE-2026-23221)
     - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
     - [amd64] ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list
     - ALSA: hda/realtek: Add quirk for Inspur S14-G1
     - ALSA: hda/realtek - fixed speaker no sound
     - romfs: check sb_set_blocksize() return value
     - [arm64,armhf] drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not
       used
     - [amd64] platform/x86: classmate-laptop: Add missing NULL pointer checks
     - [amd64] ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9
     - [amd64] ASoC: amd: yc: Add quirk for HP 200 G2a 16
     - ALSA: hda/realtek: Enable headset mic for Acer Nitro 5
     - [amd64] platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro
     - [amd64] platform/x86: panasonic-laptop: Fix sysfs group leak in error path
     - [amd64] ASoC: cs42l43: Correct handling of 3-pole jack load detection
     - tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow
     - drm/amd/display: extend delta clamping logic to CM3 LUT helper
     - drm/amd/display: remove assert around dpp_base replacement
     - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count
     - mm/hugetlb: fix hugetlb_pmd_shared() (CVE-2026-23100)
     - mm/hugetlb: fix two comments related to huge_pmd_unshare()
     - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using
       mmu_gather
     - Revert "wireguard: device: enable threaded NAPI"
     - cpuset: Fix missing adaptation for cpuset_is_populated
     - fbdev: smscufx: properly copy ioctl memory to kernelspace
     - f2fs: fix to add gc count stat in f2fs_gc_range
     - f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly
     - f2fs: fix out-of-bounds access in sysfs attribute read/write
     - f2fs: fix to avoid mapping wrong physical block for swapfile
     - [arm64] iommu/arm-smmu-qcom: do not register driver in probe()
     - f2fs: fix to avoid UAF in f2fs_write_end_io()
     - f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent
       atomic commit and checkpoint writes
     - USB: serial: option: add Telit FN920C04 RNDIS compositions
 .
   [ Simone Weiß ]
   * db-mok: Remove unused function, fixing compilation warning
 .
   [ Ben Hutchings ]
   * CI: Delete support for ccache, which was removed from common pipeline
   * CI: Update build job to work after another common pipeline change
 .
   [ Salvatore Bonaccorso ]
   * apparmor: validate DFA start states are in bounds in unpack_pdb
   * apparmor: fix memory leak in verify_header
   * apparmor: replace recursive profile removal with iterative approach
   * apparmor: fix side-effect bug in match_char() macro usage
   * apparmor: fix missing bounds check on DEFAULT table in verify_dfa()
   * apparmor: Fix double free of ns_name in aa_replace_profiles()
   * apparmor: unprivileged local user can privilge escalate policy management
   * apparmor: fix differential encoding verification
   * apparmor: fix race on rawdata dereference

linux-signed-amd64 (6.12.86+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.86-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.86
     - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
     - ALSA: usb-audio: Avoid false E-MU sample-rate notifications
     - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch
     - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable()
     - usb: chipidea: otg: not wait vbus drop if use role_switch
     - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change
     - ALSA: usb-audio: Evaluate packsize caps at the right place
     - LoongArch: Add spectre boundry for syscall dispatch table
     - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
     - leds: qcom-lpg: Check for array overflow when selecting the high
       resolution
     - greybus: gb-beagleplay: bound bootloader receive buffering
     - greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames()
     - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()
     - ibmasm: fix OOB reads in command_file_write due to missing size checks
     - ibmasm: fix heap over-read in ibmasm_send_i2o_message()
     - driver core: Don't let a device probe until it's ready
     - drm/nouveau: fix nvkm_device leak on aperture removal failure
     - kbuild: rust: allow `clippy::uninlined_format_args`
     - firmware: google: framebuffer: Do not mark framebuffer as busy
     - arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
     - padata: Fix pd UAF once and for all (CVE-2025-38584)
     - padata: Remove comment for reorder_work
     - rust: init: fix `clippy::undocumented_unsafe_blocks` warnings
     - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array
     - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion
       (CVE-2026-23468)
     - device property: Make modifications of fwnode "flags" thread safe
     - ocfs2: split transactions in dio completion to avoid credit exhaustion
     - zram: do not forget to endio for partial discard requests
     - wifi: rtw88: check for PCI upstream bridge existence
     - vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex
     - vfio/cdx: Fix NULL pointer dereference in interrupt trigger path
     - um: drivers: call kernel_strrchr() explicitly in cow_user.c
     - spi: imx: fix use-after-free on unbind
     - spi: ch341: fix memory leaks on probe failures
     - mm/memory_hotplug: fix hwpoisoned large folio handling in
       do_migrate_range()
     - crypto: pcrypt - Fix handling of MAY_BACKLOG requests
     - of: unittest: fix use-after-free in of_unittest_changeset()
     - of: unittest: fix use-after-free in testdrv_probe()
     - hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt
     - media: amphion: Fix race between m2m job_abort and device_run
     - ALSA: control: Validate buf_len before strnlen() in
       snd_ctl_elem_init_enum_names()
     - net: caif: clear client service pointer on teardown
     - net: strparser: fix skb_head leak in strp_abort_strp()
     - media: mtk-jpeg: fix use-after-free in release path due to uncancelled
       work
     - crypto: atmel-sha204a - Fix OTP sysfs read and error handling
     - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown
     - Revert "ALSA: usb: Increase volume range that triggers a warning"
     - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete
     - lib/ts_kmp: fix integer overflow in pattern length calculation
     - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in
       imx219_probe()
     - net: qrtr: ns: Fix use-after-free in driver remove()
     - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
     - ALSA: aoa: i2sbus: fix OF node lifetime handling
     - ALSA: ctxfi: Add fallback to default RSR for S/PDIF
     - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes
     - erofs: fix the out-of-bounds nameoff handling for trailing dirents
     - jbd2: fix deadlock in jbd2_journal_cancel_revoke()
     - md/raid10: fix deadlock with check operation and nowait requests
     - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused
     - mtd: docg3: fix use-after-free in docg3_release()
     - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4
     - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set
     - parisc: _llseek syscall is only available for 32-bit userspace
     - remoteproc: xlnx: Only access buffer information if IPI is buffered
     - sched: Use u64 for bandwidth ratio calculations
     - rbd: fix null-ptr-deref when device_add_disk() fails
     - block: fix zone write plugs refcount handling in
       disk_zone_wplug_schedule_bio_work()
     - io_uring/timeout: check unused sqe fields
     - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned()
     - io_uring/poll: fix signed comparison in io_poll_get_ownership()
     - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE
     - ALSA: core: Fix potential data race at fasync handling
     - ALSA: caiaq: Fix control_put() result and cache rollback
     - ALSA: caiaq: Handle probe errors properly
     - ALSA: 6fire: Fix input volume change detection
     - ALSA: pcmtest: fix reference leak on failed device registration
     - ALSA: pcmtest: Fix resource leaks in module init error paths
     - iio: adc: ad7768-1: fix one-shot mode data acquisition
     - rxrpc: Fix memory leaks in rxkad_verify_response()
     - rxrpc: Fix rxkad crypto unalignment handling
     - rxrpc: Fix re-decryption of RESPONSE packets
     - tools/accounting: handle truncated taskstats netlink messages
     - arm64: dts: marvell: uDPU: add ethernet aliases
     - net: qrtr: ns: Free the node during ctrl_cmd_bye()
     - net: rds: fix MR cleanup on copy error
     - net: txgbe: fix firmware version check
     - net/smc: avoid early lgr access in smc_clc_wait_msg
     - net: ks8851: Reinstate disabling of BHs around IRQ handler
     - netconsole: avoid out-of-bounds access on empty string in trim_newline()
     - net: ks8851: Avoid excess softirq scheduling
     - drm/arcpgu: fix device node leak
     - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
     - ipv4: icmp: validate reply type before using icmp_pointers
     - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()
     - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE'
     - tpm: avoid -Wunused-but-set-variable
     - LoongArch: Show CPU vulnerabilites correctly
     - power: supply: axp288_charger: Do not cancel work before initializing it
     - hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data()
     - randomize_kstack: Maintain kstack_offset per task
     - mmc: block: use single block write in retry
     - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration
     - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins
     - xfs: fix a resource leak in xfs_alloc_buftarg()
     - firmware: google: framebuffer: Do not unregister platform device
     - crypto: talitos - fix SEC1 32k ahash request limitation
     - crypto: talitos - rename first/last to first_desc/last_desc
     - pwm: imx-tpm: Count the number of enabled channels in probe
     - tpm: Fix auth session leak in tpm2_get_random() error path
     - tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()
     - tpm: tpm_tis: add error logging for data transfer
     - tpm: tpm_tis: stop transmit if retries are exhausted
     - rtc: ntxec: fix OF node reference imbalance
     - mm/damon/core: use time_in_range_open() for damos quota window start
     - userfaultfd: allow registration of ranges below mmap_min_addr
     - KVM: x86: Defer non-architectural deliver of exception payload to
       userspace read
     - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state
     - KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2
     - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
     - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0
     - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts
     - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode
     - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT
     - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN
     - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID)
     - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT
     - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT
     - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS
     - KVM: nSVM: Add missing consistency check for nCR3 validity
     - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
     - KVM: nSVM: Always intercept VMMCALL when L2 is active
     - io_uring/poll: fix multishot recv missing EOF on wakeup race
     - perf annotate: Use jump__delete when freeing LoongArch jumps
     - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access
     - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()
     - mtd: spi-nor: sst: Fix write enable before AAI sequence
     - amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2
     - md/raid5: fix soft lockup in retry_aligned_read()
     - md/raid5: validate payload size before accessing journal metadata
     - check-uapi: link into shared objects
     - HID: apple: ensure the keyboard backlight is off if suspending
     - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails
     - x86/cpu: Disable FRED when PTI is forced on
     - wifi: rtl8xxxu: fix potential use of uninitialized value
     - tcp: call sk_data_ready() after listener migration
     - taskstats: set version in TGID exit notifications
     - mfd: core: Preserve OF node when ACPI handle is present
     - apparmor: use target task's context in apparmor_getprocattr()
     - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
     - bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays
     - can: ucan: fix devres lifetime
     - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit
     - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup
     - crypto: atmel-ecc - Release client on allocation failure
     - crypto: hisilicon - Fix dma_unmap_single() direction
     - crypto: ccree - fix a memory leak in cc_mac_digest()
     - crypto: atmel-tdes - fix DMA sync direction
     - crypto: atmel-sha204a - Fix error codes in OTP reads
     - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path
     - crypto: atmel-sha204a - Fix uninitialized data access on OTP read error
     - crypto: nx - Fix packed layout in struct nx842_crypto_header
     - dm mirror: fix integer overflow in create_dirty_log()
     - ceph: only d_add() negative dentries when they are unhashed
     - IB/core: Fix zero dmac race in neighbor resolution
     - ktest: Fix the month in the name of the failure directory
     - ntfs3: add buffer boundary checks to run_unpack()
     - ntfs3: fix integer overflow in run_unpack() volume boundary check
     - rtmutex: Use waiter::task instead of current in remove_waiter()
     - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails
     - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode
     - smb: client: validate the whole DACL before rewriting it in cifsacl
       (CVE-2026-31709)
     - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in
       f2fs_write_end_io() (CVE-2026-31715)
     - lib: test_hmm: evict device pages on file close to avoid use-after-free
     - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally
     - ksmbd: use msleep instaed of schedule_timeout_interruptible()
     - ksmbd: replace connection list with hash table
     - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id()
     - thermal: core: Fix thermal zone governor cleanup issues
     - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor
     - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling
     - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
     - mm/migrate: factor out movable_ops page handling into
       migrate_movable_ops_page()
     - mm/migrate: move movable_ops page handling out of move_to_new_folio()
     - mm: migrate: requeue destination folio on deferred split queue
     - ALSA: aoa: Use guard() for mutex locks
     - ALSA: aoa: i2sbus: clear stale prepared state
     - mm/zsmalloc: copy KMSAN metadata in zs_page_migrate()
     - media: rc: ttusbir: respect DMA coherency rules
     - ALSA: aoa: Skip devices with no codecs in i2sbus_resume()
     - media: rc: igorplugusb: heed coherency rules
     - RDMA/mana_ib: Disable RX steering on RSS QP destroy
     - block: relax pgmap check in bio_add_page for compatible zone device pages
     - iio: frequency: admv1013: add dev variable
     - iio: frequency: admv1013: fix NULL pointer dereference on str
     - rxrpc: Fix potential UAF after skb_unshare() failure
     - net: qrtr: ns: Limit the maximum server registration per node
     - net: qrtr: ns: Limit the maximum number of lookups
     - net: bridge: use a stable FDB dst snapshot in RCU readers
     - net: mctp: fix don't require received header reserved bits to be zero
     - net: qrtr: ns: Limit the total number of nodes
     - spi: fix resource leaks on device setup failure
     - mm: prevent droppable mappings from being locked
     - crypto: authencesn - reject short ahash digests during instance creation
     - net: bonding: fix use-after-free in bond_xmit_broadcast() (CVE-2026-31419)
     - driver core: Add kernel-doc for DEV_FLAG_COUNT enum value
     - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path
     - ALSA: caiaq: Don't abort when no input device is available
     - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
     - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
     - drm/amdgpu: fix zero-size GDS range init on RDNA4
     - ALSA: caiaq: fix usb_dev refcount leak on probe failure
     - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
     - netfilter: reject zero shift in nft_bitwise
 .
   [ Ben Hutchings ]
   * Fix ordering of kernel version strings for multiple Debian revisions
     (Closes: #1113728)
   * rxrpc: Fix conn-level packet handling to unshare RESPONSE packets
 .
   [ Salvatore Bonaccorso ]
   * xfrm: esp: avoid in-place decrypt on shared skb frags
   * rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
linux-signed-amd64 (6.12.86+1~bpo12+1) bookworm-backports; urgency=high
 .
   * Sign kernel from linux 6.12.86-1~bpo12+1
 .
   * Rebuild for bookworm-backports
linux-signed-amd64 (6.12.85+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.85-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.75
     - RDMA/siw: Fix potential NULL pointer dereference in header processing
     - RDMA/umad: Reject negative data_len in ib_umad_write
     - auxdisplay: arm-charlcd: fix release_mem_region() size
     - hfsplus: return error when node already exists in hfs_bnode_create
     - rcu: Refactor expedited handling check in rcu_read_unlock_special()
     - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler()
     - rcu: Fix rcu_read_unlock() deadloop due to softirq
     - audit: move the compat_xxx_class[] extern declarations to audit_arch.h
     - i3c: Move device name assignment after i3c_bus_init
     - fs: add <linux/init_task.h> for 'init_fs'
     - i3c: master: Update hot-join flag only on success
     - gfs2: Retries missing in gfs2_{rename,exchange}
     - gfs2: Fix slab-use-after-free in qd_put
     - gfs2: Fix use-after-free in iomap inline data write path
     - i3c: dw: Initialize spinlock to avoid upsetting lockdep
     - i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers()
     - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure
     - tpm: st33zp24: Fix missing cleanup on get_burstcount() error
     - erofs: get rid of raw bi_end_io() usage
     - erofs: handle end of filesystem properly for file-backed mounts
     - btrfs: qgroup: return correct error when deleting qgroup relation item
     - btrfs: fix block_group_tree dirty_list corruption
     - smb: client: fix potential UAF and double free in smb2_open_file()
     - block: add a bio_add_virt_nofail helper
     - rnbd-srv: use bio_add_virt_nofail
     - rnbd-srv: Fix server side setting of bi_size for special IOs
     - xen/virtio: Don't use grant-dma-ops when running as Dom0
     - io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED
     - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()
     - io_uring/sync: validate passed in offset
     - cpuidle: governors: menu: Always check timers with tick stopped
     - thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature
     - md/raid5: fix raid5_run() to return error when log_init() fails
     - md/raid10: fix any_working flag handling in raid10_sync_request
     - OPP: Return correct value in dev_pm_opp_get_level
     - cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id()
     - iomap: fix submission side handling of completion side errors
     - thermal/of: Fix reference leak in thermal_of_cm_lookup()
     - ublk: Validate SQE128 flag before accessing the cmd
     - Partial revert "x86/xen: fix balloon target initialization for PVH dom0"
     - md/raid1: fix memory leak in raid1_run() if no active rdev
     - md/raid1: fix memory leak in raid1_run()
     - PM: wakeup: Handle empty list in wakeup_sources_walk_start()
     - perf: arm_spe: Properly set hw.state on failures
     - cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not
       possible
     - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races
     - [s390x] cio: Fix device lifecycle handling in css_alloc_subchannel()
     - [amd64] perf/x86/core: Do not set bit width for unavailable counters
     - crypto: qat - fix warning on adf_pfvf_pf_proto.c
     - libbpf: Fix OOB read in btf_dump_get_bitfield_value
     - [armhf] VDSO: Patch out __vdso_clock_getres() if unavailable
     - [arm64] crypto: cavium - fix dma_free_coherent() size
     - bpf: Preserve id of register in sync_linked_regs()
     - hrtimer: Fix trace oddity
     - [amd64] crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls
     - [amd64] crypto: ccp - narrow scope of snp_range_list
     - bpf, sockmap: Fix incorrect copied_seq calculation
     - bpf, sockmap: Fix FIONREAD for sockmap
     - tracing: Add a comment about ftrace_regs definition
     - ftrace: Make ftrace_regs abstract from direct use
     - ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs
     - ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros
     - ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value
     - fgraph: Replace fgraph_ret_regs with ftrace_regs
     - tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs
     - tracing: Add ftrace_fill_perf_regs() for perf event
     - [amd64] x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return
       probe
     - [amd64] x86/fgraph,bpf: Switch kprobe_multi program stack unwind to
       hw_regs path
     - [arm64] crypto: caam - fix netdev memory leak in dpaa2_caam_probe
     - bpf: Fix bpf_xdp_store_bytes proto for read-only arg
     - genirq: Set IRQF_COND_ONESHOT in devm_request_irq().
     - [amd64] platform/x86: int0002: Remove IRQF_ONESHOT from request_irq()
     - Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler
     - scsi: efct: Use IRQF_ONESHOT and default primary handler
     - EDAC/altera: Remove IRQF_ONESHOT
     - mfd: wm8350-core: Use IRQF_ONESHOT
     - media: pci: mg4b: Use IRQF_NO_THREAD
     - sched/deadline: Clear the defer params
     - sched/rt: Skip currently executing CPU in rto_next_cpu()
     - hwrng: core - Allow runtime disabling of the HW RNG
     - hwrng: core - use RCU and work_struct to fix race condition
     - pstore/ram: fix buffer overflow in persistent_ram_save_old()
     - soc: qcom: smem: handle ENOMEM error during probe
     - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size()
     - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size()
     - firmware: arm_ffa: Correct 32-bit response handling in
       NOTIFICATION_INFO_GET
     - [arm64] dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings
     - [arm64] dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings
     - [arm64] clk: qcom: Return correct error code in qcom_cc_probe_by_index()
     - [arm64] dts: qcom: sdm630: fix gpu_speed_bin size
     - [arm64] dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on
     - [arm64] dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on
     - [arm64] dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks
     - [arm64] dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of
       AD7147
     - [armhf] dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property
     - [powerpc*] uaccess: Move barrier_nospec() out of
       allow_read_{from/write}_user()
     - [arm64] soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in
       cmd_db_dev_probe
     - [arm64] soc: mediatek: svs: Fix memory leak in svs_enable_debug_write()
     - [powerpc*] eeh: fix recursive pci_lock_rescan_remove locking in EEH event
       handling
     - [arm64] dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node
     - [arm64] dts: amlogic: s4: assign mmc b clock to 24MHz
     - [arm64] dts: amlogic: s4: fix mmc clock assignment
     - [arm64] dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order
     - [arm64] dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog
       instances for j784s4
     - hwspinlock: omap: Handle devm_pm_runtime_enable() errors
     - [arm64] dts: amlogic: c3: assign the MMC signal clocks
     - [arm64] dts: amlogic: axg: assign the MMC signal clocks
     - [arm64] dts: amlogic: gx: assign the MMC signal clocks
     - [arm64] dts: amlogic: g12: assign the MMC B and C signal clocks
     - [arm64] dts: amlogic: g12: assign the MMC A signal clock
     - [arm64] dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm
     - [arm64] dts: qcom: sdm845-db845c: drop CS from SPIO0
     - [arm64] dts: qcom: sdm845-db845c: specify power for WiFi CH1
     - [arm64] dts: qcom: x1e: bus is 40-bits (fix 64GB models)
     - [arm64] dts: qcom: agatti: Add CX_MEM/DBGC GPU regions
     - [arm64] dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions
     - [arm64] drm/panthor: Recover from panthor_gpu_flush_caches() failures
     - [arm64] drm/panthor: Fix the full_tick check
     - [arm64] drm/panthor: Fix the group priority rotation logic
     - [arm64] drm/panthor: Fix immediate ticking on a disabled tick
     - [arm64] drm/panthor: Fix the logic that decides when to stop ticking
     - [arm64] drm/panthor: Make sure we resume the tick when new jobs are
       submitted
     - workqueue: Factor out assign_rescuer_work()
     - workqueue: Only assign rescuer work when really needed
     - workqueue: Process rescuer work items one-by-one using a cursor
     - drm/panel: sw43408: Remove manual invocation of unprepare at remove
     - ALSA: pcm: use new array-copying-wrapper
     - ALSA: pcm: Relax __free() variable declarations
     - ALSA: vmaster: Relax __free() variable declarations
     - [arm64] drm/panthor: Evict groups before VM termination
     - [amd64] ASoC: nau8821: Consistently clear interrupts before unmasking
     - [amd64] ASoC: nau8821: Avoid unnecessary blocking in IRQ handler
     - [amd64] ASoC: nau8821: Fixup nau8821_enable_jack_detect()
     - media: chips-media: wave5: Fix memory leak on codec_info allocation
       failure
     - drm/amd: Drop "amdgpu kernel modesetting enabled" message
     - drm/amdkfd: Fix signal_eviction_fence() bool return value
     - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init
     - [arm64] drm/msm/disp/dpu: add merge3d support for sc7280
     - [arm64] drm/msm/dpu: Set vsync source irrespective of mdp top support
     - [arm64] drm/msm/dpu: fix WD timer handling on DPU 8.x
     - regulator: core: move supply check earlier in set_machine_constraints()
     - HID: playstation: Add missing check for input_ff_create_memless
     - [arm64] drm/msm/disp: set num_planes to 1 for interleaved YUV formats
     - [arm64] drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x
     - media: ccs: Accommodate C-PHY into the calculation
     - [arm64] drm/msm/a2xx: fix pixel shader start on A225
     - drm/buddy: release free_trees array on buddy mm teardown
     - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev
     - media: uvcvideo: Fix allocation for small frame sizes
     - evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac()
     - drm/xe: Unregister drm device on probe error
     - platform/chrome: cros_ec_lightbar: Fix response size initialization
     - HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients
     - spi: tools: Add include folder to .gitignore
     - Revert "hwmon: (ibmpex) fix use-after-free in high/low store"
     - hwmon: pmbus: mpq8785: Prepare driver for multiple device support
     - hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio
       configuration
     - hwmon: pmbus: mpq8785: Add support for MPM82504
     - hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification
     - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails
     - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors
     - PCI/PM: Avoid redundant delays on D3hot->D3cold
     - wifi: cfg80211: Fix use_for flag update on BSS refresh
     - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails
     - docs: fix WARNING document not included in any toctree
     - Documentation: trace: Refactor toctree
     - Documentation: tracing: Add PCI tracepoint documentation
     - PCI: Do not attempt to set ExtTag for VFs
     - PCI/portdrv: Fix potential resource leak
     - dm: fix unlocked test for dm_suspended_md
     - dm: use READ_ONCE in dm_blk_report_zones
     - quota: fix livelock between quotactl and freeze_super
     - net: mctp-i2c: fix duplicate reception of old data
     - mctp i2c: initialise event handler read bytes
     - wifi: cfg80211: stop NAN and P2P in cfg80211_leave
     - netfilter: nf_tables: reset table validation state on abort
     - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH
     - netfilter: nf_conncount: increase the connection clean up limit to 64
     - netfilter: nft_compat: add more restrictions on netlink attributes
     - netfilter: nf_conncount: fix tracking of connections from localhost
     - module: add helper function for reading module_buildid()
     - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup()
     - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken
     - [amd64] iommu/vt-d: Flush cache for PASID table before using it
     - [amd64] iommu/vt-d: Separate page request queue from SVM
     - [amd64] iommu/vt-d: Drain PRQs when domain removed from RID
     - [amd64] iommu/vt-d: Avoid draining PRQ in sva mm release path
     - [amd64] iommu/vt-d: Clear Present bit before tearing down PASID entry
     - dm: use bio_clone_blkg_association
     - xdrgen: Fix struct prefix for typedef types in program wrappers
     - NFS: NFSERR_INVAL is not defined by NFSv2
     - xdrgen: Initialize data pointer for zero-length items
     - nfsd: never defer requests during idmap lookup
     - fat: avoid parent link count underflow in rmdir
     - tcp: tcp_tx_timestamp() must look at the rtx queue
     - PCI: Check parent for NULL in of_pci_bus_release_domain_nr()
     - wifi: ath10k: sdio: add missing lock protection in
       ath10k_sdio_fw_crashed_dump()
     - PCI: Initialize RCB from pci_configure_device()
     - PCI: Add defines for bridge window indexing
     - PCI/ACPI: Restrict program_hpx_type2() to AER bits
     - ipc: don't audit capability check in ipc_permissions()
     - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit()
     - mptcp: fix receive space timestamp initialization
     - octeontx2-af: Fix PF driver crash with kexec kernel booting
     - bonding: only set speed/duplex to unknown, if getting speed failed
     - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
     - nfc: hci: shdlc: Stop timers and work before freeing context
     - netfilter: nfnetlink_queue: optimize verdict lookup with hash table
     - netfilter: nfnetlink_queue: do shared-unconfirmed check before
       segmentation
     - netfilter: nft_set_hash: fix get operation on big endian
     - netfilter: nft_counter: fix reset of counters on 32bit archs
     - netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null
       interval
     - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets
     - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404]
     - [arm64] net: hns3: fix double free issue for tx spare buffer
     - procfs: fix missing RCU protection when reading real_parent in
       do_task_stat()
     - smb: client: correct value for smbd_max_fragmented_recv_size
     - net: atm: fix crash due to unvalidated vcc pointer in sigd_send()
     - net: sunhme: Fix sbus regression
     - net: Add skb_dstref_steal and skb_dstref_restore
     - net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input
       callers
     - xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path
     - serial: caif: fix use-after-free in caif_serial ldisc_close()
     - octeon_ep: disable per ring interrupts
     - octeon_ep: ensure dbell BADDR updation
     - octeon_ep_vf: ensure dbell BADDR updation
     - ionic: Rate limit unknown xcvr type messages
     - octeontx2-pf: Unregister devlink on probe failure
     - RDMA/rtrs: server: remove dead code
     - IB/cache: update gid cache on client reregister event
     - RDMA/hns: Fix WQ_MEM_RECLAIM warning
     - RDMA/hns: Fix RoCEv1 failure due to DSCP
     - RDMA/hns: Notify ULP of remaining soft-WCs during reset
     - power: supply: ab8500: Fix use-after-free in power_supply_changed()
     - power: supply: act8945a: Fix use-after-free in power_supply_changed()
     - power: supply: bq256xx: Fix use-after-free in power_supply_changed()
     - power: supply: bq25980: Fix use-after-free in power_supply_changed()
     - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed()
     - power: supply: goldfish: Fix use-after-free in power_supply_changed()
     - power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed()
     - power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed()
     - power: supply: rt9455: Fix use-after-free in power_supply_changed()
     - power: supply: sbs-battery: Fix use-after-free in power_supply_changed()
     - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write
     - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported
     - power: supply: wm97xx: Fix NULL pointer dereference in
       power_supply_changed()
     - RDMA/rtrs-srv: fix SG mapping
     - RDMA/rxe: Fix double free in rxe_srq_from_init
     - RDMA/iwcm: Fix workqueue list corruption by removing work_list
     - tools/power/x86/intel-speed-select: Fix file descriptor leak in
       isolate_cpus()
     - RDMA/mlx5: Fix UMR hang in LAG error state unload
     - IB/mlx5: Fix port speed query for representors
     - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper
     - vfio/pci: Lock upstream bridge for vfio_pci_core_disable()
     - [amd64] platform/x86/amd/pmf: Prevent TEE errors after hibernate
     - [amd64] crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails
     - [amd64] crypto: ccp - Add an S4 restore flow
     - [amd64] crypto: ccp - Factor out ring destroy handling to a helper
     - [amd64] crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when
       PSP_CMD_TEE_RING_INIT fails
     - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse()
     - nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx
     - NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit
     - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send
     - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler
     - RDMA/rxe: Fix race condition in QP timer handlers
     - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing
     - cxl: Fix premature commit_end increment on decoder commit failure
     - mtd: parsers: ofpart: fix OF node refcount leak in
       parse_fixed_partitions()
     - mtd: spinand: Fix kernel doc
     - power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler
     - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer
     - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc
     - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN
     - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()
     - scsi: ufs: host: mediatek: Require CONFIG_PM
     - scsi: csiostor: Fix dereference of null pointer rn
     - nvdimm: virtio_pmem: serialize flush requests
     - fs/nfs: Fix readdir slow-start regression
     - tracing: Properly process error handling in event_hist_trigger_parse()
     - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros
     - fbdev: of_display_timing: Fix device node reference leak in
       of_get_display_timings()
     - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()
     - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs
     - clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs
     - clk: qcom: rcg2: compute 2d using duty fraction directly
     - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs
     - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc
     - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc
     - clk: qcom: gcc-ipq5018: flag sleep clock as critical
     - clk: Move clk_{save,restore}_context() to COMMON_CLK section
     - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks
     - clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src
     - clk: qcom: gfx3d: add parent to parent request map
     - clk: mediatek: Fix error handling in runtime PM setup
     - interconnect: mediatek: Don't hijack parent device
     - interconnect: mediatek: Aggregate bandwidth with saturating add
     - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX
     - dma: dma-axi-dmac: fix SW cyclic transfers
     - dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue
     - soundwire: intel_ace2x: add SND_HDA_CORE dependency
     - iio: test: drop dangling symbol in gain-time-scale helpers
     - staging: greybus: lights: avoid NULL deref
     - serial: imx: change SERIAL_IMX_CONSOLE to bool
     - serial: SH_SCI: improve "DMA support" prompt
     - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms
     - iio: pressure: mprls0025pa: fix spi_transfer struct initialisation
     - iio: pressure: mprls0025pa: fix SPI CS delay violation
     - iio: pressure: mprls0025pa: fix interrupt flag
     - iio: pressure: mprls0025pa: fix scan_type struct
     - iio: pressure: mprls0025pa: fix pressure calculation
     - watchdog: starfive-wdt: Fix PM reference leak in probe error path
     - coresight: etm3x: Fix cpulocked warning on cpuhp
     - phy: freescale: imx8qm-hsio: fix NULL pointer dereference
     - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms"
     - mfd: arizona: Fix regulator resource leak on
       wm5102_clear_write_sequencer() failure
     - mfd: simple-mfd-i2c: Add MAX77705 support
     - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA
     - mfd: simple-mfd-i2c: Add SpacemiT P1 support
     - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order
     - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support
     - drivers: iio: mpu3050: use dev_err_probe for regulator request
     - usb: bdc: fix sleep during atomic
     - pinctrl: equilibrium: Fix device node reference leak in pinbank_init()
     - ovl: Fix uninit-value in ovl_fill_real
     - iio: sca3000: Fix a resource leak in sca3000_probe()
     - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition
     - pinctrl: single: fix refcount leak in pcs_add_gpio_func()
     - leds: qcom-lpg: Check the return value of regmap_bulk_write()
     - backlight: qcom-wled: Support ovp values for PMI8994
     - backlight: qcom-wled: Change PM8950 WLED configurations
     - dmaengine: fsl-edma: don't explicitly disable clocks in .remove()
     - drbd: always set BLK_FEAT_STABLE_WRITES
     - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data
     - fs/ntfs3: Initialize new folios before use
     - fs/ntfs3: prevent infinite loops caused by the next valid being the same
     - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot
     - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs
     - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check
     - kbuild: Add objtool to top-level clean target
     - objpool: fix the overestimation of object pooling metadata size
     - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO
     - cpuidle: Skip governor when only one idle state is available
     - net: sparx5/lan969x: fix DWRR cost max to match hardware register width
     - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper
     - net: mscc: ocelot: split xmit into FDMA and register injection paths
     - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()
     - ipv6: Fix out-of-bound access in fib6_add_rt2node().
     - net: sparx5/lan969x: fix PTP clock max_adj value
     - net: usb: catc: enable basic endpoint checking
     - xen-netback: reject zero-queue configuration from guest
     - net/rds: rds_sendmsg should not discard payload_len
     - net: bridge: mcast: always update mdb_n_entries for vlan contexts
     - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value
     - ipvs: do not keep dest_dst if dev is going down
     - net: remove WARN_ON_ONCE when accessing forward path array
     - netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
       (CVE-2026-23231)
     - ipv6: fix a race in ip6_sock_set_v6only()
     - bpftool: Fix truncated netlink dumps
     - ping: annotate data-races in ping_lookup()
     - macvlan: observe an RCU grace period in macvlan_common_newlink() error
       path
     - icmp: prevent possible overflow in icmp_global_allow()
     - inet: move icmp_global_{credit,stamp} to a separate cache line
     - octeontx2-af: Fix default entries mcam entry action
     - bonding: alb: fix UAF in rlb_arp_recv during bond up/down
     - net/mlx5: Fix multiport device check over light SFs
     - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels
     - apparmor: fix NULL sock in aa_sock_file_perm
     - AppArmor: Allow apparmor to handle unaligned dfa tables
     - apparmor: Fix & Optimize table creation from possibly unaligned memory
     - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure
     - apparmor: fix rlimit for posix cpu timers
     - apparmor: remove apply_modes_to_perms from label_match
     - apparmor: make label_match return a consistent value
     - apparmor: avoid per-cpu hold underflow in aa_get_buffer
     - apparmor: fix invalid deref of rawdata when export_binary is unset
     - apparmor: fix aa_label to return state from compount and component match
     - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()
     - drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()
     - drm/amdgpu: Fix memory leak in amdgpu_ras_init()
     - ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put()
     - [amd64] drm/i915/acpi: free _DSM package when no connectors
     - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init
     - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2
     - drm/amd/display: Reject cursor plane on DCE when scaled differently than
       primary
     - drm/amd/display: Fix out-of-bounds stream encoder index v3
     - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe()
     - [s390x] kexec: Make KEXEC_SIG available when CONFIG_MODULES=n
     - drm/xe: Move forcewake to 'gt.pm' substructure
     - drm/xe: Create dedicated xe_mmio structure
     - drm/xe: Clarify size of MMIO region
     - drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio'
     - drm/xe: Populate GT's mmio iomap from tile during init
     - drm/xe: Switch mmio_ext to use 'struct xe_mmio'
     - drm/xe: Add xe_tile backpointer to xe_mmio
     - drm/xe: Adjust mmio code to pass VF substructure to SRIOV code
     - drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt
     - drm/xe/mmio: Avoid double-adjust in 64-bit reads
     - drm/xe/ptl: Apply Wa_13011645652
     - drm/xe/xe2_hpg: Add set of workarounds
     - drm/xe/xe2_hpg: Fix handling of Wa_14019988906 & Wa_14019877138
     - efi: Fix reservation of unaccepted memory table
     - btrfs: use the correct type to initialize block reserve for delayed refs
     - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not
       found
     - [amd64] x86/hyperv: Fix error pointer dereference
     - [arm64] ASoC: rockchip: i2s-tdm: Use param rate if not provided by
       set_sysclk
     - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats
     - ext4: subdivide EXT4_EXT_DATA_VALID1
     - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1
     - ext4: don't cache extent during splitting extent
     - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout
     - ext4: drop extent cache when splitting extent fails
     - ext4: fix memory leak in ext4_ext_shift_extents()
     - ext4: fix e4b bitmap inconsistency reports
     - ext4: fix dirtyclusters double decrement on fs shutdown
     - ext4: use optimized mballoc scanning regardless of inode format
     - ata: pata_ftide010: Fix some DMA timings
     - ata: libata-scsi: refactor ata_scsi_translate()
     - Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT
     - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths
     - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path
     - dt-bindings: phy: qcom-edp: Add missing clock for X Elite
     - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false
     - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names
     - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names
     - perf test stat: Update test expectations and events
     - perf test stat tests: Fix for virtualized machines
     - perf unwind-libdw: Fix invalid reference counts
     - perf callchain: Fix srcline printing with inlines
     - libsubcmd: Fix null intersection case in exclude_cmds()
     - perf maps: Fix reference count leak in maps__find_ams()
     - perf annotate: Fix memcpy size in arch__grow_instructions()
     - perf vendor events amd: Fix Zen 5 MAB allocation events
     - libperf: Don't remove -g when EXTRA_CFLAGS are used
     - libperf build: Always place libperf includes first
     - rtc: interface: Alarm race handling should not discard preceding error
     - statmount: permission check should return EPERM
     - audit: add fchmodat2() to change attributes class
     - hfsplus: fix volume corruption issue for generic/498
     - fs/buffer: add alert in try_to_free_buffers() for folios without buffers
     - audit: add missing syscalls to read class
     - hfsplus: pretend special inodes as regular files
     - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr()
     - i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init
     - minix: Add required sanity checking to minix_check_superblock()
     - dlm: validate length in dlm_search_rsb_tree
     - btrfs: fallback to buffered IO if the data profile has duplication
     - btrfs: handle user interrupt properly in btrfs_trim_fs()
     - smb: client: add proper locking around ses->iface_last_update
     - gfs2: fiemap page fault fix
     - smb: client: prevent races in ->query_interfaces()
     - tools/power cpupower: Reset errno before strtoull()
     - [s390x] purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
     - [arm64] Add support for TSV110 Spectre-BHB mitigation
     - rnbd-srv: Zero the rsp buffer before using it
     - [amd64] x86/xen/pvh: Enable PAE mode for 32-bit guest only when
       CONFIG_X86_PAE is set
     - EFI/CPER: don't dump the entire memory region
     - APEI/GHES: ensure that won't go past CPER allocated record
     - APEI/GHES: ARM processor Error: don't go past allocated memory
     - EFI/CPER: don't go past the ARM processor CPER record buffer
     - ACPI: processor: Fix NULL-pointer dereference in
       acpi_processor_errata_piix4()
     - ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[]
     - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP
     - powercap: intel_rapl: Add PL4 support for Ice Lake
     - alpha: fix user-space corruption during memory compaction
     - md-cluster: fix NULL pointer dereference in process_metadata_update
     - cpufreq: dt-platdev: Block the driver from probing on more QC platforms
     - [s390x] perf: Disable register readout on sampling events
     - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD
     - ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display)
     - ACPI: battery: fix incorrect charging status when current is zero
     - xenbus: Use .freeze/.thaw to handle xenbus devices
     - blk-mq-debugfs: add missing debugfs_mutex in
       blk_mq_debugfs_register_hctxs()
     - block: decouple secure erase size limit from discard size limit
     - bpf: verifier improvement in 32bit shift sign extension pattern
     - [amd64] perf/x86/msr: Add Airmont NP
     - [amd64] perf/x86/cstate: Add Airmont NP
     - bpf: crypto: Use the correct destructor kfunc type
     - bpf: Recognize special arithmetic shift in the verifier
     - clocksource/drivers/sh_tmu: Always leave device running after probe
     - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on
       OF
     - PCI/MSI: Unmap MSI-X region on error
     - crypto: hisilicon/qm - move the barrier before writing to the mailbox
       register
     - mailbox: bcm-ferxrm-mailbox: Use default primary handler
     - char: tpm: cr50: Remove IRQF_ONESHOT
     - sched/debug: Fix updating of ppos on server write ops
     - pstore: ram_core: fix incorrect success return when vmap() fails
     - firmware: arm_ffa: Unmap Rx/Tx buffers on init failure
     - [arm64] Revert "arm64: zynqmp: Add an OP-TEE node to the device tree"
     - [arm64] tegra: smaug: Add usb-role-switch support
     - drm/display/dp_mst: Add protection against 0 vcpi
     - gpu/panel-edp: add AUO panel entry for B140HAN06.4
     - drm/amdgpu: fix NULL pointer issue buffer funcs
     - drm/amdkfd: Handle GPU reset and drain retry fault race
     - spi-geni-qcom: initialize mode related registers to 0
     - spi-geni-qcom: use xfer->bits_per_word for can_dma()
     - drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32
     - [amd64] ASoC: SOF: ipc4: Support for sending payload along with
       LARGE_CONFIG_GET
     - media: dvb-core: dmxdevfilter must always flush bufs
     - spi: stm32: fix Overrun issue at < 8bpw
     - drm/v3d: Set DMA segment size to avoid debug warnings
     - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes
     - media: omap3isp: isppreview: always clamp in preview_try_format()
     - media: omap3isp: set initial format
     - media: chips-media: wave5: Fix conditional in start_streaming
     - media: chips-media: wave5: Process ready frames when CMD_STOP sent to
       Encoder
     - media: mediatek: vcodec: Don't try to decode 422/444 VP9
     - drm/amdgpu: add support for HDP IP version 6.1.1
     - drm/amd/display: Fix dsc eDP issue
     - drm/amdgpu: avoid a warning in timedout job handler
     - drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src
     - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards
     - drm/amdgpu: Skip loading SDMA_RS64 in VF
     - drm/amd/display: only power down dig on phy endpoints
     - drm/xe: Only toggle scheduling in TDR if GuC is running
     - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask
     - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug
     - spi: spi-mem: Limit octal DTR constraints to octal DTR situations
     - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START
     - drm/panel: Fix a possible null-pointer dereference in
       jdi_panel_dsi_remove()
     - media: adv7180: fix frame interval in progressive mode
     - media: pvrusb2: fix URB leak in pvr2_send_request_ex
     - media: solo6x10: Check for out of bounds chip_id
     - media: cx25821: Fix a resource leak in cx25821_dev_setup()
     - media: v4l2-async: Fix error handling on steps after finding a match
     - media: mt9m114: Avoid a reset low spike during probe()
     - media: mt9m114: Return -EPROBE_DEFER if no endpoint is found
     - media: ipu6: Ensure stream_mutex is acquired when dealing with node list
     - media: ipu6: Close firmware streams on streaming enable failure
     - media: ipu6: Always close firmware stream
     - ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk
     - drm/amdkfd: Relax size checking during queue buffer get
     - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map()
     - drm: Account property blob allocations to memcg
     - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed
     - virt: vbox: uapi: Mark inner unions in packed structs as packed
     - [amd64] ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to
       aggregated
     - PCI: Add Intel Nova Lake audio Device ID
     - drm/amd/display: Disable FEC when powering down encoders
     - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback
     - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional
       parts
     - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release
     - media: rkisp1: Fix filter mode register configuration
     - HID: multitouch: add eGalaxTouch EXC3188 support
     - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK
     - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro
     - ALSA: hda/realtek: fix LG Gram Style 14 speakers
     - gpio: aspeed-sgpio: Change the macro to support deferred probe
     - [arm64] ASoC: sunxi: sun50i-dmic: Add missing check for
       devm_regmap_init_mmio
     - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end
     - drm/amd/display: Fix GFX12 family constant checks
     - drm/amd/display: avoid dig reg access timeout on usb4 link training fail
     - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in
       max98390_i2c_probe()
     - hwmon: (dell-smm) Add support for Dell OptiPlex 7080
     - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE
     - hwmon: (f71882fg) Add F81968 support
     - HID: logitech-hidpp: Add support for Logitech K980
     - ASoC: es8328: Add error unwind in resume
     - modpost: Amend ppc64 save/restfpr symnames for -Os build
     - power: sequencing: fix missing state_lock in pwrseq_power_on() error path
     - [amd64] ASoC: SOF: Intel: hda: Fix NULL pointer dereference
     - spi: geni-qcom: Fix abort sequence execution for serial engine errors
     - ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe
     - ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx
     - ALSA: mixer: oss: Add card disconnect checkpoints
     - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio
     - jfs: Add missing set_freezable() for freezable kthread
     - jfs: nlink overflow in jfs_rename
     - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero
     - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()
     - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H
     - wifi: rtw89: 8922a: set random mac if efuse contains zeroes
     - wifi: rtw89: ser: enable error IMR after recovering from L1
     - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()
     - wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band
       data
     - dm: replace -EEXIST with -EBUSY
     - dm: remove fake timeout to avoid leak request
     - [arm64] iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency
     - net: wwan: mhi: Add network support for Foxconn T99W760
     - wifi: libertas: fix WARNING in usb_tx_block
     - [amd64] iommu/amd: move wait_on_sem() out of spinlock
     - wifi: rtw89: mac: correct page number for CSI response
     - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode
     - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1
     - wifi: ath11k: Fix failure to connect to a 6 GHz AP
     - wifi: ath12k: fix preferred hardware mode calculation
     - wifi: cfg80211: allow only one NAN interface, also in multi radio
     - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}()
     - ipv6: annotate data-races over sysctl.flowlabel_reflect
     - ipv6: exthdrs: annotate data-race over multiple sysctl
     - ext4: mark group add fast-commit ineligible
     - ext4: move ext4_percpu_param_init() before ext4_mb_init()
     - ext4: mark group extend fast-commit ineligible
     - ext4: use reserved metadata blocks when splitting extent on endio
     - netfilter: nf_conntrack: Add allow_clash to generic protocol handler
     - netfilter: xt_tcpmss: check remaining length before reading optlen
     - net: usb: r8152: fix transmit queue timeout
     - wifi: iwlwifi: mvm: check the validity of noa_len
     - wifi: rtw89: fix unable to receive probe responses under MLO connection
     - wifi: rtw89: 8922a: add digital compensation for 2GHz
     - net/rds: No shortcut out of RDS_CONN_ERROR
     - ext4: propagate flags to convert_initialized_extent()
     - gro: change the BUG_ON() in gro_pull_from_frag0()
     - ipv4: igmp: annotate data-races around idev->mr_maxdelay
     - [arm64] net: hns3: extend HCLGE_FD_AD_QID to 11 bits
     - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power()
     - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement()
     - ipv4: fib: Annotate access to struct fib_alias.fa_state.
     - Bluetooth: btusb: Add support for MediaTek7920 0489:e158
     - Bluetooth: hci_conn: Set link_policy on incoming ACL connections
     - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
     - Bluetooth: btusb: Add new VID/PID for RTL8852CE
     - Bluetooth: btusb: Add device ID for Realtek RTL8761BU
     - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky
     - net: sfp: add quirk for Lantech 8330-265D
     - wifi: rtw89: pci: restore LDO setting after device resume
     - wifi: ath10k: fix lock protection in
       ath10k_wmi_event_peer_sta_ps_state_chg()
     - bnxt_en: Allow ntuple filters for drops
     - net: usb: sr9700: remove code to drive nonexistent multicast filter
     - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16
     - net/rds: Clear reconnect pending bit
     - PCI: Mark ASM1164 SATA controller to avoid bus reset
     - PCI/AER: Clear stale errors on reporting agents upon probe
     - PCI: Fix pci_slot_lock () device locking
     - PCI: Enable ACS after configuring IOMMU for OF platforms
     - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur
     - PCI: Mark Nvidia GB10 to avoid bus reset
     - myri10ge: avoid uninitialized variable use
     - nfc: nxp-nci: remove interrupt trigger type
     - RDMA/rtrs-clt: For conn rejection use actual err number
     - ata: libata: avoid long timeouts on hot-unplugged SATA DAS
     - hisi_acc_vfio_pci: update status after RAS error
     - scsi: buslogic: Reduce stack usage
     - vhost: fix caching attributes of MMIO regions by setting them explicitly
     - scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event
     - [riscv64] vector: init vector context with proper vlenb
     - tracing: Fix false sharing in hwlat get_sample()
     - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX
       channel is uninitialized
     - mailbox: pcc: Remove spurious IRQF_ONESHOT usage
     - mailbox: imx: Skip the suspend flag for i.MX7ULP
     - mailbox: sprd: mask interrupts that are not handled
     - remoteproc: mediatek: Break lock dependency to `prepare_lock`
     - mailbox: sprd: clear delivery flag before handling TX done
     - clk: microchip: core: correct return value on *_get_parent()
     - HID: i2c-hid: Add FocalTech FT8112
     - 9p/xen: protect xen_9pfs_front_free against concurrent calls
     - dmaengine: stm32-dma3: use module_platform_driver
     - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15)
     - soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list
     - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure
     - serial: 8250_dw: handle clock enable errors in runtime_resume
     - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs
     - fpga: of-fpga-region: Fail if any bridge is missing
     - most: core: fix resource leak in most_register_interface error paths
     - dmaengine: sun6i: Choose appropriate burst length under maxburst
     - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings
     - phy: ti: phy-j721e-wiz: restore mux selection during resume
     - phy: cadence-torrent: restore parent clock for refclk during resume
     - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()
     - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66
     - usb: gadget: f_fs: fix DMA-BUF OUT queues
     - usb: gadget: f_fs: Fix ioctl error handling
     - usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()
     - staging: rtl8723bs: fix memory leak on failure path
     - serial: 8250: 8250_omap.c: Add support for handling UART error conditions
     - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA
       termination is done
     - fix it87_wdt early reboot by reporting running timer
     - [arm*] binder: don't use %pK through printk
     - watchdog: imx7ulp_wdt: handle the nowayout option
     - phy: mvebu-cp110-utmi: fix dr_mode property read from dts
     - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature
     - Revert "mfd: da9052-spi: Change read-mask to write-mask"
     - mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs
     - iio: Use IRQF_NO_THREAD
     - iio: magnetometer: Remove IRQF_ONESHOT
     - fs: ntfs3: check return value of indx_find to avoid infinite loop
     - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent
       metadata
     - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST
     - fs/ntfs3: drop preallocated clusters for sparse and compressed files
     - fs/ntfs3: avoid calling run_get_entry() when run == NULL in
       ntfs_read_run_nb_ra()
     - ceph: supply snapshot context in ceph_uninline_data()
     - libceph: define and enforce CEPH_MAX_KEY_LEN
     - thermal: int340x: Fix sysfs group leak on DLVR registration failure
     - [amd64] ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90
     - include: uapi: netfilter_bridge.h: Cover for musl libc
     - drm/amd/display: Fix writeback on DCN 3.2+
     - drm/amd/display: Fix system resume lag issue
     - drm/amd/display: Avoid updating surface with the same surface under MPO
     - drm/amdgpu: Adjust usleep_range in fence wait
     - ALSA: usb-audio: Update the number of packets properly at receiving
     - drm/amdgpu: Add HAINAN clock adjustment
     - drm/amd/display: bypass post csc for additional color spaces in dal
     - spi: spidev: fix lock inversion between spi_lock and buf_lock
     - drm/radeon: Add HAINAN clock adjustment
     - ALSA: usb-audio: Add sanity check for OOB writes at silencing
     - btrfs: replace BUG() with error handling in __btrfs_balance()
     - [arm64] hugetlbpage: avoid unused-but-set-parameter warning (gcc-16)
     - drm/amd/display: Remove conditional for shaper 3DLUT power-on
     - rtc: zynqmp: correct frequency value
     - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
     - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
     - xfrm6: fix uninitialized saddr in xfrm6_get_saddr()
     - xfrm: skip templates check for packet offload tunnel mode
     - ipmi: ipmb: initialise event handler read bytes
     - xfrm: always flush state and policy upon NETDEV_UNREGISTER event
     - espintcp: Fix race condition in espintcp_close() (CVE-2026-23239)
     - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
     - net: usb: lan78xx: scan all MDIO addresses on LAN7801
     - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set()
     - net: ethernet: xscale: Check for PTP support properly
     - bnxt_en: Fix RSS context delete logic
     - bnxt_en: Fix deleting of Ntuple filters
     - wifi: cfg80211: wext: fix IGTK key ID off-by-one
     - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option
     - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ
     - Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short
     - Bluetooth: hci_qca: Cleanup on all setup failures
     - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ
     - Bluetooth: L2CAP: Fix not checking output MTU is acceptable on
       L2CAP_ECRED_CONN_REQ
     - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
     - tls: Fix race condition in tls_sw_cancel_work_tx() (CVE-2026-23240)
     - kcm: fix zero-frag skb in frag_list on partial sendmsg error
     - tipc: fix duplicate publication key in tipc_service_insert_publ()
     - RDMA/core: Fix stale RoCE GIDs during netdev events at registration
     - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets
     - RDMA/efa: Fix typo in efa_alloc_mr()
     - net: usb: pegasus: enable basic endpoint checking
     - RDMA/umem: Fix double dma_buf_unpin in failure path
     - net/mlx5: DR, Fix circular locking dependency in dump
     - net/mlx5: E-switch, Clear legacy flag when moving to switchdev
     - net/mlx5: Fix missing devlink lock in SRIOV enable error path
     - net/mlx5e: Separate address related variables to be in struct
     - net/mlx5e: Support routed networks during IPsec MACs initialization
     - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query
     - net: consume xmit errors of GSO frames
     - dpaa2-switch: validate num_ifs to prevent out-of-bounds write
     - netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
     - rpmsg: core: fix race in driver_override_show() and use core helper
     - [arm64] clk: renesas: rzg2l: Fix intin variable size
     - [arm64] clk: renesas: rzg2l: Select correct div round macro
     - [amd64] ASoC: SOF: ipc4-control: If there is no data do not send bytes
       update
     - [amd64] ASoC: SOF: ipc4-topology: Correct the allocation size for bytes
       controls
     - [amd64] ASoC: SOF: ipc4-control: Use the correct size for
       scontrol->ipc_control_data
     - [amd64] ASoC: SOF: ipc4-control: Keep the payload size up to date
     - fpga: dfl: use subsys_initcall to allow built-in drivers to be added
     - Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global
       IRQ' is supported"
     - phy: qcom: edp: Make the number of clocks flexible
     - dm-verity: correctly handle dm_bufio_client_create() failure
     - media: mediatek: encoder: Fix uninitialized scalar variable issue
     - media: mtk-mdp: Fix error handling in probe function
     - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove()
     - media: chips-media: wave5: Fix kthread worker destruction in polling mode
     - media: chips-media: wave5: Fix device cleanup order to prevent kernel
       panic
     - media: verisilicon: AV1: Fix enable cdef computation
     - media: verisilicon: AV1: Fix tx mode bit setting
     - [arm64] dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs
     - [armhf] omap2: Fix reference count leaks in omap_control_init()
     - [amd64] KVM: x86: Return "unsupported" instead of "invalid" on access to
       unsupported PV MSR
     - [amd64] KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3()
       succeeding
     - [arm64] Disable branch profiling for all arm64 code
     - HID: hid-pl: handle probe errors
     - HID: magicmouse: Do not crash on missing msc->input
     - HID: prodikeys: Check presence of pm->input_ep82
     - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()
     - [arm64] dts: apple: t8112-j473: Keep the HDMI port powered on
     - media: amphion: Drop min_queued_buffers assignment
     - media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init()
     - media: verisilicon: AV1: Set IDR flag for intra_only frame type
     - media: radio-keene: fix memory leak in error path
     - media: cx88: Add missing unmap in snd_cx88_hw_params()
     - media: cx23885: Add missing unmap in snd_cx23885_hw_params()
     - media: cx25821: Add missing unmap in snd_cx25821_hw_params()
     - media: i2c/tw9903: Fix potential memory leak in tw9903_probe()
     - media: i2c/tw9906: Fix potential memory leak in tw9906_probe()
     - media: i2c: ov01a10: Fix the horizontal flip control
     - media: i2c: ov01a10: Fix reported pixel-rate value
     - media: i2c: ov01a10: Fix analogue gain range
     - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls
     - media: i2c: ov01a10: Fix passing stream instead of pad to
       v4l2_subdev_state_get_format()
     - media: i2c: ov01a10: Fix test-pattern disabling
     - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()
     - media: ccs: Avoid possible division by zero
     - media: i2c: ov5647: Initialize subdev before controls
     - media: i2c: ov5647: Correct pixel array offset
     - media: i2c: ov5647: Correct minimum VBLANK value
     - media: i2c: ov5647: Sensor should report RAW color space
     - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode
     - media: ccs: Fix setting initial sub-device state
     - media: i2c: ov5647: use our own mutex for the ctrl lock
     - media: ipu6: Fix typo and wrong constant in ipu6-mmu.c
     - media: ipu6: Fix RPM reference leak in probe error paths
     - [amd64] platform/x86: ISST: Add missing write block check
     - dm-integrity: fix a typo in the code for write/discard race
     - dm: clear cloned request bio pointer when last clone bio completes
     - [arm64] soc: ti: k3-socinfo: Fix regmap leak on probe failure
     - [arm64] soc: ti: pruss: Fix double free in pruss_clk_mux_setup()
     - [amd64] KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
     - bus: omap-ocp2scp: fix OF populate on driver rebind
     - clk: clk-apple-nco: Add "apple,t8103-nco" compatible
     - [arm64,armhf] soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON
       definition
     - [arm64,armhf] soc: rockchip: grf: Support multiple grf to be handled
     - media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop
     - media: i2c: ov01a10: Fix digital gain range
     - clk: tegra: tegra124-emc: Fix potential memory leak in
       tegra124_clk_register_emc()
     - [s390x] pci: Handle futile config accesses of disabled devices directly
     - reset: gpio: suppress bind attributes in sysfs
     - dm-integrity: fix recalculation in bitmap mode
     - dm-unstripe: fix mapping bug when there are multiple targets in a table
     - [arm64] dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro
     - media: venus: vdec: fix error state assignment for zero bytesused
     - media: venus: vdec: restrict EOS addr quirk to IRIS2 only
     - drm: of: drm_of_panel_bridge_remove(): fix device_node leak
     - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations
     - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs
     - drm/buddy: Prevent BUG_ON by validating rounded allocation
     - drm/bridge: anx7625: Fix invalid EDID size
     - xfs: mark data structures corrupt on EIO and ENODATA
     - xfs: remove xfs_attr_leaf_hasname
     - media: verisilicon: AV1: Fix tile info buffer size
     - [amd64] iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in
       scalable mode
     - mfd: core: Add locking around 'mfd_of_node_list'
     - mfd: qcom-pm8xxx: Fix OF populate on driver rebind
     - mfd: omap-usb-host: Fix OF populate on driver rebind
     - iio: accel: adxl380: Avoid reading more entries than present in FIFO
     - xfs: delete attr leaf freemap entries when empty
     - xfs: fix freemap adjustments when adding xattrs to leaf blocks
     - xfs: fix the xattr scrub to detect freemap/entries array collisions
     - xfs: fix remote xattr valuelblk check
     - [amd64] KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()
     - PCI: endpoint: Fix swapped parameters in
       pci_{primary/secondary}_epc_epf_unlink() functions
     - pinctrl: intel: Add code name documentation
     - xfs: only call xf{array,blob}_destroy if we have a valid pointer
     - xfs: check return value of xchk_scrub_create_subord
     - xfs: check for deleted cursors when revalidating two btrees
     - md/bitmap: fix GPF in write_page caused by resize race
     - nfsd: fix return error code for nfsd_map_name_to_[ug]id
     - nvmem: Drop OF node reference on nvmem_add_one_cell() failure
     - [amd64] x86/kexec: add a sanity check on previous kernel's ima kexec
       buffer
     - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node
     - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN
     - io_uring/net: don't continue send bundle if poll was required for retry
     - bus: fsl-mc: fix an error handling in fsl_mc_device_add()
     - dm mpath: make pg_init_delay_msecs settable
     - [arm64] poe: fix stale POR_EL0 values for ptrace
     - tools: Fix bitfield dependency failure
     - vhost: move vdpa group bound check to vhost_vdpa
     - [powerpc*] smp: Add check for kcalloc() failure in parse_thread_groups()
     - iio: gyro: itg3200: Fix unchecked return value in read_raw
     - mtd: spinand: Disable continuous read during probe
     - mm/highmem: fix __kmap_to_page() build error
     - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()
     - ocfs2: fix reflink preserve cleanup issue
     - kexec: derive purgatory entry from symbol
     - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling
       SR-IOV"
     - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug
     - [arm64] Fix non-atomic __READ_ONCE() with CONFIG_LTO=y
     - clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841
     - btrfs: continue trimming remaining devices on failure
     - remoteproc: imx_rproc: Fix invalid loaded resource table detection
     - perf/arm-cmn: Reject unsupported hardware configurations
     - scsi: ufs: core: Flush exception handling work when RPM level is zero
     - mm/slab: use unsigned long for orig_size to ensure proper metadata align
     - PCI: dwc: Fix msg_atu_index assignment
     - usb: dwc3: gadget: Move vbus draw to workqueue context
     - usb: dwc2: fix resume failure if dr_mode is host
     - mtd: rawnand: pl353: Fix software ECC support
     - tipc: fix RCU dereference race in tipc_aead_users_dec()
     - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
     - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error
       path
     - PCI: Fix pci_slot_trylock() error handling
     - staging: rtl8723bs: fix null dereference in find_network
     - kcsan, compiler_types: avoid duplicate type issues in BPF Type Format
     - watchdog/softlockup: fix sample ring index wrap in need_counting_irqs()
     - cifs: Fix locking usage for tcon fields
     - ceph: supply snapshot context in ceph_zero_partial_object()
     - rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0
     - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID
     - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean()
     - octeontx2-af: CGX: fix bitmap leaks
     - net: ti: icssg-prueth: Add optional dependency on HSR
     - net: macb: Fix tx/rx malfunction after phy link down and up
     - tracing: Fix to set write permission to per-cpu buffer_size_kb
     - io_uring/filetable: clamp alloc_hint to the configured alloc range
     - drm/amd/display: Increase DCN35 SR enter/exit latency
     - drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify
     - procfs: fix possible double mmput() in do_procmap_query()
     - net: intel: fix PCI device ID conflict between i40e and ipw2200
     - atm: fore200e: fix use-after-free in tasklets during device removal
     - function_graph: Restore direct mode when callbacks drop to one
     - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
     - mm: numa_memblks: Identify the accurate NUMA ID of CFMW
     - fbcon: check return value of con2fb_acquire_newinfo()
     - fbdev: vt8500lcdfb: fix missing dma_free_coherent()
     - fbdev: of: display_timing: fix refcount leak in of_get_display_timings()
     - fbdev: ffb: fix corrupted video output on Sun FFB1
     - fbcon: Remove struct fbcon_display.inverse
     - cifs: some missing initializations on replay
     - [amd64] ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR
     - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle
     - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash()
     - [amd64] x86/kexec: Copy ACPI root pointer address from config table
     - [arm64] Force the use of CNTVCT_EL0 in __delay()
     - drm/amdgpu: keep vga memory on MacBooks with switchable graphics
     - net: nfc: nci: Fix parameter validation for packet data
     - tracing: ring-buffer: Fix to check event length before using
     - fgraph: Do not call handlers direct when not using ftrace_ops
     - tracing: Fix checking of freed trace_event_file for hist files
     - tracing: Wake up poll waiters for hist files when removing an event
     - NTB: ntb_transport: Fix too small buffer for debugfs_name
     - ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl()
     - [amd64] drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros
     - xfs: fix copy-paste error in previous fix
     - [arm64] Fix sampling the "stable" virtual counter in preemptible section
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.76
     - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec
       buffer"
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.77
     - drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release
     - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
     - drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse()
     - [arm64] KVM: arm64: Hide S1POE from guests when not supported by the host
     - [riscv64] irqchip/sifive-plic: Fix frozen interrupt due to affinity
       setting
     - scsi: lpfc: Properly set WC for DPP mapping
     - scsi: pm8001: Fix use-after-free in pm8001_queue_command()
     - ALSA: scarlett2: Fix redeclaration of loop variable
     - ALSA: scarlett2: Fix DSP filter control array handling
     - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices
     - [amd64] x86/fred: Correct speculative safety in fred_extint()
     - rseq: Clarify rseq registration rseq_size bound check comment
     - cgroup/cpuset: Fix incorrect use of cpuset_update_tasks_cpumask() in
       update_cpumasks_hier()
     - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume
     - ALSA: usb-audio: Cap the packet size pre-calculations
     - ALSA: usb-audio: Use inclusive terms
     - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
     - [s390x] idle: Fix cpu idle exit cpu time accounting
     - [s390x] vtime: Fix virtual timer forwarding
     - PCI: endpoint: Introduce pci_epc_function_is_valid()
     - PCI: endpoint: Introduce pci_epc_mem_map()/unmap()
     - [arm64] PCI: dwc: endpoint: Implement the pci_epc_ops::align_addr()
       operation
     - [arm64] PCI: dwc: ep: Use align addr function for
       dw_pcie_ep_raise_{msi,msix}_irq()
     - [arm64] PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry
     - drm/amdgpu: Unlock a mutex before destroying it
     - drm/amdgpu: Replace kzalloc + copy_from_user with memdup_user
     - drm/amdgpu: Fix locking bugs in error paths
     - ALSA: pci: hda: use snd_kcontrol_chip()
     - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put()
     - btrfs: fix incorrect key offset in error message in
       check_dev_extent_item()
     - btrfs: fix objectid value in error message in check_extent_data_ref()
     - btrfs: fix warning in scrub_verify_one_metadata()
     - btrfs: print correct subvol num if active swapfile prevents deletion
     - btrfs: fix compat mask in error messages in btrfs_check_features()
     - [arm64] bpf, arm64: Force 8-byte alignment for JIT buffer to prevent
       atomic tearing
     - bpf: Fix stack-out-of-bounds write in devmap
     - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value
     - [amd64] x86/acpi/boot: Correct acpi_is_processor_usable() check again
     - [arm64] memory: mtk-smi: fix device leaks on common probe
     - [arm64] memory: mtk-smi: fix device leak on larb probe
     - resource: Add resource set range and size helpers
     - PCI: Use resource_set_range() that correctly sets ->end
     - media: tegra-video: Fix memory leak in __tegra_channel_try_format()
     - media: dw9714: move power sequences to dedicated functions
     - media: dw9714: add support for powerdown pin
     - media: dw9714: Fix powerup sequence
     - [amd64] KVM: x86: Ignore -EBUSY when checking nested events from
       vcpu_block()
     - ata: libata-scsi: Refactor ata_scsi_simulate()
     - ata: libata-scsi: Refactor ata_scsiop_read_cap()
     - ata: libata-scsi: Refactor ata_scsiop_maint_in()
     - ata: libata-scsi: Document all VPD page inquiry actors
     - ata: libata-scsi: Remove struct ata_scsi_args
     - ata: libata: Remove ATA_DFLAG_ZAC device flag
     - ata: libata: Introduce ata_port_eh_scheduled()
     - ata: libata-scsi: avoid Non-NCQ command starvation
     - [arm64,armhf] drm/tegra: dsi: fix device leak on probe
     - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT
     - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting
       I/O
     - mailbox: don't protect of_parse_phandle_with_args with con_mutex
     - mailbox: sort headers alphabetically
     - mailbox: remove unused header files
     - mailbox: Use dev_err when there is error
     - mailbox: Use guard/scoped_guard for con_mutex
     - mailbox: Allow controller specific mapping using fwnode
     - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
     - ext4: add ext4_try_lock_group() to skip busy groups
     - ext4: factor out __ext4_mb_scan_group()
     - ext4: factor out ext4_mb_might_prefetch()
     - ext4: factor out ext4_mb_scan_group()
     - ext4: convert free groups order lists to xarrays
     - ext4: refactor choose group to scan group
     - ext4: implement linear-like traversal across order xarrays
     - ext4: always allocate blocks only from groups inode can use
     - workqueue: Add system_percpu_wq and system_dfl_wq
     - Input: synaptics_i2c - replace use of system_wq with system_dfl_wq
     - Input: synaptics_i2c - guard polling restart in resume
     - [amd64] iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device
       without scalable mode
     - [arm64] dts: rockchip: Fix rk356x PCIe range mappings
     - [arm64] dts: rockchip: Fix rk3588 PCIe range mappings
     - [armhf] clk: tegra: tegra124-emc: fix device leak on set_rate()
     - ima: kexec: silence RCU list traversal warning
     - ima: rename variable the seq_file "file" to "ima_kexec_file"
     - ima: define and call ima_alloc_kexec_file_buf()
     - kexec: define functions to map and unmap segments
     - ima: kexec: define functions to copy IMA log at soft boot
     - ima: verify the previous kernel's IMA buffer lies in addressable RAM
     - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range()
     - drm/exynos: vidi: fix to avoid directly dereferencing user pointer
     - drm/exynos/vidi: Remove redundant error handling in vidi_get_modes()
     - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member
       variables related to memory alloc/free (CVE-2026-23227)
     - uprobes: switch to RCU Tasks Trace flavor for better performance
     - uprobes: Fix incorrect lockdep condition in filter_chain()
     - btrfs: drop unused parameter fs_info from do_reclaim_sweep()
     - btrfs: get used bytes while holding lock at btrfs_reclaim_bgs_work()
     - btrfs: fix reclaimed bytes accounting after automatic block group reclaim
     - btrfs: fix periodic reclaim condition
     - btrfs: zoned: fix alloc_offset calculation for partly conventional block
       groups
     - btrfs: zoned: fixup last alloc pointer after extent removal for RAID1
     - btrfs: zoned: fixup last alloc pointer after extent removal for DUP
     - btrfs: zoned: fix stripe width calculation
     - btrfs: define the AUTO_KFREE/AUTO_KVFREE helper macros
     - btrfs: zoned: fixup last alloc pointer after extent removal for RAID0/10
     - [riscv64] usb: cdns3: remove redundant if branch
     - [riscv64] usb: cdns3: call cdns_power_is_lost() only once in cdns_resume()
     - [riscv64] usb: cdns3: fix role switching during resume
     - drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected()
       (Closes: #1130930)
     - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
     - hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization
       induced race
     - ksmbd: check return value of xa_store() in krb5_authenticate
     - ksmbd: add chann_lock to protect ksmbd_chann_list xarray (CVE-2026-23226)
     - ALSA: hda/realtek: Add quirk for Gigabyte G5 KF5 (2023)
     - ALSA: hda/realtek: Add quirk for Samsung Galaxy Book3 Pro 360 (NP965QFG)
     - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314
     - net: arcnet: com20020-pci: fix support for 2.5Mbit cards
     - eventpoll: Fix integer overflow in ep_loop_check_proc()
     - namespace: fix proc mount iteration
     - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
     - nfc: pn533: properly drop the usb interface reference on disconnect
     - net: usb: kaweth: validate USB endpoints
     - net: usb: kalmia: validate USB endpoints
     - net: usb: pegasus: validate USB endpoints
     - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a
       message
     - can: usb: f81604: correctly anchor the urb in the read bulk callback
     - can: ucan: Fix infinite loop from zero-length messages
     - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
     - can: usb: f81604: handle short interrupt urb messages properly
     - can: usb: f81604: handle bulk write errors properly
     - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them
     - [amd64] x86/efi: defer freeing of boot services memory
     - [amd64] platform/x86: dell-wmi-sysman: Don't hex dump plaintext password
       data
     - [amd64] platform/x86: dell-wmi: Add audio/mic mute key codes
     - ALSA: usb-audio: Use correct version for UAC3 header validation
     - wifi: radiotap: reject radiotap with unknown bits
     - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
     - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration
     - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
     - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
     - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
     - net/sched: ets: fix divide by zero in the offload path
     - nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
     - tracing: Fix WARN_ON in tracing_buffers_mmap_close
     - scsi: target: Fix recursive locking in __configfs_open_file()
     - Squashfs: check metadata block offset is within range
     - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
     - drbd: fix null-pointer dereference on local read error
     - smb: client: fix cifs_pick_channel when channels are equally loaded
     - smb: client: fix broken multichannel with krb5+signing
     - smb: client: Don't log plaintext credentials in cifs_set_cifscreds
     - scsi: core: Fix refcount leak for tagset_refcnt
     - xattr: switch to CLASS(fd) (CVE-2024-14027)
     - btrfs: always fallback to buffered write if the inode requires checksum
     - ACPI: APEI: GHES: Disable KASAN instrumentation when compile testing with
       clang < 18
     - nvme: fix admin queue leak on controller reset
     - hwmon: (aht10) Add support for dht20
     - hwmon: (aht10) Fix initialization commands for AHT20
     - pinctrl: equilibrium: rename irq_chip function callbacks
     - pinctrl: equilibrium: fix warning trace on load
     - [amd64] platform/x86: thinkpad_acpi: Fix errors reading battery thresholds
     - HID: multitouch: add quirks for Lenovo Yoga Book 9i
     - HID: multitouch: new class MT_CLS_EGALAX_P80H84
     - [amd64] pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe()
     - hwmon: (it87) Check the it87_lock() return value
     - [amd64,arm64] idpf: change IRQ naming to match netdev and ethtool queue
       numbering
     - i40e: Fix preempt count leak in napi poll tracepoint
     - e1000e: clear DPG_EN after reset to avoid autonomous power-gating
     - drm/solomon: Fix page start when updating rectangle in page addressing
       mode
     - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling
       in ALE table
     - xsk: Get rid of xdp_buff_xsk::xskb_list_node
     - xsk: s/free_list_node/list_node/
     - xsk: Fix fragment node deletion to prevent buffer leak
     - xsk: Fix zero-copy AF_XDP fragment drop
     - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
     - [arm64] net: ti: icssg-prueth: Fix ping failure after offload mode setup
       when link speed is not 1G
     - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds
     - can: bcm: fix locking for bcm_op runtime updates
     - can: mcp251x: fix deadlock in error path of mcp251x_open
     - wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config
     - drm/xe: Do not preempt fence signaling CS instructions
     - kunit: tool: copy caller args in run_kernel to prevent mutation
     - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
     - octeon_ep: Relocate counter updates before NAPI
     - octeon_ep: avoid compiler and IQ/OQ reordering
     - octeon_ep_vf: Relocate counter updates before NAPI
     - octeon_ep_vf: avoid compiler and IQ/OQ reordering
     - wifi: cw1200: Fix locking in error paths
     - wifi: wlcore: Fix a locking bug
     - wifi: mt76: mt7996: Fix possible oob access in
       mt7996_mac_write_txwi_80211()
     - wifi: mt76: mt7925: Fix possible oob access in
       mt7925_mac_write_txwi_80211()
     - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()
     - indirect_call_wrapper: do not reevaluate function pointer
     - net/rds: Fix circular locking dependency in rds_tcp_tune
     - xen/acpi-processor: fix _CST detection using undersized evaluation buffer
     - iavf: fix netdev->max_mtu to respect actual hardware limit
     - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim
     - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op()
     - smb/client: fix buffer size for smb311_posix_qinfo in
       SMB311_posix_query_info()
     - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
     - net: ipv4: fix ARM64 alignment fault in multipath hash seed
     - amd-xgbe: fix sleep while atomic on suspend/resume
     - drm/sched: Fix kernel-doc warning for drm_sched_job_done()
     - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock"
     - drm/xe/reg_sr: Fix leak on xa_store failure
     - nvme: reject invalid pr_read_keys() num_keys values
     - nvme: fix memory allocation in nvme_pr_read_keys()
     - hwmon: (max6639) : Configure based on DT property
     - hwmon: (max6639) fix inverted polarity
     - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless
       qdiscs
     - net: nfc: nci: Fix zero-length proprietary notifications
     - net_sched: sch_fq: clear q->band_pkt_count[] in fq_reset()
     - nfc: nci: free skb on nci_transceive early error paths
     - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback
     - nfc: rawsock: cancel tx_work before socket teardown
     - net: stmmac: Fix error handling in VLAN add and delete paths
     - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
     - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in
       mtk_xdp_setup()
     - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
     - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
     - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
     - net/sched: act_ife: Fix metalist update behavior
     - xdp: use modulo operation to calculate XDP frag tailroom
     - xsk: introduce helper to determine rxq->frag_size
     - i40e: fix registering XDP RxQ info
     - i40e: use xdp.frame_sz as XDP RxQ info frag_size
     - xdp: produce a warning when calculated tailroom is negative
     - tracing: Add NULL pointer check to trigger_data_free()
     - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared
       blocks
     - ext4: fix potential null deref in ext4_mb_init()
     - ata: libata-core: fix cancellation of a port deferred qc work
     - ata: libata-eh: correctly handle deferred qc timeouts
     - ata: libata: cancel pending work after clearing deferred_qc
     - ata: libata-eh: Fix detection of deferred qc timeouts
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.78
     - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
     - [amd64] ACPI: PM: Save NVS memory on Lenovo G70-35
     - scsi: mpi3mr: Add NULL checks when resetting request and reply queues
     - ALSA: hda/realtek: Fix speaker pop on Star Labs StarFighter
     - unshare: fix unshare_fs() handling
     - wifi: mac80211: set default WMM parameters on all links
     - ACPI: OSI: Add DMI quirk for Acer Aspire One D255
     - scsi: ses: Fix devices attaching to different hosts
     - [amd64] ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table
     - [amd64] ASoC: cs42l43: Report insert for exotic peripherals
     - scsi: ufs: core: Fix possible NULL pointer dereference in
       ufshcd_add_command_trace()
     - scsi: ufs: core: Fix shift out of bounds when MAXQ=32
     - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0
     - drm/amdgpu/vcn5: Add SMU dpm interface type
     - ALSA: usb-audio: Check max frame size for implicit feedback mode, too
     - kexec: Consolidate machine_kexec_mask_interrupts() implementation
     - kexec: Include kernel-end even without crashkernel
     - [powerpc*] kexec/core: use big-endian types for crash variables
     - [powerpc*] crash: adjust the elfcorehdr size
     - remoteproc: sysmon: Correct subsys_name_len type in QMI request
     - remoteproc: mediatek: Unprepare SCP clock during system suspend
     - [powerpc*] 83xx: km83xx: Fix keymile vendor prefix
     - smb/server: Fix another refcount leak in smb2_open()
     - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
     - [arm64] drm/msm/dsi: fix hdisplay calculation when programming dsi
       registers
     - xprtrdma: Decrement re_receiving on the early exit paths
     - btrfs: hold space_info->lock when clearing periodic reclaim ready
     - workqueue: Use POOL_BH instead of WQ_BH when checking pool flags
     - perf disasm: Fix off-by-one bug in outside check
     - [arm64] drm/msm/dsi: fix pclk rate calculation for bonded dsi
     - drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v14
     - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states
     - net/mlx5: IFC updates for disabled host PF
     - net/mlx5: Query to see if host PF is disabled
     - net/mlx5: Fix deadlock between devlink lock and esw->wq
     - net/mlx5: Fix crash when moving to switchdev mode
     - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
     - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL
       slave xmit (CVE-2026-23277)
     - ASoC: soc-core: drop delayed_work_pending() check before flush
     - ASoC: soc-core: flush delayed work before removing DAIs and widgets
     - ASoC: simple-card-utils: use __free(device_node) for device node
     - ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays
     - net: sfp: improve Huawei MA5671a fixup
     - serial: caif: hold tty->link reference in ldisc_open and ser_release
     - bnxt_en: Fix RSS table size check when changing ethtool channels
     - mctp: i2c: fix skb memory leak in receive path
     - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return
       value
     - bonding: add ESP offload features when slaves support
     - bonding: Correctly support GSO ESP offload
     - net: add a common function to compute features for upper devices
     - bonding: use common function to compute the features
     - bonding: fix type confusion in bond_setup_by_slave()
     - mctp: route: hold key->lock in mctp_flow_prepare_output()
     - [amd64,arm64] amd-xgbe: fix link status handling in xgbe_rx_adaptation
     - [amd64,arm64] amd-xgbe: prevent CRC errors during RX adaptation with AN
       disabled
     - xdp: allow attaching already registered memory model to xdp_rxq_info
     - xdp: register system page pool as an XDP memory model
     - net: add xmit recursion limit to tunnel xmit functions (CVE-2026-23276)
     - netfilter: nf_tables: always walk all pending catchall elements
       (CVE-2026-23278)
     - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
     - netfilter: x_tables: guard option walkers against 1-byte tail reads
     - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
     - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
     - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
       (CVE-2026-23274)
     - perf annotate: Fix hashmap__new() error checking
     - regulator: pca9450: Correct interrupt type
     - perf ftrace: Fix hashmap__new() error checking
     - sched: idle: Make skipping governor callbacks more consistent
     - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
     - nvme-pci: Fix race bug in nvme_poll_irqdisable()
     - i40e: fix src IP mask checks and memcpy argument names in cloud filter
     - e1000/e1000e: Fix leak in DMA error cleanup
     - net: bcmgenet: fix broken EEE by converting to phylib-managed state
     - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()
     - [amd64] ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock
       acquisition
     - ASoC: detect empty DMI strings
     - drm/amdkfd: Unreserve bo if queue update failed
     - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled
     - [arm64] octeontx2-af: devlink: fix NIX RAS reporter recovery condition
     - [arm64] octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt
       status
     - net: prevent NULL deref in ip[6]tunnel_xmit()
     - iio: imu: inv-mpu9150: fix irq ack preventing irq storms
     - usb: gadget: f_mass_storage: Fix potential integer overflow in
       check_command_size_in_blocks()
     - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on"
     - cgroup: fix race between task migration and iteration
     - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
     - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer
       interfaces
     - net: usb: lan78xx: fix silent drop of packets with checksum errors
     - net: usb: lan78xx: fix TX byte statistics for small packets
     - net: usb: lan78xx: skip LTM configuration for LAN7850
     - ata: libata-core: Add BRIDGE_OK quirk for QEMU drives
     - [amd64] ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA
     - [amd64] KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with
       in-kernel APIC
     - USB: add QUIRK_NO_BOS for video capture several devices
     - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
     - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed
     - usb: xhci: Fix memory leak in xhci_disable_slot()
     - usb: xhci: Prevent interrupt storm on host controller error (HCE)
     - usb: yurex: fix race in probe
     - usb: dwc3: pci: add support for the Intel Nova Lake -H
     - usb: misc: uss720: properly clean up reference in uss720_probe()
     - usb: core: don't power off roothub PHYs if phy_set_mode() fails
     - usb: cdc-acm: Restore CAP_BRK functionnality to CH343
     - usb: roles: get usb role switch from parent only for usb-b-connector
     - usb: typec: altmode/displayport: set displayport signaling rate in
       configure message
     - USB: usbcore: Introduce usb_bulk_msg_killable()
     - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts
     - USB: core: Limit the length of unkillable synchronous timeouts
     - usb: class: cdc-wdm: fix reordering issue in read code path
     - usb: mdc800: handle signal and read racing
     - usb: image: mdc800: kill download URB on timeout
     - mm/tracing: rss_stat: ensure curr is false from kthread context
     - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
     - mm/kfence: disable KFENCE upon KASAN HW tags enablement
     - mmc: core: Avoid bitfield RMW for claim/retune flags
     - [arm64] ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and
       start
     - tipc: fix divide-by-zero in tipc_sk_filter_connect()
     - kprobes: avoid crash when rmmod/insmod after ftrace killed
     - ceph: add a bunch of missing ceph_path_info initializers
     - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
     - libceph: reject preamble if control segment is empty
     - libceph: prevent potential out-of-bounds reads in process_message_header()
     - libceph: Use u32 for non-negative values in ceph_monmap_decode()
     - libceph: admit message frames only in CEPH_CON_S_OPEN state
     - ceph: fix i_nlink underrun during async unlink
     - ceph: fix memory leaks in ceph_mdsc_build_path()
     - time/jiffies: Mark jiffies_64_to_clock_t() notrace
     - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach
     - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend
     - scsi: hisi_sas: Add time interval between two H2D FIS following soft reset
       spec
     - scsi: hisi_sas: Use macro instead of magic number
     - scsi: hisi_sas: Fix NULL pointer exception during user_scan()
     - kbuild: Disable CC_HAS_ASM_GOTO_OUTPUT on clang < 17
     - Fix CC_HAS_ASM_GOTO_OUTPUT on non-x86 architectures
     - Revert "tcpm: allow looking for role_sw device in the main node"
     - drm/amd: Disable MES LR compute W/A
     - drm/bridge: samsung-dsim: Fix memory leak in error path
     - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used
     - [s390x] pfault: Fix virtual vs physical address confusion
     - nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().
     - device property: Allow secondary lookup in fwnode_get_next_child_node()
     - [arm64,armhf] irqchip/gic-v3-its: Limit number of per-device MSIs to the
       range the ITS supports
     - btrfs: fix chunk map leak in btrfs_map_block() after
       btrfs_chunk_map_num_copies()
     - ice: reintroduce retry mechanism for indirect AQ
     - ixgbevf: fix link setup issue
     - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
     - staging: rtl8723bs: fix potential out-of-bounds read in
       rtw_restruct_wmm_ie
     - media: dvb-net: fix OOB access in ULE extension header tables
     - [amd64,arm64] net: mana: Ring doorbell at 4 CQ wraparounds
     - ice: fix retry for AQ command 0x06EE
     - tracing: Fix syscall events activation by ensuring refcount hits zero
     - net/tcp-ao: Fix MAC comparison to be constant-time
     - batman-adv: Avoid double-rtnl_lock ELP metric worker
     - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
     - [arm64] mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
     - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read
     - [arm64] contpte: fix set_access_flags() no-op check for SMMU/ATS faults
     - pmdomain: bcm: bcm2835-power: Fix broken reset status read
     - ata: libata-core: Disable LPM on ST1000DM010-2EP102
     - drm/amd/display: Fallback to boot snapshot for dispclk
     - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()
     - smb: server: fix use-after-free in smb2_open()
     - ksmbd: fix use-after-free by using call_rcu() for oplock_info
     - net: nexthop: fix percpu use-after-free in remove_nh_grp_entry
     - net: ncsi: fix skb leak in error paths
     - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
     - net: dsa: microchip: Fix error path in PTP IRQ setup
     - drm/amd/pm: remove invalid gpu_metrics.energy_accumulator on smu v13.0.x
     - drm/amdgpu: Fix use-after-free race in VM acquire
     - drm/amd: Set num IP blocks to 0 if discovery fails
     - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding
     - [amd64] drm/i915: Fix potential overflow of shmem scatterlist length
     - [arm64] drm/msm: Fix dma_free_attrs() buffer size
     - tracing: Fix enabling multiple events on the kernel command line and
       bootconfig
     - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G
     - qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size
     - cifs: make default value of retrans as zero
     - xfs: fix returned valued from xfs_defer_can_append
     - xfs: fix undersized l_iclog_roundoff values
     - xfs: ensure dquot item is deleted from AIL only after log shutdown
     - [s390x] dasd: Move quiesce state with pprc swap
     - [s390x] dasd: Copy detected format information to secondary device
     - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error
     - scsi: core: Fix error handling for scsi_alloc_sdev()
     - [amd64] x86/apic: Disable x2apic on resume if the kernel expects so
     - lib/bootconfig: fix snprintf truncation check in
       xbc_node_compose_key_after()
     - lib/bootconfig: check bounds before writing in __xbc_open_brace()
     - smb: client: fix atomic open with O_DIRECT & O_SYNC
     - smb: client: fix in-place encryption corruption in SMB2_write()
     - smb: client: fix iface port assignment in parse_server_interfaces
     - btrfs: fix transaction abort on file creation due to name hash collision
     - btrfs: fix transaction abort on set received ioctl due to item overflow
     - btrfs: abort transaction on failure to update root in the received subvol
       ioctl
     - iio: dac: ds4424: reject -128 RAW value
     - iio: frequency: adf4377: Fix duplicated soft reset mask
     - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas()
     - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
     - iio: potentiometer: mcp4131: fix double application of wiper shift
     - iio: chemical: bme680: Fix measurement wait duration calculation
     - iio: buffer: Fix wait_queue not being removed
     - iio: gyro: mpu3050-core: fix pm_runtime error handling
     - iio: gyro: mpu3050-i2c: fix pm_runtime error handling
     - iio: imu: inv_icm42600: fix odr switch to the same value
     - iio: imu: inv_icm42600: fix odr switch when turning buffer off
     - iio: proximity: hx9023s: Protect against division by zero in set_samp_freq
     - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors
     - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort
     - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor
     - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD
     - net/tcp-md5: Fix MAC comparison to be constant-time
     - ksmbd: Compare MACs in constant time (CVE-2026-23364)
     - smb: client: Compare MACs in constant time
     - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()
     - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths
     - spi: cadence-quadspi: Implement refcount to handle unbind during busy
       (CVE-2025-40005)
     - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL
       (CVE-2026-23386)
     - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
       (CVE-2026-23368)
     - [amd64] x86/sev: Allow IBPB-on-Entry feature for SNP guests
     - [amd64] platform/x86: hp-bioscfg: Support allocations of larger data
       (Closes: #1127612)
     - wifi: libertas: fix use-after-free in lbs_free_adapter() (CVE-2026-23281)
     - [amd64] perf/x86/intel/uncore: Support more units on Granite Rapids
     - [amd64] perf/x86/intel/uncore: Add per-scheduler IMC CAS count events
     - mptcp: pm: in-kernel: always mark signal+subflow endp as used
     - mptcp: pm: avoid sending RM_ADDR over same subflow
     - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink
     - kbuild: Leave objtool binary around with 'make clean'
     - net/sched: act_gate: snapshot parameters with RCU on replace
       (CVE-2026-23245)
     - xfs: Fix error pointer dereference
     - can: gs_usb: gs_can_open(): always configure bitrates before starting
       device
     - cleanup: Provide retain_and_null_ptr()
     - usb: gadget: f_ncm: Fix net_device lifecycle with device_move
     - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling
     - [amd64] KVM: SVM: Limit AVIC physical max index based on configured
       max_vcpu_ids
     - [amd64] KVM: SVM: Add a helper to look up the max physical ID for AVIC
     - [amd64] KVM: SVM: Set/clear CR8 write interception when AVIC is
       (de)activated
     - [arm64,armhf] mmc: dw_mmc-rockchip: use modern PM macros
     - [arm64,armhf] mmc: dw_mmc-rockchip: Add memory clock auto-gating support
     - [arm64,armhf] mmc: dw_mmc-rockchip: Fix runtime PM support for internal
       phase support
     - mm/page_alloc: move set_page_refcounted() to callers of post_alloc_hook()
     - mm/page_alloc: sort out the alloc_contig_range() gfp flags mess
     - mm/page_alloc: forward the gfp flags from alloc_contig_range() to
       post_alloc_hook()
     - mm/kfence: fix KASAN hardware tag faults during late enablement
     - nsfs: tighten permission checks for ns iteration ioctls
     - sched_ext: Disable preemption between scx_claim_exit() and kicking helper
       work
     - sched_ext: Fix starvation of scx_enable() under fair-class saturation
     - iomap: reject delalloc mappings during writeback
     - fgraph: Fix thresh_return clear per-task notrace
     - [amd64] KVM: x86: Co-locate initialization of feature MSRs in
       kvm_arch_vcpu_create()
     - [amd64] KVM: x86: Quirk initialization of feature MSRs to KVM's max
       configuration
     - [amd64] KVM: x86: do not allow re-enabling quirks
     - [amd64] KVM: x86: Allow vendor code to disable quirks
     - [amd64] KVM: x86: Introduce supported_quirks to block disabling quirks
     - [amd64] KVM: x86: Introduce Intel specific quirk
       KVM_X86_QUIRK_IGNORE_GUEST_PAT
     - [amd64] KVM: nVMX: Add consistency checks for CR0.WP and CR4.CET
     - [amd64] KVM: x86: Introduce KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM
     - ksmbd: Don't log keys in SMB3 signing and encryption key generation
     - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output
     - net: macb: Shuffle the tx ring before enabling tx
     - cifs: open files should not hold ref on superblock
     - xfs: fix integer overflow in bmap intent sort comparator
     - drm/xe/sync: Cleanup partially initialized sync on parse failure
     - ipv6: use RCU in ip6_xmit() (CVE-2025-40135)
     - dm-verity: disable recursive forward error correction (CVE-2025-71161)
     - rxrpc: Fix recvmsg() unconditional requeue
     - btrfs: do not strictly require dirty metadata threshold for metadata
       writepages (CVE-2026-23157)
     - ice: fix devlink reload call trace (CVE-2026-23104)
     - tracing: Add recursion protection in kernel stack trace recording
       (CVE-2026-23138)
     - [amd64] Octeontx2-af: Add proper checks for fwdata (CVE-2026-23070)
     - io_uring/uring_cmd: fix too strict requirement on ioctl
     - [amd64] x86/uprobes: Fix XOL allocation failure for 32-bit tasks
     - [amd64] platform/x86/amd/pmc: Add support for Van Gogh SoC
       (CVE-2025-68334)
     - mptcp: pm: in-kernel: always set ID as avail when rm endp
     - net: stmmac: remove support for lpi_intr_o
     - f2fs: compress: change the first parameter of page_array_{alloc,free} to
       sbi
     - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic
       (CVE-2025-38627)
     - f2fs: fix to avoid migrating empty section (CVE-2025-40150)
     - blk-throttle: fix access race during throttle policy activation
       (CVE-2025-40147)
     - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
       (CVE-2025-71221)
     - net: dsa: properly keep track of conduit reference (CVE-2025-71152)
     - binfmt_misc: restore write access before closing files opened by
       open_exec() (CVE-2025-68239)
     - xfs: get rid of the xchk_xfile_*_descr calls
     - erofs: fix inline data read failure for ztailpacking pclusters
     - mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375)
     - sched_ext: Remove redundant css_put() in scx_cgroup_init()
     - io_uring/kbuf: check if target buffer list is still legacy on recycle
     - sched/fair: Fix zero_vruntime tracking
     - [s390x] stackleak: Fix __stackleak_poison() inline assembly constraint
     - [s390x] xor: Fix xor_xc_2() inline assembly constraints
     - [amd64] drm/i915/alpm: ALPM disable fixes
     - [amd64] drm/i915/psr: Repeat Selective Update area alignment
     - drm/amd/display: Add pixel_clock to amd_pp_display_configuration
     - drm/amd/pm: Use pm_display_cfg in legacy DPM (v2)
     - drm/amdgpu: Add basic validation for RAS header (CVE-2025-38426)
     - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
     - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
     - HID: bpf: prevent buffer overflow in hid_hw_request
     - sunrpc: fix cache_request leak in cache_release
     - nvdimm/bus: Fix potential use after free in asynchronous initialization
     - NFC: nxp-nci: allow GPIOs to sleep
     - net: macb: fix use-after-free access to PTP clock
     - mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations
     - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
     - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
     - smb: client: fix krb5 mount with username option
     - ksmbd: unset conn->binding on failed binding request
     - ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION
     - [amd64] drm/i915/dsc: Add Selective Update register definitions
     - [amd64] drm/i915/dsc: Add helper for writing DSC Selective Update ET
       parameters
     - [amd64] drm/i915/psr: Write DSC parameters on Selective Update in ET mode
     - [s390x] zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute
     - kprobes: Remove unneeded goto
     - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace()
     - btrfs: fix transaction abort when snapshotting received subvolumes
     - batman-adv: avoid OGM aggregation when skb tailroom is insufficient
     - net: macb: Introduce gem_init_rx_ring()
     - net: macb: Reinitialize tx/rx queue pointer registers and rx ring during
       resume
     - ata: libata-core: disable LPM on ADATA SU680 SSD
     - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption
     - mmc: sdhci: fix timing selection for 1-bit bus width
     - pmdomain: bcm: bcm2835-power: Increase ASB control timeout
     - spi: fix use-after-free on controller registration failure
     - spi: fix statistics allocation
     - mtd: rawnand: pl353: make sure optimal timings are applied
     - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in
       cadence_nand_init()
     - mtd: Avoid boot crash in RedBoot partition table parser
     - [amd64] iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry
     - serial: 8250_pci: add support for the AX99100
     - serial: 8250: Fix TX deadlock when using DMA
     - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART
       BUSY
     - serial: uartlite: fix PM runtime usage count underflow on probe
     - io_uring/kbuf: propagate BUF_MORE through early buffer commit path
     - drm: Fix use-after-free on framebuffers and property blobs when calling
       drm_dev_unplug
     - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START,
       END}
     - drm/amdgpu/gmc9.0: add bounds checking for cid
     - drm/amdgpu/mmhub2.0: add bounds checking for cid
     - drm/amdgpu/mmhub2.3: add bounds checking for cid
     - drm/amdgpu/mmhub3.0.1: add bounds checking for cid
     - drm/amdgpu/mmhub3.0.2: add bounds checking for cid
     - drm/amdgpu/mmhub3.0: add bounds checking for cid
     - drm/amdgpu/mmhub4.1.0: add bounds checking for cid
     - drm/imagination: Fix deadlock in soft reset sequence
     - drm/radeon: apply state adjust rules to some additional HAINAN vairants
     - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants
     - drm/xe/oa: Allow reading after disabling OA stream
     - drm/xe: Open-code GGTT MMIO access protection
     - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
       (CVE-2026-23395)
     - ata: libata-scsi: Return residual for emulated SCSI commands
     - ata: libata-scsi: report correct sense field pointer in
       ata_scsiop_maint_in()
     - btrfs: log new dentries when logging parent dir of a conflicting inode
     - btrfs: tree-checker: fix misleading root drop_level error message
     - [riscv64] soc: microchip: mpfs: Fix memory leak in
       mpfs_sys_controller_probe()
     - [riscv64] cache: starfive: fix device node leak in starlink_cache_init()
     - [arm64,armhf] soc: rockchip: grf: Add missing of_node_put() when returning
     - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.
     - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
     - [arm64] dts: renesas: r9a09g057: Add RTC node
     - [arm64] dts: renesas: r9a09g057: Remove wdt{0,2,3} nodes
     - [arm64] firmware: arm_scpi: Fix device_node reference leak in probe path
     - Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
     - Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
     - Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
     - Bluetooth: ISO: Fix defer tests being unstable
     - Bluetooth: hci_sync: Fix hci_le_create_conn_sync
     - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
     - Bluetooth: HIDP: Fix possible UAF
     - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
     - Bluetooth: qca: fix ROM version reading on WCN3998 chips
     - bridge: cfm: Fix race condition in peer_mep deletion (CVE-2026-23393)
     - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
     - mpls: add missing unregister_netdevice_notifier to mpls_init
     - netfilter: ctnetlink: remove refcounting in expectation dumpers
       (CVE-2025-39764)
     - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
     - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in
       sip_help_tcp()
     - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
     - nf_tables: nft_dynset: fix possible stateful expression memleak in error
       path (CVE-2026-23399)
     - netfilter: nft_ct: drop pending enqueued packets on removal
     - netfilter: xt_CT: drop pending enqueued packets on template removal
       (CVE-2026-23391)
     - netfilter: xt_time: use unsigned int for monthday bit shift
     - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
     - net: bcmgenet: increase WoL poll timeout
     - [amd64,arm64] net: mana: fix use-after-free in mana_hwc_destroy_channel()
       by reordering teardown
     - sched: idle: Consolidate the handling of two special cases
     - PM: runtime: Fix a race condition related to device removal
     - bonding: prevent potential infinite loop in bond_header_parse()
     - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
     - net/sched: teql: Fix double-free in teql_master_xmit
     - net: airoha: read default PSE reserved pages value before updating
     - net: airoha: fix PSE memory configuration in airoha_fe_pse_ports_init()
     - net: airoha: Read completion queue data in airoha_qdma_tx_napi_poll()
     - net: airoha: Remove airoha_dev_stop() in airoha_remove()
     - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check
     - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
     - clsact: Fix use-after-free in init/destroy rollback asymmetry
     - net: usb: aqc111: Do not perform PM inside suspend callback
     - igc: fix missing update of skb->tail in igc_xmit_frame()
     - igc: fix page fault in XDP TX timestamps handling
     - iavf: fix VLAN filter lost on add/delete race
     - wifi: mac80211: fix NULL deref in mesh_matches_local() (CVE-2026-23396)
     - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough
       headroom
     - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix
     - net: macb: fix uninitialized rx_fs_lock
     - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle
     - net/mlx5e: Prevent concurrent access to IPSec ASO context
     - net/mlx5e: Fix race condition during IPSec ESN update
     - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
     - net: bonding: fix NULL deref in bond_debug_rlb_hash_show
     - netfilter: bpf: defer hook memory release until rcu readers are done
     - netfilter: nf_tables: release flowtable after rcu grace period on error
       (CVE-2026-23392)
     - nfnetlink_osf: validate individual option lengths in fingerprints
       (CVE-2026-23397)
     - [arm64,armhf] net: mvpp2: guard flow control update with global_tx_fc in
       buffer switching
     - [armhf] net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error
       paths
     - icmp: fix NULL pointer dereference in icmp_tag_validation()
       (CVE-2026-23398)
     - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return
       value
     - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit()
     - [amd64] drm/i915/psr: Compute PSR entry_setup_frames into intel_crtc_state
     - USB: serial: f81232: fix incomplete serial port generation
     - i2c: cp2615: fix serial string NULL-deref at probe
     - i2c: fsi: Fix a potential leak in fsi_i2c_probe()
     - i2c: pxa: defer reset on Armada 3700 when recovery is used
     - ring-buffer: Fix to update per-subbuf entries of persistent ring buffer
     - [amd64] x86/platform/uv: Handle deconfigured sockets
     - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode
     - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode
     - mm: shmem: fix potential data corruption during shmem swapin
     - mm: shmem: avoid unpaired folio_unlock() in shmem_swapin_folio()
     - mm/shmem, swap: improve cached mTHP handling and fix potential hang
     - mm/shmem, swap: avoid redundant Xarray lookup during swapin
     - mtd: rawnand: serialize lock/unlock against other NAND operations
     - mtd: rawnand: brcmnand: skip DMA during panic write
     - drm/amd/display: Fix DisplayID not-found handling in
       parse_edid_displayid_vrr()
     - drm/amd: fix dcn 2.01 check
     - ksmbd: fix use-after-free of share_conf in compound request
     - ksmbd: fix use-after-free in durable v2 replay of active file handles
     - [amd64] drm/i915/gt: Check set_default_submission() before deferencing
     - lib/bootconfig: check xbc_init_node() return in override path
     - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure
     - hwmon: (max6639) Fix pulses-per-revolution implementation
     - [amd64] perf/x86/intel: Add missing branch counters constraint apply
     - xen/privcmd: restrict usage in unprivileged domU (CVE-2026-31788)
     - xen/privcmd: add boot control for restricted usage in domU
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.79
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.80
     - cxl/port: Fix use after free of parent_port in cxl_detach_ep()
     - bpf: Fix constant blinding for PROBE_MEM32 stores (CVE-2026-23417)
       (Closes: #1132622)
     - perf: Make sure to use pmu_ctx->pmu for groups
     - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled
     - hwmon: axi-fan: don't use driver_override as IRQ name
     - driver core: generalize driver_override in struct device
     - driver core: platform: use generic driver_override infrastructure
     - bpf: Release module BTF IDR before module unload
     - bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN
     - bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR
     - HID: asus: avoid memory leak in asus_report_fixup()
     - [amd64] platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to
       dmi_vgbs_allow_list
     - nvme-pci: cap queue creation to used queues
     - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets
     - [amd64] platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold
       16 Gen 1
     - [amd64] platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix
       touchscreen on SUPI S10
     - nvme-pci: ensure we're polling a polled queue
     - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2
     - HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
     - HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list
     - net: usb: r8152: add TRENDnet TUC-ET2G
     - kbuild: install-extmod-build: Package resolve_btfids if necessary
     - HID: mcp2221: cancel last I2C command on read error
     - HID: asus: add xg mobile 2023 external hardware support
     - module: Fix kernel panic when a symbol st_shndx is out of bounds
     - scsi: mpi3mr: Clear reset history on ready and recheck state after timeout
     - scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP
     - dma-buf: Include ioctl.h in UAPI header
     - ALSA: hda/senary: Ensure EAPD is enabled during init
     - HID: apple: avoid memory leak in apple_report_fixup()
     - sched_ext: Use WRITE_ONCE() for the write side of dsq->seq update
     - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create
     - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk
     - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390
     - objtool: Handle Clang RSP musical chairs
     - nvmet: move async event work off nvmet-wq
     - drm/amdgpu: fix gpu idle power consumption issue for gfx v12
     - usb: core: new quirk to handle devices with zero configurations
     - spi: intel-pci: Add support for Nova Lake mobile SPI flash
     - ALSA: hda/realtek: add quirk for ASUS UM6702RC
     - i3c: master: dw-i3c: Fix missing of_node for virtual I2C adapter
     - xfrm: add missing extack for XFRMA_SA_PCPU in add_acquire and allocspi
     - xfrm: fix the condition on x->pcpu_num in xfrm_sa_len
     - xfrm: call xdo_dev_state_delete during state update
     - xfrm: Fix the usage of skb->sk
     - esp: fix skb leak with espintcp and async crypto
     - xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini()
     - xfrm: prevent policy_hthresh.work from racing with netns teardown
     - af_key: validate families in pfkey_send_migrate()
     - dma: swiotlb: add KMSAN annotations to swiotlb_bounce()
     - erofs: set fileio bio failed in short read case
     - can: statistics: add missing atomic access in hot path
     - Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
     - Bluetooth: L2CAP: Validate PDU length before reading SDU length in
       l2cap_ecred_data_rcv()
     - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing
       sock_hold
     - Bluetooth: MGMT: Fix dangling pointer on
       mgmt_add_adv_patterns_monitor_complete
     - Bluetooth: hci_ll: Fix firmware leak on error path
     - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
     - [arm64] pinctrl: mediatek: common: Fix probe failure for devices without
       EINT
     - ionic: fix persistent MAC address override on PF
     - nfc: nci: fix circular locking dependency in nci_close_device
     - net: openvswitch: Avoid releasing netdev before teardown completes
     - openvswitch: defer tunnel netdev_put to RCU release
     - openvswitch: validate MPLS set/set_masked payload length
     - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe
       buffer
     - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
     - net: bcm: asp2: fix LPI timer handling
     - net: bcm: asp2: remove tx_lpi_enabled
     - net: bcm: asp2: convert to phylib managed EEE
     - net: bcmasp: Remove support for asp-v2.0
     - net: bcmasp: streamline early exit in probe
     - net: bcmasp: fix double free of WoL irq
     - net: bcmasp: Add support for asp-v3.0
     - net: bcmasp: fix double disable of clk
     - [armhf] platform/olpc: olpc-xo175-ec: Fix overflow error message to print
       inlen
     - [amd64] platform/x86: intel-hid: disable wakeup_mode during hibernation
     - ice: fix inverted ready check for VF representors
     - ice: use ice_update_eth_stats() for representor stats
     - iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
     - ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions
       expire.
     - ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist.
     - net: fix fanout UAF in packet_release() via NETDEV_UP race
     - tcp: optimize inet_use_bhash2_on_bind()
     - udp: Fix wildcard bind conflict check when using hash2
     - net: enetc: fix the output issue of 'ethtool --show-ring'
     - team: fix header_ops type confusion with non-Ethernet ports
     - net: lan743x: fix duplex configuration in mac_link_up
     - dma-mapping: add missing `inline` for `dma_free_attrs`
     - Bluetooth: L2CAP: Fix send LE flow credits in ACL link
     - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock
     - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
     - Bluetooth: btusb: clamp SCO altsetting table indices
     - tls: Purge async_hold in tls_decrypt_async_wait() (CVE-2026-23414)
     - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
     - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
     - netfilter: nf_conntrack_expect: skip expectations in other netns via proc
     - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in
       process_sdp
     - netfilter: ctnetlink: use netlink policy range checks
     - net: macb: use the current queue number for stats
     - regmap: Synchronize cache for the page selector
     - ALSA: hda/realtek: Sequence GPIO2 on Star Labs StarFighter
     - RDMA/rw: Fall back to direct SGE on MR pool exhaustion
     - RDMA/irdma: Initialize free_qp completion before using it
     - RDMA/irdma: Update ibqp state to error if QP is already in error state
     - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce()
     - RDMA/irdma: Clean up unnecessary dereference of event->cm_node
     - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err()
     - RDMA/irdma: Fix deadlock during netdev reset with active connections
     - RDMA/irdma: Return EINVAL for invalid arp index error
     - scsi: scsi_transport_sas: Fix the maximum channel scanning issue
     - [amd64] x86/efi: efi_unmap_boot_services: fix calculation of
       ranges_to_free size
     - [amd64] drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
     - PM: hibernate: Drain trailing zero pages on userspace restore
     - spi: sn-f-ospi: Fix resource leak in f_ospi_probe()
     - [amd64] ASoC: Intel: catpt: Fix the device initialization
     - [arm64,armhf] spi: meson-spicc: Fix double-put in remove path
     - drm/amd/display: Do not skip unrelated mode changes in DSC validation
     - spi: Group CS related fields in struct spi_device
     - spi: use generic driver_override infrastructure
     - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
     - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib
     - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion
     - hwmon: (pmbus/core) Fix various coding style issues
     - hwmon: (pmbus) Mark lowest/average/highest/rated attributes as read-only
     - hwmon: (pmbus) Introduce the concept of "write-only" attributes
     - sysctl: fix uninitialized variable in proc_do_large_bitmap
     - [s390x] syscalls: Add spectre boundary for syscall dispatch table
     - [s390x] barrier: Make array_index_mask_nospec() __always_inline
     - [s390x] entry: Scrub r12 register on kernel entry
     - ksmbd: replace hardcoded hdr2_len with offsetof() in
       smb2_calc_max_out_buf_len()
     - ksmbd: fix potencial OOB in get_file_all_info() for compound requests
     - ksmbd: fix memory leaks and NULL deref in smb2_lock()
     - ksmbd: do not expire session on binding failure
     - ALSA: firewire-lib: fix uninitialized local variable
     - [amd64] ASoC: SOF: ipc4-topology: Allow bytes controls without initial
       payload
     - can: gw: fix OOB heap access in cgw_csum_crc8_rel()
     - can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
     - cpufreq: conservative: Reset requested_freq on limits change
     - [amd64] platform/x86: ISST: Correct locked bit width
     - [arm64] KVM: arm64: Discard PC update state on vcpu reset
     - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs
       attributes
     - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute
       temperature
     - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible()
     - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
     - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and
       napi_tx is false
     - erofs: add GFP_NOIO in the bio completion if needed
     - alarmtimer: Fix argument order in alarm_timer_forward()
     - [amd64] x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling()
     - [amd64] x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask
     - [arm64] phy: qcom: qmp-ufs: Fix SM8650 PCS table for Gear 4
     - ovl: fix wrong detection of 32bit inode numbers
     - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
     - scsi: ses: Handle positive SCSI error from ses_recv_diag()
     - net: macb: Move devm_{free,request}_irq() out of spin lock area
     - net: macb: Protect access to net_device::ip_ptr with RCU lock
     - net: macb: Use dev_consume_skb_any() to free TX SKBs
     - [amd64] KVM: x86/mmu: Drop/zap existing present SPTE even when creating an
       MMIO SPTE (CVE-2026-23401)
     - jbd2: gracefully abort on checkpointing state corruptions
     - [arm64] irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment
     - futex: Clear stale exiting pointer in futex_lock_pi() retry path
     - dmaengine: fsl-edma: fix channel parameter config for fixed channel
       requests
     - dmaengine: sh: rz-dmac: Protect the driver specific lists
     - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock
     - drm/amdgpu: prevent immediate PASID reuse case
     - [amd64] drm/i915/dp_tunnel: Fix error handling when clearing stream BW in
       atomic state
     - xfs: stop reclaim before pushing AIL during unmount
     - xfs: save ailp before dropping the AIL lock in push callbacks
     - xfs: scrub: unlock dquot before early return in quota scrub
     - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2
     - xfs: don't irele after failing to iget in xfs_attri_recover_work
     - xfs: remove file_path tracepoint data
     - ext4: fix journal credit check when setting fscrypt context
     - ext4: convert inline data to extents when truncate exceeds inline size
     - ext4: fix stale xarray tags after writeback
     - ext4: fix fsync(2) for nojournal mode
     - ext4: make recently_deleted() properly work with lazy itable
       initialization
     - ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio
     - ext4: validate p_idx bounds in ext4_ext_correct_indexes
     - ext4: avoid infinite loops caused by residual data
     - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
     - ext4: reject mount if bigalloc with s_first_data_block != 0
     - ext4: fix use-after-free in update_super_work when racing with umount
     - ext4: fix the might_sleep() warnings in kvfree()
     - ext4: handle wraparound when searching for blocks for indirect mapped
       blocks
     - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
     - ext4: always drain queued discard work in ext4_mb_release()
     - [arm64] dts: imx8mn-tqma8mqnl: fix LDO5 power off
     - [powerpc*] powerpc64/bpf: do not increment tailcall count when prog is
       NULL
     - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()
     - tracing: Switch trace_osnoise.c code over to use guard() and __free()
     - tracing: Fix potential deadlock in cpu hotplug with osnoise
     - drm/xe: always keep track of remap prev/next
     - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]
     - ovl: Use str_on_off() helper in ovl_show_options()
     - ovl: make fsync after metadata copy-up opt-in mount option
     - xfs: avoid dereferencing log items after push callbacks
     - virt: tdx-guest: Fix handling of host controlled 'quote' buffer length
     - net: add proper RCU protection to /proc/net/ptype (CVE-2026-23255)
     - landlock: Optimize file path walks and prepare for audit support
     - landlock: Fix handling of disconnected directories (CVE-2025-68736)
     - ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw()
       (CVE-2025-22117)
     - ice: Fix PTP NULL pointer dereference during VSI rebuild (CVE-2026-23210)
     - [amd64,arm64] idpf: check error for register_netdev() on init
     - [amd64,arm64] idpf: detach and close netdevs while handling a reset
       (CVE-2026-22981)
     - [amd64,arm64] idpf: Fix RSS LUT NULL pointer crash on early ethtool
       operations (CVE-2026-22985)
     - [amd64,arm64] idpf: Fix RSS LUT NULL ptr issue after soft reset
       (CVE-2026-22993)
     - [amd64] dmaengine: idxd: Fix not releasing workqueue on .release()
     - [amd64] dmaengine: idxd: Fix memory leak when a wq is reset
     - [amd64] dmaengine: idxd: Fix freeing the allocated ida too late
     - phy: ti: j721e-wiz: Fix device node reference leak in
       wiz_get_lane_phy_types()
     - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and
       CYCLE_BIT bits for HDMA.
     - netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators
     - [amd64] dmaengine: idxd: fix possible wrong descriptor completion in
       llist_abort_desc()
     - btrfs: fix super block offset in error message in btrfs_validate_super()
     - btrfs: fix leak of kobject name for sub-group space_info
     - btrfs: fix lost error when running device stats on multiple devices fs
     - xen/privcmd: unregister xenstore notifier on module exit
     - futex: Require sys_futex_requeue() to have identical flags
     - [amd64] dmaengine: idxd: Fix leaking event log memory
     - net: bcmasp: Restore programming of TX map vector register
     - net: bcmasp: Fix network filter wake for asp-3.0
     - [amd64,arm64] idpf: nullify pointers after they are freed
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.81
     - io_uring/kbuf: remove legacy kbuf bulk allocation
     - io_uring/kbuf: remove legacy kbuf kmem cache
     - io_uring/kbuf: simplify __io_put_kbuf
     - io_uring/kbuf: remove legacy kbuf caching
     - io_uring/kbuf: open code __io_put_kbuf()
     - io_uring/kbuf: introduce io_kbuf_drop_legacy()
     - io_uring/kbuf: uninline __io_put_kbufs
     - io_uring/kbuf: drop 'issue_flags' from io_put_kbuf(s)() arguments
     - io_uring/net: don't use io_net_kbuf_recyle() for non-provided cases
     - io_uring/net: clarify io_recv_buf_select() return value
     - io_uring/kbuf: pass in struct io_buffer_list to commit/recycle helpers
     - io_uring/kbuf: introduce struct io_br_sel
     - io_uring/kbuf: use struct io_br_sel for multiple buffers picking
     - io_uring/net: use struct io_br_sel->val as the recv finish value
     - io_uring/net: use struct io_br_sel->val as the send finish value
     - io_uring/kbuf: switch to storing struct io_buffer_list locally
     - io_uring: remove async/poll related provided buffer recycles
     - io_uring/net: correct type for min_not_zero() cast
     - io_uring/rw: check for NULL io_br_sel when putting a buffer
     - io_uring/kbuf: enable bundles for incrementally consumed buffers
     - io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths
     - io_uring/kbuf: use READ_ONCE() for userspace-mapped memory
     - io_uring/kbuf: use WRITE_ONCE() for userspace-shared buffer ring fields
     - io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF
     - io_uring/kbuf: propagate BUF_MORE through early buffer commit path
     - HID: logitech-hidpp: Enable MX Master 4 over bluetooth
     - wifi: mac80211: check tdls flag in ieee80211_tdls_oper
     - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
     - atm: lec: fix use-after-free in sock_def_readable()
     - btrfs: don't take device_list_mutex when querying zone info
     - tg3: replace placeholder MAC address with device property
     - HID: logitech-hidpp: Prevent use-after-free on force feedback
       initialisation failure
     - HID: multitouch: Check to ensure report responses match the request
     - btrfs: reserve enough transaction items for qgroup ioctls
     - [arm64,armhf] i2c: tegra: Don't mark devices with pins as IRQ safe
     - btrfs: reject root items with drop_progress and zero drop_level
     - [arm64] spi: geni-qcom: Check DMA interrupts early in ISR
     - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common
       property warning
     - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU
       session
     - [arm64,armhf] crypto: caam - fix DMA corruption on long hmac keys
     - [arm64,armhf] crypto: caam - fix overflow on long hmac keys
     - crypto: af-alg - fix NULL pointer dereference in scatterwalk
     - [arm64,armhf] net: fec: fix the PTP periodic output sysfs interface
     - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak
     - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields
       to zero to prevent an info-leak
     - net/ipv6: ioam6: prevent schema length wraparound in trace fill
     - tg3: Fix race for querying speed/duplex
     - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
     - ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
     - bridge: br_nd_send: linearize skb before parsing ND options
     - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
     - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta
     - [arm64] net: enetc: check whether the RSS algorithm is Toeplitz
     - ipv6: prevent possible UaF in addrconf_permanent_addr()
     - net: airoha: Add missing cleanup bits in airoha_qdma_cleanup_rx_queue()
     - net: introduce mangleid_features
     - net: use skb_header_pointer() for TCPv4 GSO frag_off check
     - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero
       to prevent an info-leak
     - NFC: pn533: bound the UART receive buffer
     - ASoC: Intel: boards: fix unmet dependency on PINCTRL
     - bpf: Fix regsafe() for pointers to packet
     - net: ipv6: flowlabel: defer exclusive option free until RCU teardown
     - netfilter: flowtable: strictly check for maximum number of actions
     - netfilter: nfnetlink_log: account for netlink header size
     - netfilter: x_tables: ensure names are nul-terminated
     - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
     - netfilter: nf_conntrack_helper: pass helper to expect cleanup
     - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
     - netfilter: nf_conntrack_expect: honor expectation helper field
     - netfilter: nf_conntrack_expect: use expect->helper
     - netfilter: nf_conntrack_expect: store netns and zone in expectation
     - netfilter: ctnetlink: ignore explicit helper on new expectations
     - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions
       for NFPROTO_ARP
     - netfilter: nf_tables: reject immediate NF_QUEUE verdict
     - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate
     - Bluetooth: SCO: fix race conditions in sco_sock_connect()
     - Bluetooth: MGMT: validate LTK enc_size on load
     - Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
     - Bluetooth: hci_event: fix potential UAF in
       hci_le_remote_conn_param_req_evt
     - Bluetooth: MGMT: validate mesh send advertising payload length
     - rds: ib: reject FRMR registration before IB connection is established
     - bpf: sockmap: Fix use-after-free of sk->sk_socket in
       sk_psock_verdict_data_ready().
     - net/sched: sch_netem: fix out-of-bounds access in packet corruption
     - net: macb: fix clk handling on PCI glue driver removal
     - net: macb: properly unregister fixed rate clocks
     - net/mlx5: lag: Check for LAG device before creating debugfs
     - net/mlx5: Avoid "No data available" when FW version queries fail
     - net/mlx5: Fix switchdev mode rollback in case of failure
     - bnxt_en: Restore default stat ctxs for ULP when resource is available
     - net/x25: Fix potential double free of skb
     - net/x25: Fix overflow when accumulating packets
     - net/sched: cls_fw: fix NULL pointer dereference on shared blocks
     - net/sched: cls_flow: fix NULL pointer dereference on shared blocks
     - net: hsr: fix VLAN add unwind on slave errors
     - ipv6: avoid overflows in ip6_datagram_send_ctl()
     - bpf: reject direct access to nullable PTR_TO_BUF pointers
     - Revert "drm: Fix use-after-free on framebuffers and property blobs when
       calling drm_dev_unplug"
     - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
     - hwmon: (pxe1610) Check return value of page-select write in probe
     - hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS")
     - dt-bindings: gpio: fix microchip #interrupt-cells
     - hwmon: (tps53679) Fix device ID comparison and printing in
       tps53676_identify()
     - [armhf] hwmon: (occ) Fix missing newline in occ_show_extended()
     - sched/fair: Use protect_slice() instead of direct comparison
     - sched/fair: Fix zero_vruntime tracking fix
     - [amd64,arm64] drm/ioc32: stop speculation on the drm_compat_ioctl path
     - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
     - wifi: iwlwifi: mvm: fix potential out-of-bounds read in
       iwl_mvm_nd_match_info_handler()
     - USB: serial: option: add MeiG Smart SRM825WN
     - ALSA: caiaq: fix stack out-of-bounds read in init_card
     - ALSA: ctxfi: Fix missing SPDIFI1 index handling
     - io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()
     - Bluetooth: SMP: derive legacy responder STK authentication from MITM state
     - Bluetooth: SMP: force responder MITM requirements before building the
       pairing response
     - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
     - ksmbd: fix OOB write in QUERY_INFO for compound requests
     - [armhf] hwmon: (occ) Fix division by zero in occ_show_power_1()
     - drm/amdgpu: fix the idr allocation flags
     - iio: adc: ti-adc161s626: fix buffer read on big-endian
     - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read()
     - drm/ast: dp501: Fix initialization of SCU2C
     - [amd64] drm/i915/dsi: Don't do DSC horizontal timing adjustments in
       command mode
     - [amd64] drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw
       CPU eDP
     - drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB
     - drm/amdgpu/pm: drop SMU driver if version not matched messages
     - USB: serial: io_edgeport: add support for Blackbox IC135A
     - USB: serial: option: add support for Rolling Wireless RW135R-GL
     - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
     - Input: synaptics-rmi4 - fix a locking bug in an error path
     - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk
       table
     - Input: bcm5974 - recover from failed mode switch
     - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode
     - Input: xpad - add support for Razer Wolverine V3 Pro
     - iio: adc: aspeed: clear reference voltage bits before configuring vref
     - iio: accel: fix ADXL355 temperature signature value
     - iio: accel: adxl380: fix FIFO watermark bit 8 always written as 0
     - iio: dac: ad5770r: fix error return in ad5770r_read_raw()
     - iio: light: vcnl4035: fix scan buffer on big-endian
     - iio: imu: bmi160: Remove potential undefined behavior in
       bmi160_config_pin()
     - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only
     - iio: gyro: mpu3050: Fix incorrect free_irq() variable
     - iio: gyro: mpu3050: Fix irq resource leak
     - iio: gyro: mpu3050: Move iio_device_register() to correct location
     - iio: gyro: mpu3050: Fix out-of-sequence free_irq()
     - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
     - usb: ulpi: fix double free in ulpi_register_interface() error path
     - usb: usbtmc: Flush anchored URBs in usbtmc_release
     - usb: ehci-brcm: fix sleep during atomic
     - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()
     - usb: core: phy: avoid double use of 'usb3-phy'
     - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
     - usb: cdns3: gadget: fix state inconsistency on gadget init failure
     - bridge: br_nd_send: validate ND option lengths
     - cdc-acm: new quirk for EPSON HMD
     - [amd64] comedi: Reinit dev->spinlock between attachments to low-level
       drivers
     - [amd64] comedi: me_daq: Fix potential overrun of firmware buffer
     - [amd64] comedi: me4000: Fix potential overrun of firmware buffer
     - [riscv64] firmware: microchip: fail auto-update probe if no flash found
     - dt-bindings: connector: add pd-disable dependency
     - nvmem: imx: assign nvmem_cell_info::raw_len
     - nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy
     - netfilter: ipset: drop logically empty buckets in mtype_del
     - vxlan: validate ND option lengths in vxlan_na_create
     - net: ftgmac100: fix ring allocation unwind on open failure
     - [arm64] net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled
     - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error
       path
     - gpio: mxc: map Both Edge pad wakeup to Rising Edge
     - thermal: core: Fix thermal zone device registration error path
     - misc: fastrpc: possible double-free of cctx->remote_heap
     - [amd64] thunderbolt: Fix property read in nhi_wake_supported()
     - USB: dummy-hcd: Fix locking/synchronization error
     - USB: dummy-hcd: Fix interrupt synchronization error
     - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows
       partial transfer
     - usb: typec: ucsi: validate connector number in ucsi_notify_common()
     - ice: Fix memory leak in ice_set_ringparam() (CVE-2026-23389)
     - btrfs: fix the qgroup data free range for inline data extents
     - btrfs: do not free data reservation in fallback from inline due to -ENOSPC
       (CVE-2025-71269)
     - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
     - usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo
     - usb: gadget: uvc: fix NULL pointer dereference during unbind race
     - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
     - usb: gadget: f_rndis: Protect RNDIS options with mutex
     - usb: gadget: f_ecm: Fix net_device lifecycle with device_move
     - usb: gadget: f_eem: Fix net_device lifecycle with device_move
     - usb: gadget: f_subset: Fix net_device lifecycle with device_move
     - usb: gadget: f_rndis: Fix net_device lifecycle with device_move
     - usb: gadget: f_hid: move list and spinlock inits from bind to alloc
     - usb: gadget: f_uac1_legacy: validate control request size
     - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
     - spi: cadence-qspi: Fix exec_mem_op error handling
     - net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback
     - [amd64,arm64] net: mana: fix use-after-free in add_adev() error path
     - scsi: target: tcm_loop: Drain commands in target_reset handler
     - [amd64] x86/fred: Fix early boot failures on SEV-ES/SNP guests
     - mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
     - mm: replace READ_ONCE() with standard page table accessors
     - mm/memory: fix PMD/PUD checks in follow_pfnmap_start()
     - drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13
     - ext4: publish jinode after initialization
     - [s390x] perf_cpum_sf: Convert to use try_cmpxchg128()
     - [s390x] cpum_sf: Cap sampling rate to prevent lsctl exception
     - MPTCP: fix lock class name family in pm_nl_create_listen_socket
     - [amd64] x86/CPU/AMD: Add additional fixed RDSEED microcode revisions
     - drm/amd/amdgpu: decouple ASPM with pcie dpm
     - drm/amd/amdgpu: disable ASPM in some situations
     - drm/amd/display: Disable fastboot on DCE 6 too
     - drm/amd/display: Keep PLL0 running on DCE 6.0 and 6.4
     - drm/amd/display: Fix DCE 6.0 and 6.4 PLL programming.
     - drm/amd/display: Adjust DCE 8-10 clock, don't overclock by 15%
     - drm/amd/display: Disable scaling on DCE6 for now
     - drm/amd: Disable ASPM on SI
     - drm/amd/display: Correct logic check error for fastboot
     - bpf: Improve bounds when s64 crosses sign boundary
     - bpf: Add third round of bounds deduction
     - bpf: Fix u32/s32 bounds when ranges cross min/max boundary
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.82
     - lib/crypto: chacha: Zeroize permuted_state before it leaves scope
     - usb: typec: ucsi: skip connector validation before init
     - wifi: rt2x00usb: fix devres lifetime
     - xfrm_user: fix info leak in build_report()
     - net: rfkill: prevent unlimited numbers of rfkill events from being created
     - mptcp: fix slab-use-after-free in __inet_lookup_established
     - seg6: separate dst_cache for input and output paths in seg6 lwtunnel
     - Input: uinput - fix circular locking dependency with ff-core
     - Input: uinput - take event lock when submitting FF request "event"
     - ASoC: simple-card-utils: Don't use __free(device_node) at
       graph_util_parse_dai()
     - btrfs: make wait_on_extent_buffer_writeback() static inline
     - btrfs: remove unused define WAIT_PAGE_LOCK for extent io
     - btrfs: split waiting from read_extent_buffer_pages(), drop parameter wait
     - btrfs: remove unused flag EXTENT_BUFFER_READAHEAD
     - btrfs: remove unused flag EXTENT_BUFFER_CORRUPT
     - btrfs: remove pointless out labels from extent-tree.c
     - btrfs: fix incorrect return value after changing leaf in
       lookup_extent_data_ref()
     - blktrace: fix __this_cpu_read/write in preemptible context
     - nfc: nci: complete pending data exchange on device close
     - misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe
     - Revert "mptcp: add needs_id for netlink appending addr"
     - net: annotate data-races around sk->sk_{data_ready,write_space}
     - netfilter: nft_ct: fix use-after-free in timeout object destroy
     - workqueue: Add pool_workqueue to pending_pwqs list when unplugging
       multiple inactive works
     - xfrm: clear trailing padding in build_polexpire()
     - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
     - wifi: brcmsmac: Fix dma_free_coherent() size
     - [amd64] platform/x86/intel-uncore-freq: Handle autonomous UFS status bit
     - [arm64] Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower"
     - [arm64] dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V
     - [arm64] dts: hisilicon: poplar: Correct PCIe reset GPIO polarity
     - [arm64] dts: hisilicon: hi3798cv200: Add missing dma-ranges
     - nfc: pn533: allocate rx skb before consuming bytes
     - batman-adv: reject oversized global TT response buffers
     - X.509: Fix out-of-bounds access when parsing extensions
     - [amd64,arm64] EDAC/mc: Fix error path ordering in edac_mc_alloc()
     - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
     - batman-adv: hold claim backbone gateways by reference
     - [amd64] drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat
     - [amd64] drm/i915/psr: Do not use pipe_src as borders for SU area
     - net/mlx5: Update the list of the PCI supported devices
     - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled
     - mmc: vub300: fix NULL-deref on disconnect
     - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation
       failure
     - net: stmmac: fix integer underflow in chain mode
     - mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()
     - [amd64,arm64] idpf: improve locking around idpf_vc_xn_push_free()
     - [amd64,arm64] idpf: set the payload size before calling the async handler
     - rxrpc: Fix anonymous key handling
     - rxrpc: Fix call removal to use RCU safe deletion
     - rxrpc: Fix key reference count leak from call->key
     - rxrpc: Only put the call ref if one was acquired
     - rxrpc: reject undecryptable rxkad response tickets
     - rxrpc: fix reference count leak in rxrpc_server_keyring()
     - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)
     - rxrpc: Fix missing error checks for rxkad encryption/decryption failure
     - net: skb: fix cross-cache free of KFENCE-allocated skb head
     - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6
     - [amd64] x86/CPU: Fix FPDSS on Zen1 (CVE-2026-31628)
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.83
     - RDMA/irdma: Fix double free related to rereg_user_mr
     - [amd64] ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA
     - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk
     - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC
     - [arm64,armhf] media: rkvdec: reduce stack usage in
       rkvdec_init_v4l2_vp9_count_tbl()
     - ALSA: asihpi: avoid write overflow check warning
     - Bluetooth: hci_sync: annotate data-races around hdev->req_status
     - [amd64] ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF
     - [amd64,arm64] ASoC: SOF: topology: reject invalid vendor array size in
       token parser
     - can: mcp251x: add error handling for power enable in open and resume
     - [amd64] platform/x86: asus-nb-wmi: add DMI quirk for ASUS ROG Flow Z13-KJP
       GZ302EAC
     - btrfs: tracepoints: get correct superblock from dentry in event
       btrfs_sync_file()
     - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx
     - drm/amdgpu: Handle GPU page faults correctly on non-4K page systems
     - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
     - ALSA: hda/realtek: add quirk for Framework F111:000F
     - wifi: wl1251: validate packet IDs before indexing tx_frames
     - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list
     - ALSA: hda/realtek: Add quirk for Samsung Book2 Pro 360 (NP950QED)
     - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex
     - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
     - [amd64] ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx
     - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IMH9
     - [amd64] pinctrl: intel: Fix the revision for new features (1kOhm PD, HW
       debouncer)
     - [amd64] platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug
     - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3
     - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10
     - HID: roccat: fix use-after-free in roccat_report_event
     - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585
     - wifi: brcmfmac: validate bsscfg indices in IF events
     - net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules
     - [armhf] ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J
     - [armhf] soc: aspeed: socinfo: Mask table entries for accurate SoC ID
       matching
     - [arm64] dts: qcom: hamoa/x1: fix idle exit latency
     - [arm64] dts: imx8mq: Set the correct gpu_ahb clock frequency
     - [arm64] dts: imx93-9x9-qsb: change usdhc tuning step for eMMC and SD
     - [arm64] dts: imx93-tqma9352: improve eMMC pad configuration
     - [arm64] soc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei
     - tools/power/turbostat: Fix microcode patch level output for AMD/Hygon
     - PCI: hv: Set default NUMA node to 0 for devices without affinity info
     - HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP
     - xfrm: account XFRMA_IF_ID in aevent size calculation
     - [arm*] drm/vc4: Release runtime PM reference after binding V3D
     - [arm*] drm/vc4: Fix memory leak of BO array in hang state
     - [arm*] drm/vc4: Fix a memory leak in hang state error path
     - [arm* drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock
     - eventpoll: defer struct eventpoll free to RCU grace period
     - net: sched: act_csum: validate nested VLAN headers
     - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE
     - ipv4: nexthop: avoid duplicate NHA_HW_STATS_ENABLE on nexthop group dump
     - ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()
       (CVE-2026-31531)
     - ipv4: icmp: fix null-ptr-deref in icmp_build_probe()
     - net: increase IP_TUNNEL_RECURSION_LIMIT to 5
     - nfc: s3fwrn5: allocate rx skb before consuming bytes
     - net: stmmac: Fix PTP ref clock for Tegra234
     - dt-bindings: net: Fix Tegra234 MGBE PTP clock
     - tracing/probe: reject non-closed empty immediate strings
     - ixgbevf: add missing negotiate_features op to Hyper-V ops table
     - e1000: check return value of e1000_read_eeprom
     - xsk: tighten UMEM headroom validation to account for tailroom and min
       frame
     - xsk: respect tailroom for ZC setups
     - xsk: fix XDP_UMEM_SG_FLAG issues
     - xsk: validate MTU against usable frame size on bind
     - xfrm: Wait for RCU readers during policy netns exit
     - xfrm: fix refcount leak in xfrm_migrate_policy_find
     - xfrm_user: fix info leak in build_mapping()
     - ipvs: fix NULL deref in ip_vs_add_service error path
     - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator
     - netfilter: xt_multiport: validate range encoding in checkentry
     - netfilter: ip6t_eui64: reject invalid MAC header for all packets
     - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC ->
       GFP_KERNEL_ACCOUNT allocation
     - netfilter: nfnetlink_queue: make hash table per queue
     - net: txgbe: leave space for null terminators on property_entry
     - af_unix: read UNIX_DIAG_VFS data under unix_state_lock
     - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
     - net: ipa: fix event ring index not programmed for IPA v5.0+
     - l2tp: Drop large packets with UDP encap
     - gpio: tegra: fix irq_release_resources calling enable instead of disable
     - crypto: af_alg - limit RX SG extraction by receive buffer budget
     - [amd64] perf/x86/intel/uncore: Skip discovery table for offline dies
     - sched/deadline: Use revised wakeup rule for dl_server
     - crypto: algif_aead - Fix minimum RX size check for decryption
     - netfilter: conntrack: add missing netlink policy validations
       (CVE-2026-31407)
     - Revert "drm/xe/mmio: Avoid double-adjust in 64-bit reads"
     - Revert "drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt"
     - thermal: core: Mark thermal zones as exiting before unregistration
     - thermal: core: Address thermal zone removal races with resume
     - ALSA: usb-audio: Improve Focusrite sample rate filtering
     - [amd64,arm64] idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC
       handling
     - nfc: llcp: add missing return after LLCP_CLOSED checks
     - can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)
     - i2c: s3c24xx: check the size of the SMBUS message before using it
     - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
     - HID: alps: fix NULL pointer dereference in alps_raw_event()
     - HID: core: clamp report_size in s32ton() to avoid undefined shift
     - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
     - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
     - [arm*] drm/vc4: platform_get_irq_byname() returns an int
     - ALSA: fireworks: bound device-supplied status before string array lookup
     - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
     - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()
     - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
     - usb: gadget: renesas_usb3: validate endpoint index in standard request
       handlers
     - smb: client: fix off-by-8 bounds check in check_wsl_eas()
     - ksmbd: validate EaNameLength in smb2_get_ea()
     - ksmbd: require 3 sub-authorities before reading sub_auth[2]
     - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc
     - usbip: validate number_of_packets in usbip_pack_ret_submit()
     - usb: storage: Expand range of matched versions for VL817 quirks entry
     - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen
     - usb: gadget: f_hid: don't call cdev_init while cdev in use
     - usb: port: add delay after usb_hub_set_port_power()
     - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
     - scripts: generate_rust_analyzer.py: avoid FD leak
     - wifi: rtw88: fix device leak on probe failure
     - staging: sm750fb: fix division by zero in ps_to_hz()
     - USB: serial: option: add Telit Cinterion FN990A MBIM composition
     - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates
       race
     - ALSA: ctxfi: Limit PTP to a single page
     - dcache: Limit the minimal number of bucket to two
     - media: vidtv: fix NULL pointer dereference in
       vidtv_channel_pmt_match_sections
     - ocfs2: fix possible deadlock between unlink and dio_end_io_write
     - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
     - ocfs2: handle invalid dinode in ocfs2_group_extend
     - PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup
     - [amd64] KVM: SEV: Reject attempts to sync VMSA of an
       already-launched/encrypted vCPU
     - [amd64] KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being
       created
     - [amd64] KVM: SEV: Drop WARN on large size for
       KVM_MEMORY_ENCRYPT_REG_REGION
     - gpiolib: unify two loops initializing GPIO descriptors
     - gpiolib: fix race condition for gdev->srcu (CVE-2026-22986)
     - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr()
     - kernel: be more careful about dup_mmap() failures and uprobe registering
     - KVM: Remove subtle "struct kvm_stats_desc" pseudo-overlay
     - [amd64] KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs
     - checkpatch: add support for Assisted-by tag
     - [amd64] x86-64: rename misleadingly named '__copy_user_nocache()' function
     - [amd64] x86: rename and clean up __copy_from_user_inatomic_nocache()
     - x86-64/arm64/powerpc: clean up and rename __copy_from_user_flushcache
     - [amd64] KVM: x86: Use scratch field in MMIO fragment to hold small write
       values
     - [arm64] ASoC: qcom: q6apm: move component registration to unmanaged
       version
     - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
     - media: vidtv: fix nfeeds state corruption on start_streaming failure
     - media: mediatek: vcodec: fix use-after-free in encoder release path
     - media: em28xx: fix use-after-free in em28xx_v4l2_open()
     - hwmon: (powerz) Fix use-after-free on USB disconnect
     - ALSA: 6fire: fix use-after-free on disconnect
     - bcache: fix cached_dev.sb_bio use-after-free and crash
     - media: as102: fix to not free memory after the device is registered in
       as102_usb_probe()
     - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map
     - media: vidtv: fix pass-by-value structs causing MSAN warnings
     - media: hackrf: fix to not free memory after the device is registered in
       hackrf_probe()
     - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block()
     - ocfs2: validate inline data i_size during inode read
     - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
     - rxrpc: Fix key quota calculation for multitoken keys
     - PCI: Fix placement of pci_save_state() in pci_bus_add_device()
     - ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)
     - PCI: Revert "Enable ACS after configuring IOMMU for OF platforms"
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.84
     - mm/userfaultfd: fix hugetlb fault mutex hash calculation
     - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown
     - ima: verify if the segment size has changed
     - ima: do not copy measurement list to kdump kernel
     - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
     - [arm64] net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU
       registers
     - drm/amdgpu: replace PASID IDR with XArray
     - mm/pagewalk: fix race between concurrent split and refault
     - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger
     - scripts/dtc: Remove unused dts_version in dtc-lexer.l
     - rxrpc: only handle RESPONSE during service challenge
     - fs/ntfs3: validate rec->used in journal-replay file record check
     - f2fs: fix to avoid memory leak in f2fs_rename()
     - fuse: reject oversized dirents in page cache
     - fuse: Check for large folio with SPLICE_F_MOVE
     - fuse: quiet down complaints in fuse_conn_limit_write
     - ksmbd: require minimum ACE size in smb_check_perm_dacl()
     - smb: server: fix active_num_conn leak on transport allocation failure
     - smb: server: fix max_connections off-by-one in tcp accept path
     - smb: client: require a full NFS mode SID before reading mode bits
     - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
     - ksmbd: validate response sizes in ipc_validate_msg()
     - ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()
     - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
     - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
     - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()
     - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu
     - ALSA: caiaq: take a reference on the USB device in create_card()
     - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
     - [amd64] crypto: ccp: Don't attempt to copy CSR to userspace if PSP command
       failed
     - [amd64] crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP
       command failed
     - [amd64] crypto: ccp: Don't attempt to copy ID to userspace if PSP command
       failed
     - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.85
     - crypto: scatterwalk - Backport memcpy_sglist()
     - crypto: algif_aead - use memcpy_sglist() instead of null skcipher
     - crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)
     - crypto: algif_aead - snapshot IV for async AEAD requests
     - crypto: authenc - use memcpy_sglist() instead of null skcipher
     - crypto: authencesn - Do not place hiseq at end of dst for out-of-place
       decryption
     - crypto: authencesn - Fix src offset when decrypting in-place
     - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
     - xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
     - Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)
linux-signed-amd64 (6.12.85+1~bpo12+1) bookworm-backports; urgency=high
 .
   * Sign kernel from linux 6.12.85-1~bpo12+1
 .
   * Rebuild for bookworm-backports
linux-signed-amd64 (6.12.74+2) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.74-2
 .
   * Refresh patchset to address multiple vulnerabilities in AppArmor
linux-signed-amd64 (6.12.74+2~bpo12+1) bookworm-backports; urgency=high
 .
   * Sign kernel from linux 6.12.74-2~bpo12+1
 .
   * Rebuild for bookworm-backports

linux-signed-arm64 (6.12.86+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.86-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.86
     - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
     - ALSA: usb-audio: Avoid false E-MU sample-rate notifications
     - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch
     - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable()
     - usb: chipidea: otg: not wait vbus drop if use role_switch
     - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change
     - ALSA: usb-audio: Evaluate packsize caps at the right place
     - LoongArch: Add spectre boundry for syscall dispatch table
     - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
     - leds: qcom-lpg: Check for array overflow when selecting the high
       resolution
     - greybus: gb-beagleplay: bound bootloader receive buffering
     - greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames()
     - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()
     - ibmasm: fix OOB reads in command_file_write due to missing size checks
     - ibmasm: fix heap over-read in ibmasm_send_i2o_message()
     - driver core: Don't let a device probe until it's ready
     - drm/nouveau: fix nvkm_device leak on aperture removal failure
     - kbuild: rust: allow `clippy::uninlined_format_args`
     - firmware: google: framebuffer: Do not mark framebuffer as busy
     - arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
     - padata: Fix pd UAF once and for all (CVE-2025-38584)
     - padata: Remove comment for reorder_work
     - rust: init: fix `clippy::undocumented_unsafe_blocks` warnings
     - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array
     - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion
       (CVE-2026-23468)
     - device property: Make modifications of fwnode "flags" thread safe
     - ocfs2: split transactions in dio completion to avoid credit exhaustion
     - zram: do not forget to endio for partial discard requests
     - wifi: rtw88: check for PCI upstream bridge existence
     - vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex
     - vfio/cdx: Fix NULL pointer dereference in interrupt trigger path
     - um: drivers: call kernel_strrchr() explicitly in cow_user.c
     - spi: imx: fix use-after-free on unbind
     - spi: ch341: fix memory leaks on probe failures
     - mm/memory_hotplug: fix hwpoisoned large folio handling in
       do_migrate_range()
     - crypto: pcrypt - Fix handling of MAY_BACKLOG requests
     - of: unittest: fix use-after-free in of_unittest_changeset()
     - of: unittest: fix use-after-free in testdrv_probe()
     - hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt
     - media: amphion: Fix race between m2m job_abort and device_run
     - ALSA: control: Validate buf_len before strnlen() in
       snd_ctl_elem_init_enum_names()
     - net: caif: clear client service pointer on teardown
     - net: strparser: fix skb_head leak in strp_abort_strp()
     - media: mtk-jpeg: fix use-after-free in release path due to uncancelled
       work
     - crypto: atmel-sha204a - Fix OTP sysfs read and error handling
     - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown
     - Revert "ALSA: usb: Increase volume range that triggers a warning"
     - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete
     - lib/ts_kmp: fix integer overflow in pattern length calculation
     - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in
       imx219_probe()
     - net: qrtr: ns: Fix use-after-free in driver remove()
     - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
     - ALSA: aoa: i2sbus: fix OF node lifetime handling
     - ALSA: ctxfi: Add fallback to default RSR for S/PDIF
     - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes
     - erofs: fix the out-of-bounds nameoff handling for trailing dirents
     - jbd2: fix deadlock in jbd2_journal_cancel_revoke()
     - md/raid10: fix deadlock with check operation and nowait requests
     - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused
     - mtd: docg3: fix use-after-free in docg3_release()
     - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4
     - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set
     - parisc: _llseek syscall is only available for 32-bit userspace
     - remoteproc: xlnx: Only access buffer information if IPI is buffered
     - sched: Use u64 for bandwidth ratio calculations
     - rbd: fix null-ptr-deref when device_add_disk() fails
     - block: fix zone write plugs refcount handling in
       disk_zone_wplug_schedule_bio_work()
     - io_uring/timeout: check unused sqe fields
     - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned()
     - io_uring/poll: fix signed comparison in io_poll_get_ownership()
     - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE
     - ALSA: core: Fix potential data race at fasync handling
     - ALSA: caiaq: Fix control_put() result and cache rollback
     - ALSA: caiaq: Handle probe errors properly
     - ALSA: 6fire: Fix input volume change detection
     - ALSA: pcmtest: fix reference leak on failed device registration
     - ALSA: pcmtest: Fix resource leaks in module init error paths
     - iio: adc: ad7768-1: fix one-shot mode data acquisition
     - rxrpc: Fix memory leaks in rxkad_verify_response()
     - rxrpc: Fix rxkad crypto unalignment handling
     - rxrpc: Fix re-decryption of RESPONSE packets
     - tools/accounting: handle truncated taskstats netlink messages
     - arm64: dts: marvell: uDPU: add ethernet aliases
     - net: qrtr: ns: Free the node during ctrl_cmd_bye()
     - net: rds: fix MR cleanup on copy error
     - net: txgbe: fix firmware version check
     - net/smc: avoid early lgr access in smc_clc_wait_msg
     - net: ks8851: Reinstate disabling of BHs around IRQ handler
     - netconsole: avoid out-of-bounds access on empty string in trim_newline()
     - net: ks8851: Avoid excess softirq scheduling
     - drm/arcpgu: fix device node leak
     - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
     - ipv4: icmp: validate reply type before using icmp_pointers
     - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()
     - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE'
     - tpm: avoid -Wunused-but-set-variable
     - LoongArch: Show CPU vulnerabilites correctly
     - power: supply: axp288_charger: Do not cancel work before initializing it
     - hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data()
     - randomize_kstack: Maintain kstack_offset per task
     - mmc: block: use single block write in retry
     - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration
     - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins
     - xfs: fix a resource leak in xfs_alloc_buftarg()
     - firmware: google: framebuffer: Do not unregister platform device
     - crypto: talitos - fix SEC1 32k ahash request limitation
     - crypto: talitos - rename first/last to first_desc/last_desc
     - pwm: imx-tpm: Count the number of enabled channels in probe
     - tpm: Fix auth session leak in tpm2_get_random() error path
     - tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()
     - tpm: tpm_tis: add error logging for data transfer
     - tpm: tpm_tis: stop transmit if retries are exhausted
     - rtc: ntxec: fix OF node reference imbalance
     - mm/damon/core: use time_in_range_open() for damos quota window start
     - userfaultfd: allow registration of ranges below mmap_min_addr
     - KVM: x86: Defer non-architectural deliver of exception payload to
       userspace read
     - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state
     - KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2
     - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
     - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0
     - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts
     - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode
     - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT
     - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN
     - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID)
     - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT
     - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT
     - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS
     - KVM: nSVM: Add missing consistency check for nCR3 validity
     - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
     - KVM: nSVM: Always intercept VMMCALL when L2 is active
     - io_uring/poll: fix multishot recv missing EOF on wakeup race
     - perf annotate: Use jump__delete when freeing LoongArch jumps
     - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access
     - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()
     - mtd: spi-nor: sst: Fix write enable before AAI sequence
     - amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2
     - md/raid5: fix soft lockup in retry_aligned_read()
     - md/raid5: validate payload size before accessing journal metadata
     - check-uapi: link into shared objects
     - HID: apple: ensure the keyboard backlight is off if suspending
     - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails
     - x86/cpu: Disable FRED when PTI is forced on
     - wifi: rtl8xxxu: fix potential use of uninitialized value
     - tcp: call sk_data_ready() after listener migration
     - taskstats: set version in TGID exit notifications
     - mfd: core: Preserve OF node when ACPI handle is present
     - apparmor: use target task's context in apparmor_getprocattr()
     - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
     - bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays
     - can: ucan: fix devres lifetime
     - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit
     - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup
     - crypto: atmel-ecc - Release client on allocation failure
     - crypto: hisilicon - Fix dma_unmap_single() direction
     - crypto: ccree - fix a memory leak in cc_mac_digest()
     - crypto: atmel-tdes - fix DMA sync direction
     - crypto: atmel-sha204a - Fix error codes in OTP reads
     - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path
     - crypto: atmel-sha204a - Fix uninitialized data access on OTP read error
     - crypto: nx - Fix packed layout in struct nx842_crypto_header
     - dm mirror: fix integer overflow in create_dirty_log()
     - ceph: only d_add() negative dentries when they are unhashed
     - IB/core: Fix zero dmac race in neighbor resolution
     - ktest: Fix the month in the name of the failure directory
     - ntfs3: add buffer boundary checks to run_unpack()
     - ntfs3: fix integer overflow in run_unpack() volume boundary check
     - rtmutex: Use waiter::task instead of current in remove_waiter()
     - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails
     - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode
     - smb: client: validate the whole DACL before rewriting it in cifsacl
       (CVE-2026-31709)
     - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in
       f2fs_write_end_io() (CVE-2026-31715)
     - lib: test_hmm: evict device pages on file close to avoid use-after-free
     - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally
     - ksmbd: use msleep instaed of schedule_timeout_interruptible()
     - ksmbd: replace connection list with hash table
     - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id()
     - thermal: core: Fix thermal zone governor cleanup issues
     - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor
     - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling
     - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
     - mm/migrate: factor out movable_ops page handling into
       migrate_movable_ops_page()
     - mm/migrate: move movable_ops page handling out of move_to_new_folio()
     - mm: migrate: requeue destination folio on deferred split queue
     - ALSA: aoa: Use guard() for mutex locks
     - ALSA: aoa: i2sbus: clear stale prepared state
     - mm/zsmalloc: copy KMSAN metadata in zs_page_migrate()
     - media: rc: ttusbir: respect DMA coherency rules
     - ALSA: aoa: Skip devices with no codecs in i2sbus_resume()
     - media: rc: igorplugusb: heed coherency rules
     - RDMA/mana_ib: Disable RX steering on RSS QP destroy
     - block: relax pgmap check in bio_add_page for compatible zone device pages
     - iio: frequency: admv1013: add dev variable
     - iio: frequency: admv1013: fix NULL pointer dereference on str
     - rxrpc: Fix potential UAF after skb_unshare() failure
     - net: qrtr: ns: Limit the maximum server registration per node
     - net: qrtr: ns: Limit the maximum number of lookups
     - net: bridge: use a stable FDB dst snapshot in RCU readers
     - net: mctp: fix don't require received header reserved bits to be zero
     - net: qrtr: ns: Limit the total number of nodes
     - spi: fix resource leaks on device setup failure
     - mm: prevent droppable mappings from being locked
     - crypto: authencesn - reject short ahash digests during instance creation
     - net: bonding: fix use-after-free in bond_xmit_broadcast() (CVE-2026-31419)
     - driver core: Add kernel-doc for DEV_FLAG_COUNT enum value
     - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path
     - ALSA: caiaq: Don't abort when no input device is available
     - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
     - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
     - drm/amdgpu: fix zero-size GDS range init on RDNA4
     - ALSA: caiaq: fix usb_dev refcount leak on probe failure
     - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
     - netfilter: reject zero shift in nft_bitwise
 .
   [ Ben Hutchings ]
   * Fix ordering of kernel version strings for multiple Debian revisions
     (Closes: #1113728)
   * rxrpc: Fix conn-level packet handling to unshare RESPONSE packets
 .
   [ Salvatore Bonaccorso ]
   * xfrm: esp: avoid in-place decrypt on shared skb frags
   * rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
linux-signed-arm64 (6.12.86+1~bpo12+1) bookworm-backports; urgency=high
 .
   * Sign kernel from linux 6.12.86-1~bpo12+1
 .
   * Rebuild for bookworm-backports
linux-signed-arm64 (6.12.85+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.85-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.75
     - RDMA/siw: Fix potential NULL pointer dereference in header processing
     - RDMA/umad: Reject negative data_len in ib_umad_write
     - auxdisplay: arm-charlcd: fix release_mem_region() size
     - hfsplus: return error when node already exists in hfs_bnode_create
     - rcu: Refactor expedited handling check in rcu_read_unlock_special()
     - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler()
     - rcu: Fix rcu_read_unlock() deadloop due to softirq
     - audit: move the compat_xxx_class[] extern declarations to audit_arch.h
     - i3c: Move device name assignment after i3c_bus_init
     - fs: add <linux/init_task.h> for 'init_fs'
     - i3c: master: Update hot-join flag only on success
     - gfs2: Retries missing in gfs2_{rename,exchange}
     - gfs2: Fix slab-use-after-free in qd_put
     - gfs2: Fix use-after-free in iomap inline data write path
     - i3c: dw: Initialize spinlock to avoid upsetting lockdep
     - i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers()
     - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure
     - tpm: st33zp24: Fix missing cleanup on get_burstcount() error
     - erofs: get rid of raw bi_end_io() usage
     - erofs: handle end of filesystem properly for file-backed mounts
     - btrfs: qgroup: return correct error when deleting qgroup relation item
     - btrfs: fix block_group_tree dirty_list corruption
     - smb: client: fix potential UAF and double free in smb2_open_file()
     - block: add a bio_add_virt_nofail helper
     - rnbd-srv: use bio_add_virt_nofail
     - rnbd-srv: Fix server side setting of bi_size for special IOs
     - xen/virtio: Don't use grant-dma-ops when running as Dom0
     - io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED
     - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()
     - io_uring/sync: validate passed in offset
     - cpuidle: governors: menu: Always check timers with tick stopped
     - thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature
     - md/raid5: fix raid5_run() to return error when log_init() fails
     - md/raid10: fix any_working flag handling in raid10_sync_request
     - OPP: Return correct value in dev_pm_opp_get_level
     - cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id()
     - iomap: fix submission side handling of completion side errors
     - thermal/of: Fix reference leak in thermal_of_cm_lookup()
     - ublk: Validate SQE128 flag before accessing the cmd
     - Partial revert "x86/xen: fix balloon target initialization for PVH dom0"
     - md/raid1: fix memory leak in raid1_run() if no active rdev
     - md/raid1: fix memory leak in raid1_run()
     - PM: wakeup: Handle empty list in wakeup_sources_walk_start()
     - perf: arm_spe: Properly set hw.state on failures
     - cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not
       possible
     - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races
     - [s390x] cio: Fix device lifecycle handling in css_alloc_subchannel()
     - [amd64] perf/x86/core: Do not set bit width for unavailable counters
     - crypto: qat - fix warning on adf_pfvf_pf_proto.c
     - libbpf: Fix OOB read in btf_dump_get_bitfield_value
     - [armhf] VDSO: Patch out __vdso_clock_getres() if unavailable
     - [arm64] crypto: cavium - fix dma_free_coherent() size
     - bpf: Preserve id of register in sync_linked_regs()
     - hrtimer: Fix trace oddity
     - [amd64] crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls
     - [amd64] crypto: ccp - narrow scope of snp_range_list
     - bpf, sockmap: Fix incorrect copied_seq calculation
     - bpf, sockmap: Fix FIONREAD for sockmap
     - tracing: Add a comment about ftrace_regs definition
     - ftrace: Make ftrace_regs abstract from direct use
     - ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs
     - ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros
     - ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value
     - fgraph: Replace fgraph_ret_regs with ftrace_regs
     - tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs
     - tracing: Add ftrace_fill_perf_regs() for perf event
     - [amd64] x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return
       probe
     - [amd64] x86/fgraph,bpf: Switch kprobe_multi program stack unwind to
       hw_regs path
     - [arm64] crypto: caam - fix netdev memory leak in dpaa2_caam_probe
     - bpf: Fix bpf_xdp_store_bytes proto for read-only arg
     - genirq: Set IRQF_COND_ONESHOT in devm_request_irq().
     - [amd64] platform/x86: int0002: Remove IRQF_ONESHOT from request_irq()
     - Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler
     - scsi: efct: Use IRQF_ONESHOT and default primary handler
     - EDAC/altera: Remove IRQF_ONESHOT
     - mfd: wm8350-core: Use IRQF_ONESHOT
     - media: pci: mg4b: Use IRQF_NO_THREAD
     - sched/deadline: Clear the defer params
     - sched/rt: Skip currently executing CPU in rto_next_cpu()
     - hwrng: core - Allow runtime disabling of the HW RNG
     - hwrng: core - use RCU and work_struct to fix race condition
     - pstore/ram: fix buffer overflow in persistent_ram_save_old()
     - soc: qcom: smem: handle ENOMEM error during probe
     - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size()
     - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size()
     - firmware: arm_ffa: Correct 32-bit response handling in
       NOTIFICATION_INFO_GET
     - [arm64] dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings
     - [arm64] dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings
     - [arm64] clk: qcom: Return correct error code in qcom_cc_probe_by_index()
     - [arm64] dts: qcom: sdm630: fix gpu_speed_bin size
     - [arm64] dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on
     - [arm64] dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on
     - [arm64] dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks
     - [arm64] dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of
       AD7147
     - [armhf] dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property
     - [powerpc*] uaccess: Move barrier_nospec() out of
       allow_read_{from/write}_user()
     - [arm64] soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in
       cmd_db_dev_probe
     - [arm64] soc: mediatek: svs: Fix memory leak in svs_enable_debug_write()
     - [powerpc*] eeh: fix recursive pci_lock_rescan_remove locking in EEH event
       handling
     - [arm64] dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node
     - [arm64] dts: amlogic: s4: assign mmc b clock to 24MHz
     - [arm64] dts: amlogic: s4: fix mmc clock assignment
     - [arm64] dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order
     - [arm64] dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog
       instances for j784s4
     - hwspinlock: omap: Handle devm_pm_runtime_enable() errors
     - [arm64] dts: amlogic: c3: assign the MMC signal clocks
     - [arm64] dts: amlogic: axg: assign the MMC signal clocks
     - [arm64] dts: amlogic: gx: assign the MMC signal clocks
     - [arm64] dts: amlogic: g12: assign the MMC B and C signal clocks
     - [arm64] dts: amlogic: g12: assign the MMC A signal clock
     - [arm64] dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm
     - [arm64] dts: qcom: sdm845-db845c: drop CS from SPIO0
     - [arm64] dts: qcom: sdm845-db845c: specify power for WiFi CH1
     - [arm64] dts: qcom: x1e: bus is 40-bits (fix 64GB models)
     - [arm64] dts: qcom: agatti: Add CX_MEM/DBGC GPU regions
     - [arm64] dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions
     - [arm64] drm/panthor: Recover from panthor_gpu_flush_caches() failures
     - [arm64] drm/panthor: Fix the full_tick check
     - [arm64] drm/panthor: Fix the group priority rotation logic
     - [arm64] drm/panthor: Fix immediate ticking on a disabled tick
     - [arm64] drm/panthor: Fix the logic that decides when to stop ticking
     - [arm64] drm/panthor: Make sure we resume the tick when new jobs are
       submitted
     - workqueue: Factor out assign_rescuer_work()
     - workqueue: Only assign rescuer work when really needed
     - workqueue: Process rescuer work items one-by-one using a cursor
     - drm/panel: sw43408: Remove manual invocation of unprepare at remove
     - ALSA: pcm: use new array-copying-wrapper
     - ALSA: pcm: Relax __free() variable declarations
     - ALSA: vmaster: Relax __free() variable declarations
     - [arm64] drm/panthor: Evict groups before VM termination
     - [amd64] ASoC: nau8821: Consistently clear interrupts before unmasking
     - [amd64] ASoC: nau8821: Avoid unnecessary blocking in IRQ handler
     - [amd64] ASoC: nau8821: Fixup nau8821_enable_jack_detect()
     - media: chips-media: wave5: Fix memory leak on codec_info allocation
       failure
     - drm/amd: Drop "amdgpu kernel modesetting enabled" message
     - drm/amdkfd: Fix signal_eviction_fence() bool return value
     - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init
     - [arm64] drm/msm/disp/dpu: add merge3d support for sc7280
     - [arm64] drm/msm/dpu: Set vsync source irrespective of mdp top support
     - [arm64] drm/msm/dpu: fix WD timer handling on DPU 8.x
     - regulator: core: move supply check earlier in set_machine_constraints()
     - HID: playstation: Add missing check for input_ff_create_memless
     - [arm64] drm/msm/disp: set num_planes to 1 for interleaved YUV formats
     - [arm64] drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x
     - media: ccs: Accommodate C-PHY into the calculation
     - [arm64] drm/msm/a2xx: fix pixel shader start on A225
     - drm/buddy: release free_trees array on buddy mm teardown
     - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev
     - media: uvcvideo: Fix allocation for small frame sizes
     - evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac()
     - drm/xe: Unregister drm device on probe error
     - platform/chrome: cros_ec_lightbar: Fix response size initialization
     - HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients
     - spi: tools: Add include folder to .gitignore
     - Revert "hwmon: (ibmpex) fix use-after-free in high/low store"
     - hwmon: pmbus: mpq8785: Prepare driver for multiple device support
     - hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio
       configuration
     - hwmon: pmbus: mpq8785: Add support for MPM82504
     - hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification
     - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails
     - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors
     - PCI/PM: Avoid redundant delays on D3hot->D3cold
     - wifi: cfg80211: Fix use_for flag update on BSS refresh
     - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails
     - docs: fix WARNING document not included in any toctree
     - Documentation: trace: Refactor toctree
     - Documentation: tracing: Add PCI tracepoint documentation
     - PCI: Do not attempt to set ExtTag for VFs
     - PCI/portdrv: Fix potential resource leak
     - dm: fix unlocked test for dm_suspended_md
     - dm: use READ_ONCE in dm_blk_report_zones
     - quota: fix livelock between quotactl and freeze_super
     - net: mctp-i2c: fix duplicate reception of old data
     - mctp i2c: initialise event handler read bytes
     - wifi: cfg80211: stop NAN and P2P in cfg80211_leave
     - netfilter: nf_tables: reset table validation state on abort
     - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH
     - netfilter: nf_conncount: increase the connection clean up limit to 64
     - netfilter: nft_compat: add more restrictions on netlink attributes
     - netfilter: nf_conncount: fix tracking of connections from localhost
     - module: add helper function for reading module_buildid()
     - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup()
     - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken
     - [amd64] iommu/vt-d: Flush cache for PASID table before using it
     - [amd64] iommu/vt-d: Separate page request queue from SVM
     - [amd64] iommu/vt-d: Drain PRQs when domain removed from RID
     - [amd64] iommu/vt-d: Avoid draining PRQ in sva mm release path
     - [amd64] iommu/vt-d: Clear Present bit before tearing down PASID entry
     - dm: use bio_clone_blkg_association
     - xdrgen: Fix struct prefix for typedef types in program wrappers
     - NFS: NFSERR_INVAL is not defined by NFSv2
     - xdrgen: Initialize data pointer for zero-length items
     - nfsd: never defer requests during idmap lookup
     - fat: avoid parent link count underflow in rmdir
     - tcp: tcp_tx_timestamp() must look at the rtx queue
     - PCI: Check parent for NULL in of_pci_bus_release_domain_nr()
     - wifi: ath10k: sdio: add missing lock protection in
       ath10k_sdio_fw_crashed_dump()
     - PCI: Initialize RCB from pci_configure_device()
     - PCI: Add defines for bridge window indexing
     - PCI/ACPI: Restrict program_hpx_type2() to AER bits
     - ipc: don't audit capability check in ipc_permissions()
     - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit()
     - mptcp: fix receive space timestamp initialization
     - octeontx2-af: Fix PF driver crash with kexec kernel booting
     - bonding: only set speed/duplex to unknown, if getting speed failed
     - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
     - nfc: hci: shdlc: Stop timers and work before freeing context
     - netfilter: nfnetlink_queue: optimize verdict lookup with hash table
     - netfilter: nfnetlink_queue: do shared-unconfirmed check before
       segmentation
     - netfilter: nft_set_hash: fix get operation on big endian
     - netfilter: nft_counter: fix reset of counters on 32bit archs
     - netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null
       interval
     - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets
     - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404]
     - [arm64] net: hns3: fix double free issue for tx spare buffer
     - procfs: fix missing RCU protection when reading real_parent in
       do_task_stat()
     - smb: client: correct value for smbd_max_fragmented_recv_size
     - net: atm: fix crash due to unvalidated vcc pointer in sigd_send()
     - net: sunhme: Fix sbus regression
     - net: Add skb_dstref_steal and skb_dstref_restore
     - net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input
       callers
     - xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path
     - serial: caif: fix use-after-free in caif_serial ldisc_close()
     - octeon_ep: disable per ring interrupts
     - octeon_ep: ensure dbell BADDR updation
     - octeon_ep_vf: ensure dbell BADDR updation
     - ionic: Rate limit unknown xcvr type messages
     - octeontx2-pf: Unregister devlink on probe failure
     - RDMA/rtrs: server: remove dead code
     - IB/cache: update gid cache on client reregister event
     - RDMA/hns: Fix WQ_MEM_RECLAIM warning
     - RDMA/hns: Fix RoCEv1 failure due to DSCP
     - RDMA/hns: Notify ULP of remaining soft-WCs during reset
     - power: supply: ab8500: Fix use-after-free in power_supply_changed()
     - power: supply: act8945a: Fix use-after-free in power_supply_changed()
     - power: supply: bq256xx: Fix use-after-free in power_supply_changed()
     - power: supply: bq25980: Fix use-after-free in power_supply_changed()
     - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed()
     - power: supply: goldfish: Fix use-after-free in power_supply_changed()
     - power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed()
     - power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed()
     - power: supply: rt9455: Fix use-after-free in power_supply_changed()
     - power: supply: sbs-battery: Fix use-after-free in power_supply_changed()
     - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write
     - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported
     - power: supply: wm97xx: Fix NULL pointer dereference in
       power_supply_changed()
     - RDMA/rtrs-srv: fix SG mapping
     - RDMA/rxe: Fix double free in rxe_srq_from_init
     - RDMA/iwcm: Fix workqueue list corruption by removing work_list
     - tools/power/x86/intel-speed-select: Fix file descriptor leak in
       isolate_cpus()
     - RDMA/mlx5: Fix UMR hang in LAG error state unload
     - IB/mlx5: Fix port speed query for representors
     - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper
     - vfio/pci: Lock upstream bridge for vfio_pci_core_disable()
     - [amd64] platform/x86/amd/pmf: Prevent TEE errors after hibernate
     - [amd64] crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails
     - [amd64] crypto: ccp - Add an S4 restore flow
     - [amd64] crypto: ccp - Factor out ring destroy handling to a helper
     - [amd64] crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when
       PSP_CMD_TEE_RING_INIT fails
     - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse()
     - nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx
     - NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit
     - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send
     - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler
     - RDMA/rxe: Fix race condition in QP timer handlers
     - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing
     - cxl: Fix premature commit_end increment on decoder commit failure
     - mtd: parsers: ofpart: fix OF node refcount leak in
       parse_fixed_partitions()
     - mtd: spinand: Fix kernel doc
     - power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler
     - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer
     - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc
     - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN
     - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()
     - scsi: ufs: host: mediatek: Require CONFIG_PM
     - scsi: csiostor: Fix dereference of null pointer rn
     - nvdimm: virtio_pmem: serialize flush requests
     - fs/nfs: Fix readdir slow-start regression
     - tracing: Properly process error handling in event_hist_trigger_parse()
     - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros
     - fbdev: of_display_timing: Fix device node reference leak in
       of_get_display_timings()
     - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()
     - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs
     - clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs
     - clk: qcom: rcg2: compute 2d using duty fraction directly
     - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs
     - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc
     - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc
     - clk: qcom: gcc-ipq5018: flag sleep clock as critical
     - clk: Move clk_{save,restore}_context() to COMMON_CLK section
     - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks
     - clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src
     - clk: qcom: gfx3d: add parent to parent request map
     - clk: mediatek: Fix error handling in runtime PM setup
     - interconnect: mediatek: Don't hijack parent device
     - interconnect: mediatek: Aggregate bandwidth with saturating add
     - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX
     - dma: dma-axi-dmac: fix SW cyclic transfers
     - dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue
     - soundwire: intel_ace2x: add SND_HDA_CORE dependency
     - iio: test: drop dangling symbol in gain-time-scale helpers
     - staging: greybus: lights: avoid NULL deref
     - serial: imx: change SERIAL_IMX_CONSOLE to bool
     - serial: SH_SCI: improve "DMA support" prompt
     - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms
     - iio: pressure: mprls0025pa: fix spi_transfer struct initialisation
     - iio: pressure: mprls0025pa: fix SPI CS delay violation
     - iio: pressure: mprls0025pa: fix interrupt flag
     - iio: pressure: mprls0025pa: fix scan_type struct
     - iio: pressure: mprls0025pa: fix pressure calculation
     - watchdog: starfive-wdt: Fix PM reference leak in probe error path
     - coresight: etm3x: Fix cpulocked warning on cpuhp
     - phy: freescale: imx8qm-hsio: fix NULL pointer dereference
     - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms"
     - mfd: arizona: Fix regulator resource leak on
       wm5102_clear_write_sequencer() failure
     - mfd: simple-mfd-i2c: Add MAX77705 support
     - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA
     - mfd: simple-mfd-i2c: Add SpacemiT P1 support
     - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order
     - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support
     - drivers: iio: mpu3050: use dev_err_probe for regulator request
     - usb: bdc: fix sleep during atomic
     - pinctrl: equilibrium: Fix device node reference leak in pinbank_init()
     - ovl: Fix uninit-value in ovl_fill_real
     - iio: sca3000: Fix a resource leak in sca3000_probe()
     - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition
     - pinctrl: single: fix refcount leak in pcs_add_gpio_func()
     - leds: qcom-lpg: Check the return value of regmap_bulk_write()
     - backlight: qcom-wled: Support ovp values for PMI8994
     - backlight: qcom-wled: Change PM8950 WLED configurations
     - dmaengine: fsl-edma: don't explicitly disable clocks in .remove()
     - drbd: always set BLK_FEAT_STABLE_WRITES
     - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data
     - fs/ntfs3: Initialize new folios before use
     - fs/ntfs3: prevent infinite loops caused by the next valid being the same
     - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot
     - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs
     - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check
     - kbuild: Add objtool to top-level clean target
     - objpool: fix the overestimation of object pooling metadata size
     - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO
     - cpuidle: Skip governor when only one idle state is available
     - net: sparx5/lan969x: fix DWRR cost max to match hardware register width
     - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper
     - net: mscc: ocelot: split xmit into FDMA and register injection paths
     - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()
     - ipv6: Fix out-of-bound access in fib6_add_rt2node().
     - net: sparx5/lan969x: fix PTP clock max_adj value
     - net: usb: catc: enable basic endpoint checking
     - xen-netback: reject zero-queue configuration from guest
     - net/rds: rds_sendmsg should not discard payload_len
     - net: bridge: mcast: always update mdb_n_entries for vlan contexts
     - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value
     - ipvs: do not keep dest_dst if dev is going down
     - net: remove WARN_ON_ONCE when accessing forward path array
     - netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
       (CVE-2026-23231)
     - ipv6: fix a race in ip6_sock_set_v6only()
     - bpftool: Fix truncated netlink dumps
     - ping: annotate data-races in ping_lookup()
     - macvlan: observe an RCU grace period in macvlan_common_newlink() error
       path
     - icmp: prevent possible overflow in icmp_global_allow()
     - inet: move icmp_global_{credit,stamp} to a separate cache line
     - octeontx2-af: Fix default entries mcam entry action
     - bonding: alb: fix UAF in rlb_arp_recv during bond up/down
     - net/mlx5: Fix multiport device check over light SFs
     - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels
     - apparmor: fix NULL sock in aa_sock_file_perm
     - AppArmor: Allow apparmor to handle unaligned dfa tables
     - apparmor: Fix & Optimize table creation from possibly unaligned memory
     - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure
     - apparmor: fix rlimit for posix cpu timers
     - apparmor: remove apply_modes_to_perms from label_match
     - apparmor: make label_match return a consistent value
     - apparmor: avoid per-cpu hold underflow in aa_get_buffer
     - apparmor: fix invalid deref of rawdata when export_binary is unset
     - apparmor: fix aa_label to return state from compount and component match
     - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()
     - drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()
     - drm/amdgpu: Fix memory leak in amdgpu_ras_init()
     - ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put()
     - [amd64] drm/i915/acpi: free _DSM package when no connectors
     - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init
     - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2
     - drm/amd/display: Reject cursor plane on DCE when scaled differently than
       primary
     - drm/amd/display: Fix out-of-bounds stream encoder index v3
     - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe()
     - [s390x] kexec: Make KEXEC_SIG available when CONFIG_MODULES=n
     - drm/xe: Move forcewake to 'gt.pm' substructure
     - drm/xe: Create dedicated xe_mmio structure
     - drm/xe: Clarify size of MMIO region
     - drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio'
     - drm/xe: Populate GT's mmio iomap from tile during init
     - drm/xe: Switch mmio_ext to use 'struct xe_mmio'
     - drm/xe: Add xe_tile backpointer to xe_mmio
     - drm/xe: Adjust mmio code to pass VF substructure to SRIOV code
     - drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt
     - drm/xe/mmio: Avoid double-adjust in 64-bit reads
     - drm/xe/ptl: Apply Wa_13011645652
     - drm/xe/xe2_hpg: Add set of workarounds
     - drm/xe/xe2_hpg: Fix handling of Wa_14019988906 & Wa_14019877138
     - efi: Fix reservation of unaccepted memory table
     - btrfs: use the correct type to initialize block reserve for delayed refs
     - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not
       found
     - [amd64] x86/hyperv: Fix error pointer dereference
     - [arm64] ASoC: rockchip: i2s-tdm: Use param rate if not provided by
       set_sysclk
     - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats
     - ext4: subdivide EXT4_EXT_DATA_VALID1
     - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1
     - ext4: don't cache extent during splitting extent
     - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout
     - ext4: drop extent cache when splitting extent fails
     - ext4: fix memory leak in ext4_ext_shift_extents()
     - ext4: fix e4b bitmap inconsistency reports
     - ext4: fix dirtyclusters double decrement on fs shutdown
     - ext4: use optimized mballoc scanning regardless of inode format
     - ata: pata_ftide010: Fix some DMA timings
     - ata: libata-scsi: refactor ata_scsi_translate()
     - Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT
     - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths
     - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path
     - dt-bindings: phy: qcom-edp: Add missing clock for X Elite
     - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false
     - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names
     - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names
     - perf test stat: Update test expectations and events
     - perf test stat tests: Fix for virtualized machines
     - perf unwind-libdw: Fix invalid reference counts
     - perf callchain: Fix srcline printing with inlines
     - libsubcmd: Fix null intersection case in exclude_cmds()
     - perf maps: Fix reference count leak in maps__find_ams()
     - perf annotate: Fix memcpy size in arch__grow_instructions()
     - perf vendor events amd: Fix Zen 5 MAB allocation events
     - libperf: Don't remove -g when EXTRA_CFLAGS are used
     - libperf build: Always place libperf includes first
     - rtc: interface: Alarm race handling should not discard preceding error
     - statmount: permission check should return EPERM
     - audit: add fchmodat2() to change attributes class
     - hfsplus: fix volume corruption issue for generic/498
     - fs/buffer: add alert in try_to_free_buffers() for folios without buffers
     - audit: add missing syscalls to read class
     - hfsplus: pretend special inodes as regular files
     - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr()
     - i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init
     - minix: Add required sanity checking to minix_check_superblock()
     - dlm: validate length in dlm_search_rsb_tree
     - btrfs: fallback to buffered IO if the data profile has duplication
     - btrfs: handle user interrupt properly in btrfs_trim_fs()
     - smb: client: add proper locking around ses->iface_last_update
     - gfs2: fiemap page fault fix
     - smb: client: prevent races in ->query_interfaces()
     - tools/power cpupower: Reset errno before strtoull()
     - [s390x] purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
     - [arm64] Add support for TSV110 Spectre-BHB mitigation
     - rnbd-srv: Zero the rsp buffer before using it
     - [amd64] x86/xen/pvh: Enable PAE mode for 32-bit guest only when
       CONFIG_X86_PAE is set
     - EFI/CPER: don't dump the entire memory region
     - APEI/GHES: ensure that won't go past CPER allocated record
     - APEI/GHES: ARM processor Error: don't go past allocated memory
     - EFI/CPER: don't go past the ARM processor CPER record buffer
     - ACPI: processor: Fix NULL-pointer dereference in
       acpi_processor_errata_piix4()
     - ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[]
     - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP
     - powercap: intel_rapl: Add PL4 support for Ice Lake
     - alpha: fix user-space corruption during memory compaction
     - md-cluster: fix NULL pointer dereference in process_metadata_update
     - cpufreq: dt-platdev: Block the driver from probing on more QC platforms
     - [s390x] perf: Disable register readout on sampling events
     - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD
     - ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display)
     - ACPI: battery: fix incorrect charging status when current is zero
     - xenbus: Use .freeze/.thaw to handle xenbus devices
     - blk-mq-debugfs: add missing debugfs_mutex in
       blk_mq_debugfs_register_hctxs()
     - block: decouple secure erase size limit from discard size limit
     - bpf: verifier improvement in 32bit shift sign extension pattern
     - [amd64] perf/x86/msr: Add Airmont NP
     - [amd64] perf/x86/cstate: Add Airmont NP
     - bpf: crypto: Use the correct destructor kfunc type
     - bpf: Recognize special arithmetic shift in the verifier
     - clocksource/drivers/sh_tmu: Always leave device running after probe
     - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on
       OF
     - PCI/MSI: Unmap MSI-X region on error
     - crypto: hisilicon/qm - move the barrier before writing to the mailbox
       register
     - mailbox: bcm-ferxrm-mailbox: Use default primary handler
     - char: tpm: cr50: Remove IRQF_ONESHOT
     - sched/debug: Fix updating of ppos on server write ops
     - pstore: ram_core: fix incorrect success return when vmap() fails
     - firmware: arm_ffa: Unmap Rx/Tx buffers on init failure
     - [arm64] Revert "arm64: zynqmp: Add an OP-TEE node to the device tree"
     - [arm64] tegra: smaug: Add usb-role-switch support
     - drm/display/dp_mst: Add protection against 0 vcpi
     - gpu/panel-edp: add AUO panel entry for B140HAN06.4
     - drm/amdgpu: fix NULL pointer issue buffer funcs
     - drm/amdkfd: Handle GPU reset and drain retry fault race
     - spi-geni-qcom: initialize mode related registers to 0
     - spi-geni-qcom: use xfer->bits_per_word for can_dma()
     - drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32
     - [amd64] ASoC: SOF: ipc4: Support for sending payload along with
       LARGE_CONFIG_GET
     - media: dvb-core: dmxdevfilter must always flush bufs
     - spi: stm32: fix Overrun issue at < 8bpw
     - drm/v3d: Set DMA segment size to avoid debug warnings
     - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes
     - media: omap3isp: isppreview: always clamp in preview_try_format()
     - media: omap3isp: set initial format
     - media: chips-media: wave5: Fix conditional in start_streaming
     - media: chips-media: wave5: Process ready frames when CMD_STOP sent to
       Encoder
     - media: mediatek: vcodec: Don't try to decode 422/444 VP9
     - drm/amdgpu: add support for HDP IP version 6.1.1
     - drm/amd/display: Fix dsc eDP issue
     - drm/amdgpu: avoid a warning in timedout job handler
     - drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src
     - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards
     - drm/amdgpu: Skip loading SDMA_RS64 in VF
     - drm/amd/display: only power down dig on phy endpoints
     - drm/xe: Only toggle scheduling in TDR if GuC is running
     - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask
     - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug
     - spi: spi-mem: Limit octal DTR constraints to octal DTR situations
     - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START
     - drm/panel: Fix a possible null-pointer dereference in
       jdi_panel_dsi_remove()
     - media: adv7180: fix frame interval in progressive mode
     - media: pvrusb2: fix URB leak in pvr2_send_request_ex
     - media: solo6x10: Check for out of bounds chip_id
     - media: cx25821: Fix a resource leak in cx25821_dev_setup()
     - media: v4l2-async: Fix error handling on steps after finding a match
     - media: mt9m114: Avoid a reset low spike during probe()
     - media: mt9m114: Return -EPROBE_DEFER if no endpoint is found
     - media: ipu6: Ensure stream_mutex is acquired when dealing with node list
     - media: ipu6: Close firmware streams on streaming enable failure
     - media: ipu6: Always close firmware stream
     - ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk
     - drm/amdkfd: Relax size checking during queue buffer get
     - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map()
     - drm: Account property blob allocations to memcg
     - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed
     - virt: vbox: uapi: Mark inner unions in packed structs as packed
     - [amd64] ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to
       aggregated
     - PCI: Add Intel Nova Lake audio Device ID
     - drm/amd/display: Disable FEC when powering down encoders
     - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback
     - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional
       parts
     - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release
     - media: rkisp1: Fix filter mode register configuration
     - HID: multitouch: add eGalaxTouch EXC3188 support
     - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK
     - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro
     - ALSA: hda/realtek: fix LG Gram Style 14 speakers
     - gpio: aspeed-sgpio: Change the macro to support deferred probe
     - [arm64] ASoC: sunxi: sun50i-dmic: Add missing check for
       devm_regmap_init_mmio
     - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end
     - drm/amd/display: Fix GFX12 family constant checks
     - drm/amd/display: avoid dig reg access timeout on usb4 link training fail
     - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in
       max98390_i2c_probe()
     - hwmon: (dell-smm) Add support for Dell OptiPlex 7080
     - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE
     - hwmon: (f71882fg) Add F81968 support
     - HID: logitech-hidpp: Add support for Logitech K980
     - ASoC: es8328: Add error unwind in resume
     - modpost: Amend ppc64 save/restfpr symnames for -Os build
     - power: sequencing: fix missing state_lock in pwrseq_power_on() error path
     - [amd64] ASoC: SOF: Intel: hda: Fix NULL pointer dereference
     - spi: geni-qcom: Fix abort sequence execution for serial engine errors
     - ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe
     - ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx
     - ALSA: mixer: oss: Add card disconnect checkpoints
     - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio
     - jfs: Add missing set_freezable() for freezable kthread
     - jfs: nlink overflow in jfs_rename
     - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero
     - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()
     - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H
     - wifi: rtw89: 8922a: set random mac if efuse contains zeroes
     - wifi: rtw89: ser: enable error IMR after recovering from L1
     - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()
     - wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band
       data
     - dm: replace -EEXIST with -EBUSY
     - dm: remove fake timeout to avoid leak request
     - [arm64] iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency
     - net: wwan: mhi: Add network support for Foxconn T99W760
     - wifi: libertas: fix WARNING in usb_tx_block
     - [amd64] iommu/amd: move wait_on_sem() out of spinlock
     - wifi: rtw89: mac: correct page number for CSI response
     - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode
     - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1
     - wifi: ath11k: Fix failure to connect to a 6 GHz AP
     - wifi: ath12k: fix preferred hardware mode calculation
     - wifi: cfg80211: allow only one NAN interface, also in multi radio
     - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}()
     - ipv6: annotate data-races over sysctl.flowlabel_reflect
     - ipv6: exthdrs: annotate data-race over multiple sysctl
     - ext4: mark group add fast-commit ineligible
     - ext4: move ext4_percpu_param_init() before ext4_mb_init()
     - ext4: mark group extend fast-commit ineligible
     - ext4: use reserved metadata blocks when splitting extent on endio
     - netfilter: nf_conntrack: Add allow_clash to generic protocol handler
     - netfilter: xt_tcpmss: check remaining length before reading optlen
     - net: usb: r8152: fix transmit queue timeout
     - wifi: iwlwifi: mvm: check the validity of noa_len
     - wifi: rtw89: fix unable to receive probe responses under MLO connection
     - wifi: rtw89: 8922a: add digital compensation for 2GHz
     - net/rds: No shortcut out of RDS_CONN_ERROR
     - ext4: propagate flags to convert_initialized_extent()
     - gro: change the BUG_ON() in gro_pull_from_frag0()
     - ipv4: igmp: annotate data-races around idev->mr_maxdelay
     - [arm64] net: hns3: extend HCLGE_FD_AD_QID to 11 bits
     - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power()
     - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement()
     - ipv4: fib: Annotate access to struct fib_alias.fa_state.
     - Bluetooth: btusb: Add support for MediaTek7920 0489:e158
     - Bluetooth: hci_conn: Set link_policy on incoming ACL connections
     - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
     - Bluetooth: btusb: Add new VID/PID for RTL8852CE
     - Bluetooth: btusb: Add device ID for Realtek RTL8761BU
     - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky
     - net: sfp: add quirk for Lantech 8330-265D
     - wifi: rtw89: pci: restore LDO setting after device resume
     - wifi: ath10k: fix lock protection in
       ath10k_wmi_event_peer_sta_ps_state_chg()
     - bnxt_en: Allow ntuple filters for drops
     - net: usb: sr9700: remove code to drive nonexistent multicast filter
     - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16
     - net/rds: Clear reconnect pending bit
     - PCI: Mark ASM1164 SATA controller to avoid bus reset
     - PCI/AER: Clear stale errors on reporting agents upon probe
     - PCI: Fix pci_slot_lock () device locking
     - PCI: Enable ACS after configuring IOMMU for OF platforms
     - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur
     - PCI: Mark Nvidia GB10 to avoid bus reset
     - myri10ge: avoid uninitialized variable use
     - nfc: nxp-nci: remove interrupt trigger type
     - RDMA/rtrs-clt: For conn rejection use actual err number
     - ata: libata: avoid long timeouts on hot-unplugged SATA DAS
     - hisi_acc_vfio_pci: update status after RAS error
     - scsi: buslogic: Reduce stack usage
     - vhost: fix caching attributes of MMIO regions by setting them explicitly
     - scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event
     - [riscv64] vector: init vector context with proper vlenb
     - tracing: Fix false sharing in hwlat get_sample()
     - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX
       channel is uninitialized
     - mailbox: pcc: Remove spurious IRQF_ONESHOT usage
     - mailbox: imx: Skip the suspend flag for i.MX7ULP
     - mailbox: sprd: mask interrupts that are not handled
     - remoteproc: mediatek: Break lock dependency to `prepare_lock`
     - mailbox: sprd: clear delivery flag before handling TX done
     - clk: microchip: core: correct return value on *_get_parent()
     - HID: i2c-hid: Add FocalTech FT8112
     - 9p/xen: protect xen_9pfs_front_free against concurrent calls
     - dmaengine: stm32-dma3: use module_platform_driver
     - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15)
     - soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list
     - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure
     - serial: 8250_dw: handle clock enable errors in runtime_resume
     - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs
     - fpga: of-fpga-region: Fail if any bridge is missing
     - most: core: fix resource leak in most_register_interface error paths
     - dmaengine: sun6i: Choose appropriate burst length under maxburst
     - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings
     - phy: ti: phy-j721e-wiz: restore mux selection during resume
     - phy: cadence-torrent: restore parent clock for refclk during resume
     - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()
     - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66
     - usb: gadget: f_fs: fix DMA-BUF OUT queues
     - usb: gadget: f_fs: Fix ioctl error handling
     - usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()
     - staging: rtl8723bs: fix memory leak on failure path
     - serial: 8250: 8250_omap.c: Add support for handling UART error conditions
     - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA
       termination is done
     - fix it87_wdt early reboot by reporting running timer
     - [arm*] binder: don't use %pK through printk
     - watchdog: imx7ulp_wdt: handle the nowayout option
     - phy: mvebu-cp110-utmi: fix dr_mode property read from dts
     - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature
     - Revert "mfd: da9052-spi: Change read-mask to write-mask"
     - mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs
     - iio: Use IRQF_NO_THREAD
     - iio: magnetometer: Remove IRQF_ONESHOT
     - fs: ntfs3: check return value of indx_find to avoid infinite loop
     - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent
       metadata
     - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST
     - fs/ntfs3: drop preallocated clusters for sparse and compressed files
     - fs/ntfs3: avoid calling run_get_entry() when run == NULL in
       ntfs_read_run_nb_ra()
     - ceph: supply snapshot context in ceph_uninline_data()
     - libceph: define and enforce CEPH_MAX_KEY_LEN
     - thermal: int340x: Fix sysfs group leak on DLVR registration failure
     - [amd64] ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90
     - include: uapi: netfilter_bridge.h: Cover for musl libc
     - drm/amd/display: Fix writeback on DCN 3.2+
     - drm/amd/display: Fix system resume lag issue
     - drm/amd/display: Avoid updating surface with the same surface under MPO
     - drm/amdgpu: Adjust usleep_range in fence wait
     - ALSA: usb-audio: Update the number of packets properly at receiving
     - drm/amdgpu: Add HAINAN clock adjustment
     - drm/amd/display: bypass post csc for additional color spaces in dal
     - spi: spidev: fix lock inversion between spi_lock and buf_lock
     - drm/radeon: Add HAINAN clock adjustment
     - ALSA: usb-audio: Add sanity check for OOB writes at silencing
     - btrfs: replace BUG() with error handling in __btrfs_balance()
     - [arm64] hugetlbpage: avoid unused-but-set-parameter warning (gcc-16)
     - drm/amd/display: Remove conditional for shaper 3DLUT power-on
     - rtc: zynqmp: correct frequency value
     - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
     - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
     - xfrm6: fix uninitialized saddr in xfrm6_get_saddr()
     - xfrm: skip templates check for packet offload tunnel mode
     - ipmi: ipmb: initialise event handler read bytes
     - xfrm: always flush state and policy upon NETDEV_UNREGISTER event
     - espintcp: Fix race condition in espintcp_close() (CVE-2026-23239)
     - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
     - net: usb: lan78xx: scan all MDIO addresses on LAN7801
     - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set()
     - net: ethernet: xscale: Check for PTP support properly
     - bnxt_en: Fix RSS context delete logic
     - bnxt_en: Fix deleting of Ntuple filters
     - wifi: cfg80211: wext: fix IGTK key ID off-by-one
     - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option
     - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ
     - Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short
     - Bluetooth: hci_qca: Cleanup on all setup failures
     - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ
     - Bluetooth: L2CAP: Fix not checking output MTU is acceptable on
       L2CAP_ECRED_CONN_REQ
     - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
     - tls: Fix race condition in tls_sw_cancel_work_tx() (CVE-2026-23240)
     - kcm: fix zero-frag skb in frag_list on partial sendmsg error
     - tipc: fix duplicate publication key in tipc_service_insert_publ()
     - RDMA/core: Fix stale RoCE GIDs during netdev events at registration
     - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets
     - RDMA/efa: Fix typo in efa_alloc_mr()
     - net: usb: pegasus: enable basic endpoint checking
     - RDMA/umem: Fix double dma_buf_unpin in failure path
     - net/mlx5: DR, Fix circular locking dependency in dump
     - net/mlx5: E-switch, Clear legacy flag when moving to switchdev
     - net/mlx5: Fix missing devlink lock in SRIOV enable error path
     - net/mlx5e: Separate address related variables to be in struct
     - net/mlx5e: Support routed networks during IPsec MACs initialization
     - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query
     - net: consume xmit errors of GSO frames
     - dpaa2-switch: validate num_ifs to prevent out-of-bounds write
     - netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
     - rpmsg: core: fix race in driver_override_show() and use core helper
     - [arm64] clk: renesas: rzg2l: Fix intin variable size
     - [arm64] clk: renesas: rzg2l: Select correct div round macro
     - [amd64] ASoC: SOF: ipc4-control: If there is no data do not send bytes
       update
     - [amd64] ASoC: SOF: ipc4-topology: Correct the allocation size for bytes
       controls
     - [amd64] ASoC: SOF: ipc4-control: Use the correct size for
       scontrol->ipc_control_data
     - [amd64] ASoC: SOF: ipc4-control: Keep the payload size up to date
     - fpga: dfl: use subsys_initcall to allow built-in drivers to be added
     - Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global
       IRQ' is supported"
     - phy: qcom: edp: Make the number of clocks flexible
     - dm-verity: correctly handle dm_bufio_client_create() failure
     - media: mediatek: encoder: Fix uninitialized scalar variable issue
     - media: mtk-mdp: Fix error handling in probe function
     - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove()
     - media: chips-media: wave5: Fix kthread worker destruction in polling mode
     - media: chips-media: wave5: Fix device cleanup order to prevent kernel
       panic
     - media: verisilicon: AV1: Fix enable cdef computation
     - media: verisilicon: AV1: Fix tx mode bit setting
     - [arm64] dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs
     - [armhf] omap2: Fix reference count leaks in omap_control_init()
     - [amd64] KVM: x86: Return "unsupported" instead of "invalid" on access to
       unsupported PV MSR
     - [amd64] KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3()
       succeeding
     - [arm64] Disable branch profiling for all arm64 code
     - HID: hid-pl: handle probe errors
     - HID: magicmouse: Do not crash on missing msc->input
     - HID: prodikeys: Check presence of pm->input_ep82
     - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()
     - [arm64] dts: apple: t8112-j473: Keep the HDMI port powered on
     - media: amphion: Drop min_queued_buffers assignment
     - media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init()
     - media: verisilicon: AV1: Set IDR flag for intra_only frame type
     - media: radio-keene: fix memory leak in error path
     - media: cx88: Add missing unmap in snd_cx88_hw_params()
     - media: cx23885: Add missing unmap in snd_cx23885_hw_params()
     - media: cx25821: Add missing unmap in snd_cx25821_hw_params()
     - media: i2c/tw9903: Fix potential memory leak in tw9903_probe()
     - media: i2c/tw9906: Fix potential memory leak in tw9906_probe()
     - media: i2c: ov01a10: Fix the horizontal flip control
     - media: i2c: ov01a10: Fix reported pixel-rate value
     - media: i2c: ov01a10: Fix analogue gain range
     - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls
     - media: i2c: ov01a10: Fix passing stream instead of pad to
       v4l2_subdev_state_get_format()
     - media: i2c: ov01a10: Fix test-pattern disabling
     - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()
     - media: ccs: Avoid possible division by zero
     - media: i2c: ov5647: Initialize subdev before controls
     - media: i2c: ov5647: Correct pixel array offset
     - media: i2c: ov5647: Correct minimum VBLANK value
     - media: i2c: ov5647: Sensor should report RAW color space
     - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode
     - media: ccs: Fix setting initial sub-device state
     - media: i2c: ov5647: use our own mutex for the ctrl lock
     - media: ipu6: Fix typo and wrong constant in ipu6-mmu.c
     - media: ipu6: Fix RPM reference leak in probe error paths
     - [amd64] platform/x86: ISST: Add missing write block check
     - dm-integrity: fix a typo in the code for write/discard race
     - dm: clear cloned request bio pointer when last clone bio completes
     - [arm64] soc: ti: k3-socinfo: Fix regmap leak on probe failure
     - [arm64] soc: ti: pruss: Fix double free in pruss_clk_mux_setup()
     - [amd64] KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
     - bus: omap-ocp2scp: fix OF populate on driver rebind
     - clk: clk-apple-nco: Add "apple,t8103-nco" compatible
     - [arm64,armhf] soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON
       definition
     - [arm64,armhf] soc: rockchip: grf: Support multiple grf to be handled
     - media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop
     - media: i2c: ov01a10: Fix digital gain range
     - clk: tegra: tegra124-emc: Fix potential memory leak in
       tegra124_clk_register_emc()
     - [s390x] pci: Handle futile config accesses of disabled devices directly
     - reset: gpio: suppress bind attributes in sysfs
     - dm-integrity: fix recalculation in bitmap mode
     - dm-unstripe: fix mapping bug when there are multiple targets in a table
     - [arm64] dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro
     - media: venus: vdec: fix error state assignment for zero bytesused
     - media: venus: vdec: restrict EOS addr quirk to IRIS2 only
     - drm: of: drm_of_panel_bridge_remove(): fix device_node leak
     - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations
     - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs
     - drm/buddy: Prevent BUG_ON by validating rounded allocation
     - drm/bridge: anx7625: Fix invalid EDID size
     - xfs: mark data structures corrupt on EIO and ENODATA
     - xfs: remove xfs_attr_leaf_hasname
     - media: verisilicon: AV1: Fix tile info buffer size
     - [amd64] iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in
       scalable mode
     - mfd: core: Add locking around 'mfd_of_node_list'
     - mfd: qcom-pm8xxx: Fix OF populate on driver rebind
     - mfd: omap-usb-host: Fix OF populate on driver rebind
     - iio: accel: adxl380: Avoid reading more entries than present in FIFO
     - xfs: delete attr leaf freemap entries when empty
     - xfs: fix freemap adjustments when adding xattrs to leaf blocks
     - xfs: fix the xattr scrub to detect freemap/entries array collisions
     - xfs: fix remote xattr valuelblk check
     - [amd64] KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()
     - PCI: endpoint: Fix swapped parameters in
       pci_{primary/secondary}_epc_epf_unlink() functions
     - pinctrl: intel: Add code name documentation
     - xfs: only call xf{array,blob}_destroy if we have a valid pointer
     - xfs: check return value of xchk_scrub_create_subord
     - xfs: check for deleted cursors when revalidating two btrees
     - md/bitmap: fix GPF in write_page caused by resize race
     - nfsd: fix return error code for nfsd_map_name_to_[ug]id
     - nvmem: Drop OF node reference on nvmem_add_one_cell() failure
     - [amd64] x86/kexec: add a sanity check on previous kernel's ima kexec
       buffer
     - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node
     - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN
     - io_uring/net: don't continue send bundle if poll was required for retry
     - bus: fsl-mc: fix an error handling in fsl_mc_device_add()
     - dm mpath: make pg_init_delay_msecs settable
     - [arm64] poe: fix stale POR_EL0 values for ptrace
     - tools: Fix bitfield dependency failure
     - vhost: move vdpa group bound check to vhost_vdpa
     - [powerpc*] smp: Add check for kcalloc() failure in parse_thread_groups()
     - iio: gyro: itg3200: Fix unchecked return value in read_raw
     - mtd: spinand: Disable continuous read during probe
     - mm/highmem: fix __kmap_to_page() build error
     - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()
     - ocfs2: fix reflink preserve cleanup issue
     - kexec: derive purgatory entry from symbol
     - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling
       SR-IOV"
     - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug
     - [arm64] Fix non-atomic __READ_ONCE() with CONFIG_LTO=y
     - clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841
     - btrfs: continue trimming remaining devices on failure
     - remoteproc: imx_rproc: Fix invalid loaded resource table detection
     - perf/arm-cmn: Reject unsupported hardware configurations
     - scsi: ufs: core: Flush exception handling work when RPM level is zero
     - mm/slab: use unsigned long for orig_size to ensure proper metadata align
     - PCI: dwc: Fix msg_atu_index assignment
     - usb: dwc3: gadget: Move vbus draw to workqueue context
     - usb: dwc2: fix resume failure if dr_mode is host
     - mtd: rawnand: pl353: Fix software ECC support
     - tipc: fix RCU dereference race in tipc_aead_users_dec()
     - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
     - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error
       path
     - PCI: Fix pci_slot_trylock() error handling
     - staging: rtl8723bs: fix null dereference in find_network
     - kcsan, compiler_types: avoid duplicate type issues in BPF Type Format
     - watchdog/softlockup: fix sample ring index wrap in need_counting_irqs()
     - cifs: Fix locking usage for tcon fields
     - ceph: supply snapshot context in ceph_zero_partial_object()
     - rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0
     - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID
     - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean()
     - octeontx2-af: CGX: fix bitmap leaks
     - net: ti: icssg-prueth: Add optional dependency on HSR
     - net: macb: Fix tx/rx malfunction after phy link down and up
     - tracing: Fix to set write permission to per-cpu buffer_size_kb
     - io_uring/filetable: clamp alloc_hint to the configured alloc range
     - drm/amd/display: Increase DCN35 SR enter/exit latency
     - drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify
     - procfs: fix possible double mmput() in do_procmap_query()
     - net: intel: fix PCI device ID conflict between i40e and ipw2200
     - atm: fore200e: fix use-after-free in tasklets during device removal
     - function_graph: Restore direct mode when callbacks drop to one
     - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
     - mm: numa_memblks: Identify the accurate NUMA ID of CFMW
     - fbcon: check return value of con2fb_acquire_newinfo()
     - fbdev: vt8500lcdfb: fix missing dma_free_coherent()
     - fbdev: of: display_timing: fix refcount leak in of_get_display_timings()
     - fbdev: ffb: fix corrupted video output on Sun FFB1
     - fbcon: Remove struct fbcon_display.inverse
     - cifs: some missing initializations on replay
     - [amd64] ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR
     - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle
     - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash()
     - [amd64] x86/kexec: Copy ACPI root pointer address from config table
     - [arm64] Force the use of CNTVCT_EL0 in __delay()
     - drm/amdgpu: keep vga memory on MacBooks with switchable graphics
     - net: nfc: nci: Fix parameter validation for packet data
     - tracing: ring-buffer: Fix to check event length before using
     - fgraph: Do not call handlers direct when not using ftrace_ops
     - tracing: Fix checking of freed trace_event_file for hist files
     - tracing: Wake up poll waiters for hist files when removing an event
     - NTB: ntb_transport: Fix too small buffer for debugfs_name
     - ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl()
     - [amd64] drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros
     - xfs: fix copy-paste error in previous fix
     - [arm64] Fix sampling the "stable" virtual counter in preemptible section
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.76
     - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec
       buffer"
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.77
     - drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release
     - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
     - drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse()
     - [arm64] KVM: arm64: Hide S1POE from guests when not supported by the host
     - [riscv64] irqchip/sifive-plic: Fix frozen interrupt due to affinity
       setting
     - scsi: lpfc: Properly set WC for DPP mapping
     - scsi: pm8001: Fix use-after-free in pm8001_queue_command()
     - ALSA: scarlett2: Fix redeclaration of loop variable
     - ALSA: scarlett2: Fix DSP filter control array handling
     - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices
     - [amd64] x86/fred: Correct speculative safety in fred_extint()
     - rseq: Clarify rseq registration rseq_size bound check comment
     - cgroup/cpuset: Fix incorrect use of cpuset_update_tasks_cpumask() in
       update_cpumasks_hier()
     - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume
     - ALSA: usb-audio: Cap the packet size pre-calculations
     - ALSA: usb-audio: Use inclusive terms
     - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
     - [s390x] idle: Fix cpu idle exit cpu time accounting
     - [s390x] vtime: Fix virtual timer forwarding
     - PCI: endpoint: Introduce pci_epc_function_is_valid()
     - PCI: endpoint: Introduce pci_epc_mem_map()/unmap()
     - [arm64] PCI: dwc: endpoint: Implement the pci_epc_ops::align_addr()
       operation
     - [arm64] PCI: dwc: ep: Use align addr function for
       dw_pcie_ep_raise_{msi,msix}_irq()
     - [arm64] PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry
     - drm/amdgpu: Unlock a mutex before destroying it
     - drm/amdgpu: Replace kzalloc + copy_from_user with memdup_user
     - drm/amdgpu: Fix locking bugs in error paths
     - ALSA: pci: hda: use snd_kcontrol_chip()
     - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put()
     - btrfs: fix incorrect key offset in error message in
       check_dev_extent_item()
     - btrfs: fix objectid value in error message in check_extent_data_ref()
     - btrfs: fix warning in scrub_verify_one_metadata()
     - btrfs: print correct subvol num if active swapfile prevents deletion
     - btrfs: fix compat mask in error messages in btrfs_check_features()
     - [arm64] bpf, arm64: Force 8-byte alignment for JIT buffer to prevent
       atomic tearing
     - bpf: Fix stack-out-of-bounds write in devmap
     - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value
     - [amd64] x86/acpi/boot: Correct acpi_is_processor_usable() check again
     - [arm64] memory: mtk-smi: fix device leaks on common probe
     - [arm64] memory: mtk-smi: fix device leak on larb probe
     - resource: Add resource set range and size helpers
     - PCI: Use resource_set_range() that correctly sets ->end
     - media: tegra-video: Fix memory leak in __tegra_channel_try_format()
     - media: dw9714: move power sequences to dedicated functions
     - media: dw9714: add support for powerdown pin
     - media: dw9714: Fix powerup sequence
     - [amd64] KVM: x86: Ignore -EBUSY when checking nested events from
       vcpu_block()
     - ata: libata-scsi: Refactor ata_scsi_simulate()
     - ata: libata-scsi: Refactor ata_scsiop_read_cap()
     - ata: libata-scsi: Refactor ata_scsiop_maint_in()
     - ata: libata-scsi: Document all VPD page inquiry actors
     - ata: libata-scsi: Remove struct ata_scsi_args
     - ata: libata: Remove ATA_DFLAG_ZAC device flag
     - ata: libata: Introduce ata_port_eh_scheduled()
     - ata: libata-scsi: avoid Non-NCQ command starvation
     - [arm64,armhf] drm/tegra: dsi: fix device leak on probe
     - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT
     - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting
       I/O
     - mailbox: don't protect of_parse_phandle_with_args with con_mutex
     - mailbox: sort headers alphabetically
     - mailbox: remove unused header files
     - mailbox: Use dev_err when there is error
     - mailbox: Use guard/scoped_guard for con_mutex
     - mailbox: Allow controller specific mapping using fwnode
     - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
     - ext4: add ext4_try_lock_group() to skip busy groups
     - ext4: factor out __ext4_mb_scan_group()
     - ext4: factor out ext4_mb_might_prefetch()
     - ext4: factor out ext4_mb_scan_group()
     - ext4: convert free groups order lists to xarrays
     - ext4: refactor choose group to scan group
     - ext4: implement linear-like traversal across order xarrays
     - ext4: always allocate blocks only from groups inode can use
     - workqueue: Add system_percpu_wq and system_dfl_wq
     - Input: synaptics_i2c - replace use of system_wq with system_dfl_wq
     - Input: synaptics_i2c - guard polling restart in resume
     - [amd64] iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device
       without scalable mode
     - [arm64] dts: rockchip: Fix rk356x PCIe range mappings
     - [arm64] dts: rockchip: Fix rk3588 PCIe range mappings
     - [armhf] clk: tegra: tegra124-emc: fix device leak on set_rate()
     - ima: kexec: silence RCU list traversal warning
     - ima: rename variable the seq_file "file" to "ima_kexec_file"
     - ima: define and call ima_alloc_kexec_file_buf()
     - kexec: define functions to map and unmap segments
     - ima: kexec: define functions to copy IMA log at soft boot
     - ima: verify the previous kernel's IMA buffer lies in addressable RAM
     - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range()
     - drm/exynos: vidi: fix to avoid directly dereferencing user pointer
     - drm/exynos/vidi: Remove redundant error handling in vidi_get_modes()
     - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member
       variables related to memory alloc/free (CVE-2026-23227)
     - uprobes: switch to RCU Tasks Trace flavor for better performance
     - uprobes: Fix incorrect lockdep condition in filter_chain()
     - btrfs: drop unused parameter fs_info from do_reclaim_sweep()
     - btrfs: get used bytes while holding lock at btrfs_reclaim_bgs_work()
     - btrfs: fix reclaimed bytes accounting after automatic block group reclaim
     - btrfs: fix periodic reclaim condition
     - btrfs: zoned: fix alloc_offset calculation for partly conventional block
       groups
     - btrfs: zoned: fixup last alloc pointer after extent removal for RAID1
     - btrfs: zoned: fixup last alloc pointer after extent removal for DUP
     - btrfs: zoned: fix stripe width calculation
     - btrfs: define the AUTO_KFREE/AUTO_KVFREE helper macros
     - btrfs: zoned: fixup last alloc pointer after extent removal for RAID0/10
     - [riscv64] usb: cdns3: remove redundant if branch
     - [riscv64] usb: cdns3: call cdns_power_is_lost() only once in cdns_resume()
     - [riscv64] usb: cdns3: fix role switching during resume
     - drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected()
       (Closes: #1130930)
     - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
     - hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization
       induced race
     - ksmbd: check return value of xa_store() in krb5_authenticate
     - ksmbd: add chann_lock to protect ksmbd_chann_list xarray (CVE-2026-23226)
     - ALSA: hda/realtek: Add quirk for Gigabyte G5 KF5 (2023)
     - ALSA: hda/realtek: Add quirk for Samsung Galaxy Book3 Pro 360 (NP965QFG)
     - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314
     - net: arcnet: com20020-pci: fix support for 2.5Mbit cards
     - eventpoll: Fix integer overflow in ep_loop_check_proc()
     - namespace: fix proc mount iteration
     - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
     - nfc: pn533: properly drop the usb interface reference on disconnect
     - net: usb: kaweth: validate USB endpoints
     - net: usb: kalmia: validate USB endpoints
     - net: usb: pegasus: validate USB endpoints
     - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a
       message
     - can: usb: f81604: correctly anchor the urb in the read bulk callback
     - can: ucan: Fix infinite loop from zero-length messages
     - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
     - can: usb: f81604: handle short interrupt urb messages properly
     - can: usb: f81604: handle bulk write errors properly
     - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them
     - [amd64] x86/efi: defer freeing of boot services memory
     - [amd64] platform/x86: dell-wmi-sysman: Don't hex dump plaintext password
       data
     - [amd64] platform/x86: dell-wmi: Add audio/mic mute key codes
     - ALSA: usb-audio: Use correct version for UAC3 header validation
     - wifi: radiotap: reject radiotap with unknown bits
     - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
     - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration
     - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
     - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
     - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
     - net/sched: ets: fix divide by zero in the offload path
     - nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
     - tracing: Fix WARN_ON in tracing_buffers_mmap_close
     - scsi: target: Fix recursive locking in __configfs_open_file()
     - Squashfs: check metadata block offset is within range
     - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
     - drbd: fix null-pointer dereference on local read error
     - smb: client: fix cifs_pick_channel when channels are equally loaded
     - smb: client: fix broken multichannel with krb5+signing
     - smb: client: Don't log plaintext credentials in cifs_set_cifscreds
     - scsi: core: Fix refcount leak for tagset_refcnt
     - xattr: switch to CLASS(fd) (CVE-2024-14027)
     - btrfs: always fallback to buffered write if the inode requires checksum
     - ACPI: APEI: GHES: Disable KASAN instrumentation when compile testing with
       clang < 18
     - nvme: fix admin queue leak on controller reset
     - hwmon: (aht10) Add support for dht20
     - hwmon: (aht10) Fix initialization commands for AHT20
     - pinctrl: equilibrium: rename irq_chip function callbacks
     - pinctrl: equilibrium: fix warning trace on load
     - [amd64] platform/x86: thinkpad_acpi: Fix errors reading battery thresholds
     - HID: multitouch: add quirks for Lenovo Yoga Book 9i
     - HID: multitouch: new class MT_CLS_EGALAX_P80H84
     - [amd64] pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe()
     - hwmon: (it87) Check the it87_lock() return value
     - [amd64,arm64] idpf: change IRQ naming to match netdev and ethtool queue
       numbering
     - i40e: Fix preempt count leak in napi poll tracepoint
     - e1000e: clear DPG_EN after reset to avoid autonomous power-gating
     - drm/solomon: Fix page start when updating rectangle in page addressing
       mode
     - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling
       in ALE table
     - xsk: Get rid of xdp_buff_xsk::xskb_list_node
     - xsk: s/free_list_node/list_node/
     - xsk: Fix fragment node deletion to prevent buffer leak
     - xsk: Fix zero-copy AF_XDP fragment drop
     - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
     - [arm64] net: ti: icssg-prueth: Fix ping failure after offload mode setup
       when link speed is not 1G
     - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds
     - can: bcm: fix locking for bcm_op runtime updates
     - can: mcp251x: fix deadlock in error path of mcp251x_open
     - wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config
     - drm/xe: Do not preempt fence signaling CS instructions
     - kunit: tool: copy caller args in run_kernel to prevent mutation
     - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
     - octeon_ep: Relocate counter updates before NAPI
     - octeon_ep: avoid compiler and IQ/OQ reordering
     - octeon_ep_vf: Relocate counter updates before NAPI
     - octeon_ep_vf: avoid compiler and IQ/OQ reordering
     - wifi: cw1200: Fix locking in error paths
     - wifi: wlcore: Fix a locking bug
     - wifi: mt76: mt7996: Fix possible oob access in
       mt7996_mac_write_txwi_80211()
     - wifi: mt76: mt7925: Fix possible oob access in
       mt7925_mac_write_txwi_80211()
     - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()
     - indirect_call_wrapper: do not reevaluate function pointer
     - net/rds: Fix circular locking dependency in rds_tcp_tune
     - xen/acpi-processor: fix _CST detection using undersized evaluation buffer
     - iavf: fix netdev->max_mtu to respect actual hardware limit
     - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim
     - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op()
     - smb/client: fix buffer size for smb311_posix_qinfo in
       SMB311_posix_query_info()
     - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
     - net: ipv4: fix ARM64 alignment fault in multipath hash seed
     - amd-xgbe: fix sleep while atomic on suspend/resume
     - drm/sched: Fix kernel-doc warning for drm_sched_job_done()
     - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock"
     - drm/xe/reg_sr: Fix leak on xa_store failure
     - nvme: reject invalid pr_read_keys() num_keys values
     - nvme: fix memory allocation in nvme_pr_read_keys()
     - hwmon: (max6639) : Configure based on DT property
     - hwmon: (max6639) fix inverted polarity
     - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless
       qdiscs
     - net: nfc: nci: Fix zero-length proprietary notifications
     - net_sched: sch_fq: clear q->band_pkt_count[] in fq_reset()
     - nfc: nci: free skb on nci_transceive early error paths
     - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback
     - nfc: rawsock: cancel tx_work before socket teardown
     - net: stmmac: Fix error handling in VLAN add and delete paths
     - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
     - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in
       mtk_xdp_setup()
     - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
     - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
     - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
     - net/sched: act_ife: Fix metalist update behavior
     - xdp: use modulo operation to calculate XDP frag tailroom
     - xsk: introduce helper to determine rxq->frag_size
     - i40e: fix registering XDP RxQ info
     - i40e: use xdp.frame_sz as XDP RxQ info frag_size
     - xdp: produce a warning when calculated tailroom is negative
     - tracing: Add NULL pointer check to trigger_data_free()
     - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared
       blocks
     - ext4: fix potential null deref in ext4_mb_init()
     - ata: libata-core: fix cancellation of a port deferred qc work
     - ata: libata-eh: correctly handle deferred qc timeouts
     - ata: libata: cancel pending work after clearing deferred_qc
     - ata: libata-eh: Fix detection of deferred qc timeouts
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.78
     - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
     - [amd64] ACPI: PM: Save NVS memory on Lenovo G70-35
     - scsi: mpi3mr: Add NULL checks when resetting request and reply queues
     - ALSA: hda/realtek: Fix speaker pop on Star Labs StarFighter
     - unshare: fix unshare_fs() handling
     - wifi: mac80211: set default WMM parameters on all links
     - ACPI: OSI: Add DMI quirk for Acer Aspire One D255
     - scsi: ses: Fix devices attaching to different hosts
     - [amd64] ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table
     - [amd64] ASoC: cs42l43: Report insert for exotic peripherals
     - scsi: ufs: core: Fix possible NULL pointer dereference in
       ufshcd_add_command_trace()
     - scsi: ufs: core: Fix shift out of bounds when MAXQ=32
     - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0
     - drm/amdgpu/vcn5: Add SMU dpm interface type
     - ALSA: usb-audio: Check max frame size for implicit feedback mode, too
     - kexec: Consolidate machine_kexec_mask_interrupts() implementation
     - kexec: Include kernel-end even without crashkernel
     - [powerpc*] kexec/core: use big-endian types for crash variables
     - [powerpc*] crash: adjust the elfcorehdr size
     - remoteproc: sysmon: Correct subsys_name_len type in QMI request
     - remoteproc: mediatek: Unprepare SCP clock during system suspend
     - [powerpc*] 83xx: km83xx: Fix keymile vendor prefix
     - smb/server: Fix another refcount leak in smb2_open()
     - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
     - [arm64] drm/msm/dsi: fix hdisplay calculation when programming dsi
       registers
     - xprtrdma: Decrement re_receiving on the early exit paths
     - btrfs: hold space_info->lock when clearing periodic reclaim ready
     - workqueue: Use POOL_BH instead of WQ_BH when checking pool flags
     - perf disasm: Fix off-by-one bug in outside check
     - [arm64] drm/msm/dsi: fix pclk rate calculation for bonded dsi
     - drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v14
     - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states
     - net/mlx5: IFC updates for disabled host PF
     - net/mlx5: Query to see if host PF is disabled
     - net/mlx5: Fix deadlock between devlink lock and esw->wq
     - net/mlx5: Fix crash when moving to switchdev mode
     - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
     - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL
       slave xmit (CVE-2026-23277)
     - ASoC: soc-core: drop delayed_work_pending() check before flush
     - ASoC: soc-core: flush delayed work before removing DAIs and widgets
     - ASoC: simple-card-utils: use __free(device_node) for device node
     - ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays
     - net: sfp: improve Huawei MA5671a fixup
     - serial: caif: hold tty->link reference in ldisc_open and ser_release
     - bnxt_en: Fix RSS table size check when changing ethtool channels
     - mctp: i2c: fix skb memory leak in receive path
     - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return
       value
     - bonding: add ESP offload features when slaves support
     - bonding: Correctly support GSO ESP offload
     - net: add a common function to compute features for upper devices
     - bonding: use common function to compute the features
     - bonding: fix type confusion in bond_setup_by_slave()
     - mctp: route: hold key->lock in mctp_flow_prepare_output()
     - [amd64,arm64] amd-xgbe: fix link status handling in xgbe_rx_adaptation
     - [amd64,arm64] amd-xgbe: prevent CRC errors during RX adaptation with AN
       disabled
     - xdp: allow attaching already registered memory model to xdp_rxq_info
     - xdp: register system page pool as an XDP memory model
     - net: add xmit recursion limit to tunnel xmit functions (CVE-2026-23276)
     - netfilter: nf_tables: always walk all pending catchall elements
       (CVE-2026-23278)
     - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
     - netfilter: x_tables: guard option walkers against 1-byte tail reads
     - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
     - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
     - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
       (CVE-2026-23274)
     - perf annotate: Fix hashmap__new() error checking
     - regulator: pca9450: Correct interrupt type
     - perf ftrace: Fix hashmap__new() error checking
     - sched: idle: Make skipping governor callbacks more consistent
     - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
     - nvme-pci: Fix race bug in nvme_poll_irqdisable()
     - i40e: fix src IP mask checks and memcpy argument names in cloud filter
     - e1000/e1000e: Fix leak in DMA error cleanup
     - net: bcmgenet: fix broken EEE by converting to phylib-managed state
     - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()
     - [amd64] ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock
       acquisition
     - ASoC: detect empty DMI strings
     - drm/amdkfd: Unreserve bo if queue update failed
     - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled
     - [arm64] octeontx2-af: devlink: fix NIX RAS reporter recovery condition
     - [arm64] octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt
       status
     - net: prevent NULL deref in ip[6]tunnel_xmit()
     - iio: imu: inv-mpu9150: fix irq ack preventing irq storms
     - usb: gadget: f_mass_storage: Fix potential integer overflow in
       check_command_size_in_blocks()
     - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on"
     - cgroup: fix race between task migration and iteration
     - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
     - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer
       interfaces
     - net: usb: lan78xx: fix silent drop of packets with checksum errors
     - net: usb: lan78xx: fix TX byte statistics for small packets
     - net: usb: lan78xx: skip LTM configuration for LAN7850
     - ata: libata-core: Add BRIDGE_OK quirk for QEMU drives
     - [amd64] ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA
     - [amd64] KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with
       in-kernel APIC
     - USB: add QUIRK_NO_BOS for video capture several devices
     - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
     - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed
     - usb: xhci: Fix memory leak in xhci_disable_slot()
     - usb: xhci: Prevent interrupt storm on host controller error (HCE)
     - usb: yurex: fix race in probe
     - usb: dwc3: pci: add support for the Intel Nova Lake -H
     - usb: misc: uss720: properly clean up reference in uss720_probe()
     - usb: core: don't power off roothub PHYs if phy_set_mode() fails
     - usb: cdc-acm: Restore CAP_BRK functionnality to CH343
     - usb: roles: get usb role switch from parent only for usb-b-connector
     - usb: typec: altmode/displayport: set displayport signaling rate in
       configure message
     - USB: usbcore: Introduce usb_bulk_msg_killable()
     - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts
     - USB: core: Limit the length of unkillable synchronous timeouts
     - usb: class: cdc-wdm: fix reordering issue in read code path
     - usb: mdc800: handle signal and read racing
     - usb: image: mdc800: kill download URB on timeout
     - mm/tracing: rss_stat: ensure curr is false from kthread context
     - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
     - mm/kfence: disable KFENCE upon KASAN HW tags enablement
     - mmc: core: Avoid bitfield RMW for claim/retune flags
     - [arm64] ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and
       start
     - tipc: fix divide-by-zero in tipc_sk_filter_connect()
     - kprobes: avoid crash when rmmod/insmod after ftrace killed
     - ceph: add a bunch of missing ceph_path_info initializers
     - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
     - libceph: reject preamble if control segment is empty
     - libceph: prevent potential out-of-bounds reads in process_message_header()
     - libceph: Use u32 for non-negative values in ceph_monmap_decode()
     - libceph: admit message frames only in CEPH_CON_S_OPEN state
     - ceph: fix i_nlink underrun during async unlink
     - ceph: fix memory leaks in ceph_mdsc_build_path()
     - time/jiffies: Mark jiffies_64_to_clock_t() notrace
     - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach
     - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend
     - scsi: hisi_sas: Add time interval between two H2D FIS following soft reset
       spec
     - scsi: hisi_sas: Use macro instead of magic number
     - scsi: hisi_sas: Fix NULL pointer exception during user_scan()
     - kbuild: Disable CC_HAS_ASM_GOTO_OUTPUT on clang < 17
     - Fix CC_HAS_ASM_GOTO_OUTPUT on non-x86 architectures
     - Revert "tcpm: allow looking for role_sw device in the main node"
     - drm/amd: Disable MES LR compute W/A
     - drm/bridge: samsung-dsim: Fix memory leak in error path
     - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used
     - [s390x] pfault: Fix virtual vs physical address confusion
     - nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().
     - device property: Allow secondary lookup in fwnode_get_next_child_node()
     - [arm64,armhf] irqchip/gic-v3-its: Limit number of per-device MSIs to the
       range the ITS supports
     - btrfs: fix chunk map leak in btrfs_map_block() after
       btrfs_chunk_map_num_copies()
     - ice: reintroduce retry mechanism for indirect AQ
     - ixgbevf: fix link setup issue
     - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
     - staging: rtl8723bs: fix potential out-of-bounds read in
       rtw_restruct_wmm_ie
     - media: dvb-net: fix OOB access in ULE extension header tables
     - [amd64,arm64] net: mana: Ring doorbell at 4 CQ wraparounds
     - ice: fix retry for AQ command 0x06EE
     - tracing: Fix syscall events activation by ensuring refcount hits zero
     - net/tcp-ao: Fix MAC comparison to be constant-time
     - batman-adv: Avoid double-rtnl_lock ELP metric worker
     - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
     - [arm64] mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
     - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read
     - [arm64] contpte: fix set_access_flags() no-op check for SMMU/ATS faults
     - pmdomain: bcm: bcm2835-power: Fix broken reset status read
     - ata: libata-core: Disable LPM on ST1000DM010-2EP102
     - drm/amd/display: Fallback to boot snapshot for dispclk
     - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()
     - smb: server: fix use-after-free in smb2_open()
     - ksmbd: fix use-after-free by using call_rcu() for oplock_info
     - net: nexthop: fix percpu use-after-free in remove_nh_grp_entry
     - net: ncsi: fix skb leak in error paths
     - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
     - net: dsa: microchip: Fix error path in PTP IRQ setup
     - drm/amd/pm: remove invalid gpu_metrics.energy_accumulator on smu v13.0.x
     - drm/amdgpu: Fix use-after-free race in VM acquire
     - drm/amd: Set num IP blocks to 0 if discovery fails
     - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding
     - [amd64] drm/i915: Fix potential overflow of shmem scatterlist length
     - [arm64] drm/msm: Fix dma_free_attrs() buffer size
     - tracing: Fix enabling multiple events on the kernel command line and
       bootconfig
     - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G
     - qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size
     - cifs: make default value of retrans as zero
     - xfs: fix returned valued from xfs_defer_can_append
     - xfs: fix undersized l_iclog_roundoff values
     - xfs: ensure dquot item is deleted from AIL only after log shutdown
     - [s390x] dasd: Move quiesce state with pprc swap
     - [s390x] dasd: Copy detected format information to secondary device
     - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error
     - scsi: core: Fix error handling for scsi_alloc_sdev()
     - [amd64] x86/apic: Disable x2apic on resume if the kernel expects so
     - lib/bootconfig: fix snprintf truncation check in
       xbc_node_compose_key_after()
     - lib/bootconfig: check bounds before writing in __xbc_open_brace()
     - smb: client: fix atomic open with O_DIRECT & O_SYNC
     - smb: client: fix in-place encryption corruption in SMB2_write()
     - smb: client: fix iface port assignment in parse_server_interfaces
     - btrfs: fix transaction abort on file creation due to name hash collision
     - btrfs: fix transaction abort on set received ioctl due to item overflow
     - btrfs: abort transaction on failure to update root in the received subvol
       ioctl
     - iio: dac: ds4424: reject -128 RAW value
     - iio: frequency: adf4377: Fix duplicated soft reset mask
     - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas()
     - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
     - iio: potentiometer: mcp4131: fix double application of wiper shift
     - iio: chemical: bme680: Fix measurement wait duration calculation
     - iio: buffer: Fix wait_queue not being removed
     - iio: gyro: mpu3050-core: fix pm_runtime error handling
     - iio: gyro: mpu3050-i2c: fix pm_runtime error handling
     - iio: imu: inv_icm42600: fix odr switch to the same value
     - iio: imu: inv_icm42600: fix odr switch when turning buffer off
     - iio: proximity: hx9023s: Protect against division by zero in set_samp_freq
     - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors
     - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort
     - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor
     - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD
     - net/tcp-md5: Fix MAC comparison to be constant-time
     - ksmbd: Compare MACs in constant time (CVE-2026-23364)
     - smb: client: Compare MACs in constant time
     - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()
     - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths
     - spi: cadence-quadspi: Implement refcount to handle unbind during busy
       (CVE-2025-40005)
     - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL
       (CVE-2026-23386)
     - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
       (CVE-2026-23368)
     - [amd64] x86/sev: Allow IBPB-on-Entry feature for SNP guests
     - [amd64] platform/x86: hp-bioscfg: Support allocations of larger data
       (Closes: #1127612)
     - wifi: libertas: fix use-after-free in lbs_free_adapter() (CVE-2026-23281)
     - [amd64] perf/x86/intel/uncore: Support more units on Granite Rapids
     - [amd64] perf/x86/intel/uncore: Add per-scheduler IMC CAS count events
     - mptcp: pm: in-kernel: always mark signal+subflow endp as used
     - mptcp: pm: avoid sending RM_ADDR over same subflow
     - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink
     - kbuild: Leave objtool binary around with 'make clean'
     - net/sched: act_gate: snapshot parameters with RCU on replace
       (CVE-2026-23245)
     - xfs: Fix error pointer dereference
     - can: gs_usb: gs_can_open(): always configure bitrates before starting
       device
     - cleanup: Provide retain_and_null_ptr()
     - usb: gadget: f_ncm: Fix net_device lifecycle with device_move
     - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling
     - [amd64] KVM: SVM: Limit AVIC physical max index based on configured
       max_vcpu_ids
     - [amd64] KVM: SVM: Add a helper to look up the max physical ID for AVIC
     - [amd64] KVM: SVM: Set/clear CR8 write interception when AVIC is
       (de)activated
     - [arm64,armhf] mmc: dw_mmc-rockchip: use modern PM macros
     - [arm64,armhf] mmc: dw_mmc-rockchip: Add memory clock auto-gating support
     - [arm64,armhf] mmc: dw_mmc-rockchip: Fix runtime PM support for internal
       phase support
     - mm/page_alloc: move set_page_refcounted() to callers of post_alloc_hook()
     - mm/page_alloc: sort out the alloc_contig_range() gfp flags mess
     - mm/page_alloc: forward the gfp flags from alloc_contig_range() to
       post_alloc_hook()
     - mm/kfence: fix KASAN hardware tag faults during late enablement
     - nsfs: tighten permission checks for ns iteration ioctls
     - sched_ext: Disable preemption between scx_claim_exit() and kicking helper
       work
     - sched_ext: Fix starvation of scx_enable() under fair-class saturation
     - iomap: reject delalloc mappings during writeback
     - fgraph: Fix thresh_return clear per-task notrace
     - [amd64] KVM: x86: Co-locate initialization of feature MSRs in
       kvm_arch_vcpu_create()
     - [amd64] KVM: x86: Quirk initialization of feature MSRs to KVM's max
       configuration
     - [amd64] KVM: x86: do not allow re-enabling quirks
     - [amd64] KVM: x86: Allow vendor code to disable quirks
     - [amd64] KVM: x86: Introduce supported_quirks to block disabling quirks
     - [amd64] KVM: x86: Introduce Intel specific quirk
       KVM_X86_QUIRK_IGNORE_GUEST_PAT
     - [amd64] KVM: nVMX: Add consistency checks for CR0.WP and CR4.CET
     - [amd64] KVM: x86: Introduce KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM
     - ksmbd: Don't log keys in SMB3 signing and encryption key generation
     - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output
     - net: macb: Shuffle the tx ring before enabling tx
     - cifs: open files should not hold ref on superblock
     - xfs: fix integer overflow in bmap intent sort comparator
     - drm/xe/sync: Cleanup partially initialized sync on parse failure
     - ipv6: use RCU in ip6_xmit() (CVE-2025-40135)
     - dm-verity: disable recursive forward error correction (CVE-2025-71161)
     - rxrpc: Fix recvmsg() unconditional requeue
     - btrfs: do not strictly require dirty metadata threshold for metadata
       writepages (CVE-2026-23157)
     - ice: fix devlink reload call trace (CVE-2026-23104)
     - tracing: Add recursion protection in kernel stack trace recording
       (CVE-2026-23138)
     - [amd64] Octeontx2-af: Add proper checks for fwdata (CVE-2026-23070)
     - io_uring/uring_cmd: fix too strict requirement on ioctl
     - [amd64] x86/uprobes: Fix XOL allocation failure for 32-bit tasks
     - [amd64] platform/x86/amd/pmc: Add support for Van Gogh SoC
       (CVE-2025-68334)
     - mptcp: pm: in-kernel: always set ID as avail when rm endp
     - net: stmmac: remove support for lpi_intr_o
     - f2fs: compress: change the first parameter of page_array_{alloc,free} to
       sbi
     - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic
       (CVE-2025-38627)
     - f2fs: fix to avoid migrating empty section (CVE-2025-40150)
     - blk-throttle: fix access race during throttle policy activation
       (CVE-2025-40147)
     - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
       (CVE-2025-71221)
     - net: dsa: properly keep track of conduit reference (CVE-2025-71152)
     - binfmt_misc: restore write access before closing files opened by
       open_exec() (CVE-2025-68239)
     - xfs: get rid of the xchk_xfile_*_descr calls
     - erofs: fix inline data read failure for ztailpacking pclusters
     - mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375)
     - sched_ext: Remove redundant css_put() in scx_cgroup_init()
     - io_uring/kbuf: check if target buffer list is still legacy on recycle
     - sched/fair: Fix zero_vruntime tracking
     - [s390x] stackleak: Fix __stackleak_poison() inline assembly constraint
     - [s390x] xor: Fix xor_xc_2() inline assembly constraints
     - [amd64] drm/i915/alpm: ALPM disable fixes
     - [amd64] drm/i915/psr: Repeat Selective Update area alignment
     - drm/amd/display: Add pixel_clock to amd_pp_display_configuration
     - drm/amd/pm: Use pm_display_cfg in legacy DPM (v2)
     - drm/amdgpu: Add basic validation for RAS header (CVE-2025-38426)
     - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
     - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
     - HID: bpf: prevent buffer overflow in hid_hw_request
     - sunrpc: fix cache_request leak in cache_release
     - nvdimm/bus: Fix potential use after free in asynchronous initialization
     - NFC: nxp-nci: allow GPIOs to sleep
     - net: macb: fix use-after-free access to PTP clock
     - mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations
     - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
     - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
     - smb: client: fix krb5 mount with username option
     - ksmbd: unset conn->binding on failed binding request
     - ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION
     - [amd64] drm/i915/dsc: Add Selective Update register definitions
     - [amd64] drm/i915/dsc: Add helper for writing DSC Selective Update ET
       parameters
     - [amd64] drm/i915/psr: Write DSC parameters on Selective Update in ET mode
     - [s390x] zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute
     - kprobes: Remove unneeded goto
     - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace()
     - btrfs: fix transaction abort when snapshotting received subvolumes
     - batman-adv: avoid OGM aggregation when skb tailroom is insufficient
     - net: macb: Introduce gem_init_rx_ring()
     - net: macb: Reinitialize tx/rx queue pointer registers and rx ring during
       resume
     - ata: libata-core: disable LPM on ADATA SU680 SSD
     - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption
     - mmc: sdhci: fix timing selection for 1-bit bus width
     - pmdomain: bcm: bcm2835-power: Increase ASB control timeout
     - spi: fix use-after-free on controller registration failure
     - spi: fix statistics allocation
     - mtd: rawnand: pl353: make sure optimal timings are applied
     - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in
       cadence_nand_init()
     - mtd: Avoid boot crash in RedBoot partition table parser
     - [amd64] iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry
     - serial: 8250_pci: add support for the AX99100
     - serial: 8250: Fix TX deadlock when using DMA
     - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART
       BUSY
     - serial: uartlite: fix PM runtime usage count underflow on probe
     - io_uring/kbuf: propagate BUF_MORE through early buffer commit path
     - drm: Fix use-after-free on framebuffers and property blobs when calling
       drm_dev_unplug
     - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START,
       END}
     - drm/amdgpu/gmc9.0: add bounds checking for cid
     - drm/amdgpu/mmhub2.0: add bounds checking for cid
     - drm/amdgpu/mmhub2.3: add bounds checking for cid
     - drm/amdgpu/mmhub3.0.1: add bounds checking for cid
     - drm/amdgpu/mmhub3.0.2: add bounds checking for cid
     - drm/amdgpu/mmhub3.0: add bounds checking for cid
     - drm/amdgpu/mmhub4.1.0: add bounds checking for cid
     - drm/imagination: Fix deadlock in soft reset sequence
     - drm/radeon: apply state adjust rules to some additional HAINAN vairants
     - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants
     - drm/xe/oa: Allow reading after disabling OA stream
     - drm/xe: Open-code GGTT MMIO access protection
     - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
       (CVE-2026-23395)
     - ata: libata-scsi: Return residual for emulated SCSI commands
     - ata: libata-scsi: report correct sense field pointer in
       ata_scsiop_maint_in()
     - btrfs: log new dentries when logging parent dir of a conflicting inode
     - btrfs: tree-checker: fix misleading root drop_level error message
     - [riscv64] soc: microchip: mpfs: Fix memory leak in
       mpfs_sys_controller_probe()
     - [riscv64] cache: starfive: fix device node leak in starlink_cache_init()
     - [arm64,armhf] soc: rockchip: grf: Add missing of_node_put() when returning
     - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.
     - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
     - [arm64] dts: renesas: r9a09g057: Add RTC node
     - [arm64] dts: renesas: r9a09g057: Remove wdt{0,2,3} nodes
     - [arm64] firmware: arm_scpi: Fix device_node reference leak in probe path
     - Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
     - Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
     - Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
     - Bluetooth: ISO: Fix defer tests being unstable
     - Bluetooth: hci_sync: Fix hci_le_create_conn_sync
     - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
     - Bluetooth: HIDP: Fix possible UAF
     - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
     - Bluetooth: qca: fix ROM version reading on WCN3998 chips
     - bridge: cfm: Fix race condition in peer_mep deletion (CVE-2026-23393)
     - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
     - mpls: add missing unregister_netdevice_notifier to mpls_init
     - netfilter: ctnetlink: remove refcounting in expectation dumpers
       (CVE-2025-39764)
     - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
     - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in
       sip_help_tcp()
     - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
     - nf_tables: nft_dynset: fix possible stateful expression memleak in error
       path (CVE-2026-23399)
     - netfilter: nft_ct: drop pending enqueued packets on removal
     - netfilter: xt_CT: drop pending enqueued packets on template removal
       (CVE-2026-23391)
     - netfilter: xt_time: use unsigned int for monthday bit shift
     - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
     - net: bcmgenet: increase WoL poll timeout
     - [amd64,arm64] net: mana: fix use-after-free in mana_hwc_destroy_channel()
       by reordering teardown
     - sched: idle: Consolidate the handling of two special cases
     - PM: runtime: Fix a race condition related to device removal
     - bonding: prevent potential infinite loop in bond_header_parse()
     - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
     - net/sched: teql: Fix double-free in teql_master_xmit
     - net: airoha: read default PSE reserved pages value before updating
     - net: airoha: fix PSE memory configuration in airoha_fe_pse_ports_init()
     - net: airoha: Read completion queue data in airoha_qdma_tx_napi_poll()
     - net: airoha: Remove airoha_dev_stop() in airoha_remove()
     - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check
     - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
     - clsact: Fix use-after-free in init/destroy rollback asymmetry
     - net: usb: aqc111: Do not perform PM inside suspend callback
     - igc: fix missing update of skb->tail in igc_xmit_frame()
     - igc: fix page fault in XDP TX timestamps handling
     - iavf: fix VLAN filter lost on add/delete race
     - wifi: mac80211: fix NULL deref in mesh_matches_local() (CVE-2026-23396)
     - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough
       headroom
     - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix
     - net: macb: fix uninitialized rx_fs_lock
     - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle
     - net/mlx5e: Prevent concurrent access to IPSec ASO context
     - net/mlx5e: Fix race condition during IPSec ESN update
     - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
     - net: bonding: fix NULL deref in bond_debug_rlb_hash_show
     - netfilter: bpf: defer hook memory release until rcu readers are done
     - netfilter: nf_tables: release flowtable after rcu grace period on error
       (CVE-2026-23392)
     - nfnetlink_osf: validate individual option lengths in fingerprints
       (CVE-2026-23397)
     - [arm64,armhf] net: mvpp2: guard flow control update with global_tx_fc in
       buffer switching
     - [armhf] net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error
       paths
     - icmp: fix NULL pointer dereference in icmp_tag_validation()
       (CVE-2026-23398)
     - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return
       value
     - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit()
     - [amd64] drm/i915/psr: Compute PSR entry_setup_frames into intel_crtc_state
     - USB: serial: f81232: fix incomplete serial port generation
     - i2c: cp2615: fix serial string NULL-deref at probe
     - i2c: fsi: Fix a potential leak in fsi_i2c_probe()
     - i2c: pxa: defer reset on Armada 3700 when recovery is used
     - ring-buffer: Fix to update per-subbuf entries of persistent ring buffer
     - [amd64] x86/platform/uv: Handle deconfigured sockets
     - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode
     - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode
     - mm: shmem: fix potential data corruption during shmem swapin
     - mm: shmem: avoid unpaired folio_unlock() in shmem_swapin_folio()
     - mm/shmem, swap: improve cached mTHP handling and fix potential hang
     - mm/shmem, swap: avoid redundant Xarray lookup during swapin
     - mtd: rawnand: serialize lock/unlock against other NAND operations
     - mtd: rawnand: brcmnand: skip DMA during panic write
     - drm/amd/display: Fix DisplayID not-found handling in
       parse_edid_displayid_vrr()
     - drm/amd: fix dcn 2.01 check
     - ksmbd: fix use-after-free of share_conf in compound request
     - ksmbd: fix use-after-free in durable v2 replay of active file handles
     - [amd64] drm/i915/gt: Check set_default_submission() before deferencing
     - lib/bootconfig: check xbc_init_node() return in override path
     - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure
     - hwmon: (max6639) Fix pulses-per-revolution implementation
     - [amd64] perf/x86/intel: Add missing branch counters constraint apply
     - xen/privcmd: restrict usage in unprivileged domU (CVE-2026-31788)
     - xen/privcmd: add boot control for restricted usage in domU
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.79
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.80
     - cxl/port: Fix use after free of parent_port in cxl_detach_ep()
     - bpf: Fix constant blinding for PROBE_MEM32 stores (CVE-2026-23417)
       (Closes: #1132622)
     - perf: Make sure to use pmu_ctx->pmu for groups
     - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled
     - hwmon: axi-fan: don't use driver_override as IRQ name
     - driver core: generalize driver_override in struct device
     - driver core: platform: use generic driver_override infrastructure
     - bpf: Release module BTF IDR before module unload
     - bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN
     - bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR
     - HID: asus: avoid memory leak in asus_report_fixup()
     - [amd64] platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to
       dmi_vgbs_allow_list
     - nvme-pci: cap queue creation to used queues
     - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets
     - [amd64] platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold
       16 Gen 1
     - [amd64] platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix
       touchscreen on SUPI S10
     - nvme-pci: ensure we're polling a polled queue
     - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2
     - HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
     - HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list
     - net: usb: r8152: add TRENDnet TUC-ET2G
     - kbuild: install-extmod-build: Package resolve_btfids if necessary
     - HID: mcp2221: cancel last I2C command on read error
     - HID: asus: add xg mobile 2023 external hardware support
     - module: Fix kernel panic when a symbol st_shndx is out of bounds
     - scsi: mpi3mr: Clear reset history on ready and recheck state after timeout
     - scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP
     - dma-buf: Include ioctl.h in UAPI header
     - ALSA: hda/senary: Ensure EAPD is enabled during init
     - HID: apple: avoid memory leak in apple_report_fixup()
     - sched_ext: Use WRITE_ONCE() for the write side of dsq->seq update
     - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create
     - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk
     - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390
     - objtool: Handle Clang RSP musical chairs
     - nvmet: move async event work off nvmet-wq
     - drm/amdgpu: fix gpu idle power consumption issue for gfx v12
     - usb: core: new quirk to handle devices with zero configurations
     - spi: intel-pci: Add support for Nova Lake mobile SPI flash
     - ALSA: hda/realtek: add quirk for ASUS UM6702RC
     - i3c: master: dw-i3c: Fix missing of_node for virtual I2C adapter
     - xfrm: add missing extack for XFRMA_SA_PCPU in add_acquire and allocspi
     - xfrm: fix the condition on x->pcpu_num in xfrm_sa_len
     - xfrm: call xdo_dev_state_delete during state update
     - xfrm: Fix the usage of skb->sk
     - esp: fix skb leak with espintcp and async crypto
     - xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini()
     - xfrm: prevent policy_hthresh.work from racing with netns teardown
     - af_key: validate families in pfkey_send_migrate()
     - dma: swiotlb: add KMSAN annotations to swiotlb_bounce()
     - erofs: set fileio bio failed in short read case
     - can: statistics: add missing atomic access in hot path
     - Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
     - Bluetooth: L2CAP: Validate PDU length before reading SDU length in
       l2cap_ecred_data_rcv()
     - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing
       sock_hold
     - Bluetooth: MGMT: Fix dangling pointer on
       mgmt_add_adv_patterns_monitor_complete
     - Bluetooth: hci_ll: Fix firmware leak on error path
     - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
     - [arm64] pinctrl: mediatek: common: Fix probe failure for devices without
       EINT
     - ionic: fix persistent MAC address override on PF
     - nfc: nci: fix circular locking dependency in nci_close_device
     - net: openvswitch: Avoid releasing netdev before teardown completes
     - openvswitch: defer tunnel netdev_put to RCU release
     - openvswitch: validate MPLS set/set_masked payload length
     - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe
       buffer
     - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
     - net: bcm: asp2: fix LPI timer handling
     - net: bcm: asp2: remove tx_lpi_enabled
     - net: bcm: asp2: convert to phylib managed EEE
     - net: bcmasp: Remove support for asp-v2.0
     - net: bcmasp: streamline early exit in probe
     - net: bcmasp: fix double free of WoL irq
     - net: bcmasp: Add support for asp-v3.0
     - net: bcmasp: fix double disable of clk
     - [armhf] platform/olpc: olpc-xo175-ec: Fix overflow error message to print
       inlen
     - [amd64] platform/x86: intel-hid: disable wakeup_mode during hibernation
     - ice: fix inverted ready check for VF representors
     - ice: use ice_update_eth_stats() for representor stats
     - iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
     - ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions
       expire.
     - ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist.
     - net: fix fanout UAF in packet_release() via NETDEV_UP race
     - tcp: optimize inet_use_bhash2_on_bind()
     - udp: Fix wildcard bind conflict check when using hash2
     - net: enetc: fix the output issue of 'ethtool --show-ring'
     - team: fix header_ops type confusion with non-Ethernet ports
     - net: lan743x: fix duplex configuration in mac_link_up
     - dma-mapping: add missing `inline` for `dma_free_attrs`
     - Bluetooth: L2CAP: Fix send LE flow credits in ACL link
     - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock
     - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
     - Bluetooth: btusb: clamp SCO altsetting table indices
     - tls: Purge async_hold in tls_decrypt_async_wait() (CVE-2026-23414)
     - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
     - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
     - netfilter: nf_conntrack_expect: skip expectations in other netns via proc
     - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in
       process_sdp
     - netfilter: ctnetlink: use netlink policy range checks
     - net: macb: use the current queue number for stats
     - regmap: Synchronize cache for the page selector
     - ALSA: hda/realtek: Sequence GPIO2 on Star Labs StarFighter
     - RDMA/rw: Fall back to direct SGE on MR pool exhaustion
     - RDMA/irdma: Initialize free_qp completion before using it
     - RDMA/irdma: Update ibqp state to error if QP is already in error state
     - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce()
     - RDMA/irdma: Clean up unnecessary dereference of event->cm_node
     - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err()
     - RDMA/irdma: Fix deadlock during netdev reset with active connections
     - RDMA/irdma: Return EINVAL for invalid arp index error
     - scsi: scsi_transport_sas: Fix the maximum channel scanning issue
     - [amd64] x86/efi: efi_unmap_boot_services: fix calculation of
       ranges_to_free size
     - [amd64] drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
     - PM: hibernate: Drain trailing zero pages on userspace restore
     - spi: sn-f-ospi: Fix resource leak in f_ospi_probe()
     - [amd64] ASoC: Intel: catpt: Fix the device initialization
     - [arm64,armhf] spi: meson-spicc: Fix double-put in remove path
     - drm/amd/display: Do not skip unrelated mode changes in DSC validation
     - spi: Group CS related fields in struct spi_device
     - spi: use generic driver_override infrastructure
     - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
     - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib
     - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion
     - hwmon: (pmbus/core) Fix various coding style issues
     - hwmon: (pmbus) Mark lowest/average/highest/rated attributes as read-only
     - hwmon: (pmbus) Introduce the concept of "write-only" attributes
     - sysctl: fix uninitialized variable in proc_do_large_bitmap
     - [s390x] syscalls: Add spectre boundary for syscall dispatch table
     - [s390x] barrier: Make array_index_mask_nospec() __always_inline
     - [s390x] entry: Scrub r12 register on kernel entry
     - ksmbd: replace hardcoded hdr2_len with offsetof() in
       smb2_calc_max_out_buf_len()
     - ksmbd: fix potencial OOB in get_file_all_info() for compound requests
     - ksmbd: fix memory leaks and NULL deref in smb2_lock()
     - ksmbd: do not expire session on binding failure
     - ALSA: firewire-lib: fix uninitialized local variable
     - [amd64] ASoC: SOF: ipc4-topology: Allow bytes controls without initial
       payload
     - can: gw: fix OOB heap access in cgw_csum_crc8_rel()
     - can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
     - cpufreq: conservative: Reset requested_freq on limits change
     - [amd64] platform/x86: ISST: Correct locked bit width
     - [arm64] KVM: arm64: Discard PC update state on vcpu reset
     - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs
       attributes
     - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute
       temperature
     - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible()
     - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
     - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and
       napi_tx is false
     - erofs: add GFP_NOIO in the bio completion if needed
     - alarmtimer: Fix argument order in alarm_timer_forward()
     - [amd64] x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling()
     - [amd64] x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask
     - [arm64] phy: qcom: qmp-ufs: Fix SM8650 PCS table for Gear 4
     - ovl: fix wrong detection of 32bit inode numbers
     - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
     - scsi: ses: Handle positive SCSI error from ses_recv_diag()
     - net: macb: Move devm_{free,request}_irq() out of spin lock area
     - net: macb: Protect access to net_device::ip_ptr with RCU lock
     - net: macb: Use dev_consume_skb_any() to free TX SKBs
     - [amd64] KVM: x86/mmu: Drop/zap existing present SPTE even when creating an
       MMIO SPTE (CVE-2026-23401)
     - jbd2: gracefully abort on checkpointing state corruptions
     - [arm64] irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment
     - futex: Clear stale exiting pointer in futex_lock_pi() retry path
     - dmaengine: fsl-edma: fix channel parameter config for fixed channel
       requests
     - dmaengine: sh: rz-dmac: Protect the driver specific lists
     - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock
     - drm/amdgpu: prevent immediate PASID reuse case
     - [amd64] drm/i915/dp_tunnel: Fix error handling when clearing stream BW in
       atomic state
     - xfs: stop reclaim before pushing AIL during unmount
     - xfs: save ailp before dropping the AIL lock in push callbacks
     - xfs: scrub: unlock dquot before early return in quota scrub
     - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2
     - xfs: don't irele after failing to iget in xfs_attri_recover_work
     - xfs: remove file_path tracepoint data
     - ext4: fix journal credit check when setting fscrypt context
     - ext4: convert inline data to extents when truncate exceeds inline size
     - ext4: fix stale xarray tags after writeback
     - ext4: fix fsync(2) for nojournal mode
     - ext4: make recently_deleted() properly work with lazy itable
       initialization
     - ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio
     - ext4: validate p_idx bounds in ext4_ext_correct_indexes
     - ext4: avoid infinite loops caused by residual data
     - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
     - ext4: reject mount if bigalloc with s_first_data_block != 0
     - ext4: fix use-after-free in update_super_work when racing with umount
     - ext4: fix the might_sleep() warnings in kvfree()
     - ext4: handle wraparound when searching for blocks for indirect mapped
       blocks
     - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
     - ext4: always drain queued discard work in ext4_mb_release()
     - [arm64] dts: imx8mn-tqma8mqnl: fix LDO5 power off
     - [powerpc*] powerpc64/bpf: do not increment tailcall count when prog is
       NULL
     - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()
     - tracing: Switch trace_osnoise.c code over to use guard() and __free()
     - tracing: Fix potential deadlock in cpu hotplug with osnoise
     - drm/xe: always keep track of remap prev/next
     - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]
     - ovl: Use str_on_off() helper in ovl_show_options()
     - ovl: make fsync after metadata copy-up opt-in mount option
     - xfs: avoid dereferencing log items after push callbacks
     - virt: tdx-guest: Fix handling of host controlled 'quote' buffer length
     - net: add proper RCU protection to /proc/net/ptype (CVE-2026-23255)
     - landlock: Optimize file path walks and prepare for audit support
     - landlock: Fix handling of disconnected directories (CVE-2025-68736)
     - ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw()
       (CVE-2025-22117)
     - ice: Fix PTP NULL pointer dereference during VSI rebuild (CVE-2026-23210)
     - [amd64,arm64] idpf: check error for register_netdev() on init
     - [amd64,arm64] idpf: detach and close netdevs while handling a reset
       (CVE-2026-22981)
     - [amd64,arm64] idpf: Fix RSS LUT NULL pointer crash on early ethtool
       operations (CVE-2026-22985)
     - [amd64,arm64] idpf: Fix RSS LUT NULL ptr issue after soft reset
       (CVE-2026-22993)
     - [amd64] dmaengine: idxd: Fix not releasing workqueue on .release()
     - [amd64] dmaengine: idxd: Fix memory leak when a wq is reset
     - [amd64] dmaengine: idxd: Fix freeing the allocated ida too late
     - phy: ti: j721e-wiz: Fix device node reference leak in
       wiz_get_lane_phy_types()
     - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and
       CYCLE_BIT bits for HDMA.
     - netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators
     - [amd64] dmaengine: idxd: fix possible wrong descriptor completion in
       llist_abort_desc()
     - btrfs: fix super block offset in error message in btrfs_validate_super()
     - btrfs: fix leak of kobject name for sub-group space_info
     - btrfs: fix lost error when running device stats on multiple devices fs
     - xen/privcmd: unregister xenstore notifier on module exit
     - futex: Require sys_futex_requeue() to have identical flags
     - [amd64] dmaengine: idxd: Fix leaking event log memory
     - net: bcmasp: Restore programming of TX map vector register
     - net: bcmasp: Fix network filter wake for asp-3.0
     - [amd64,arm64] idpf: nullify pointers after they are freed
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.81
     - io_uring/kbuf: remove legacy kbuf bulk allocation
     - io_uring/kbuf: remove legacy kbuf kmem cache
     - io_uring/kbuf: simplify __io_put_kbuf
     - io_uring/kbuf: remove legacy kbuf caching
     - io_uring/kbuf: open code __io_put_kbuf()
     - io_uring/kbuf: introduce io_kbuf_drop_legacy()
     - io_uring/kbuf: uninline __io_put_kbufs
     - io_uring/kbuf: drop 'issue_flags' from io_put_kbuf(s)() arguments
     - io_uring/net: don't use io_net_kbuf_recyle() for non-provided cases
     - io_uring/net: clarify io_recv_buf_select() return value
     - io_uring/kbuf: pass in struct io_buffer_list to commit/recycle helpers
     - io_uring/kbuf: introduce struct io_br_sel
     - io_uring/kbuf: use struct io_br_sel for multiple buffers picking
     - io_uring/net: use struct io_br_sel->val as the recv finish value
     - io_uring/net: use struct io_br_sel->val as the send finish value
     - io_uring/kbuf: switch to storing struct io_buffer_list locally
     - io_uring: remove async/poll related provided buffer recycles
     - io_uring/net: correct type for min_not_zero() cast
     - io_uring/rw: check for NULL io_br_sel when putting a buffer
     - io_uring/kbuf: enable bundles for incrementally consumed buffers
     - io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths
     - io_uring/kbuf: use READ_ONCE() for userspace-mapped memory
     - io_uring/kbuf: use WRITE_ONCE() for userspace-shared buffer ring fields
     - io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF
     - io_uring/kbuf: propagate BUF_MORE through early buffer commit path
     - HID: logitech-hidpp: Enable MX Master 4 over bluetooth
     - wifi: mac80211: check tdls flag in ieee80211_tdls_oper
     - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
     - atm: lec: fix use-after-free in sock_def_readable()
     - btrfs: don't take device_list_mutex when querying zone info
     - tg3: replace placeholder MAC address with device property
     - HID: logitech-hidpp: Prevent use-after-free on force feedback
       initialisation failure
     - HID: multitouch: Check to ensure report responses match the request
     - btrfs: reserve enough transaction items for qgroup ioctls
     - [arm64,armhf] i2c: tegra: Don't mark devices with pins as IRQ safe
     - btrfs: reject root items with drop_progress and zero drop_level
     - [arm64] spi: geni-qcom: Check DMA interrupts early in ISR
     - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common
       property warning
     - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU
       session
     - [arm64,armhf] crypto: caam - fix DMA corruption on long hmac keys
     - [arm64,armhf] crypto: caam - fix overflow on long hmac keys
     - crypto: af-alg - fix NULL pointer dereference in scatterwalk
     - [arm64,armhf] net: fec: fix the PTP periodic output sysfs interface
     - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak
     - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields
       to zero to prevent an info-leak
     - net/ipv6: ioam6: prevent schema length wraparound in trace fill
     - tg3: Fix race for querying speed/duplex
     - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
     - ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
     - bridge: br_nd_send: linearize skb before parsing ND options
     - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
     - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta
     - [arm64] net: enetc: check whether the RSS algorithm is Toeplitz
     - ipv6: prevent possible UaF in addrconf_permanent_addr()
     - net: airoha: Add missing cleanup bits in airoha_qdma_cleanup_rx_queue()
     - net: introduce mangleid_features
     - net: use skb_header_pointer() for TCPv4 GSO frag_off check
     - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero
       to prevent an info-leak
     - NFC: pn533: bound the UART receive buffer
     - ASoC: Intel: boards: fix unmet dependency on PINCTRL
     - bpf: Fix regsafe() for pointers to packet
     - net: ipv6: flowlabel: defer exclusive option free until RCU teardown
     - netfilter: flowtable: strictly check for maximum number of actions
     - netfilter: nfnetlink_log: account for netlink header size
     - netfilter: x_tables: ensure names are nul-terminated
     - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
     - netfilter: nf_conntrack_helper: pass helper to expect cleanup
     - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
     - netfilter: nf_conntrack_expect: honor expectation helper field
     - netfilter: nf_conntrack_expect: use expect->helper
     - netfilter: nf_conntrack_expect: store netns and zone in expectation
     - netfilter: ctnetlink: ignore explicit helper on new expectations
     - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions
       for NFPROTO_ARP
     - netfilter: nf_tables: reject immediate NF_QUEUE verdict
     - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate
     - Bluetooth: SCO: fix race conditions in sco_sock_connect()
     - Bluetooth: MGMT: validate LTK enc_size on load
     - Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
     - Bluetooth: hci_event: fix potential UAF in
       hci_le_remote_conn_param_req_evt
     - Bluetooth: MGMT: validate mesh send advertising payload length
     - rds: ib: reject FRMR registration before IB connection is established
     - bpf: sockmap: Fix use-after-free of sk->sk_socket in
       sk_psock_verdict_data_ready().
     - net/sched: sch_netem: fix out-of-bounds access in packet corruption
     - net: macb: fix clk handling on PCI glue driver removal
     - net: macb: properly unregister fixed rate clocks
     - net/mlx5: lag: Check for LAG device before creating debugfs
     - net/mlx5: Avoid "No data available" when FW version queries fail
     - net/mlx5: Fix switchdev mode rollback in case of failure
     - bnxt_en: Restore default stat ctxs for ULP when resource is available
     - net/x25: Fix potential double free of skb
     - net/x25: Fix overflow when accumulating packets
     - net/sched: cls_fw: fix NULL pointer dereference on shared blocks
     - net/sched: cls_flow: fix NULL pointer dereference on shared blocks
     - net: hsr: fix VLAN add unwind on slave errors
     - ipv6: avoid overflows in ip6_datagram_send_ctl()
     - bpf: reject direct access to nullable PTR_TO_BUF pointers
     - Revert "drm: Fix use-after-free on framebuffers and property blobs when
       calling drm_dev_unplug"
     - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
     - hwmon: (pxe1610) Check return value of page-select write in probe
     - hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS")
     - dt-bindings: gpio: fix microchip #interrupt-cells
     - hwmon: (tps53679) Fix device ID comparison and printing in
       tps53676_identify()
     - [armhf] hwmon: (occ) Fix missing newline in occ_show_extended()
     - sched/fair: Use protect_slice() instead of direct comparison
     - sched/fair: Fix zero_vruntime tracking fix
     - [amd64,arm64] drm/ioc32: stop speculation on the drm_compat_ioctl path
     - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
     - wifi: iwlwifi: mvm: fix potential out-of-bounds read in
       iwl_mvm_nd_match_info_handler()
     - USB: serial: option: add MeiG Smart SRM825WN
     - ALSA: caiaq: fix stack out-of-bounds read in init_card
     - ALSA: ctxfi: Fix missing SPDIFI1 index handling
     - io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()
     - Bluetooth: SMP: derive legacy responder STK authentication from MITM state
     - Bluetooth: SMP: force responder MITM requirements before building the
       pairing response
     - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
     - ksmbd: fix OOB write in QUERY_INFO for compound requests
     - [armhf] hwmon: (occ) Fix division by zero in occ_show_power_1()
     - drm/amdgpu: fix the idr allocation flags
     - iio: adc: ti-adc161s626: fix buffer read on big-endian
     - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read()
     - drm/ast: dp501: Fix initialization of SCU2C
     - [amd64] drm/i915/dsi: Don't do DSC horizontal timing adjustments in
       command mode
     - [amd64] drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw
       CPU eDP
     - drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB
     - drm/amdgpu/pm: drop SMU driver if version not matched messages
     - USB: serial: io_edgeport: add support for Blackbox IC135A
     - USB: serial: option: add support for Rolling Wireless RW135R-GL
     - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
     - Input: synaptics-rmi4 - fix a locking bug in an error path
     - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk
       table
     - Input: bcm5974 - recover from failed mode switch
     - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode
     - Input: xpad - add support for Razer Wolverine V3 Pro
     - iio: adc: aspeed: clear reference voltage bits before configuring vref
     - iio: accel: fix ADXL355 temperature signature value
     - iio: accel: adxl380: fix FIFO watermark bit 8 always written as 0
     - iio: dac: ad5770r: fix error return in ad5770r_read_raw()
     - iio: light: vcnl4035: fix scan buffer on big-endian
     - iio: imu: bmi160: Remove potential undefined behavior in
       bmi160_config_pin()
     - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only
     - iio: gyro: mpu3050: Fix incorrect free_irq() variable
     - iio: gyro: mpu3050: Fix irq resource leak
     - iio: gyro: mpu3050: Move iio_device_register() to correct location
     - iio: gyro: mpu3050: Fix out-of-sequence free_irq()
     - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
     - usb: ulpi: fix double free in ulpi_register_interface() error path
     - usb: usbtmc: Flush anchored URBs in usbtmc_release
     - usb: ehci-brcm: fix sleep during atomic
     - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()
     - usb: core: phy: avoid double use of 'usb3-phy'
     - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
     - usb: cdns3: gadget: fix state inconsistency on gadget init failure
     - bridge: br_nd_send: validate ND option lengths
     - cdc-acm: new quirk for EPSON HMD
     - [amd64] comedi: Reinit dev->spinlock between attachments to low-level
       drivers
     - [amd64] comedi: me_daq: Fix potential overrun of firmware buffer
     - [amd64] comedi: me4000: Fix potential overrun of firmware buffer
     - [riscv64] firmware: microchip: fail auto-update probe if no flash found
     - dt-bindings: connector: add pd-disable dependency
     - nvmem: imx: assign nvmem_cell_info::raw_len
     - nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy
     - netfilter: ipset: drop logically empty buckets in mtype_del
     - vxlan: validate ND option lengths in vxlan_na_create
     - net: ftgmac100: fix ring allocation unwind on open failure
     - [arm64] net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled
     - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error
       path
     - gpio: mxc: map Both Edge pad wakeup to Rising Edge
     - thermal: core: Fix thermal zone device registration error path
     - misc: fastrpc: possible double-free of cctx->remote_heap
     - [amd64] thunderbolt: Fix property read in nhi_wake_supported()
     - USB: dummy-hcd: Fix locking/synchronization error
     - USB: dummy-hcd: Fix interrupt synchronization error
     - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows
       partial transfer
     - usb: typec: ucsi: validate connector number in ucsi_notify_common()
     - ice: Fix memory leak in ice_set_ringparam() (CVE-2026-23389)
     - btrfs: fix the qgroup data free range for inline data extents
     - btrfs: do not free data reservation in fallback from inline due to -ENOSPC
       (CVE-2025-71269)
     - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
     - usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo
     - usb: gadget: uvc: fix NULL pointer dereference during unbind race
     - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
     - usb: gadget: f_rndis: Protect RNDIS options with mutex
     - usb: gadget: f_ecm: Fix net_device lifecycle with device_move
     - usb: gadget: f_eem: Fix net_device lifecycle with device_move
     - usb: gadget: f_subset: Fix net_device lifecycle with device_move
     - usb: gadget: f_rndis: Fix net_device lifecycle with device_move
     - usb: gadget: f_hid: move list and spinlock inits from bind to alloc
     - usb: gadget: f_uac1_legacy: validate control request size
     - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
     - spi: cadence-qspi: Fix exec_mem_op error handling
     - net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback
     - [amd64,arm64] net: mana: fix use-after-free in add_adev() error path
     - scsi: target: tcm_loop: Drain commands in target_reset handler
     - [amd64] x86/fred: Fix early boot failures on SEV-ES/SNP guests
     - mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
     - mm: replace READ_ONCE() with standard page table accessors
     - mm/memory: fix PMD/PUD checks in follow_pfnmap_start()
     - drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13
     - ext4: publish jinode after initialization
     - [s390x] perf_cpum_sf: Convert to use try_cmpxchg128()
     - [s390x] cpum_sf: Cap sampling rate to prevent lsctl exception
     - MPTCP: fix lock class name family in pm_nl_create_listen_socket
     - [amd64] x86/CPU/AMD: Add additional fixed RDSEED microcode revisions
     - drm/amd/amdgpu: decouple ASPM with pcie dpm
     - drm/amd/amdgpu: disable ASPM in some situations
     - drm/amd/display: Disable fastboot on DCE 6 too
     - drm/amd/display: Keep PLL0 running on DCE 6.0 and 6.4
     - drm/amd/display: Fix DCE 6.0 and 6.4 PLL programming.
     - drm/amd/display: Adjust DCE 8-10 clock, don't overclock by 15%
     - drm/amd/display: Disable scaling on DCE6 for now
     - drm/amd: Disable ASPM on SI
     - drm/amd/display: Correct logic check error for fastboot
     - bpf: Improve bounds when s64 crosses sign boundary
     - bpf: Add third round of bounds deduction
     - bpf: Fix u32/s32 bounds when ranges cross min/max boundary
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.82
     - lib/crypto: chacha: Zeroize permuted_state before it leaves scope
     - usb: typec: ucsi: skip connector validation before init
     - wifi: rt2x00usb: fix devres lifetime
     - xfrm_user: fix info leak in build_report()
     - net: rfkill: prevent unlimited numbers of rfkill events from being created
     - mptcp: fix slab-use-after-free in __inet_lookup_established
     - seg6: separate dst_cache for input and output paths in seg6 lwtunnel
     - Input: uinput - fix circular locking dependency with ff-core
     - Input: uinput - take event lock when submitting FF request "event"
     - ASoC: simple-card-utils: Don't use __free(device_node) at
       graph_util_parse_dai()
     - btrfs: make wait_on_extent_buffer_writeback() static inline
     - btrfs: remove unused define WAIT_PAGE_LOCK for extent io
     - btrfs: split waiting from read_extent_buffer_pages(), drop parameter wait
     - btrfs: remove unused flag EXTENT_BUFFER_READAHEAD
     - btrfs: remove unused flag EXTENT_BUFFER_CORRUPT
     - btrfs: remove pointless out labels from extent-tree.c
     - btrfs: fix incorrect return value after changing leaf in
       lookup_extent_data_ref()
     - blktrace: fix __this_cpu_read/write in preemptible context
     - nfc: nci: complete pending data exchange on device close
     - misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe
     - Revert "mptcp: add needs_id for netlink appending addr"
     - net: annotate data-races around sk->sk_{data_ready,write_space}
     - netfilter: nft_ct: fix use-after-free in timeout object destroy
     - workqueue: Add pool_workqueue to pending_pwqs list when unplugging
       multiple inactive works
     - xfrm: clear trailing padding in build_polexpire()
     - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
     - wifi: brcmsmac: Fix dma_free_coherent() size
     - [amd64] platform/x86/intel-uncore-freq: Handle autonomous UFS status bit
     - [arm64] Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower"
     - [arm64] dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V
     - [arm64] dts: hisilicon: poplar: Correct PCIe reset GPIO polarity
     - [arm64] dts: hisilicon: hi3798cv200: Add missing dma-ranges
     - nfc: pn533: allocate rx skb before consuming bytes
     - batman-adv: reject oversized global TT response buffers
     - X.509: Fix out-of-bounds access when parsing extensions
     - [amd64,arm64] EDAC/mc: Fix error path ordering in edac_mc_alloc()
     - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
     - batman-adv: hold claim backbone gateways by reference
     - [amd64] drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat
     - [amd64] drm/i915/psr: Do not use pipe_src as borders for SU area
     - net/mlx5: Update the list of the PCI supported devices
     - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled
     - mmc: vub300: fix NULL-deref on disconnect
     - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation
       failure
     - net: stmmac: fix integer underflow in chain mode
     - mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()
     - [amd64,arm64] idpf: improve locking around idpf_vc_xn_push_free()
     - [amd64,arm64] idpf: set the payload size before calling the async handler
     - rxrpc: Fix anonymous key handling
     - rxrpc: Fix call removal to use RCU safe deletion
     - rxrpc: Fix key reference count leak from call->key
     - rxrpc: Only put the call ref if one was acquired
     - rxrpc: reject undecryptable rxkad response tickets
     - rxrpc: fix reference count leak in rxrpc_server_keyring()
     - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)
     - rxrpc: Fix missing error checks for rxkad encryption/decryption failure
     - net: skb: fix cross-cache free of KFENCE-allocated skb head
     - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6
     - [amd64] x86/CPU: Fix FPDSS on Zen1 (CVE-2026-31628)
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.83
     - RDMA/irdma: Fix double free related to rereg_user_mr
     - [amd64] ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA
     - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk
     - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC
     - [arm64,armhf] media: rkvdec: reduce stack usage in
       rkvdec_init_v4l2_vp9_count_tbl()
     - ALSA: asihpi: avoid write overflow check warning
     - Bluetooth: hci_sync: annotate data-races around hdev->req_status
     - [amd64] ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF
     - [amd64,arm64] ASoC: SOF: topology: reject invalid vendor array size in
       token parser
     - can: mcp251x: add error handling for power enable in open and resume
     - [amd64] platform/x86: asus-nb-wmi: add DMI quirk for ASUS ROG Flow Z13-KJP
       GZ302EAC
     - btrfs: tracepoints: get correct superblock from dentry in event
       btrfs_sync_file()
     - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx
     - drm/amdgpu: Handle GPU page faults correctly on non-4K page systems
     - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
     - ALSA: hda/realtek: add quirk for Framework F111:000F
     - wifi: wl1251: validate packet IDs before indexing tx_frames
     - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list
     - ALSA: hda/realtek: Add quirk for Samsung Book2 Pro 360 (NP950QED)
     - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex
     - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
     - [amd64] ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx
     - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IMH9
     - [amd64] pinctrl: intel: Fix the revision for new features (1kOhm PD, HW
       debouncer)
     - [amd64] platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug
     - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3
     - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10
     - HID: roccat: fix use-after-free in roccat_report_event
     - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585
     - wifi: brcmfmac: validate bsscfg indices in IF events
     - net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules
     - [armhf] ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J
     - [armhf] soc: aspeed: socinfo: Mask table entries for accurate SoC ID
       matching
     - [arm64] dts: qcom: hamoa/x1: fix idle exit latency
     - [arm64] dts: imx8mq: Set the correct gpu_ahb clock frequency
     - [arm64] dts: imx93-9x9-qsb: change usdhc tuning step for eMMC and SD
     - [arm64] dts: imx93-tqma9352: improve eMMC pad configuration
     - [arm64] soc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei
     - tools/power/turbostat: Fix microcode patch level output for AMD/Hygon
     - PCI: hv: Set default NUMA node to 0 for devices without affinity info
     - HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP
     - xfrm: account XFRMA_IF_ID in aevent size calculation
     - [arm*] drm/vc4: Release runtime PM reference after binding V3D
     - [arm*] drm/vc4: Fix memory leak of BO array in hang state
     - [arm*] drm/vc4: Fix a memory leak in hang state error path
     - [arm* drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock
     - eventpoll: defer struct eventpoll free to RCU grace period
     - net: sched: act_csum: validate nested VLAN headers
     - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE
     - ipv4: nexthop: avoid duplicate NHA_HW_STATS_ENABLE on nexthop group dump
     - ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()
       (CVE-2026-31531)
     - ipv4: icmp: fix null-ptr-deref in icmp_build_probe()
     - net: increase IP_TUNNEL_RECURSION_LIMIT to 5
     - nfc: s3fwrn5: allocate rx skb before consuming bytes
     - net: stmmac: Fix PTP ref clock for Tegra234
     - dt-bindings: net: Fix Tegra234 MGBE PTP clock
     - tracing/probe: reject non-closed empty immediate strings
     - ixgbevf: add missing negotiate_features op to Hyper-V ops table
     - e1000: check return value of e1000_read_eeprom
     - xsk: tighten UMEM headroom validation to account for tailroom and min
       frame
     - xsk: respect tailroom for ZC setups
     - xsk: fix XDP_UMEM_SG_FLAG issues
     - xsk: validate MTU against usable frame size on bind
     - xfrm: Wait for RCU readers during policy netns exit
     - xfrm: fix refcount leak in xfrm_migrate_policy_find
     - xfrm_user: fix info leak in build_mapping()
     - ipvs: fix NULL deref in ip_vs_add_service error path
     - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator
     - netfilter: xt_multiport: validate range encoding in checkentry
     - netfilter: ip6t_eui64: reject invalid MAC header for all packets
     - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC ->
       GFP_KERNEL_ACCOUNT allocation
     - netfilter: nfnetlink_queue: make hash table per queue
     - net: txgbe: leave space for null terminators on property_entry
     - af_unix: read UNIX_DIAG_VFS data under unix_state_lock
     - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
     - net: ipa: fix event ring index not programmed for IPA v5.0+
     - l2tp: Drop large packets with UDP encap
     - gpio: tegra: fix irq_release_resources calling enable instead of disable
     - crypto: af_alg - limit RX SG extraction by receive buffer budget
     - [amd64] perf/x86/intel/uncore: Skip discovery table for offline dies
     - sched/deadline: Use revised wakeup rule for dl_server
     - crypto: algif_aead - Fix minimum RX size check for decryption
     - netfilter: conntrack: add missing netlink policy validations
       (CVE-2026-31407)
     - Revert "drm/xe/mmio: Avoid double-adjust in 64-bit reads"
     - Revert "drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt"
     - thermal: core: Mark thermal zones as exiting before unregistration
     - thermal: core: Address thermal zone removal races with resume
     - ALSA: usb-audio: Improve Focusrite sample rate filtering
     - [amd64,arm64] idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC
       handling
     - nfc: llcp: add missing return after LLCP_CLOSED checks
     - can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)
     - i2c: s3c24xx: check the size of the SMBUS message before using it
     - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
     - HID: alps: fix NULL pointer dereference in alps_raw_event()
     - HID: core: clamp report_size in s32ton() to avoid undefined shift
     - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
     - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
     - [arm*] drm/vc4: platform_get_irq_byname() returns an int
     - ALSA: fireworks: bound device-supplied status before string array lookup
     - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
     - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()
     - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
     - usb: gadget: renesas_usb3: validate endpoint index in standard request
       handlers
     - smb: client: fix off-by-8 bounds check in check_wsl_eas()
     - ksmbd: validate EaNameLength in smb2_get_ea()
     - ksmbd: require 3 sub-authorities before reading sub_auth[2]
     - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc
     - usbip: validate number_of_packets in usbip_pack_ret_submit()
     - usb: storage: Expand range of matched versions for VL817 quirks entry
     - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen
     - usb: gadget: f_hid: don't call cdev_init while cdev in use
     - usb: port: add delay after usb_hub_set_port_power()
     - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
     - scripts: generate_rust_analyzer.py: avoid FD leak
     - wifi: rtw88: fix device leak on probe failure
     - staging: sm750fb: fix division by zero in ps_to_hz()
     - USB: serial: option: add Telit Cinterion FN990A MBIM composition
     - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates
       race
     - ALSA: ctxfi: Limit PTP to a single page
     - dcache: Limit the minimal number of bucket to two
     - media: vidtv: fix NULL pointer dereference in
       vidtv_channel_pmt_match_sections
     - ocfs2: fix possible deadlock between unlink and dio_end_io_write
     - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
     - ocfs2: handle invalid dinode in ocfs2_group_extend
     - PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup
     - [amd64] KVM: SEV: Reject attempts to sync VMSA of an
       already-launched/encrypted vCPU
     - [amd64] KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being
       created
     - [amd64] KVM: SEV: Drop WARN on large size for
       KVM_MEMORY_ENCRYPT_REG_REGION
     - gpiolib: unify two loops initializing GPIO descriptors
     - gpiolib: fix race condition for gdev->srcu (CVE-2026-22986)
     - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr()
     - kernel: be more careful about dup_mmap() failures and uprobe registering
     - KVM: Remove subtle "struct kvm_stats_desc" pseudo-overlay
     - [amd64] KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs
     - checkpatch: add support for Assisted-by tag
     - [amd64] x86-64: rename misleadingly named '__copy_user_nocache()' function
     - [amd64] x86: rename and clean up __copy_from_user_inatomic_nocache()
     - x86-64/arm64/powerpc: clean up and rename __copy_from_user_flushcache
     - [amd64] KVM: x86: Use scratch field in MMIO fragment to hold small write
       values
     - [arm64] ASoC: qcom: q6apm: move component registration to unmanaged
       version
     - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
     - media: vidtv: fix nfeeds state corruption on start_streaming failure
     - media: mediatek: vcodec: fix use-after-free in encoder release path
     - media: em28xx: fix use-after-free in em28xx_v4l2_open()
     - hwmon: (powerz) Fix use-after-free on USB disconnect
     - ALSA: 6fire: fix use-after-free on disconnect
     - bcache: fix cached_dev.sb_bio use-after-free and crash
     - media: as102: fix to not free memory after the device is registered in
       as102_usb_probe()
     - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map
     - media: vidtv: fix pass-by-value structs causing MSAN warnings
     - media: hackrf: fix to not free memory after the device is registered in
       hackrf_probe()
     - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block()
     - ocfs2: validate inline data i_size during inode read
     - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
     - rxrpc: Fix key quota calculation for multitoken keys
     - PCI: Fix placement of pci_save_state() in pci_bus_add_device()
     - ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)
     - PCI: Revert "Enable ACS after configuring IOMMU for OF platforms"
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.84
     - mm/userfaultfd: fix hugetlb fault mutex hash calculation
     - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown
     - ima: verify if the segment size has changed
     - ima: do not copy measurement list to kdump kernel
     - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
     - [arm64] net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU
       registers
     - drm/amdgpu: replace PASID IDR with XArray
     - mm/pagewalk: fix race between concurrent split and refault
     - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger
     - scripts/dtc: Remove unused dts_version in dtc-lexer.l
     - rxrpc: only handle RESPONSE during service challenge
     - fs/ntfs3: validate rec->used in journal-replay file record check
     - f2fs: fix to avoid memory leak in f2fs_rename()
     - fuse: reject oversized dirents in page cache
     - fuse: Check for large folio with SPLICE_F_MOVE
     - fuse: quiet down complaints in fuse_conn_limit_write
     - ksmbd: require minimum ACE size in smb_check_perm_dacl()
     - smb: server: fix active_num_conn leak on transport allocation failure
     - smb: server: fix max_connections off-by-one in tcp accept path
     - smb: client: require a full NFS mode SID before reading mode bits
     - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
     - ksmbd: validate response sizes in ipc_validate_msg()
     - ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()
     - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
     - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
     - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()
     - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu
     - ALSA: caiaq: take a reference on the USB device in create_card()
     - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
     - [amd64] crypto: ccp: Don't attempt to copy CSR to userspace if PSP command
       failed
     - [amd64] crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP
       command failed
     - [amd64] crypto: ccp: Don't attempt to copy ID to userspace if PSP command
       failed
     - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.85
     - crypto: scatterwalk - Backport memcpy_sglist()
     - crypto: algif_aead - use memcpy_sglist() instead of null skcipher
     - crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)
     - crypto: algif_aead - snapshot IV for async AEAD requests
     - crypto: authenc - use memcpy_sglist() instead of null skcipher
     - crypto: authencesn - Do not place hiseq at end of dst for out-of-place
       decryption
     - crypto: authencesn - Fix src offset when decrypting in-place
     - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
     - xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
     - Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)
linux-signed-arm64 (6.12.85+1~bpo12+1) bookworm-backports; urgency=high
 .
   * Sign kernel from linux 6.12.85-1~bpo12+1
 .
   * Rebuild for bookworm-backports
linux-signed-arm64 (6.12.74+2) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.74-2
 .
   * Refresh patchset to address multiple vulnerabilities in AppArmor
linux-signed-arm64 (6.12.74+2~bpo12+1) bookworm-backports; urgency=high
 .
   * Sign kernel from linux 6.12.74-2~bpo12+1
 .
   * Rebuild for bookworm-backports

luanti (5.10.0+dfsg-5+deb13u1) trixie-security; urgency=medium
 .
   * GHSA-22c4-238c-m5j4 / GHSA-g596-mf82-w8c3 (no CVE yet)

lxc (1:6.0.4-4+deb13u3) trixie; urgency=medium
 .
   * Cherry-pick upstream fix for CVE-2026-39402

lxd (5.0.2+git20231211.1364ae4-9+deb13u6) trixie-security; urgency=high
 .
   * Cherry-pick fixes for the following security issues (from Incus):
     - CVE-2026-40197 / GHSA-r7w7-mmxr-47r9
     - CVE-2026-40251 / GHSA-4m88-wxj4-9qj6
     - CVE-2026-41648 / GHSA-67wx-r9xr-x75x
     - CVE-2026-41684 / GHSA-x5r6-jr56-89pv
     - CVE-2026-41685 / GHSA-98vh-x9cx-9cfp
lxd (5.0.2+git20231211.1364ae4-9+deb13u5) trixie-security; urgency=high
 .
   * Cherry-pick fixes for the following security issues:
     - CVE-2026-34177 / GHSA-fm2x-c5qw-4h6f
     - CVE-2026-34178 / GHSA-q96j-3fmm-7fv4
     - CVE-2026-34179 / GHSA-c3h3-89qf-jqm5
lxd (5.0.2+git20231211.1364ae4-9+deb13u4) trixie-security; urgency=high
 .
   * Cherry-pick fixes for the following security issues:
     - CVE-2026-28384 / GHSA-4rmf-rcp8-2r9g
     - CVE-2026-33542 / GHSA-p8mm-23gg-jc9r
     - CVE-2026-33897 / GHSA-83xr-5xxr-mh92

mailman-suite (0+20240312-1+deb13u1) trixie; urgency=medium
 .
   * Add humanize as a dependency for the suite as postorius needs it.
    (Closes: #1116708)

mapserver (8.4.0-4+deb13u2) trixie; urgency=high
 .
   * Non-maintainer upload.
   * Fix CVE-2026-33721: Heap buffer overflow in SLD `Categorize` Threshold
     parsing.
   * Add d/salsa-ci.yml for Salsa CI.

mediawiki (1:1.43.8+dfsg-1~deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 1.43.8, fixing CVE-2026-5266, CVE-2026-34086,
     CVE-2026-34087, CVE-2026-34088, CVE-2026-34091, CVE-2026-34092,
     CVE-2026-34093, CVE-2026-34094, CVE-2026-34095. This version is not
     affected by CVE-2026-34089, CVE-2026-34090.
   * Refresh patch files.
mediawiki (1:1.43.6+dfsg-2) unstable; urgency=medium
 .
   * Update autopkgtest for new restrictions in apache2 sandboxing
mediawiki (1:1.43.6+dfsg-1) unstable; urgency=medium
 .
   * New upstream version 1.43.6, fixing CVE-2025-67475, CVE-2025-67477,
     CVE-2025-67478, CVE-2025-67479, CVE-2025-67480, CVE-2025-67481,
     CVE-2025-67482, CVE-2025-67483, CVE-2025-67484. This version is not
     affected by CVE-2025-67476.
     * Update copyright file for changes in vendor/.

modsecurity-crs (3.3.7-1+deb13u2) trixie; urgency=medium
 .
   * Fixes CVE-2026-33691

mongo-c-driver (1.30.4-1+deb13u2) trixie; urgency=medium
 .
   * Fix CVE-2026-6231: bson_validate may skip validation when processing
     certain inputs
   * Fix CVE-2026-4359: a compromised third party cloud server or
     man-in-the-middle attacker could send a malformed HTTP response and cause
     an application crash
   * Fix: improve handling of corrupt GridFS files (upstream ticket:
     https://jira.mongodb.org/browse/CDRIVER-6281)
   * Fix CVE-2025-14911: user-controlled chunkSize metadata from lacks
     appropriate validation allowing malformed GridFS metadata to overflow the
     bounding container
   * Fix CVE-2026-6691: Cyrus SASL integration performs unsafe string copying
     during username canonicalization, enabling a heap buffer overflow before
     any authentication or network traffic

multipart (1.2.1-2+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2026-28356: Fix ReDoS in parse_options_header.

mumble (1.5.735-5+deb13u1) trixie; urgency=medium
 .
   * debian/patches:
     - Add 95-opus-dos-security.diff to fix crashes Opus buffer overruns
       leading to crashes (Closes: #1129178)

mupdf (1.25.1+ds1-6+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Avoid overflow src_stride calculation in unpack_stream (CVE-2026-3308)
     (Closes: #1133189)

musl (1.2.5-3.1~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie.
 .
 musl (1.2.5-3.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-6042: Algorithmic complexity DoS in iconv GB18030 decoder
   * CVE-2026-40200: Stack corruption in qsort
   * (Closes: #1133372)

nano (8.4-1+deb13u1) trixie; urgency=medium
 .
   * Add upstream fix for CVE-2026-6842: possible creation of permissive
     ~/.local.
   * Add upstream patch for CVE-2026-6843: format string vulnerability.
   * Update debian-branch to trixie.

nautilus-wipe (0.4.alpha2-1.1~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie.
 .
 nautilus-wipe (0.4.alpha2-1.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * Remove Multi-Arch: same. (Closes: #1077235)

netatalk (4.2.3~ds-1+deb13u1) trixie; urgency=high
 .
   [ Daniel Markstedt ]
   * add patch that fixes critical bug in uam module;
     closes: bug#1111652, thanks to Stefan van Lieshout and
     Hector Rulot

netty (1:4.1.48-10+deb13u1) trixie-security; urgency=high
 .
   * Team upload
   * Fix CVE-2025-55163 (Closes: #1111105)
     Netty is vulnerable to MadeYouReset DDoS.
     This is a logical vulnerability in the HTTP/2 protocol,
     that uses malformed HTTP/2 control frames in order to break
     the max concurrent streams limit, which results in resource
     exhaustion and distributed denial of service.
   * Fix CVE-2025-58056 (Closes: #1113994)
     when supplied with specially crafted input, BrotliDecoder and
     certain other decompression decoders will allocate a large
     number of reachable byte buffers, which can lead to
     denial of service. BrotliDecoder.decompress has
     no limit in how often it calls pull, decompressing
     data 64K bytes at a time. The buffers are saved in
     the output list, and remain reachable until OOM is hit.
   * Fix CVE-2025-58057:
     When supplied with specially crafted input, BrotliDecoder
     and certain other decompression decoders will allocate
     a large number of reachable byte buffers, which can lead
     to denial of service. BrotliDecoder.decompress has no limit
     in how often it calls pull, decompressing data 64K bytes at
     a time. The buffers are saved in the output list, and remain
     reachable until OOM is hit.
     (Closes: #1113994)
   * Fix CVE-2025-59419 (Closes: #1118282)
     SMTP Command Injection Vulnerability Allowing Email Forgery
     An SMTP Command Injection (CRLF Injection) vulnerability
     in Netty's SMTP codec allows a remote attacker who can control
     SMTP command parameters (e.g., an email recipient)
     to forge arbitrary emails from the trusted server.
     This bypasses standard email authentication and can
     be used to impersonate executives and forge high-stakes
     corporate communications.
   * Fix CVE-2025-67735 (Closes: #1123606)
     `io.netty.handler.codec.http.HttpRequestEncoder`
     has a CRLF injection with the request URI when constructing
     a request. This leads to request smuggling when
     `HttpRequestEncoder` is used without proper sanitization
     of the URI. Any application / framework using `HttpRequestEncoder`
     can be subject to be abused to perform request smuggling using
     CRLF injection

nginx (1.26.3-3+deb13u4) trixie; urgency=medium
 .
   * d/conf/*_params: use "$host" instead of "$http_host"
     * "$http_host" forwards the Host header exactly as supplied by the client
       and may not match the effective request target (e.g. absolute-form
       requests with a conflicting Host header)
       this can expose inconsistent or attacker-controlled host values to
       backend applications (uwsgi, fastcgi, scgi, proxy)
     * switch to "$host" as a safer, normalized alternative
     * note: this changes behaviour, as "$host" does not preserve the
       client-supplied port; deployments relying on "$http_host" including
       a port number may be affected
     * it is workaround for Debian bug #1126960 for stable/oldstable release
nginx (1.26.3-3+deb13u3) trixie; urgency=medium
 .
   * backport changes from upstream nginx, fixes for buffer overflow
     vulnerability in the ngx_http_dav_module (CVE-2026-27654), buffer overflow
     vulnerabilities in the ngx_http_mp4_module (CVE-2026-27784, CVE-2026-32647),
     mail session authentication vulnerabilities (CVE-2026-27651, CVE-2026-28753)
     and OCSP result bypass vulnerability in stream (CVE-2026-28755)
     * d/p/CVE-2026-27651.patch add
     * d/p/CVE-2026-27654.patch add
     * d/p/CVE-2026-27784.patch add
     * d/p/CVE-2026-28753.patch add
     * d/p/CVE-2026-28755.patch add
     * d/p/CVE-2026-32647.patch add

ngtcp2 (1.11.0-1+deb13u1) trixie-security; urgency=medium
 .
   * Team upload
   * Backport patch for CVE-2026-40170 (closes: #1134197)

node-flatted (3.2.7~ds-1+deb13u1) trixie; urgency=medium
 .
   * Team upload
   * Add patch for CVE-2026-33228 (prototype pollution in parse)
     (Closes: #1131462)

node-node-rsa (1.1.1-5+deb13u1) trixie; urgency=medium
 .
   * Team upload.
 .
   [ Yadd ]
   * Add patch to fix FTBFS issue with OpenSSL 3. Closes: #1117354.

node-tar (6.2.1+~cs7.0.8-1+deb13u1) trixie; urgency=medium
 .
   * Team upload
   * Add patches for 6 CVEs: CVE-2026-23745, CVE-2026-23950, CVE-2026-24842,
     CVE-2026-26960, CVE-2026-29786, CVE-2026-31802 (Closes: #1129378)

nodejs (20.19.2+dfsg-1+deb13u2) trixie-security; urgency=medium
 .
   * Upstream security patches:
     + CVE-2026-21713: use timing-safe comparison in Web Cryptography HMAC
     + CVE-2026-21717: fix array index hash collision
     + CVE-2026-21710: http: use null prototype for headersDistinct/trailersDistinct
     + CVE-2026-21716: include permission check on lib/fs/promises
     + CVE-2026-21715: add permission check to realpath.native
     + CVE-2026-21714: handle NGHTTP2_ERR_FLOW_CONTROL error code
     + CVE-2026-21637: tls wrap SNICallback invocation in try/catch
   * copyright: add rapidhash from sec/51 patch
nodejs (20.19.2+dfsg-1+deb13u1) trixie-security; urgency=medium
 .
   * Upstream security patches:
     + CVE-2025-23085: follow-up fix wrong check for NGHTTP2_GOAWAY
     + CVE-2026-21637: TLS error handling allows remote attackers to
       crash or exhaust resources of a TLS server when `pskCallback`
       or `ALPNCallback` are in use.
     + CVE-2025-59465: malformed `HTTP/2 HEADERS` frame with oversized
       invalid `HPACK` data can cause a crash.
     + CVE-2025-55132: permission model allows a file's access and
       modification timestamps to be changed via `futimes()` even when
       the process has only read permissions.
     + CVE-2025-55130: permissions model allows attackers to bypass
       `--allow-fs-read` and `--allow-fs-write` restrictions using
       crafted relative symlink paths.
     + CVE-2025-59466: "Maximum call stack size exceeded" errors become
       uncatchable when `async_hooks.createHook()` is enabled.
     + CVE-2025-55131: buffer allocation logic can expose uninitialized
       memory when allocations are interrupted, when using the `vm` module
       with the timeout option.
   * Upstream critical fixes (see sec/NN patches)
     + zlib: fix pointer alignment (10)
     + os: fix GetInterfaceAddresses memory leak (15)
     + src: fix possible dereference of null pointers (17, 29)
     + v8: fix missing callback in heap utils destroy (19)
     + v8: loong64 - avoid memory access under stack pointer (27)
     + http2: do not crash on mismatched ping buffer length (28)
     + v8: riscv64 - Fix sp handling in MacroAssembler::LeaveFrame (44)

ntfs-3g (1:2022.10.3-5+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * acls.c: Fix heap buffer overflow in 'ntfs_build_permissions_posix'
     (CVE-2026-40706)

numba (0.61.2+dfsg-1+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * Conditionally skip tests requiring more CPUs than available.
     Closes: #1108051.

opam (2.3.0-1+deb13u1) trixie-security; urgency=medium
 .
   * Invalidate .install fields containing destination filepath trying to
     escape their scope

openjdk-21 (21.0.11+10-1~deb13u2) trixie-security; urgency=medium
 .
   * Rebuild for trixie, now with updated jtreg7
openjdk-21 (21.0.11+10-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie
openjdk-21 (21.0.11~9ea-2) unstable; urgency=medium
 .
   * Ensure that all generated files are up to date:
     - The copyright generator now checks if the current directory contains
       an unpacked OpenJDK tree by verifying the presence of the
       ASSEMBLY_EXCEPTION file.
     - The copyright generator now drops common license text in-memory,
       without running a shell script that modifies the source tree.
     - d/rules: Add targets to generate all files and check that they match
       the ones provided in the source package.
     - d/rules: Add nogen DEB_BUILD_OPTION to disable file regeneration.
   * d/rules: Use '-' instead of '~' in opt version string, swap package
     version and distribution.
openjdk-21 (21.0.11~9ea-1) unstable; urgency=medium
 .
   * OpenJDK 21.0.11 early access, build 9.
   * d/t/problems.csv: Update problem list.
openjdk-21 (21.0.11~8ea-1) unstable; urgency=medium
 .
   * OpenJDK 21.0.11 early access, build 8.
 .
   [ Vladimir Petko ]
   * d/rules: Revert replace '~' with '-' in the optional version string.
     This should be resolved upstream.
 .
   [ Matthias Klose ]
   * d/t/jtreg-autopkgtest.in: Increase the timeout from 10 to 30 seconds
     on loong64 (zero VM).
openjdk-21 (21.0.11~6ea-1) unstable; urgency=medium
 .
   * OpenJDK 21.0.11 early access, build 6.
   * d/rules: Remove '[' separator in the version string, it makes
     version string invalid.
openjdk-21 (21.0.11~5ea-1) unstable; urgency=medium
 .
   * OpenJDK 21.0.11 early access, build 5.
 .
   [ Miao Wang ]
   * d/t/problems.csv: Add tests which take too long to finish on
     loong64.
 .
   [ Vladimir Petko ]
   * d/rules: Separate package version in version string.
   * d/dbg.py: Fix syntax errors in gdb unwinder, do not install unwinder
     for zero, install hotspot unwinder in the correct directory.
   * d/t/jtreg-autopkgtest.{in,sh}: Do not force agentvm for s390x jtreg
     tests to resolve the build crash on Launchpad.
     Disable debug traces. Load unwinder in the disabled state.
     Return iterator rather than list from OpenJDKFrameFilter.flatten().
     Remove unused code from NativeMethodInfo.
 .
   [ Matthias Klose ]
   * Refresh patches.
openjdk-21 (21.0.10+7-1) unstable; urgency=medium
 .
   * OpenJDK 21.0.10 release, build 7.
    - CVEs:
       + CVE-2026-21945: 8368032: Enhance Certificate Checking.
       + CVE-2026-21932: 8359501: Enhance Handling of URIs.
       + CVE-2026-21933: 8362632: Improve HttpServer Request handling.
       + CVE-2026-21925: 8341496: Improve JMX connections.
   * d/t/control: Regenerate.

openjdk-25 (25.0.3+9-2~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie
openjdk-25 (25.0.3+9-1) unstable; urgency=medium
 .
   * OpenJDK 25.0.3 release, Build 9.
     - CVEs:
       + CVE-2026-22016: 8370529: Enhance Path Factories Redux
       + CVE-2026-34282: 8374557: Enhance TLS connection handling
       + CVE-2026-22021: 8371830: Enhance certificate chain validation
       + CVE-2026-22013: 8370615: Improve Kerberos credentialing
       + CVE-2026-23865: 8379158: Update FreeType to 2.14.2
       + CVE-2026-22008: 8367463: Improved Arena allocations
       + CVE-2026-22018: 8370986: Enhance Zip file reading
       + CVE-2026-22007: 8369575: Enhance crypto algorithm support
       + CVE-2026-34268: 8371935: Enhance key generation
   * d/rules: Check generated files only on amd64. This resolves riscv64
     ftbfs, as some architectures change with_check flag.
   * Remove openjdk-25-jvmci-jdk binary package.
   * d/t/problems.csv: Fix typo in loong64 excluded tests lists.
   * Add common GPL and Apache license headers to copyright generator.
   * d/copyright: Regenerate.
openjdk-25 (25.0.3~8ea-2) unstable; urgency=medium
 .
   * Ensure that all generated files are up to date:
     - The copyright generator now checks if the current directory contains
       an unpacked OpenJDK tree by verifying the presence of the
       ASSEMBLY_EXCEPTION file.
     - The copyright generator now drops common license text in-memory,
       without running a shell script that modifies the source tree.
     - d/rules: Add targets to generate all files and check that they match
       the ones provided in the source package.
     - d/rules: Add nogen DEB_BUILD_OPTION to disable file regeneration.
   * d/rules: Use '-' instead of '~' in opt version string, swap package
     version and distribution.
openjdk-25 (25.0.3~8ea-1) unstable; urgency=medium
 .
   * OpenJDK 25.0.3 snapshot, Build 8.
   * d/p/jdk-8369817.diff: Apply upstream patch to resolve failing
     EmptyPath test (JDK-8369817).
   * d/p/jdk-8381555.diff: Apply upstream patch to disable G1 Compressed
     Oops test on 32 bit architectures (JDK-8381555).
   * d/t/problems.csv: Update problem list.
openjdk-25 (25.0.3~7ea-2) unstable; urgency=medium
 .
   * d/t/dependencies.sh: Regenerate.
openjdk-25 (25.0.3~7ea-1) unstable; urgency=medium
 .
   * OpenJDK 25.0.3 snapshot, Build 7.
 .
   [ Vladimir Petko ]
   * d/rules: Revert optional version string changes.
     This should be resolved upstream.
 .
   [ Matthias Klose ]
   * d/t/jtreg-autopkgtest.in: Increase the timeout from 10 to 30 seconds
     on loong64 (zero VM).
openjdk-25 (25.0.3~5ea-2) unstable; urgency=medium
 .
   [ Vladimir Petko ]
   * d/rules: Remove '[' separator in version string, it makes the version
     string invalid.
   * d/t/dependencies.{in,sh}: Relax test assertion and regenerate.
 .
   [ Matthias Klose ]
   * Regenerate test scripts. Closes: #1127309.
   * Move pandoc and graphviz to general build dependencies, needed for
     man page generation.
   * Use pre-generated man pages on architectures where pandoc is not
     available. Closes: #1128485.
openjdk-25 (25.0.3~5ea-1) unstable; urgency=medium
 .
   * OpenJDK 25.0.3 snapshot, Build 5.
 .
   [ Miao Wang ]
   * d/t/problems.csv: Add tests which take too long to finish on
     loong64.
 .
   [ Vladimir Petko ]
   * d/rules: Separate package version in version string.
   * d/dbg.py: Fix syntax errors in gdb unwinder, do not install unwinder
     for zero, install hotspot unwinder in the correct directory.
   * d/t/jtreg-autopkgtest.{in,sh}: Do not force agentvm for s390x jtreg
     tests to resolve the build crash on Launchpad.
     Disable debug traces. Load unwinder in the disabled state.
     Return iterator rather than list from OpenJDKFrameFilter.flatten().
     Remove unused code from NativeMethodInfo.
openjdk-25 (25.0.2+10-1) unstable; urgency=medium
 .
   * OpenJDK 25.0.2 release, build 10.
     - CVEs:
       + CVE-2026-21945: 8368032: Enhance Certificate Checking.
       + CVE-2026-21932: 8359501: Enhance Handling of URIs.
       + CVE-2026-21933: 8362632: Improve HttpServer Request handling.
       + CVE-2026-21925: 8341496: Improve JMX connections.
   * d/rules: Use jtreg8 package for the tests.
   * d/p/power-opt.diff: Refresh patch.
   * Drop patches applied upstream:
      - d/p/jdk-8359735.patch.
      - d/p/jdk-8369450-proposed.patch.
      - d/p/jdk-8370049-proposed.patch.

openssh (1:10.0p1-7+deb13u4) trixie; urgency=medium
 .
   * Don't reuse c->isatty for signalling that the remote channel has a tty
     attached (closes: #1135798).
 .
 openssh (1:10.0p1-7+deb13u3) trixie; urgency=medium
 .
   * Backport minor security fixes from 10.3p1:
     - ssh(1): the -J and equivalent -oProxyJump="..." options now validate
       user and host names for ProxyJump/-J options passed via the
       command-line (no such validation is performed for this option in
       configuration files). This prevents shell injection in situations
       where these were directly exposed to adversarial input, which would
       have been a terrible idea to begin with.
     - CVE-2026-35386: ssh(1): validation of shell metacharacters in user
       names supplied on the command-line was performed too late to prevent
       some situations where they could be expanded from %-tokens in
       ssh_config. For certain configurations, such as those that use a "%u"
       token in a "Match exec" block, an attacker who can control the user
       name passed to ssh(1) could potentially execute arbitrary shell
       commands. Reported by Florian Kohnhäuser (closes: #1132573).
       We continue to recommend against directly exposing ssh(1) and other
       tools' command-lines to untrusted input. Mitigations such as this can
       not be absolute given the variety of shells and user configurations in
       use.
     - CVE-2026-35414: sshd(8): when matching an authorized_keys
       principals="" option against a list of principals in a certificate, an
       incorrect algorithm was used that could allow inappropriate matching
       in cases where a principal name in the certificate contains a comma
       character. Exploitation of the condition requires an authorized_keys
       principals="" option that lists more than one principal *and* a CA
       that will issue a certificate that encodes more than one of these
       principal names separated by a comma (typical CAs strongly constrain
       which principal names they will place in a certificate). This
       condition only applies to user- trusted CA keys in authorized_keys,
       the main certificate authentication path
       (TrustedUserCAKeys/AuthorizedPrincipalsFile) is not affected. Reported
       by Vladimir Tokarev (closes: #1132576).
     - CVE-2026-35385: scp(1): when downloading files as root in legacy (-O)
       mode and without the -p (preserve modes) flag set, scp did not clear
       setuid/setgid bits from downloaded files as one might typically
       expect. This bug dates back to the original Berkeley rcp program.
       Reported by Christos Papakonstantinou of Cantina and Spearbit (closes:
       #1132572).
     - CVE-2026-35387: sshd(8): fix incomplete application of
       PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard
       to ECDSA keys. Previously if one of these directives contains any
       ECDSA algorithm name (say "ecdsa-sha2-nistp384"), then any other ECDSA
       algorithm would be accepted in its place regardless of whether it was
       listed or not.  Reported by Christos Papakonstantinou of Cantina and
       Spearbit (closes: #1132574).
     - CVE-2026-35388: ssh(1): connection multiplexing confirmation
       (requested using "ControlMaster ask/autoask") was not being tested for
       proxy mode multiplexing sessions (i.e. "ssh -O proxy ..."). Reported
       by Michalis Vasileiadis (closes: #1132575).
   * Cherry-pick IPQoS handling updates from upstream:
     - Set default IPQoS for interactive sessions to Expedited Forwarding
       (EF).
     - Deprecate support for IPv4 type-of-service (TOS) IPQoS keywords.
     - Make ssh(1) and sshd(8) set IP QoS (aka IP_TOS, IPV6_TCLASS)
       continually at runtime based on what sessions/channels are open.
     - Correctly set extended type for client-side channels.  Fixes
       interactive vs bulk IPQoS for client->server traffic.
 .
 openssh (1:10.0p1-7+deb13u2) trixie-security; urgency=medium
 .
   * CVE-2026-3497: Fix incorrect GSS-API error handling; Replace incorrect
     use of sshpkt_disconnect() with ssh_packet_disconnect(), and properly
     initialize some variables (closes: #1130595; thanks, Marc Deslauriers).
openssh (1:10.0p1-7+deb13u3) trixie; urgency=medium
 .
   * Backport minor security fixes from 10.3p1:
     - ssh(1): the -J and equivalent -oProxyJump="..." options now validate
       user and host names for ProxyJump/-J options passed via the
       command-line (no such validation is performed for this option in
       configuration files). This prevents shell injection in situations
       where these were directly exposed to adversarial input, which would
       have been a terrible idea to begin with.
     - CVE-2026-35386: ssh(1): validation of shell metacharacters in user
       names supplied on the command-line was performed too late to prevent
       some situations where they could be expanded from %-tokens in
       ssh_config. For certain configurations, such as those that use a "%u"
       token in a "Match exec" block, an attacker who can control the user
       name passed to ssh(1) could potentially execute arbitrary shell
       commands. Reported by Florian Kohnhäuser (closes: #1132573).
       We continue to recommend against directly exposing ssh(1) and other
       tools' command-lines to untrusted input. Mitigations such as this can
       not be absolute given the variety of shells and user configurations in
       use.
     - CVE-2026-35414: sshd(8): when matching an authorized_keys
       principals="" option against a list of principals in a certificate, an
       incorrect algorithm was used that could allow inappropriate matching
       in cases where a principal name in the certificate contains a comma
       character. Exploitation of the condition requires an authorized_keys
       principals="" option that lists more than one principal *and* a CA
       that will issue a certificate that encodes more than one of these
       principal names separated by a comma (typical CAs strongly constrain
       which principal names they will place in a certificate). This
       condition only applies to user- trusted CA keys in authorized_keys,
       the main certificate authentication path
       (TrustedUserCAKeys/AuthorizedPrincipalsFile) is not affected. Reported
       by Vladimir Tokarev (closes: #1132576).
     - CVE-2026-35385: scp(1): when downloading files as root in legacy (-O)
       mode and without the -p (preserve modes) flag set, scp did not clear
       setuid/setgid bits from downloaded files as one might typically
       expect. This bug dates back to the original Berkeley rcp program.
       Reported by Christos Papakonstantinou of Cantina and Spearbit (closes:
       #1132572).
     - CVE-2026-35387: sshd(8): fix incomplete application of
       PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard
       to ECDSA keys. Previously if one of these directives contains any
       ECDSA algorithm name (say "ecdsa-sha2-nistp384"), then any other ECDSA
       algorithm would be accepted in its place regardless of whether it was
       listed or not.  Reported by Christos Papakonstantinou of Cantina and
       Spearbit (closes: #1132574).
     - CVE-2026-35388: ssh(1): connection multiplexing confirmation
       (requested using "ControlMaster ask/autoask") was not being tested for
       proxy mode multiplexing sessions (i.e. "ssh -O proxy ..."). Reported
       by Michalis Vasileiadis (closes: #1132575).
   * Cherry-pick IPQoS handling updates from upstream:
     - Set default IPQoS for interactive sessions to Expedited Forwarding
       (EF).
     - Deprecate support for IPv4 type-of-service (TOS) IPQoS keywords.
     - Make ssh(1) and sshd(8) set IP QoS (aka IP_TOS, IPV6_TCLASS)
       continually at runtime based on what sessions/channels are open.
     - Correctly set extended type for client-side channels.  Fixes
       interactive vs bulk IPQoS for client->server traffic.
 .
 openssh (1:10.0p1-7+deb13u2) trixie-security; urgency=medium
 .
   * CVE-2026-3497: Fix incorrect GSS-API error handling; Replace incorrect
     use of sshpkt_disconnect() with ssh_packet_disconnect(), and properly
     initialize some variables (closes: #1130595; thanks, Marc Deslauriers).
openssh (1:10.0p1-7+deb13u2) trixie-security; urgency=medium
 .
   * CVE-2026-3497: Fix incorrect GSS-API error handling; Replace incorrect
     use of sshpkt_disconnect() with ssh_packet_disconnect(), and properly
     initialize some variables (closes: #1130595; thanks, Marc Deslauriers).

openssl (3.5.6-1~deb13u1) trixie; urgency=medium
 .
   * Import 3.5.6
openssl (3.5.5-1) unstable; urgency=medium
 .
   * Import 3.5.5
    - CVE-2025-11187 (Improper validation of PBMAC1 parameters in PKCS#12 MAC
      verification)
    - CVE-2025-15467 (Stack buffer overflow in CMS AuthEnvelopedData parsing)
    - CVE-2025-15468 (NULL dereference in SSL_CIPHER_find() function on unknown
      cipher ID)
    - CVE-2025-15469 ("openssl dgst" one-shot codepath silently truncates inputs
      >16MB)
    - CVE-2025-66199 (TLS 1.3 CompressedCertificate excessive memory allocation)
    - CVE-2025-68160 (Heap out-of-bounds write in BIO_f_linebuffer on short
      writes)
    - CVE-2025-69418 (Unauthenticated/unencrypted trailing bytes with low-level
      OCB function calls)
    - CVE-2025-69419 (Out of bounds write in PKCS12_get_friendlyname() UTF-8
      conversion)
    - CVE-2025-69420 (Missing ASN1_TYPE validation in TS_RESP_verify_response()
      function)
    - CVE-2025-69421 (NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex
      function)
    - CVE-2026-22795 (Missing ASN1_TYPE validation in PKCS#12 parsing)
    - CVE-2026-22796 (ASN1_TYPE Type Confusion in the
    - PKCS7_digest_from_attributes() function)
openssl (3.5.5-1~deb13u2) trixie-security; urgency=medium
 .
   * CVE-2026-2673 ("OpenSSL TLS 1.3 server may choose unexpected key agreement
     group") (Closes: #1130650).
   * CVE-2026-28387 ("Potential use-after-free in DANE client code")
   * CVE-2026-28389 ("Possible NULL dereference when processing CMS
     KeyAgreeRecipientInfo")
   * CVE-2026-28390 ("Possible NULL dereference when processing CMS
     KeyTransportRecipient Info")
   * CVE-2026-31789 ("Heap buffer overflow in hexadecimal conversion")
   * CVE-2026-31790 ("Incorrect failure handling in RSA KEM RSASVE
     encapsulation")

orca (48.1-1+deb13u2) trixie; urgency=medium
 .
   * prerm: Remove lightdm wrapper on package removal (closes: #826542)

osdlyrics (0.5.15+dfsg-2+deb13u1) trixie; urgency=medium
 .
   * QA upload.
   * debian/gbp.conf: Added, track the debian/trixie packaging branch.
   * debian/control: Add missing runtime dependency python3-pycurl.
     (Closes: #1133380)

packagekit (1.3.1-1+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Do not allow re-invoking methods on non-new transactions

pdns (4.9.14-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 4.9.14, fixing security issues CVE-2026-33257,
     CVE-2026-33260, CVE-2026-33611, CVE-2026-33610, CVE-2026-33609,
     CVE-2026-33608.
   * d/gbp.conf: setup for trixie
   * d/watch: restrict to 4.x series

pdns-recursor (5.2.9-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 5.2.9, fixing CVE-2026-33257, CVE-2026-33258,
     CVE-2026-33259, CVE-2026-33260, CVE-2026-33261, CVE-2026-33601,
     CVE-2026-33600.

pgbouncer (1.24.1-1+deb13u2) trixie; urgency=medium
 .
   * Security update.
       * Fix CVE-2026-6664: An integer overflow in network packet parsing code
         in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a
         crash. An unauthenticated remote attacker can crash PgBouncer with a
         malformed SCRAM authentication packet.
       * Fix CVE-2026-6665: The SCRAM code in PgBouncer before 1.25.2 did not
         check the return value of strlcat() correctly when building the
         contents of the SCRAM client-final-message. A malicious backend that
         sends a SCRAM server-final-message with a long nonce can trigger a
         stack overflow.
       * Fix CVE-2026-6666: A possible null pointer reference in PgBouncer
         before 1.25.2 could lead to a crash, if a server sends an error
         response without SQLSTATE field.
       * Fix CVE-2026-6667: PgBouncer before 1.25.2 did not perform an
         appropriate authorization check for the KILL_CLIENT admin command. All
         users with access to the administration console (which itself requires
         authorization) could run this command. It would have been correct to
         allow only users listed in the admin_users parameter.

phosh (0.46.0-3+deb13u1) trixie; urgency=medium
 .
   * Backport patches from upstream's 0.46 branch.
     This gets us in sync with upstream's 0.46 branch bringing in
     some Wi-Fi and Cell Broadcast related fixes.

php-league-commonmark (2.7.0-1+deb13u1) trixie; urgency=medium
 .
   * Track debian/trixie
   * Fix DisallowedRawHtml bypass via newline/tab in tag names [CVE-2026-30838]
   * Fix DomainFilteringAdapter hostname boundary bypass [CVE-2026-33347]
   * Document CVE fixed in previous changelog entry

php-phpseclib (2.0.48-3+deb13u3) trixie; urgency=medium
 .
   * ASN1: reduce length of supported OIDs from 4096 bytes to 128 bytes
     [CVE-2024-27355]
php-phpseclib (2.0.48-3+deb13u1) trixie-security; urgency=medium
 .
   * Track trixie branch
   * make unpadding constant time [CVE-2026-32935] (Closes: #1131483)

php-phpseclib3 (3.0.43-2+deb13u3) trixie; urgency=medium
 .
   * ASN1: reduce length of supported OIDs from 4096 bytes to 128 bytes
     [CVE-2024-27355]
php-phpseclib3 (3.0.43-2+deb13u1) trixie-security; urgency=medium
 .
   * make unpadding constant time [CVE-2026-32935] (Closes: #1131482)
   * Track trixie

php8.4 (8.4.16-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream version 8.4.16
    + [CVE-2025-14180]: Fixed GHSA-8xr5-qppj-gvwj (PDO quoting result null
      deref).
    + [CVE-2025-14178]: Fixed GHSA-h96m-rvf9-jgm2 (Heap buffer overflow in
      array_merge()).
    + [CVE-2025-14177]: Fixed GHSA-3237-qqm7-mfv7 (Information Leak of
      Memory in getimagesize).

phpseclib (1.0.23-6+deb13u3) trixie; urgency=medium
 .
   * ASN1: reduce length of supported OIDs from 4096 bytes to 128 bytes
     [CVE-2024-27355]
phpseclib (1.0.23-6+deb13u1) trixie-security; urgency=medium
 .
   * Track trixie branch
   * make unpadding constant time [CVE-2026-32935] (Closes: #1131485)

pillow (11.1.0-5+deb13u2) trixie-security; urgency=medium
 .
   * CVE-2026-40192

postorius (1.3.13-1+deb13u1) trixie-security; urgency=medium
 .
   * Fix XSS in queue for held messages

proftpd-dfsg (1.3.8.c+dfsg-4+deb13u2) trixie; urgency=medium
 .
   * Add patch for CVE-2026-42167 (Closes: #1135119).
     Thanks to Paul Howarth for adaption to 1.3.8c.

prosody (13.0.1-1+deb131u) trixie-security; urgency=medium
 .
   * CVE-2026-43504 fix
   * CVE-2026-43505 fix
   * CVE-2026-43506 fix
   * CVE-2026-43507 fix

pyasn1 (0.6.1-1+deb13u2) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Denial of Service in pyasn1 via Unbounded Recursion (CVE-2026-30922)
     (Closes: #1131371)

pyjwt (2.10.1-2+deb13u1) trixie-security; urgency=medium
 .
   * Team upload
   * Fix CVE-2026-32597: PyJWT did not validate the crit (Critical) Header
     Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit
     array listing extensions that PyJWT does not understand, the library
     accepts the token instead of rejecting it. This violates the MUST
     requirement in the RFC. (Closes: #1130662)

pymupdf (1.25.4+ds1-3+deb13u1) trixie; urgency=medium
 .
   * Backport upstream fix for CVE-2026-3029:
     Improved safety of `pymupdf embed-extract`. This now refuses to write to
     an existing file or outside current directory, unless `-output` or new flag
     `-unsafe` is specified.

python-aiohttp (3.11.16-1+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2025-69223
   * CVE-2025-69224
   * CVE-2025-69225
   * CVE-2025-69226
   * CVE-2025-69227
   * CVE-2025-69228
   * CVE-2025-69229

python-authlib (1.6.0-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload by the Debian LTS team.
   * d/patches/CVE-2025-68158.patch: Add patch to fix CVE-2025-68158.
     - The cache-backed state/request-token storage is not tied to the
       initiating user session, so CSRF is possible for any attacker that has
       a valid state.
   * d/patches/CVE-2025-62706.patch: Add patch to fix CVE-2025-62706.
     - Authlib’s JWE zip=DEF path performs unbounded DEFLATE decompression
       which can lead to a DoS.
   * d/patches/CVE-2025-61920.patch: Add patch to fix CVE-2025-61920.
     - Authlib’s JOSE implementation accepts unbounded JWS/JWT header and
       signature segments which can lead to a DoS during verification.
   * d/patches/CVE-2025-59420.patch: Add patch to fix CVE-2025-59420.
     - Authlib’s JWS verification accepts tokens that declare unknown critical
       header parameters (crit), violating RFC 7515 “must‑understand” semantics.
       An attacker can craft a signed token with a critical header that strict
       verifiers reject but Authlib accepts. In mixed‑language fleets, this
       enables split‑brain verification and can lead to policy bypass, replay,
       or privilege escalation.

python-bottle-sqlite (0.2.0-4+deb13u1) trixie; urgency=medium
 .
   [ IOhannes m zmölnig ]
   * Backport patch for Python-3.11+ (Closes: #1132009)

python-certbot (4.0.0-2+deb13u1) trixie; urgency=medium
 .
   * Import patch to store profile in renewal (Closes: #1125267)

python-ldap (3.4.4-1+deb13u1) trixie; urgency=medium
 .
   * CVE-2025-61911 (Closes: #1117858)
   * CVE-2025-61912 (Closes: #1117859)

python-mapbox-earcut (1.0.3-1+deb13u1) trixie; urgency=medium
 .
   * Drop Multi-Arch: same from binary package (Closes: #1133401)

python-oslo.db (17.2.1-2+deb13u1) trixie; urgency=medium
 .
   * Add patch:
     Add_MariaDB_error_1020_handling_as_DBConsistencyError_subclass_....patch.

python-tornado (6.4.2-3+deb13u2) trixie-security; urgency=medium
 .
   * Backport 87a85bb4de18ab17c360f7cb530274202fd05d4c to fix a
     regression in the fix for CVE-2025-67725, spotted by the
     python-jaeger autopkgtest, with thanks to Thomas Goirand
     in the help tracking this down.

python3-lxc (1:5.0.0-2+deb13u1) trixie; urgency=medium
 .
   * Cherry-pick upstream fix for compatibility with Python 3.13+
     (Closes: #1135733)

python3.13 (3.13.5-2+deb13u2) trixie; urgency=medium
 .
   * CVE-2026-3446
   * CVE-2026-4224
   * CVE-2026-3644
   * CVE-2026-4519
   * CVE-2026-6019 (Closes: #1135116)
   * CVE-2026-6100
python3.13 (3.13.5-2+deb13u1) trixie; urgency=medium
 .
   * CVE-2025-11468 (Closes: #1126787)
   * CVE-2025-12084
   * CVE-2025-13462
   * CVE-2025-13836
   * CVE-2025-13837
   * CVE-2025-6069
   * CVE-2025-6075
   * CVE-2025-8194 (Closes: #1124764)
   * CVE-2025-8291
   * CVE-2025-15282 (Closes: #1126780)
   * CVE-2026-0672 (Closes: #1126762)
   * CVE-2026-0865 (Closes: #1126740)
   * CVE-2026-1299 (Closes: #1126745)
   * CVE-2026-2297

qcoro (0.12.0-1+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * Skip two flaky tests. Closes: #1108055.

qt6-base (6.8.2+dfsg-9+deb13u2) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Backport upstream patches to fix data races in QReadWriteLock
     (Closes: #1122640).
   * Backport a upstream patch to fix data races in QProcessEnvironment
     (Closes: #1123679).

remmina (1.4.39+dfsg-1+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * Add patch to prevent remmina from phoning home (Closes: #1109981, #1123632).

request-tracker5 (5.0.7+dfsg-4+deb13u2) trixie; urgency=medium
 .
   * Set a version for ckeditor when we build it to allow Firefox v148 to
     correctly detect that it needs a work around, see:
     https://bugzilla.mozilla.org/show_bug.cgi?id=2002481
     (Closes: #1129090)

roundcube (1.6.15+dfsg-0+deb13u1) trixie-security; urgency=high
 .
   * New upstream security and bugfix release (closes: #1131182, #1132268).
     + Fix CVE-2026-35537: Pre-auth arbitrary file write via unsafe
       deserialization in redis/memcache session handler.
     + Fix CVE-2026-35538: IMAP Injection + CSRF bypass in mail search.
     + Fix CVE-2026-35539: XSS vulnerability in HTML attachment preview.
     + Fix CVE-2026-35540: SSRF and information disclosure vulnerability via
       stylesheet links pointing to a local network hosts.
     + Fix CVE-2026-35541: A password could get changed without providing the
       old password in some situations.
     + Fix CVE-2026-35542: Remote image blocking bypass via a crafted <body>
       background attribute.
     + Fix CVE-2026-35543: Remote image blocking bypass via various SVG animate
       attributes.
     + Fix CVE-2026-35544: Fixed position mitigation bypass via use of
       `!important`.
     + Fix CVE-2026-35545: SVG animate FUNCIRI attribute bypass (remote image
       loading via fill/filter/stroke).
   * Refresh d/patches.
   * Add custom patch to avoid runtime dependency on mlocati/ip-lib which is
     not present in trixie.
roundcube (1.6.14+dfsg-1) unstable; urgency=high
 .
   * New upstream security and bugfix release (closes: #1131182).
     + Fix pre-auth arbitrary file write via unsafe deserialization in
       redis/memcache session handler.
     + Fix bug where a password could get changed without providing the old
       password.
     + Fix IMAP Injection + CSRF bypass in mail search.
     + Fix remote image blocking bypass via various SVG animate attributes.
     + Fix remote image blocking bypass via a crafted <body> background
       attribute.
     + Fix fixed position mitigation bypass via use of `!important`.
     + Fix XSS vulnerability in HTML attachment preview.
     + Fix SSRF and information disclosure vulnerability via stylesheet links
       pointing to a local network hosts.
   * Refresh d/patches.
   * Cherry-pick upstream changes from 1.7 to fix PHP 8.2 deprecation warning on
     utf8_{encode,decode}() uses.
   * Cherry-pick upstream change from 1.7 to fix PHP 8.4 deprecation warning on
     str_getcsv() use.
   * Cherry-pick upstream regression fix where mail search would fail on
     non-ascii search criteria.
   * Add custom patch to avoid dependency on mlocati/ip-lib, which as of today
     is not present in Debian.
   * phpunit: Pass `--display-deprecations` and `--display-phpunit-deprecations`
     flags.
roundcube (1.6.13+dfsg-1) unstable; urgency=high
 .
   * New upstream security and bugfix release (closes: #1127447).
     + Fix CSS injection vulnerability.
     + Fix remote image blocking bypass via SVG content.
   * Remove an obsolete maintscript entry.
   * Refresh d/patches.
   * d/control: Remove `Rules-Requires-Root: no`.
   * Update Standards-Version to 4.7.3.
     + Remove "Priority: optional" which is the current default and spelling it
       out is no longer recommended per Policy.

rsync (3.4.1+ds1-5+deb13u2) trixie; urgency=medium
 .
   * d/p/syscall_use_openat2...: New patch to fix symlink handling on the
     receiver (closes: #1093160)
   * Add patch for CVE-2026-41035

ruby-rack (3.1.20-0+deb13u1) trixie-security; urgency=high
 .
   * New upstream version 3.1.20.
     - CVE-2026-25500: XSS injection via malicious filename
       in `Rack::Directory`. (Closes: #1128480)
     - CVE-2026-22860: Directory traversal via root prefix
       bypass in `Rack::Directory`. (Closes: #1128479)
ruby-rack (3.1.18-1) unstable; urgency=medium
 .
   * New upstream version 3.1.18.
     - CVE-2025-61772: Multipart parser buffers unbounded per-part headers,
       enabling DoS (memory exhaustion).
     - CVE-2025-61771: Multipart parser buffers large non‑file fields
       entirely in memory, enabling DoS (memory exhaustion).
     - CVE-2025-61770: Unbounded multipart preamble buffering enables DoS
       (memory exhaustion).
     - CVE-2025-61780 Improper handling of headers in Rack::Sendfile may
       allow proxy bypass.
     - CVE-2025-61919 Unbounded read in Rack::Request form parsing can lead
       to memory exhaustion.
     - Closes: #1117855, #1117856, #1117627, #1117628

sed (4.9-2+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * sed: -i --follow-symlinks: fix TOCTOU race (CVE-2026-5958)
     (Closes: #1134495)

simpleeval (1.0.3-1+deb13u1) trixie-security; urgency=high
 .
   * Add 01_CVE-2026-32640.patch (Closes: #1130875)
     This patch fixes CVE-2026-32640
     https://github.com/danthedeckie/simpleeval/pull/171
     with commits
     https://github.com/danthedeckie/simpleeval/commit/9cb4a7b99498c173263bd90f77bc185e160fb6b8
     https://github.com/danthedeckie/simpleeval/commit/1654cbf0219345f707c79664b8657be6b8d23e33
     https://github.com/danthedeckie/simpleeval/commit/cffa9f68cee54404a2ef43d949a8ae8a3311c503

snapd (2.68.3-3+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * data/systemd-tmpfiles: protect the per-snap tmp
   * data: more precise prune pattern for tmpfiles (CVE-2026-3888)
     (Closes: #1131120)

spip (4.4.13+dfsg-0+deb13u1) trixie-security; urgency=medium
 .
   [ Matthieu Marcillaud ]
   * build: Version 4.4.13, fixing privilege escalation introduced in 4.4.10.
 .
   [ David Prévot ]
   * Refresh patches header
spip (4.4.11+dfsg-1) unstable; urgency=medium
 .
   [ Matthieu Marcillaud ]
   * build: Version 4.4.11
 .
   [ David Prévot ]
   * Document CVE fixes in previous changelog entries

starlet (0.31-2+deb13u1) trixie; urgency=medium
 .
   * Add patch from upstream Git to prevent HTTP Smuggling.
     Fixes CVE-2026-40561. (Closes: #1135584)

stayrtr (0.6.2-1+deb13u1) trixie; urgency=medium
 .
   * Backport the upstream commit 0ac8a9abef021cbd45d362135c8fc25174d752f7
     to stop serving stale VRPs when the validator is stuck. (See #1120625.)
   * Use Restart=on-abnormal instead of on-abort.

strongswan (6.0.1-6+deb13u5) trixie-security; urgency=medium
 .
   * d/patches: add fix for integer underflow in libsimaka when handling
     EAP-SIM/AKA attributes (CVE-2026-35330)
   * d/patches: add fix for integer underflow in libradius when handling RADIUS
     attributes (CVE-2026-35333)
   * d/patches: add fix for NULL-pointer dereference in libtls when handling
     ECDH public values (CVE-2026-35332)
   * d/patches: add fix for infinite loop in libtls when handling supported
     versions TLS extension (CVE-2026-35328)
   * d/patches: add fix for NULL-pointer dereference in libstrongswan (pkcs5)
     and the pkcs7 plugin when processing padding in PKCS#7 (CVE-2026-35329)
   * d/patches: add fix for acceptation of authentication certificates
     violating name constraints (CVE-2026-35331)
   * d/patches: add fix for possible NULL-pointer dereference in gmp plugin for
     RSA decryption (CVE-2026-35334)
strongswan (6.0.1-6+deb13u4) trixie-security; urgency=medium
 .
   * d/patch: fix integer overflow in EAP-TTLS plugin (CVE-2026-25075)

sudo (1.9.16p2-3+deb13u2) trixie; urgency=medium
 .
   * cherry-pick upstream exec_mailer-Set-group-as-well-as-uid.
     This is upstream and fixes CVE-2026-35535:
     https://github.com/sudo-project/sudo/commit/3e474c2 (Closes: #1130593)

superqt (0.7.3-1+deb13u1) trixie; urgency=medium
 .
   * Team upload.
 .
   [ Stuart Prescott ]
   * Add patch to skip flaky font metrics test. Closes: #1131249.

suricata (1:7.0.10-1+deb13u4) trixie; urgency=medium
 .
   * Fix CVE-2026-31932 in 7.0.10.
     Cherry-Picked from 4c51a74e2e3a06d352dcac5a720450a392c5c5b2.
   * Fix CVE-2026-31933 in 7.0.10.
     Cherry-Picked from fecaa08f591c508b6486e7e9a2ee05636d1f9503.
   * Fix CVE-2026-31935 in 7.0.10.
     Cherry-Picked from 82b7c9c35aaebf8a2811bdb703dd51c2fa0693c2.
   * Fix CVE-2026-31937 in 7.0.10.
     Cherry-Picked from 281f419c0481f7d24d8ce5482b962673a3938e9b.

swupdate (2024.12.1+dfsg-3+deb13u2) trixie; urgency=medium
 .
   * Apply ustream CVE-2026-28525 patch

sylpheed (3.8.0~beta1-2+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload
   * Add link check to address CVE-2021-37746 (backport from claws-mail)

systemd (257.13-1~deb13u1) trixie; urgency=medium
 .
   [ Luca Boccassi ]
   * preinst: ensure /tmp workaround does not override local unit/fstab
     (Closes: #1116344)
   * preinst: ensure /tmp/ workaround is only attempted on first trixie upgrade
   * Explicitly disable bpf-framework for stage1 builds
 .
   [ Tobias Deiminger ]
   * CVE-2026-40226 (In nspawn in systemd 233 through 259 before 260, an
     escape-to-host act ...)
   * CVE-2026-40225 (In udev in systemd before 260, local root execution can
     occur via mali ...)
   * CVE-2026-29111 (systemd, a system and service manager, (as PID 1) hits an
     assert and f ...)
   * CVE-2026-4105 (A flaw was found in systemd. The systemd-machined service
     contains an  ...)
   * Update upstream source from tag 'upstream/257.13'
     Update to upstream version '257.13'
     with Debian dir 608373bc40f1a965a842a0c61f9d1fb40c3dfc82

systemd-boot-efi-amd64-signed (257.13+1~deb13u1) trixie; urgency=high
 .
   * Sign EFI binaries from systemd-boot-efi 257.13-1~deb13u1
 .
   [ Luca Boccassi ]
   * preinst: ensure /tmp workaround does not override local unit/fstab
     (Closes: #1116344)
   * preinst: ensure /tmp/ workaround is only attempted on first trixie upgrade
   * Explicitly disable bpf-framework for stage1 builds
 .
   [ Tobias Deiminger ]
   * CVE-2026-40226 (In nspawn in systemd 233 through 259 before 260, an
     escape-to-host act ...)
   * CVE-2026-40225 (In udev in systemd before 260, local root execution can
     occur via mali ...)
   * CVE-2026-29111 (systemd, a system and service manager, (as PID 1) hits an
     assert and f ...)
   * CVE-2026-4105 (A flaw was found in systemd. The systemd-machined service
     contains an  ...)
   * Update upstream source from tag 'upstream/257.13'
     Update to upstream version '257.13'
     with Debian dir 608373bc40f1a965a842a0c61f9d1fb40c3dfc82

systemd-boot-efi-arm64-signed (257.13+1~deb13u1) trixie; urgency=high
 .
   * Sign EFI binaries from systemd-boot-efi 257.13-1~deb13u1
 .
   [ Luca Boccassi ]
   * preinst: ensure /tmp workaround does not override local unit/fstab
     (Closes: #1116344)
   * preinst: ensure /tmp/ workaround is only attempted on first trixie upgrade
   * Explicitly disable bpf-framework for stage1 builds
 .
   [ Tobias Deiminger ]
   * CVE-2026-40226 (In nspawn in systemd 233 through 259 before 260, an
     escape-to-host act ...)
   * CVE-2026-40225 (In udev in systemd before 260, local root execution can
     occur via mali ...)
   * CVE-2026-29111 (systemd, a system and service manager, (as PID 1) hits an
     assert and f ...)
   * CVE-2026-4105 (A flaw was found in systemd. The systemd-machined service
     contains an  ...)
   * Update upstream source from tag 'upstream/257.13'
     Update to upstream version '257.13'
     with Debian dir 608373bc40f1a965a842a0c61f9d1fb40c3dfc82

thunderbird (1:140.10.1esr-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security
thunderbird (1:140.10.1esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * Rebuild for bookworm-security
thunderbird (1:140.10.0esr-1) unstable; urgency=medium
 .
   * [00598c1] rebuild patch queue from patch-queue branch
     added patches:
     fixes/Fix-conflicting-types-for-once_flag-and-call_once-with-gl.patch
     fixes/Fix-sandbox-to-build-with-glibc-2.43.patch
     (Closes: #1128876)
   * [b212746] New upstream version 140.10.0esr
     Fixed CVE issues in upstream version 140.10 (MFSA 2026-34):
     CVE-2026-6746: Use-after-free in the DOM: Core & HTML component
     CVE-2026-6747: Use-after-free in the WebRTC component
     CVE-2026-6748: Uninitialized memory in the Audio/Video: Web Codecs
                    component
     CVE-2026-6749: Information disclosure due to uninitialized memory in the
                    Graphics: Canvas2D component
     CVE-2026-6750: Privilege escalation in the Graphics: WebRender component
     CVE-2026-6751: Uninitialized memory in the Audio/Video: Web Codecs
                    component
     CVE-2026-6752: Incorrect boundary conditions in the WebRTC component
     CVE-2026-6753: Incorrect boundary conditions in the WebRTC component
     CVE-2026-6754: Use-after-free in the JavaScript Engine component
     CVE-2026-6757: Invalid pointer in the JavaScript: WebAssembly component
     CVE-2026-6759: Use-after-free in the Widget: Cocoa component
     CVE-2026-6761: Privilege escalation in the Networking component
     CVE-2026-6762: Spoofing issue in the DOM: Core & HTML component
     CVE-2026-6763: Mitigation bypass in the File Handling component
     CVE-2026-6764: Incorrect boundary conditions in the DOM: Device Interfaces
                    component
     CVE-2026-6765: Information disclosure in the Form Autofill component
     CVE-2026-6766: Incorrect boundary conditions in the Libraries component in
                    NSS
     CVE-2026-6767: Other issue in the Libraries component in NSS
     CVE-2026-6769: Privilege escalation in the Debugger component
     CVE-2026-6770: Other issue in the Storage: IndexedDB component
     CVE-2026-6771: Mitigation bypass in the DOM: Security component
     CVE-2026-6772: Incorrect boundary conditions in the Libraries component in
                    NSS
     CVE-2026-6776: Incorrect boundary conditions in the WebRTC: Networking
                    component
     CVE-2026-6785: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR
                    140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird
                    150
     CVE-2026-6786: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird
                    ESR 140.10, Firefox 150 and Thunderbird 150
thunderbird (1:140.10.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security
thunderbird (1:140.10.0esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * Rebuild for bookworm-security
thunderbird (1:140.9.1esr-1) unstable; urgency=medium
 .
   * [49731f6] New upstream version 140.9.1esr
     Fixed CVE issues in upstream version 140.9.1 (MFSA 2026-29):
     CVE-2026-5732: Incorrect boundary conditions, integer overflow in the
                    Graphics: Text component
     CVE-2026-5731: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox
                    ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and
                    Thunderbird 149.0.2
     CVE-2026-5734: Memory safety bugs fixed in Firefox ESR 140.9.1,
                    Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird
                    149.0.2
thunderbird (1:140.9.1esr-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security
thunderbird (1:140.9.1esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * Rebuild for bookworm-security
thunderbird (1:140.9.0esr-1) unstable; urgency=medium
 .
   * [a5389ca] New upstream version 140.9.0esr
     Fixed CVE issues in upstream version 140.9 (MFSA 2026-24):
     CVE-2026-3889: Spoofing issue in Thunderbird
     CVE-2026-4371: Out of bounds read in IMAP parsing
     CVE-2026-4684: Race condition, use-after-free in the Graphics: WebRender
                    component
     CVE-2026-4685: Incorrect boundary conditions in the Graphics: Canvas2D
                    component
     CVE-2026-4686: Incorrect boundary conditions in the Graphics: Canvas2D
                    component
     CVE-2026-4687: Sandbox escape due to incorrect boundary conditions in the
                    Telemetry component
     CVE-2026-4688: Sandbox escape due to use-after-free in the Disability
                    Access APIs component
     CVE-2026-4689: Sandbox escape due to incorrect boundary conditions,
                    integer overflow in the XPCOM component
     CVE-2026-4690: Sandbox escape due to incorrect boundary conditions,
                    integer overflow in the XPCOM component
     CVE-2026-4691: Use-after-free in the CSS Parsing and Computation component
     CVE-2026-4692: Sandbox escape in the Responsive Design Mode component
     CVE-2026-4693: Incorrect boundary conditions in the Audio/Video: Playback
                    component
     CVE-2026-4694: Incorrect boundary conditions, integer overflow in the
                    Graphics component
     CVE-2026-4695: Incorrect boundary conditions in the Audio/Video: Web
                    Codecs component
     CVE-2026-4696: Use-after-free in the Layout: Text and Fonts component
     CVE-2026-4697: Incorrect boundary conditions in the Audio/Video: Web
                    Codecs component
     CVE-2026-4698: JIT miscompilation in the JavaScript Engine: JIT component
     CVE-2026-4699: Incorrect boundary conditions in the Layout: Text and Fonts
                    component
     CVE-2026-4700: Mitigation bypass in the Networking: HTTP component
     CVE-2026-4701: Use-after-free in the JavaScript Engine component
     CVE-2026-4702: JIT miscompilation in the JavaScript Engine component
     CVE-2026-4704: Denial-of-service in the WebRTC: Signaling component
     CVE-2026-4705: Undefined behavior in the WebRTC: Signaling component
     CVE-2026-4706: Incorrect boundary conditions in the Graphics: Canvas2D
                    component
     CVE-2026-4707: Incorrect boundary conditions in the Graphics: Canvas2D
                    component
     CVE-2026-4708: Incorrect boundary conditions in the Graphics component
     CVE-2026-4709: Incorrect boundary conditions in the Audio/Video: GMP
                    component
     CVE-2026-4710: Incorrect boundary conditions in the Audio/Video component
     CVE-2026-4711: Use-after-free in the Widget: Cocoa component
     CVE-2026-4712: Information disclosure in the Widget: Cocoa component
     CVE-2026-4713: Incorrect boundary conditions in the Graphics component
     CVE-2026-4714: Incorrect boundary conditions in the Audio/Video component
     CVE-2026-4715: Uninitialized memory in the Graphics: Canvas2D component
     CVE-2026-4716: Incorrect boundary conditions, uninitialized memory in the
                    JavaScript Engine component
     CVE-2026-4717: Privilege escalation in the Netmonitor component
     CVE-2025-59375: Denial-of-service in the XML component
     CVE-2026-4718: Undefined behavior in the WebRTC: Signaling component
     CVE-2026-4719: Incorrect boundary conditions in the Graphics: Text
                    component
     CVE-2026-4720: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird
                    ESR 140.9, Firefox 149 and Thunderbird 149
     CVE-2026-4721: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR
                    140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird
                    149
thunderbird (1:140.9.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security
thunderbird (1:140.9.0esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * Rebuild for bookworm-security
thunderbird (1:140.8.0esr-1) unstable; urgency=medium
 .
   * [2c79d20] d/source.filter: don't filter out *.orig files
   * [860f180] New upstream version 140.8.0esr
     Fixed CVE issues in upstream version 140.8 (MFSA 2026-17):
     CVE-2026-2757: Incorrect boundary conditions in the WebRTC: Audio/Video
                    component
     CVE-2026-2758: Use-after-free in the JavaScript: GC component
     CVE-2026-2759: Incorrect boundary conditions in the Graphics: ImageLib
                    component
     CVE-2026-2760: Sandbox escape due to incorrect boundary conditions in the
                    Graphics: WebRender component
     CVE-2026-2761: Sandbox escape in the Graphics: WebRender component
     CVE-2026-2762: Integer overflow in the JavaScript: Standard Library
                    component
     CVE-2026-2763: Use-after-free in the JavaScript Engine component
     CVE-2026-2764: JIT miscompilation, use-after-free in the JavaScript
                    Engine: JIT component
     CVE-2026-2765: Use-after-free in the JavaScript Engine component
     CVE-2026-2766: Use-after-free in the JavaScript Engine: JIT component
     CVE-2026-2767: Use-after-free in the JavaScript: WebAssembly component
     CVE-2026-2768: Sandbox escape in the Storage: IndexedDB component
     CVE-2026-2769: Use-after-free in the Storage: IndexedDB component
     CVE-2026-2770: Use-after-free in the DOM: Bindings (WebIDL) component
     CVE-2026-2771: Undefined behavior in the DOM: Core & HTML component
     CVE-2026-2772: Use-after-free in the Audio/Video: Playback component
     CVE-2026-2773: Incorrect boundary conditions in the Web Audio component
     CVE-2026-2774: Integer overflow in the Audio/Video component
     CVE-2026-2775: Mitigation bypass in the DOM: HTML Parser component
     CVE-2026-2776: Sandbox escape due to incorrect boundary conditions in the
                    Telemetry component in External Software
     CVE-2026-2777: Privilege escalation in the Messaging System component
     CVE-2026-2778: Sandbox escape due to incorrect boundary conditions in the
                    DOM: Core & HTML component
     CVE-2026-2779: Incorrect boundary conditions in the Networking: JAR
                    component
     CVE-2026-2780: Privilege escalation in the Netmonitor component
     CVE-2026-2781: Integer overflow in the Libraries component in NSS
     CVE-2026-2782: Privilege escalation in the Netmonitor component
     CVE-2026-2783: Information disclosure due to JIT miscompilation in the
                    JavaScript Engine: JIT component
     CVE-2026-2784: Mitigation bypass in the DOM: Security component
     CVE-2026-2785: Invalid pointer in the JavaScript Engine component
     CVE-2026-2786: Use-after-free in the JavaScript Engine component
     CVE-2026-2787: Use-after-free in the DOM: Window and Location component
     CVE-2026-2788: Incorrect boundary conditions in the Audio/Video: GMP
                    component
     CVE-2026-2789: Use-after-free in the Graphics: ImageLib component
     CVE-2026-2790: Same-origin policy bypass in the Networking: JAR component
     CVE-2026-2791: Mitigation bypass in the Networking: Cache component
     CVE-2026-2792: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird
                    ESR 140.8, Firefox 148 and Thunderbird 148
     CVE-2026-2793: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR
                    140.8, Thunderbird ESR 140.8, Firefox 148 and
                    Thunderbird 148
   * [ff6cabd] d/rules: override dh_clean
   * [eb4c1eb] rebuild patch queue from patch-queue branch
     added patches:
     fixes/Add-missing-.gitmodules-files-which-are-needed-to-build-t.patch
   * [c9b11f8] d/rules: create empty .gitmodules file via dh_auto_configure

tiff (4.7.0-3+deb13u2) trixie-security; urgency=medium
 .
   * CVE-2026-4775 (Closes: #1132632)

toil (8.0.0-5+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * Conditionally skip tests requiring more CPUs than available.
     Closes: #1108056.

tor (0.4.9.8-0+deb13u1) trixie-security; urgency=medium
 .
   * Upload 0.4.9.8 to debian-security, fixing out-of-bound reads among
     other things. Consult the upstream changelog for details.
tor (0.4.9.8-0+deb12u1) bookworm-security; urgency=medium
 .
   * Upload 0.4.9.8 to debian-security, fixing out-of-bound reads among
     other things. Consult the upstream changelog for details.
   * Keep systemd files in /lib (as opposed to /usr/lib)
tor (0.4.9.6-1) unstable; urgency=medium
 .
   * New upstream version.
   * Drop 64b5638b backport patch
tor (0.4.9.6-1~bpo13+1) trixie-backports; urgency=medium
 .
   * Rebuild for trixie-backports.
tor (0.4.9.6-1~bpo12+1) bookworm-backports-sloppy; urgency=medium
 .
   * Rebuild for bookworm-backports-sloppy.
   * Keep systemd files in /lib (as opposed to /usr/lib)
tor (0.4.9.6-0+deb13u1) trixie-security; urgency=medium
 .
   * Upload 0.4.9.x tree to debian-security:  Fixes, among other things:
     - TROVE-2026-004 (memory compare using the wrong length)
     - TROVE-2025-016 (out-of-bounds read error with V1 EXTEND cells)
tor (0.4.9.6-0+deb12u1) bookworm-security; urgency=medium
 .
   * Upload 0.4.9.x tree to debian-security for bookworm/Debian 12/oldstable
     as the 0.4.7 tree is end-of-life.
   * Keep systemd files in /lib (as opposed to /usr/lib)
tor (0.4.9.5-2) unstable; urgency=medium
 .
   * Include 64b5638b from
     https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/990
     to fix issues on big-endian systems (closes: #1128946)
   * tests/setup-onion-service: include onionshare -> onionshare-cli dependency
     change from the debian-main branch, also dropping the unzip dependency.
tor (0.4.9.5-2~bpo13+1) trixie-backports; urgency=medium
 .
   * Rebuild for trixie-backports.
tor (0.4.9.5-2~bpo12+1) bookworm-backports-sloppy; urgency=medium
 .
   * Rebuild for bookworm-backports-sloppy.
   * Keep systemd files in /lib (as opposed to /usr/lib)
tor (0.4.9.5-1) unstable; urgency=medium
 .
   * New upsteam tree.
tor (0.4.8.22-1) unstable; urgency=medium
 .
   * New upstream version.
tor (0.4.8.22-1~bpo13+1) trixie-backports; urgency=medium
 .
   * Rebuild for trixie-backports.
tor (0.4.8.22-1~bpo12+1) bookworm-backports-sloppy; urgency=medium
 .
   * Rebuild for bookworm-backports-sloppy.
   * Keep systemd files in /lib (as opposed to /usr/lib)
tor (0.4.8.21-1) unstable; urgency=medium
 .
   * New upstream version.
tor (0.4.8.21-1~bpo13+2) trixie-backports; urgency=medium
 .
   * Rebuild for trixie-backports.
   * Do *not* move the systemd files to /lib.
tor (0.4.8.21-1~bpo13+1) trixie-backports; urgency=medium
 .
   * Rebuild for trixie-backports.
   * Keep systemd files in /lib (as opposed to /usr/lib)
tor (0.4.8.21-1~bpo12+1) bookworm-backports-sloppy; urgency=medium
 .
   * Rebuild for bookworm-backports-sloppy.
   * Keep systemd files in /lib (as opposed to /usr/lib)

tzdata (2026b-0+deb13u1) trixie; urgency=medium
 .
   * New upstream version 2026b:
     - British Columbia moved to permanent -07 on 2026-03-09, so it will not
       fall back from -07 to -08 on 2026-11-01.
tzdata (2026b-0+deb12u1) bookworm; urgency=medium
 .
   * New upstream version 2026b:
     - No leap second on 2026-06-30
     - Moldova has used EU transition times since 2022
     - British Columbia moved to permanent -07 on 2026-03-09, so it will not
       fall back from -07 to -08 on 2026-11-01.
   * Drop No-leap-second-on-2025-12-31.patch (merged upstream)
tzdata (2026a-3) unstable; urgency=medium
 .
   * Also test leapseconds exiry during build (using changelog timestamp)
tzdata (2026a-2) unstable; urgency=medium
 .
   * Add autopkgtest to check for outdated leap-seconds.list (LP: #2140307)
   * Bump Standards-Version to 4.7.4
tzdata (2026a-1) unstable; urgency=medium
 .
   * New upstream version 2026a:
     - No leap second on 2026-06-30
     - Moldova has used EU transition times since 2022
   * Add autopkgtest test case for 2026a release
   * Bump Standards-Version to 4.7.3 (no changes)

unbound (1.22.0-2+deb13u2) trixie; urgency=medium
 .
   * two patches from upstream to avoid ssl handshake to root NSes:
       1247-forward-first-ssl-handshake-failed-on-root-nameservers.patch
       1247-turn-off-fetch-policy-for-delegation-when.patch
     (Closes: #1129922)

valkey (8.1.1+dfsg1-3+deb13u2) trixie-security; urgency=medium
 .
   * Non-maintainer upload.
   * Fix the following vulnerabilities (Closes: #1130911)
     - CVE-2025-67733: RESP Protocol Injection via Lua error_reply
     - CVE-2026-21863: Remote DoS with malformed Valkey Cluster bus message

vips (8.16.1-1+deb13u1) trixie; urgency=medium
 .
   [ Moritz Mühlenhoff <jmm@debian.org> ]
   * CVE-2026-3283 CVE-2026-3284 (Closes: #1129310)
   * CVE-2026-3282 (Closes: #1129311)
   * CVE-2026-3281 (Closes: #1129312)
   * CVE-2026-3147 (Closes: #1129314)
   * CVE-2026-3145 CVE-2026-3146 (Closes: #1129315)
   * CVE-2026-2913 (Closes: #1128785)

webkit2gtk (2.52.3-2~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security.
   * Re-enable libmanette in i386.
   * Enable the transitional packages.
   * Use clang on armhf since trixie uses clang-19 and is not affected by
     WebKit bug #290167.
   * Add the 'Priority: optional' field.
webkit2gtk (2.52.3-1) unstable; urgency=high
 .
   * New upstream release (Closes: #1134002)
   * Update no-must-tail.patch (Closes: #1134097)
     (thanks, John Paul Adrian Glaubitz).
   * Drop fix-ftbfs-no-skia.patch.
webkit2gtk (2.52.2-2) unstable; urgency=high
 .
   * fix-ftbfs-no-skia.patch:
     - Fix FTBFS on platforms that don't use Skia (like s390x).
webkit2gtk (2.52.2-1) unstable; urgency=high
 .
   * New upstream release (Closes: #1132198) (LP: #2148077).
   * Drop fix-dom-build.patch.
webkit2gtk (2.52.1-1) unstable; urgency=high
 .
   * New upstream release.
   * The WebKitGTK security advisory WSA-2026-0002 lists the following
     security fixes in the latest versions of WebKitGTK:
     - CVE-2026-20643, CVE-2026-20664, CVE-2026-20665,
       CVE-2026-20691, CVE-2026-28857, CVE-2026-28859,
       CVE-2026-28861, CVE-2026-28871 (fixed in 2.52.1).
   * Drop fix-string-cast.patch and fix-swift-build.patch.
   * fix-dom-build.patch:
     - Cherry pick patch to fix the GTK3 build (WebKit bug #310915).
webkit2gtk (2.52.0-1) unstable; urgency=medium
 .
   * New upstream release.
   * Bring all changes from the 2.51 (experimental) branch.
   * Upstream has removed support for soup2 in WebKitGTK 2.51.1, so there
     will be no more backports for bookworm, which will stay with 2.50.x.
     - Remove all references to ccache, we were only using it for bookworm
       backports.
     - Remove all the logic to build 4.0 API (soup2) packages.
     - Replace the 4.0 API debhelper files with the 4.1 versions.
     - Disable libjavascriptcoregtk-bin when not building the 4.0 API
       packages.
   * debian/control.in:
     - Add build dependencies on gir1.2-gobject-2.0-dev,
       gir1.2-soup-3.0-dev and gir1.2-gtk-*-dev.
   * debian/source/lintian-overrides:
     - Update source-is-missing overrides.
   * debian/copyright:
     - Update copyright information of all files.
   * debian/libwebkit2gtk-4.1-0.symbols:
     - Update symbols.
   * debian/rules:
     - No need to use -DENABLE_MINIBROWSER=ON any more, this is on by
       default (see WebKit bug #240515)
     - Build always the 4.0 API / GTK3 version of the WebDriver. This is
       what were already doing in practice, so it just simplifies the rules
       file.
     - Remove the GTK*_BUILD_DEP variables and make those build
       dependencies unconditional.
     - Fix usage of the ENABLE_DOCUMENTATION setting.
     - Add setting (and patch) to enable building the Swift demo (for
       testing purposes only, disabled by default).
   * debian/patches/fix-string-cast.patch:
     - Fix build failure.
webkit2gtk (2.51.93-1) experimental; urgency=medium
 .
   * New upstream development release.
   * Remove build dependency on gcc-14 and all other references to
     mips64el, as it has been removed from Debian (see #1129516).
webkit2gtk (2.51.92-1) experimental; urgency=medium
 .
   * New upstream development release.
   * debian/rules:
     - Use --param ggc-min-expand=10 on hurd-i386 and x32 to reduce memory
       usage.
   * debian/patches/no-must-tail.patch:
     - Update patch to cover alpha and hppa (see #1127874).
   * debian/copyright:
     - Update copyright information of all files.
   * debian/control:
     - Remove "Priority: optional" field, this is now redundant (Debian
       policy 4.7.3).
     - Update Standards-Version to 4.7.3.
webkit2gtk (2.51.91-1) experimental; urgency=medium
 .
   * New upstream development release.
   * debian/rules:
     - Use --param ggc-min-expand=10 on powerpc.
   * Refresh all patches.
     - Drop fix-system-malloc.patch.
webkit2gtk (2.51.90-1) experimental; urgency=medium
 .
   * New upstream development release.
   * debian/rules:
     - Disable native SIMD on Ubuntu (Jeremy Bícha).
     - Build with -no-integrated-cpp to further reduce memory usage on some
       32-bit architectures (#1125347).
     - Use gcc on armhf instead of clang-19 (#1124051).
     - Use --param ggc-min-expand=10 on armhf to reduce memory usage even
       more.
     - Add setting (and patch) to enable building the Swift demo (for
       testing purposes only, disabled by default).
   * debian/patches/no-must-tail.patch:
     - Disable musttail on sh4 and m68k (#1125380).
   * debian/patches/fix-system-malloc.patch:
     - Fix i386 build due to undefined value.
   * debian/copyright:
     - Update copyright information of all files.
   * debian/libwebkit2gtk-4.1-0.symbols:
     - Update symbols.
webkit2gtk (2.51.4-1) experimental; urgency=medium
 .
   * New upstream development release.
   * debian/copyright:
     - Update copyright information of all files.
   * Restore the Hurd build (#1122189).
   * debian/source/lintian-overrides:
     - Update source-is-missing overrides.
   * debian/control.in:
     - Build depend on libxml2-utils. glib-compile-resources uses xmllint
       (Jeremy Bícha).
webkit2gtk (2.51.3-1) experimental; urgency=medium
 .
   [ Alberto Garcia ]
   * New upstream development release.
   * debian/copyright:
     - Update copyright information of all files.
   * debian/patches/fix-string-cast.patch:
     - Fix build failure.
   * debian/libwebkit2gtk-4.1-0.symbols:
     - Update symbols.
 .
   [ Jeremy Bicha ]
   * debian/control.in:
     - Stop suggesting devhelp, it's going to be removed from Debian.
webkit2gtk (2.51.2-1) experimental; urgency=medium
 .
   * New upstream development release.
   * debian/rules:
     - No need to use -DENABLE_MINIBROWSER=ON any more, this is on by
       default (see WebKit bug #240515)
     - Build always the 4.0 API / GTK3 version of the WebDriver. This is
       what were already doing in practice, so it just simplifies the rules
       file.
     - Remove the GTK*_BUILD_DEP variables and make those build
       dependencies unconditional.
     - Fix usage of the ENABLE_DOCUMENTATION setting.
   * Use clang-19 on armhf since the build fails with versions 20 and 21
     (WebKit bug #290167).
   * debian/libwebkit2gtk-4.1-0.symbols:
     - Update symbols.
webkit2gtk (2.51.1-1) experimental; urgency=medium
 .
   * New upstream development release.
   * debian/libwebkit2gtk-4.0-37.symbols:
     - Update symbols.
   * debian/copyright:
     - Update copyright information of all files.
   * debian/source/lintian-overrides:
     - Update source-is-missing overrides.
   * debian/watch, debian/gbp.conf:
     - Branch for 2.51.x in experimental.
   * As of 2.50.0, WebKitGTK no longer depends on GstTranscoder (WebKit bug
     #295985).
     - debian/control.in: Remove build dependency on
       libgstreamer-plugins-bad1.0-dev.
     - debian/rules: Don't use -DUSE_GSTREAMER_TRANSCODER=OFF in Ubuntu.
   * debian/control.in:
     - Drop build dependency on libgirepository1.0-dev (see #1118932).
     - Add build dependencies on gir1.2-gobject-2.0-dev,
       gir1.2-soup-3.0-dev and gir1.2-gtk-*-dev (via debian/rules).
     - Remove Rules-Requires-Root: no, as this is the default value since
       dpkg 1.22.13 (fixes redundant-rules-requires-root-no-field).
   * Upstream has removed support for soup2 in WebKitGTK 2.51.1, so there
     will be no more backports for bookworm, which will stay with 2.50.x.
     - Remove all references to ccache, we were only using it for bookworm
       backports.
     - Remove all the logic to build 4.0 API (soup2) packages.
     - Replace the 4.0 API debhelper files with the 4.1 versions.
     - Disable libjavascriptcoregtk-bin when not building the 4.0 API
       packages.
webkit2gtk (2.50.6-1) unstable; urgency=medium
 .
   * New upstream release.
   * debian/rules:
     - Use --param ggc-min-expand=10 on hurd-i386 and x32 to reduce memory
       usage.
   * debian/patches/no-must-tail.patch:
     - Update patch to cover alpha and hppa (Closes: #1127874).
   * Remove all references to mips64el as it has been removed from Debian
     (see #1129516).
webkit2gtk (2.50.6-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security.
   * Re-enable libmanette in i386.
   * Enable the transitional packages.
   * Don't override the clang compiler on armhf since trixie already uses
     clang-19 by default.
   * Add the 'Priority: optional' field.
webkit2gtk (2.50.6-1~deb12u1) bookworm-security; urgency=medium
 .
   * Rebuild for bookworm-security.
   * Disable sysprof profiling integration to avoid new dependencies:
     - debian/control.in: Don't depend on libsysprof-capture-4-dev.
     - debian/rules: Build with -DUSE_SYSPROF_CAPTURE=OFF.
   * Disable JPEG XL to avoid adding new dependencies.
     - debian/control.in: Remove build dependency on libjxl-dev.
     - debian/rules: Build with -DUSE_JPEGXL=OFF.
   * debian/rules:
     - Enable ENABLE_SOUP2 and USE_OLD_PKG_NAMES to keep using the old
       package names.
     - Re-enable libmanette in i386.
     - Use CLoop and disable the JIT on i386, for compatibility with
       non-SSE2 CPUs.
   * debian/patches/dont-detect-sse2.patch:
     - Disable SSE2 on i386 (Closes: #1126591).
   * debian/control-common.in:
     - Make the -dev packages depend on the gir packages.
   * debian/control.in:
     - Build depend on ccache.
   * Use clang-16 instead of clang.
   * debian/patches/fix-minibrowser.patch:
     - Fix the MiniBrowser with clang-16.
webkit2gtk (2.50.5-1) unstable; urgency=medium
 .
   * New upstream release.
   * debian/control.in:
     - Build depend on libxml2-utils. glib-compile-resources uses xmllint
       (Jeremy Bícha).
     - Remove "Priority: optional" field, this is now redundant (Debian
       policy 4.7.3).
     - Update Standards-Version to 4.7.3.
   * debian/rules:
     - Disable native SIMD on Ubuntu (LP: #2121516) (Jeremy Bícha).
     - Build with -no-integrated-cpp to further reduce memory usage on some
       32-bit architectures (Closes: #1125347).
     - Use gcc on armhf instead of clang-19 (Closes: #1124051)
       (LP: #2103459).
     - Use --param ggc-min-expand=10 on armhf and powerpc to reduce memory
       usage even more.
   * debian/patches/no-must-tail.patch:
     - Disable musttail on sh4 and m68k (Closes: #1125380).
   * Update copyright years.
webkit2gtk (2.50.4-1) unstable; urgency=medium
 .
   [ Alberto Garcia ]
   * New upstream release.
   * debian/copyright:
     - Update copyright information of all files.
 .
   [ Samuel Thibault ]
   * control, rules: Restore building on hurd-any (Closes: #1122189).
   * debian/libwebkit2gtk-4.0-37.symbols: Fix list for hurd-any.

wireshark (4.4.15-0+deb13u1) trixie-security; urgency=medium
 .
   * Team upload.
   * New upstream version 4.4.15 (Closes: #1135323)
     - CVE-2026-7379: Memory leak in sharkd, allows DoS
     - CVE-2026-7378: Crash in sharkd, allows DoS
     - CVE-2026-7376: Crash in sharkd, allows DoS
     - CVE-2026-7375: UDS Infinite loop, allows DoS
     - CVE-2026-6870: GSM dissector crash leading to DoS
     - CVE-2026-6869: WebSocket dissector crash leading to DoS
     - CVE-2026-6868: HTTP dissector crash leading to DoS
     - CVE-2026-6867: SMB2 dissector crash leading to DoS
     - CVE-2026-6538: BEEP dissector crash leading to DoS
     - CVE-2026-6537: ZigBee dissector crash leading to DoS
     - CVE-2026-6535: zlib crash in Wireshark, allows DoS
     - CVE-2026-6534: USB infinite loop, allows DoS
     - CVE-2026-6533: LZ77 crash in Wireshark, allows DoS
     - CVE-2026-6532: Kismet crash in Wireshark, allows DoS
     - CVE-2026-6531: SANE Infinite loop, allows DoS
     - CVE-2026-6530: DCP-ETSI crash in Wireshark, allows DoS
     - CVE-2026-6529: iLBC crash in Wireshark, allows DoS
     - CVE-2026-6527: ASN.1 crash in Wireshark, allows DoS
     - CVE-2026-6524: MySQL crash in Wireshark, allows DoS
     - CVE-2026-6523: GNW Infinite loop, allows DoS
     - CVE-2026-6522: RPKI-Router Infinite loop, allows DoS
     - CVE-2026-6521: OpenFlow v5 Infinite loop, allows DoS
     - CVE-2026-6520: OpenFlow v6 Infinite loop, allows DoS
     - CVE-2026-6519: MBIM Infinite loop, allows DoS
     - CVE-2026-5657: iLBC crash in Wireshark, allows DoS
     - CVE-2026-5656: Profile import path traversal DoS/RCE
     - CVE-2026-5654: AMR-NB crash in Wireshark, allows DoS
     - CVE-2026-5653: DCP-ETSI crash in Wireshark, allows DoS
     - CVE-2026-5409: Monero crash in Wireshark, allows DoS
     - CVE-2026-5408: BT-DHT crash in Wireshark, allows DoS
     - CVE-2026-5407: SMB2 Infinite loop, allows DoS
     - CVE-2026-5406: FC-SWILS crash in Wireshark, allows DoS
     - CVE-2026-5405: RDP crash in Wireshark, allows DoS/RCE
     - CVE-2026-5404: K12 RF5 parser crash DoS, allows DoS
     - CVE-2026-5403: SBC crash in Wireshark, allows DoS/RCE
     - CVE-2026-5401: AFP Spotlight crash in Wireshark, allows DoS
     - CVE-2026-5299: ICMPv6 PvD crash in Wireshark, allows DoS
   * d/gbp.conf: Update to trixie
   * d/libwsutil16.symbols: Update symbols to reflect upstream
   * d/libwireshark18.symbols: Update symbols to reflect upstream
   * d/watch: Restrict to 4.4.x releases

xdg-dbus-proxy (0.1.6-1+deb13u1) trixie-security; urgency=high
 .
   * d/gbp.conf: Configure for trixie
   * d/p/Improve-detection-of-eavesdrop-true.patch:
     Fix detection of eavesdrop=true match rules, resolving a vulnerability
     in which a malicious or compromised Flatpak app could monitor D-Bus
     traffic that it was not intended to be able to access.
     (CVE-2026-34080) (Closes: #1132939)

xorg-server (2:21.1.16-1.3+deb13u2) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * xkb: fix buffer re-use in _XkbSetCompatMap (CVE-2026-33999)
   * xkb: Fix bounds check in _CheckSetGeom() (CVE-2026-34000)
   * miext/sync: Fix use-after-free in miSyncTriggerFence() (CVE-2026-34001)
   * xkb: Fix out-of-bounds read in CheckModifierMap() (CVE-2026-34002)
   * xkb: Add additional bound checking in CheckKeyTypes() (CVE-2026-34003)
   * xkb: Add more _XkbCheckRequestBounds() (CVE-2026-34003)
=======================================
Sat, 14 Mar 2026 - Debian 13.4 released
=======================================
=========================================================================
[Date: Sat, 14 Mar 2026 09:32:58 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

btrfs-modules-6.12.57+deb13-s390x-di |  6.12.57-1 | s390x
btrfs-modules-6.12.69+deb13-s390x-di |  6.12.69-1 | s390x
cdrom-core-modules-6.12.57+deb13-s390x-di |  6.12.57-1 | s390x
cdrom-core-modules-6.12.69+deb13-s390x-di |  6.12.69-1 | s390x
crypto-dm-modules-6.12.57+deb13-s390x-di |  6.12.57-1 | s390x
crypto-dm-modules-6.12.69+deb13-s390x-di |  6.12.69-1 | s390x
crypto-modules-6.12.57+deb13-s390x-di |  6.12.57-1 | s390x
crypto-modules-6.12.69+deb13-s390x-di |  6.12.69-1 | s390x
dasd-extra-modules-6.12.57+deb13-s390x-di |  6.12.57-1 | s390x
dasd-extra-modules-6.12.69+deb13-s390x-di |  6.12.69-1 | s390x
dasd-modules-6.12.57+deb13-s390x-di |  6.12.57-1 | s390x
dasd-modules-6.12.69+deb13-s390x-di |  6.12.69-1 | s390x
ext4-modules-6.12.57+deb13-s390x-di |  6.12.57-1 | s390x
ext4-modules-6.12.69+deb13-s390x-di |  6.12.69-1 | s390x
f2fs-modules-6.12.57+deb13-s390x-di |  6.12.57-1 | s390x
f2fs-modules-6.12.69+deb13-s390x-di |  6.12.69-1 | s390x
fat-modules-6.12.57+deb13-s390x-di |  6.12.57-1 | s390x
fat-modules-6.12.69+deb13-s390x-di |  6.12.69-1 | s390x
isofs-modules-6.12.57+deb13-s390x-di |  6.12.57-1 | s390x
isofs-modules-6.12.69+deb13-s390x-di |  6.12.69-1 | s390x
kernel-image-6.12.57+deb13-s390x-di |  6.12.57-1 | s390x
kernel-image-6.12.69+deb13-s390x-di |  6.12.69-1 | s390x
linux-headers-6.12.57+deb13-s390x |  6.12.57-1 | s390x
linux-headers-6.12.69+deb13-s390x |  6.12.69-1 | s390x
linux-image-6.12.57+deb13-s390x |  6.12.57-1 | s390x
linux-image-6.12.57+deb13-s390x-dbg |  6.12.57-1 | s390x
linux-image-6.12.69+deb13-s390x |  6.12.69-1 | s390x
linux-image-6.12.69+deb13-s390x-dbg |  6.12.69-1 | s390x
loop-modules-6.12.57+deb13-s390x-di |  6.12.57-1 | s390x
loop-modules-6.12.69+deb13-s390x-di |  6.12.69-1 | s390x
md-modules-6.12.57+deb13-s390x-di |  6.12.57-1 | s390x
md-modules-6.12.69+deb13-s390x-di |  6.12.69-1 | s390x
mtd-core-modules-6.12.57+deb13-s390x-di |  6.12.57-1 | s390x
mtd-core-modules-6.12.69+deb13-s390x-di |  6.12.69-1 | s390x
multipath-modules-6.12.57+deb13-s390x-di |  6.12.57-1 | s390x
multipath-modules-6.12.69+deb13-s390x-di |  6.12.69-1 | s390x
nbd-modules-6.12.57+deb13-s390x-di |  6.12.57-1 | s390x
nbd-modules-6.12.69+deb13-s390x-di |  6.12.69-1 | s390x
nic-modules-6.12.57+deb13-s390x-di |  6.12.57-1 | s390x
nic-modules-6.12.69+deb13-s390x-di |  6.12.69-1 | s390x
scsi-core-modules-6.12.57+deb13-s390x-di |  6.12.57-1 | s390x
scsi-core-modules-6.12.69+deb13-s390x-di |  6.12.69-1 | s390x
scsi-modules-6.12.57+deb13-s390x-di |  6.12.57-1 | s390x
scsi-modules-6.12.69+deb13-s390x-di |  6.12.69-1 | s390x
udf-modules-6.12.57+deb13-s390x-di |  6.12.57-1 | s390x
udf-modules-6.12.69+deb13-s390x-di |  6.12.69-1 | s390x
xfs-modules-6.12.57+deb13-s390x-di |  6.12.57-1 | s390x
xfs-modules-6.12.69+deb13-s390x-di |  6.12.69-1 | s390x

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 14 Mar 2026 09:33:13 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

ata-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
ata-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
btrfs-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
btrfs-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
cdrom-core-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
cdrom-core-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
crypto-dm-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
crypto-dm-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
crypto-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
crypto-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
drm-core-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
drm-core-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
ext4-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
ext4-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
f2fs-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
f2fs-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
fat-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
fat-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
fb-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
fb-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
input-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
input-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
isofs-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
isofs-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
jfs-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
jfs-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
kernel-image-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
kernel-image-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
linux-headers-6.12.57+deb13-riscv64 |  6.12.57-1 | riscv64
linux-headers-6.12.69+deb13-riscv64 |  6.12.69-1 | riscv64
linux-image-6.12.57+deb13-riscv64 |  6.12.57-1 | riscv64
linux-image-6.12.57+deb13-riscv64-dbg |  6.12.57-1 | riscv64
linux-image-6.12.69+deb13-riscv64 |  6.12.69-1 | riscv64
linux-image-6.12.69+deb13-riscv64-dbg |  6.12.69-1 | riscv64
loop-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
loop-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
md-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
md-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
mmc-core-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
mmc-core-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
mmc-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
mmc-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
mtd-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
mtd-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
multipath-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
multipath-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
nbd-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
nbd-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
nic-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
nic-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
nic-shared-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
nic-shared-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
nic-usb-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
nic-usb-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
nic-wireless-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
nic-wireless-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
pata-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
pata-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
ppp-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
ppp-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
sata-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
sata-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
scsi-core-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
scsi-core-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
scsi-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
scsi-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
scsi-nic-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
scsi-nic-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
squashfs-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
squashfs-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
udf-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
udf-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
usb-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
usb-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
usb-serial-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
usb-serial-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
usb-storage-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
usb-storage-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64
xfs-modules-6.12.57+deb13-riscv64-di |  6.12.57-1 | riscv64
xfs-modules-6.12.69+deb13-riscv64-di |  6.12.69-1 | riscv64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 14 Mar 2026 09:33:28 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

linux-headers-6.12.57+deb13-amd64 |  6.12.57-1 | amd64
linux-headers-6.12.57+deb13-cloud-amd64 |  6.12.57-1 | amd64
linux-headers-6.12.57+deb13-rt-amd64 |  6.12.57-1 | amd64
linux-headers-6.12.69+deb13-amd64 |  6.12.69-1 | amd64
linux-headers-6.12.69+deb13-cloud-amd64 |  6.12.69-1 | amd64
linux-headers-6.12.69+deb13-rt-amd64 |  6.12.69-1 | amd64
linux-image-6.12.57+deb13-amd64-dbg |  6.12.57-1 | amd64
linux-image-6.12.57+deb13-amd64-unsigned |  6.12.57-1 | amd64
linux-image-6.12.57+deb13-cloud-amd64-dbg |  6.12.57-1 | amd64
linux-image-6.12.57+deb13-cloud-amd64-unsigned |  6.12.57-1 | amd64
linux-image-6.12.57+deb13-rt-amd64-dbg |  6.12.57-1 | amd64
linux-image-6.12.57+deb13-rt-amd64-unsigned |  6.12.57-1 | amd64
linux-image-6.12.69+deb13-amd64-dbg |  6.12.69-1 | amd64
linux-image-6.12.69+deb13-amd64-unsigned |  6.12.69-1 | amd64
linux-image-6.12.69+deb13-cloud-amd64-dbg |  6.12.69-1 | amd64
linux-image-6.12.69+deb13-cloud-amd64-unsigned |  6.12.69-1 | amd64
linux-image-6.12.69+deb13-rt-amd64-dbg |  6.12.69-1 | amd64
linux-image-6.12.69+deb13-rt-amd64-unsigned |  6.12.69-1 | amd64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 14 Mar 2026 09:33:56 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

linux-kbuild-6.12.57+deb13 |  6.12.57-1 | amd64, arm64, armel, armhf, i386, ppc64el, riscv64, s390x
linux-kbuild-6.12.69+deb13 |  6.12.69-1 | amd64, arm64, armel, armhf, i386, ppc64el, riscv64, s390x

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 14 Mar 2026 09:34:11 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

linux-headers-6.12.57+deb13-arm64 |  6.12.57-1 | arm64
linux-headers-6.12.57+deb13-arm64-16k |  6.12.57-1 | arm64
linux-headers-6.12.57+deb13-cloud-arm64 |  6.12.57-1 | arm64
linux-headers-6.12.57+deb13-rt-arm64 |  6.12.57-1 | arm64
linux-headers-6.12.69+deb13-arm64 |  6.12.69-1 | arm64
linux-headers-6.12.69+deb13-arm64-16k |  6.12.69-1 | arm64
linux-headers-6.12.69+deb13-cloud-arm64 |  6.12.69-1 | arm64
linux-headers-6.12.69+deb13-rt-arm64 |  6.12.69-1 | arm64
linux-image-6.12.57+deb13-arm64-16k-dbg |  6.12.57-1 | arm64
linux-image-6.12.57+deb13-arm64-16k-unsigned |  6.12.57-1 | arm64
linux-image-6.12.57+deb13-arm64-dbg |  6.12.57-1 | arm64
linux-image-6.12.57+deb13-arm64-unsigned |  6.12.57-1 | arm64
linux-image-6.12.57+deb13-cloud-arm64-dbg |  6.12.57-1 | arm64
linux-image-6.12.57+deb13-cloud-arm64-unsigned |  6.12.57-1 | arm64
linux-image-6.12.57+deb13-rt-arm64-dbg |  6.12.57-1 | arm64
linux-image-6.12.57+deb13-rt-arm64-unsigned |  6.12.57-1 | arm64
linux-image-6.12.69+deb13-arm64-16k-dbg |  6.12.69-1 | arm64
linux-image-6.12.69+deb13-arm64-16k-unsigned |  6.12.69-1 | arm64
linux-image-6.12.69+deb13-arm64-dbg |  6.12.69-1 | arm64
linux-image-6.12.69+deb13-arm64-unsigned |  6.12.69-1 | arm64
linux-image-6.12.69+deb13-cloud-arm64-dbg |  6.12.69-1 | arm64
linux-image-6.12.69+deb13-cloud-arm64-unsigned |  6.12.69-1 | arm64
linux-image-6.12.69+deb13-rt-arm64-dbg |  6.12.69-1 | arm64
linux-image-6.12.69+deb13-rt-arm64-unsigned |  6.12.69-1 | arm64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 14 Mar 2026 09:34:20 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

linux-headers-6.12.57+deb13-rpi |  6.12.57-1 | armel
linux-headers-6.12.69+deb13-rpi |  6.12.69-1 | armel
linux-image-6.12.57+deb13-rpi |  6.12.57-1 | armel
linux-image-6.12.57+deb13-rpi-dbg |  6.12.57-1 | armel
linux-image-6.12.69+deb13-rpi |  6.12.69-1 | armel
linux-image-6.12.69+deb13-rpi-dbg |  6.12.69-1 | armel

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 14 Mar 2026 09:34:38 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

ata-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
ata-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
btrfs-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
btrfs-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
cdrom-core-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
cdrom-core-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
crypto-dm-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
crypto-dm-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
crypto-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
crypto-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
drm-core-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
drm-core-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
ext4-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
ext4-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
f2fs-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
f2fs-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
fat-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
fat-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
fb-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
fb-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
input-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
input-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
isofs-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
isofs-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
jfs-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
jfs-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
kernel-image-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
kernel-image-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
linux-headers-6.12.57+deb13-armmp |  6.12.57-1 | armhf
linux-headers-6.12.57+deb13-armmp-lpae |  6.12.57-1 | armhf
linux-headers-6.12.57+deb13-rt-armmp |  6.12.57-1 | armhf
linux-headers-6.12.69+deb13-armmp |  6.12.69-1 | armhf
linux-headers-6.12.69+deb13-armmp-lpae |  6.12.69-1 | armhf
linux-headers-6.12.69+deb13-rt-armmp |  6.12.69-1 | armhf
linux-image-6.12.57+deb13-armmp |  6.12.57-1 | armhf
linux-image-6.12.57+deb13-armmp-dbg |  6.12.57-1 | armhf
linux-image-6.12.57+deb13-armmp-lpae |  6.12.57-1 | armhf
linux-image-6.12.57+deb13-armmp-lpae-dbg |  6.12.57-1 | armhf
linux-image-6.12.57+deb13-rt-armmp |  6.12.57-1 | armhf
linux-image-6.12.57+deb13-rt-armmp-dbg |  6.12.57-1 | armhf
linux-image-6.12.69+deb13-armmp |  6.12.69-1 | armhf
linux-image-6.12.69+deb13-armmp-dbg |  6.12.69-1 | armhf
linux-image-6.12.69+deb13-armmp-lpae |  6.12.69-1 | armhf
linux-image-6.12.69+deb13-armmp-lpae-dbg |  6.12.69-1 | armhf
linux-image-6.12.69+deb13-rt-armmp |  6.12.69-1 | armhf
linux-image-6.12.69+deb13-rt-armmp-dbg |  6.12.69-1 | armhf
loop-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
loop-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
md-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
md-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
mmc-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
mmc-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
mtd-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
mtd-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
multipath-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
multipath-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
nbd-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
nbd-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
nic-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
nic-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
nic-shared-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
nic-shared-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
nic-usb-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
nic-usb-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
nic-wireless-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
nic-wireless-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
pata-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
pata-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
ppp-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
ppp-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
sata-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
sata-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
scsi-core-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
scsi-core-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
scsi-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
scsi-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
scsi-nic-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
scsi-nic-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
sound-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
sound-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
speakup-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
speakup-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
squashfs-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
squashfs-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
udf-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
udf-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
uinput-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
uinput-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
usb-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
usb-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
usb-serial-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
usb-serial-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf
usb-storage-modules-6.12.57+deb13-armmp-di |  6.12.57-1 | armhf
usb-storage-modules-6.12.69+deb13-armmp-di |  6.12.69-1 | armhf

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 14 Mar 2026 09:34:48 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

ata-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
ata-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
btrfs-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
btrfs-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
cdrom-core-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
cdrom-core-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
crypto-dm-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
crypto-dm-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
crypto-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
crypto-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
drm-core-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
drm-core-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
ext4-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
ext4-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
f2fs-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
f2fs-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
fat-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
fat-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
fb-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
fb-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
firewire-core-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
firewire-core-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
hypervisor-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
hypervisor-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
input-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
input-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
isofs-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
isofs-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
jfs-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
jfs-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
kernel-image-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
kernel-image-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
linux-headers-6.12.57+deb13-powerpc64le |  6.12.57-1 | ppc64el
linux-headers-6.12.57+deb13-powerpc64le-64k |  6.12.57-1 | ppc64el
linux-headers-6.12.69+deb13-powerpc64le |  6.12.69-1 | ppc64el
linux-headers-6.12.69+deb13-powerpc64le-64k |  6.12.69-1 | ppc64el
linux-image-6.12.57+deb13-powerpc64le |  6.12.57-1 | ppc64el
linux-image-6.12.57+deb13-powerpc64le-64k |  6.12.57-1 | ppc64el
linux-image-6.12.57+deb13-powerpc64le-64k-dbg |  6.12.57-1 | ppc64el
linux-image-6.12.57+deb13-powerpc64le-dbg |  6.12.57-1 | ppc64el
linux-image-6.12.69+deb13-powerpc64le |  6.12.69-1 | ppc64el
linux-image-6.12.69+deb13-powerpc64le-64k |  6.12.69-1 | ppc64el
linux-image-6.12.69+deb13-powerpc64le-64k-dbg |  6.12.69-1 | ppc64el
linux-image-6.12.69+deb13-powerpc64le-dbg |  6.12.69-1 | ppc64el
loop-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
loop-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
md-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
md-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
mtd-core-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
mtd-core-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
multipath-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
multipath-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
nbd-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
nbd-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
nic-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
nic-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
nic-shared-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
nic-shared-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
nic-usb-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
nic-usb-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
nic-wireless-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
nic-wireless-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
ppp-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
ppp-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
sata-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
sata-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
scsi-core-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
scsi-core-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
scsi-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
scsi-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
scsi-nic-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
scsi-nic-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
serial-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
serial-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
squashfs-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
squashfs-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
udf-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
udf-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
uinput-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
uinput-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
usb-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
usb-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
usb-serial-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
usb-serial-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
usb-storage-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
usb-storage-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el
xfs-modules-6.12.57+deb13-powerpc64le-di |  6.12.57-1 | ppc64el
xfs-modules-6.12.69+deb13-powerpc64le-di |  6.12.69-1 | ppc64el

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 14 Mar 2026 09:34:58 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

ata-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
ata-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
btrfs-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
btrfs-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
cdrom-core-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
cdrom-core-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
crypto-dm-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
crypto-dm-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
crypto-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
crypto-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
drm-core-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
drm-core-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
ext4-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
ext4-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
f2fs-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
f2fs-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
fat-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
fat-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
fb-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
fb-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
firewire-core-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
firewire-core-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
input-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
input-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
isofs-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
isofs-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
jfs-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
jfs-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
kernel-image-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
kernel-image-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
linux-image-6.12.57+deb13-amd64 |  6.12.57-1 | amd64
linux-image-6.12.57+deb13-cloud-amd64 |  6.12.57-1 | amd64
linux-image-6.12.57+deb13-rt-amd64 |  6.12.57-1 | amd64
linux-image-6.12.69+deb13-amd64 |  6.12.69-1 | amd64
linux-image-6.12.69+deb13-cloud-amd64 |  6.12.69-1 | amd64
linux-image-6.12.69+deb13-rt-amd64 |  6.12.69-1 | amd64
loop-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
loop-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
md-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
md-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
mmc-core-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
mmc-core-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
mmc-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
mmc-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
mtd-core-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
mtd-core-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
multipath-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
multipath-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
nbd-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
nbd-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
nic-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
nic-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
nic-pcmcia-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
nic-pcmcia-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
nic-shared-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
nic-shared-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
nic-usb-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
nic-usb-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
nic-wireless-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
nic-wireless-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
pata-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
pata-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
pcmcia-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
pcmcia-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
pcmcia-storage-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
pcmcia-storage-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
ppp-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
ppp-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
rfkill-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
rfkill-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
sata-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
sata-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
scsi-core-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
scsi-core-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
scsi-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
scsi-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
scsi-nic-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
scsi-nic-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
serial-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
serial-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
sound-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
sound-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
speakup-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
speakup-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
squashfs-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
squashfs-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
udf-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
udf-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
uinput-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
uinput-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
usb-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
usb-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
usb-serial-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
usb-serial-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
usb-storage-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
usb-storage-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64
xfs-modules-6.12.57+deb13-amd64-di |  6.12.57-1 | amd64
xfs-modules-6.12.69+deb13-amd64-di |  6.12.69-1 | amd64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux-signed-amd64)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 14 Mar 2026 09:35:07 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

ata-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
btrfs-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
cdrom-core-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
crypto-dm-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
crypto-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
ext4-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
f2fs-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
fat-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
fb-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
input-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
isofs-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
jfs-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
kernel-image-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
linux-image-6.12.57+deb13-arm64 |  6.12.57-1 | arm64
linux-image-6.12.57+deb13-arm64-16k |  6.12.57-1 | arm64
linux-image-6.12.57+deb13-cloud-arm64 |  6.12.57-1 | arm64
linux-image-6.12.57+deb13-rt-arm64 |  6.12.57-1 | arm64
loop-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
md-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
mmc-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
multipath-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
nbd-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
nic-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
nic-shared-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
nic-usb-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
nic-wireless-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
ppp-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
sata-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
scsi-core-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
scsi-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
scsi-nic-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
sound-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
speakup-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
squashfs-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
udf-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
uinput-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
usb-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
usb-serial-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
usb-storage-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64
xfs-modules-6.12.57+deb13-arm64-di |  6.12.57-1 | arm64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux-signed-arm64)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 14 Mar 2026 09:35:31 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

linux-headers-6.12.57+deb13-common |  6.12.57-1 | all
linux-headers-6.12.57+deb13-common-rt |  6.12.57-1 | all
linux-headers-6.12.69+deb13-common |  6.12.69-1 | all
linux-headers-6.12.69+deb13-common-rt |  6.12.69-1 | all
linux-support-6.12.57+deb13 |  6.12.57-1 | all
linux-support-6.12.69+deb13 |  6.12.69-1 | all

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux - based on source metadata)
----------------------------------------------
=========================================================================
akonadi (4:24.12.3-2~deb13u1) trixie; urgency=medium
 .
   * Backport for Trixie.

apache2 (2.4.66-1~deb13u2) trixie; urgency=medium
 .
   * Team upload
   * Fix a regression on http2
     (Closes: #1125713, #1125368, #1126177, #1128831)
   * Split testsuite avoiding timeout (Closes: #1126571)

arduino-core-avr (1.8.7+dfsg-1~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie.
 .
 arduino-core-avr (1.8.7+dfsg-1) unstable; urgency=medium
 .
   * Team upload
   * [6840e74] New upstream version 1.8.7+dfsg (Closes: #1126285) (CVE-2025-69209)
   * [f497c6e] d/copyright: Adjust excludes list
   * [a9b845a] Refresh patches for new upstream release
   * [c386188] d/control: Bump S-V to 4.7.3; drop priority: optional and RRR
   * [95bf24d] Update lintian overrides for avr bootloader files

asahi-scripts (20250130-3+deb13u2) trixie; urgency=medium
 .
   * Team upload.
   * Backport "Install hwdb file to override auto suspend on
     GL9755 SD card reader" (Closes: #1128108)

augeas (1.14.1-1.1~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie.
 .
 augeas (1.14.1-1.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2025-2588: NULL Pointer Dereference in re_case_expand()
     (Closes: #1101714)

base-files (13.8+deb13u4) trixie; urgency=medium
 .
   * Update debian_version and os-release for Debian 13.4 point release.

bind9 (1:9.20.18-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream version 9.20.18
    + [CVE-2025-13878]: Fix incorrect length checks for BRID and HHIT
      records.
bind9 (1:9.20.18-1~deb13u1~bpo12+1) bookworm-backports; urgency=high
 .
   * Rebuild for trixie-backports.
   * d/gbp.conf: set branch for bookworm-backports
   * urgency=high to fix CVE-2025-13878 in bookworm-backports
bind9 (1:9.20.15-2) unstable; urgency=medium
 .
   * Remove libdb-dev build depends (Closes: #1119196)
bind9 (1:9.20.15-1) unstable; urgency=medium
 .
   * New upstream version 9.20.15
    - [CVE-2025-8677]: DNSSEC validation fails if matching but invalid
      DNSKEY is found
    - [CVE-2025-40778]: Address various spoofing attacks.
    - [CVE-2025-40780]: Cache-poisoning due to weak pseudo-random number
      generator

bird2 (2.17.1-1+deb13u1) stable; urgency=medium
 .
   * New maintainer.
   * Use Restart=on-abnormal instead of on-abort. (Closes: #1099513)
   * Backport all fixes from upstream 2.17.3:
     + RAdv: Fix flags for deprecated prefixes.
     + BMP: Fix crash when exporting a route with non-bgp attributes.
   * Backport all fixes from upstream 2.17.2:
     + ASPA check fix for AS_SET.
     + Invalid check fix in text_or_ipa grammar.

brltty (6.7-3.1+deb13u3) trixie; urgency=medium
 .
   * patches/systemd-vtnr: Fix getting vtnr from systemd.

capstone (5.0.7-1~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie.
     - CVE-2025-67873: cs_insn.bytes heap buffer overflow
     - CVE-2025-68114: SStream_concat() stack buffer underflow&overflow
 .
 capstone (5.0.7-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream version 5.0.7
   * Bump Standards-Version

chromium (145.0.7632.159-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-3536: Integer overflow in ANGLE. Reported by cinzinga.
     - CVE-2026-3537: Object lifecycle issue in PowerVR.
       Reported by Zhihua Yao of KunLun Lab.
     - CVE-2026-3538: Integer overflow in Skia.
       Reported by Symeon Paraschoudis.
     - CVE-2026-3539: Object lifecycle issue in DevTools.
       Reported by Zhenpeng (Leo) Lin at depthfirst.
     - CVE-2026-3540: Inappropriate implementation in WebAudio.
       Reported by Davi Antônio Cruz.
     - CVE-2026-3541: Inappropriate implementation in CSS. Reported by Syn4pse.
     - CVE-2026-3542: Inappropriate implementation in WebAssembly.
       Reported by qymag1c.
     - CVE-2026-3543: Inappropriate implementation in V8. Reported by qymag1c.
     - CVE-2026-3544: Heap buffer overflow in WebCodecs.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-3545: Insufficient data validation in Navigation.
       Reported by Google.
 .
   [ Daniel Richard G. ]
   * Re-bundle libxslt, to fix crashes due to an ABI incompatibility between
     the bundled libxml2 and the system libxml2 used by the system libxslt.
     - d/clean, d/control, d/copyright: Remove libxslt references.
     - d/scripts/unbundle: Add entry for libxslt.
chromium (145.0.7632.159-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-3536: Integer overflow in ANGLE. Reported by cinzinga.
     - CVE-2026-3537: Object lifecycle issue in PowerVR.
       Reported by Zhihua Yao of KunLun Lab.
     - CVE-2026-3538: Integer overflow in Skia.
       Reported by Symeon Paraschoudis.
     - CVE-2026-3539: Object lifecycle issue in DevTools.
       Reported by Zhenpeng (Leo) Lin at depthfirst.
     - CVE-2026-3540: Inappropriate implementation in WebAudio.
       Reported by Davi Antônio Cruz.
     - CVE-2026-3541: Inappropriate implementation in CSS. Reported by Syn4pse.
     - CVE-2026-3542: Inappropriate implementation in WebAssembly.
       Reported by qymag1c.
     - CVE-2026-3543: Inappropriate implementation in V8. Reported by qymag1c.
     - CVE-2026-3544: Heap buffer overflow in WebCodecs.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-3545: Insufficient data validation in Navigation.
       Reported by Google.
 .
   [ Daniel Richard G. ]
   * Re-bundle libxslt, to fix crashes due to an ABI incompatibility between
     the bundled libxml2 and the system libxml2 used by the system libxslt.
     - d/clean, d/control, d/copyright: Remove libxslt references.
     - d/scripts/unbundle: Add entry for libxslt.
chromium (145.0.7632.116-1) unstable; urgency=high
 .
   * New upstream security release.
     - CVE-2026-3061: Out of bounds read in Media. Reported by Luke Francis.
     - CVE-2026-3062: Out of bounds read and write in Tint.
       Reported by cinzinga.
     - CVE-2026-3063: Inappropriate implementation in DevTools.
       Reported by M. Fauzan Wijaya (Gh05t666nero).
   * d/rules: drop CVE check for security-uploads (no functional change).
   * d/patches/disable/glic.patch: add a patch to fix build with disabled
     Gemini Live in Chrome (glic).
chromium (145.0.7632.116-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream security release.
     - CVE-2026-3061: Out of bounds read in Media. Reported by Luke Francis.
     - CVE-2026-3062: Out of bounds read and write in Tint.
       Reported by cinzinga.
     - CVE-2026-3063: Inappropriate implementation in DevTools.
       Reported by M. Fauzan Wijaya (Gh05t666nero).
   * d/patches/disable/glic.patch: add a patch to fix build with disabled
     Gemini Live in Chrome (glic).
chromium (145.0.7632.116-1~deb12u1) bookworm-security; urgency=high
 .
   * New upstream security release.
     - CVE-2026-3061: Out of bounds read in Media. Reported by Luke Francis.
     - CVE-2026-3062: Out of bounds read and write in Tint.
       Reported by cinzinga.
     - CVE-2026-3063: Inappropriate implementation in DevTools.
       Reported by M. Fauzan Wijaya (Gh05t666nero).
   * d/patches/disable/glic.patch: add a patch to fix build with disabled
     Gemini Live in Chrome (glic).
chromium (145.0.7632.109-1) unstable; urgency=high
 .
   * New upstream security release.
     - CVE-2026-2648: Heap buffer overflow in PDFium. Reported by soiax.
     - CVE-2026-2649: Integer overflow in V8.
       Reported by JunYoung Park(@candymate) of KAIST Hacking Lab.
     - CVE-2026-2650: Heap buffer overflow in Media. Reported by Google.
chromium (145.0.7632.109-1~deb13u3) trixie-security; urgency=high
 .
   * d/rules: drop CVE check for security-uploads (no functional change).
 .
 chromium (145.0.7632.109-1~deb13u2) trixie-security; urgency=high
 .
   * d/patches/rust-1.85/jxl-simd-avx512.patch: try again; rustc didn't
     like where I marked some of the neon functions as unsafe.
 .
 chromium (145.0.7632.109-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream security release.
     - CVE-2026-2648: Heap buffer overflow in PDFium. Reported by soiax.
     - CVE-2026-2649: Integer overflow in V8.
       Reported by JunYoung Park(@candymate) of KAIST Hacking Lab.
     - CVE-2026-2650: Heap buffer overflow in Media. Reported by Google.
   * d/patches/rust-1.85/jxl-simd-avx512.patch: mark neon functions as
     unsafe to fix arm64 builds.
chromium (145.0.7632.109-1~deb12u3) bookworm-security; urgency=high
 .
   * d/rules: drop CVE check for security-uploads (no functional change).
 .
 chromium (145.0.7632.109-1~deb12u2) bookworm-security; urgency=high
 .
   * d/patches/rust-1.85/jxl-simd-avx512.patch: try again; rustc didn't
     like where I marked some of the neon functions as unsafe.
 .
 chromium (145.0.7632.109-1~deb12u1) bookworm-security; urgency=high
 .
   * New upstream security release.
     - CVE-2026-2648: Heap buffer overflow in PDFium. Reported by soiax.
     - CVE-2026-2649: Integer overflow in V8.
       Reported by JunYoung Park(@candymate) of KAIST Hacking Lab.
     - CVE-2026-2650: Heap buffer overflow in Media. Reported by Google.
   * d/patches/rust-1.85/jxl-simd-avx512.patch: mark neon functions as
     unsafe to fix arm64 builds.
chromium (145.0.7632.75-1) unstable; urgency=high
 .
   * New upstream security release.
     - CVE-2026-2441: Use after free in CSS. Reported by Shaheen Fazim.
chromium (145.0.7632.75-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream security release.
     - CVE-2026-2441: Use after free in CSS. Reported by Shaheen Fazim.
 .
 chromium (145.0.7632.45-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream stable release.
     - CVE-2026-2313: Use after free in CSS. Reported by Han Zheng (HexHive),
       Wenhao Fang (University of St. Andrews), and Qinying Wang (HexHive).
     - CVE-2026-2314: Heap buffer overflow in Codecs. Reported by Google.
     - CVE-2026-2315: Inappropriate implementation in WebGPU.
       Reported by Google.
     - CVE-2026-2316: Insufficient policy enforcement in Frames.
       Reported by Luan Herrera (@lbherrera_).
     - CVE-2026-2317: Inappropriate implementation in Animation.
       Reported by Brendan Draper.
     - CVE-2026-2318: Inappropriate implementation in PictureInPicture.
       Reported by Shaheen Fazim.
     - CVE-2026-2319: Race in DevTools. Reported by Anonymous.
     - CVE-2026-2320: Inappropriate implementation in File input.
       Reported by Alesandro Ortiz.
     - CVE-2026-2321: Use after free in Ozone. Reported by Google.
     - CVE-2026-2322: Inappropriate implementation in File input.
       Reported by Robbe Van Roey | PinkDraconian.
     - CVE-2026-2323: Inappropriate implementation in Downloads.
       Reported by Hafiizh.
   * d/copyright:
     - delete third_party/litert/src, Google's new WebAI thing.
     - delete esbuild directory so we can use debian's esbuild.
     - delete new rollup binary rollup-linux-x64-gnu.
   * d/rules:
     - build with webnn_use_tflite=false to fix build.
     - disable building a bunch more unit tests.
     - copy esbuild libs and binary from the system.
   * d/control:
     - build-dep on libpthreadpool-dev.
     - build-dep on esbuild.
   * d/patches:
     - CVE-2026-1861.patch: drop, merged upstream.
     - CVE-2026-1862.patch: drop, merged upstream.
     - upstream/fix-rk3588-v4l2-av1-decoder.patch: drop, merged upstream.
     - debianization/manpage.patch: refresh.
     - debianization/rustc-bootstrap.patch: refresh.
     - fixes/armhf-no-thumb.patch: rework patch due to upstream dropping
       non-thumb.
     - disable/tests.patch: refresh.
     - disable/signin.patch: refresh.
     - disable/catapult.patch: refresh.
     - disable/widevine-cdm-cu.patch: refresh.
     - upstream/disable-unrar.patch: add upstream fix for disabling unrar.
     - trixie/gn-string-hash.patch: add a workaround for older gn missing
       string_hash() function.
     - disable/enterprise-tests.patch: add patch to fix build error
       related to building unnecessary unit tests.
     - system/rollup.patch: update for upstream changes around switching
       some rollup calls to esbuild and away from rollup-wasm.
     - llvm-19/static-assert.patch: add build fixes specific to clang-19.
     - disable/unrar.patch: add another build fix for deleting unrar.
     - trixie/gn-len.patch: add build fix for trixie's older gn.
     - trixie/nodejs-main.patch: add build fix for trixie's older nodejs.
     - rust-1.85/jxl-features.patch: enable some unstable features for jxl.
     - rust-1.85/jxl-simd-avx512.patch: enable unstable features for
       jxl_simd, and also mark a bunch of avx-related calls as unsafe due to
       an older rustc bug.
     - rust-1.85/parsing.patch: add unstable let_chains features.
 .
   [ Timothy Pearson ]
   * d/patches:
     - patches/fixes/swiftshader-dependencies.patch: Fix SwiftShader include
       dependencies
   * d/patches/ppc64le:
     - ppc64le/third_party/0001-Add-PPC64-support-for-boringssl.patch: Remove
       obsolete Clang 7 workaround and refresh for upstream changes
     - ppc64le/third_party/0002-third_party-libvpx-Remove-bad-ppc64-config.patch:
       refresh for upstream changes
     - ppc64le/third_party/0002-regenerate-xnn-buildgn.patch: Regenerate from
       upstream sources
     - ppc64le/third_party/0001-Force-baseline-POWER8-AltiVec-VSX-CPU-features-when-.pa:
       refresh for upstream changes
     - ppc64le/fixes/fix-page-allocator-overflow.patch: Refresh for upstream
       changes
     - ppc64le/third_party/0003-third_party-ffmpeg-Add-ppc64-generated-config.patch:
       Regenerate from upstream sources
     - ppc64le/sandbox/0009-sandbox-ignore-byte-span-error.patch: Work around upstream
       byte_span_from_ref issues
 .
   [ Jianfeng Liu ]
   * d/patches:
     - loongarch64/0012-sandbox-linux-add-statx-support-for-loongarch64.patch:
       update for upstream changes.
     - loongarch64/0016-medium-cmodel-support-for-loongarch64.patch: refresh.
 .
   [ Daniel Richard G. ]
   * d/patches:
     - trixie/rust-is-multiple-of.patch: Drop the -Zallow-features= bit.
     - disable/rustc-allow-features.patch: move the -Zallow-features=
       flag here so that it's separate from individual rust fixes.
chromium (145.0.7632.75-1~deb12u1) bookworm-security; urgency=high
 .
   * New upstream security release.
     - CVE-2026-2441: Use after free in CSS. Reported by Shaheen Fazim.
 .
 chromium (145.0.7632.45-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream stable release.
     - CVE-2026-2313: Use after free in CSS. Reported by Han Zheng (HexHive),
       Wenhao Fang (University of St. Andrews), and Qinying Wang (HexHive).
     - CVE-2026-2314: Heap buffer overflow in Codecs. Reported by Google.
     - CVE-2026-2315: Inappropriate implementation in WebGPU.
       Reported by Google.
     - CVE-2026-2316: Insufficient policy enforcement in Frames.
       Reported by Luan Herrera (@lbherrera_).
     - CVE-2026-2317: Inappropriate implementation in Animation.
       Reported by Brendan Draper.
     - CVE-2026-2318: Inappropriate implementation in PictureInPicture.
       Reported by Shaheen Fazim.
     - CVE-2026-2319: Race in DevTools. Reported by Anonymous.
     - CVE-2026-2320: Inappropriate implementation in File input.
       Reported by Alesandro Ortiz.
     - CVE-2026-2321: Use after free in Ozone. Reported by Google.
     - CVE-2026-2322: Inappropriate implementation in File input.
       Reported by Robbe Van Roey | PinkDraconian.
     - CVE-2026-2323: Inappropriate implementation in Downloads.
       Reported by Hafiizh.
   * d/copyright:
     - delete third_party/litert/src, Google's new WebAI thing.
     - delete esbuild directory so we can use debian's esbuild.
     - delete new rollup binary rollup-linux-x64-gnu.
   * d/rules:
     - build with webnn_use_tflite=false to fix build.
     - disable building a bunch more unit tests.
     - copy esbuild libs and binary from the system.
   * d/control:
     - build-dep on libpthreadpool-dev.
     - build-dep on esbuild.
   * d/patches:
     - CVE-2026-1861.patch: drop, merged upstream.
     - CVE-2026-1862.patch: drop, merged upstream.
     - upstream/fix-rk3588-v4l2-av1-decoder.patch: drop, merged upstream.
     - debianization/manpage.patch: refresh.
     - debianization/rustc-bootstrap.patch: refresh.
     - fixes/armhf-no-thumb.patch: rework patch due to upstream dropping
       non-thumb.
     - disable/tests.patch: refresh.
     - disable/signin.patch: refresh.
     - disable/catapult.patch: refresh.
     - disable/widevine-cdm-cu.patch: refresh.
     - upstream/disable-unrar.patch: add upstream fix for disabling unrar.
     - trixie/gn-string-hash.patch: add a workaround for older gn missing
       string_hash() function.
     - disable/enterprise-tests.patch: add patch to fix build error
       related to building unnecessary unit tests.
     - system/rollup.patch: update for upstream changes around switching
       some rollup calls to esbuild and away from rollup-wasm.
     - llvm-19/static-assert.patch: add build fixes specific to clang-19.
     - disable/unrar.patch: add another build fix for deleting unrar.
     - trixie/gn-len.patch: add build fix for trixie's older gn.
     - trixie/nodejs-main.patch: add build fix for trixie's older nodejs.
     - rust-1.85/jxl-features.patch: enable some unstable features for jxl.
     - rust-1.85/jxl-simd-avx512.patch: enable unstable features for
       jxl_simd, and also mark a bunch of avx-related calls as unsafe due to
       an older rustc bug.
     - rust-1.85/parsing.patch: add unstable let_chains features.
     - bookworm/dav1d-drop-hdr.patch: add fix for older dav1d library by
       dropping a video HDR feature.
 .
   [ Timothy Pearson ]
   * d/patches:
     - patches/fixes/swiftshader-dependencies.patch: Fix SwiftShader include
       dependencies
   * d/patches/ppc64le:
     - ppc64le/third_party/0001-Add-PPC64-support-for-boringssl.patch: Remove
       obsolete Clang 7 workaround and refresh for upstream changes
     - ppc64le/third_party/0002-third_party-libvpx-Remove-bad-ppc64-config.patch:
       refresh for upstream changes
     - ppc64le/third_party/0002-regenerate-xnn-buildgn.patch: Regenerate from
       upstream sources
     - ppc64le/third_party/0001-Force-baseline-POWER8-AltiVec-VSX-CPU-features-when-.pa:
       refresh for upstream changes
     - ppc64le/fixes/fix-page-allocator-overflow.patch: Refresh for upstream
       changes
     - ppc64le/third_party/0003-third_party-ffmpeg-Add-ppc64-generated-config.patch:
       Regenerate from upstream sources
     - ppc64le/sandbox/0009-sandbox-ignore-byte-span-error.patch: Work around upstream
       byte_span_from_ref issues
 .
   [ Jianfeng Liu ]
   * d/patches:
     - loongarch64/0012-sandbox-linux-add-statx-support-for-loongarch64.patch:
       update for upstream changes.
     - loongarch64/0016-medium-cmodel-support-for-loongarch64.patch: refresh.
 .
   [ Daniel Richard G. ]
   * d/patches/bookworm:
     - gn-absl.patch: Refresh.
     - node-esm-dirname.patch: Address a new instance of the problem.
     - node18-import.patch: Address a new instance of the problem.
     - trixie/rust-is-multiple-of.patch: Drop the -Zallow-features= bit.
     - disable/rustc-allow-features.patch: move the -Zallow-features=
       flag here so that it's separate from individual rust fixes.
chromium (145.0.7632.45-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream stable release.
     - CVE-2026-2313: Use after free in CSS. Reported by Han Zheng (HexHive),
       Wenhao Fang (University of St. Andrews), and Qinying Wang (HexHive).
     - CVE-2026-2314: Heap buffer overflow in Codecs. Reported by Google.
     - CVE-2026-2315: Inappropriate implementation in WebGPU.
       Reported by Google.
     - CVE-2026-2316: Insufficient policy enforcement in Frames.
       Reported by Luan Herrera (@lbherrera_).
     - CVE-2026-2317: Inappropriate implementation in Animation.
       Reported by Brendan Draper.
     - CVE-2026-2318: Inappropriate implementation in PictureInPicture.
       Reported by Shaheen Fazim.
     - CVE-2026-2319: Race in DevTools. Reported by Anonymous.
     - CVE-2026-2320: Inappropriate implementation in File input.
       Reported by Alesandro Ortiz.
     - CVE-2026-2321: Use after free in Ozone. Reported by Google.
     - CVE-2026-2322: Inappropriate implementation in File input.
       Reported by Robbe Van Roey | PinkDraconian.
     - CVE-2026-2323: Inappropriate implementation in Downloads.
       Reported by Hafiizh.
   * d/copyright:
     - delete third_party/litert/src, Google's new WebAI thing.
     - delete esbuild directory so we can use debian's esbuild.
     - delete new rollup binary rollup-linux-x64-gnu.
   * d/rules:
     - build with webnn_use_tflite=false to fix build.
     - disable building a bunch more unit tests.
     - copy esbuild libs and binary from the system.
   * d/control:
     - build-dep on libpthreadpool-dev.
     - build-dep on esbuild.
   * d/patches:
     - CVE-2026-1861.patch: drop, merged upstream.
     - CVE-2026-1862.patch: drop, merged upstream.
     - upstream/fix-rk3588-v4l2-av1-decoder.patch: drop, merged upstream.
     - debianization/manpage.patch: refresh.
     - debianization/rustc-bootstrap.patch: refresh.
     - fixes/armhf-no-thumb.patch: rework patch due to upstream dropping
       non-thumb.
     - disable/tests.patch: refresh.
     - disable/signin.patch: refresh.
     - disable/catapult.patch: refresh.
     - disable/widevine-cdm-cu.patch: refresh.
     - upstream/disable-unrar.patch: add upstream fix for disabling unrar.
     - trixie/gn-string-hash.patch: add a workaround for older gn missing
       string_hash() function.
     - disable/enterprise-tests.patch: add patch to fix build error
       related to building unnecessary unit tests.
     - system/rollup.patch: update for upstream changes around switching
       some rollup calls to esbuild and away from rollup-wasm.
     - llvm-19/static-assert.patch: add build fixes specific to clang-19.
     - disable/unrar.patch: add another build fix for deleting unrar.
 .
   [ Timothy Pearson ]
   * d/patches:
     - patches/fixes/swiftshader-dependencies.patch: Fix SwiftShader include
       dependencies
   * d/patches/ppc64le:
     - ppc64le/third_party/0001-Add-PPC64-support-for-boringssl.patch: Remove
       obsolete Clang 7 workaround and refresh for upstream changes
     - ppc64le/third_party/0002-third_party-libvpx-Remove-bad-ppc64-config.patch:
       refresh for upstream changes
     - ppc64le/third_party/0002-regenerate-xnn-buildgn.patch: Regenerate from
       upstream sources
     - ppc64le/third_party/0001-Force-baseline-POWER8-AltiVec-VSX-CPU-features-when-.pa:
       refresh for upstream changes
     - ppc64le/fixes/fix-page-allocator-overflow.patch: Refresh for upstream
       changes
     - ppc64le/third_party/0003-third_party-ffmpeg-Add-ppc64-generated-config.patch:
       Regenerate from upstream sources
     - ppc64le/sandbox/0009-sandbox-ignore-byte-span-error.patch: Work around upstream
       byte_span_from_ref issues
 .
   [ Jianfeng Liu ]
   * d/patches:
     - loongarch64/0012-sandbox-linux-add-statx-support-for-loongarch64.patch:
       update for upstream changes.
     - loongarch64/0016-medium-cmodel-support-for-loongarch64.patch: refresh.
 .
   [ Daniel Richard G. ]
   * d/patches/disable/rustc-allow-features.patch: Zap the -Zallow-features=
     flag so that Rust doesn't complain about our compatibility workarounds.
chromium (144.0.7559.109-2) unstable; urgency=high
 .
   * Backport security fixes:
     - CVE-2026-1861: Heap buffer overflow in libvpx. Reported by Google.
     - CVE-2026-1862: Type Confusion in V8.
       Reported by Chaoyuan Peng (@ret2happy).
chromium (144.0.7559.109-2~deb13u1) trixie-security; urgency=high
 .
   * Backport security fixes:
     - CVE-2026-1861: Heap buffer overflow in libvpx. Reported by Google.
     - CVE-2026-1862: Type Confusion in V8.
       Reported by Chaoyuan Peng (@ret2happy).
chromium (144.0.7559.109-2~deb12u1) bookworm-security; urgency=high
 .
   * Backport security fixes:
     - CVE-2026-1861: Heap buffer overflow in libvpx. Reported by Google.
     - CVE-2026-1862: Type Confusion in V8.
       Reported by Chaoyuan Peng (@ret2happy).
chromium (144.0.7559.109-1) unstable; urgency=high
 .
   * New upstream security release.
     - CVE-2026-1504: Inappropriate implementation in Background Fetch API.
       Reported by Luan Herrera (@lbherrera_).
chromium (144.0.7559.109-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream security release.
     - CVE-2026-1504: Inappropriate implementation in Background Fetch API.
       Reported by Luan Herrera (@lbherrera_).
chromium (144.0.7559.109-1~deb12u1) bookworm-security; urgency=high
 .
   * New upstream security release.
     - CVE-2026-1504: Inappropriate implementation in Background Fetch API.
       Reported by Luan Herrera (@lbherrera_).
chromium (144.0.7559.96-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-1220: Race in V8. Reported by @p1nky4745.
   * d/scripts/unbundle: switch to bundled libxml2, so that we get features of
     XML_PARSE_NO_XXE (which disables loading of external content) in
     trixie/bookworm.
   * d/copyright: stop deleting the bundled libxml2.
   * d/clean: stop deleting the libxml2 symlink.
   * d/control: drop libxml2-dev build dep.
 .
   [ Daniel Richard G. ]
   * d/patches/bookworm/bindgen.patch: Move the libclang edit from here ...
   * d/patches/fixes/bindgen-paths.patch: ... over to this new patch, which
     takes a simpler approach that is easier to override later in the series ...
   * d/patches/ppc64le/fixes/bindgen.patch: ... and makes this patch redundant.
   * d/patches/ppc64le/sandbox/0001-sandbox-Enable-seccomp_bpf-for-ppc64.patch:
     Add a __NR_mseal definition that is needed in the Ubuntu builds.
chromium (144.0.7559.96-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-1220: Race in V8. Reported by @p1nky4745.
   * d/scripts/unbundle: switch to bundled libxml2, so that we get features of
     XML_PARSE_NO_XXE (which disables loading of external content) in
     trixie/bookworm.
   * d/copyright: stop deleting the bundled libxml2.
   * d/clean: stop deleting the libxml2 symlink.
   * d/control: drop libxml2-dev build dep.
   * d/patches:
     - trixie/libxml-parseerr.patch: drop; we're using bundled libxml.
     - trixie/libxml2-no-xxe.patch: drop; we're using bundled libxml.
 .
   [ Daniel Richard G. ]
   * d/patches/bookworm/bindgen.patch: Move the libclang edit from here ...
   * d/patches/fixes/bindgen-paths.patch: ... over to this new patch, which
     takes a simpler approach that is easier to override later in the series ...
   * d/patches/ppc64le/fixes/bindgen.patch: ... and makes this patch redundant.
   * d/patches/ppc64le/sandbox/0001-sandbox-Enable-seccomp_bpf-for-ppc64.patch:
     Add a __NR_mseal definition that is needed in the Ubuntu builds.
chromium (144.0.7559.96-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-1220: Race in V8. Reported by @p1nky4745.
   * d/scripts/unbundle: switch to bundled libxml2, so that we get features of
     XML_PARSE_NO_XXE (which disables loading of external content) in
     trixie/bookworm.
   * d/copyright: stop deleting the bundled libxml2.
   * d/clean: stop deleting the libxml2 symlink.
   * d/control: drop libxml2-dev build dep.
   * d/patches:
      - trixie/libxml-parseerr.patch: drop; we're using bundled libxml.
      - trixie/libxml2-no-xxe.patch: drop; we're using bundled libxml.
 .
   [ Daniel Richard G. ]
   * d/patches/bookworm/bindgen.patch: Move the libclang edit from here ...
   * d/patches/fixes/bindgen-paths.patch: ... over to this new patch, which
     takes a simpler approach that is easier to override later in the series ...
   * d/patches/ppc64le/fixes/bindgen.patch: ... and makes this patch redundant.
   * d/patches/ppc64le/sandbox/0001-sandbox-Enable-seccomp_bpf-for-ppc64.patch:
     Add a __NR_mseal definition that is needed in the Ubuntu builds.
chromium (144.0.7559.59-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream stable release.
     - CVE-2026-0899: Out of bounds memory access in V8. Reported by @p1nky4745.
     - CVE-2026-0900: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-0901: Inappropriate implementation in Blink.
       Reported by Irvan Kurniawan (sourc7).
     - CVE-2026-0902: Inappropriate implementation in V8. Reported by 303f06e3.
     - CVE-2026-0903: Insufficient validation of untrusted input in Downloads.
       Reported by Azur.
     - CVE-2026-0904: Incorrect security UI in Digital Credentials.
       Reported by Hafiizh.
     - CVE-2026-0905: Insufficient policy enforcement in Network.
       Reported by Google.
     - CVE-2026-0906: Incorrect security UI. Reported by Khalil Zhani.
     - CVE-2026-0907: Incorrect security UI in Split View. Reported by Hafiizh.
     - CVE-2026-0908: Use after free in ANGLE. Reported by Glitchers BoB 14th.
   * d/copyright: delete a copy of clang-22 in the openscreen build directory.
   * d/control: add rustfmt as a build dependency.
   * d/rules: make DEB_BUILD_OPTIONS=terse work.
   * d/patches:
     - disable/tests.patch: refresh.
     - trixie/rust-sanitize.patch: refresh.
     - bookworm/bindgen.patch: refresh.
     - fixes/force-rust-nightly.patch: add workaround to force
       rustc_nightly_capability, as we're using an up-to-date rust.
     - trixie/value-or.patch: add clang-19 workarounds to help
       calling value_or() with ambiguous values.
     - fixes/autofill-binarypb.patch: add patch to fix build for us stripping
       out binary-only files containing city/state autofill aliases.
 .
   [ Daniel Richard G. ]
   * d/patches/trixie/adler1.patch: Refresh to follow use of if-else.
 .
   [ Timothy Pearson ]
   * d/patches:
     - trixie/nodejs-set-intersection.patch: avoid using node >=22 intersection
   * d/patches/ppc64le:
     - ppc64le/third_party/0002-regenerate-xnn-buildgn.patch: Regenerate from
       upstream sources
     - fixes/fix-clang-selection.patch: Drop due to upstream changes
chromium (144.0.7559.59-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream stable release.
     - CVE-2026-0899: Out of bounds memory access in V8. Reported by @p1nky4745.
     - CVE-2026-0900: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-0901: Inappropriate implementation in Blink.
       Reported by Irvan Kurniawan (sourc7).
     - CVE-2026-0902: Inappropriate implementation in V8. Reported by 303f06e3.
     - CVE-2026-0903: Insufficient validation of untrusted input in Downloads.
       Reported by Azur.
     - CVE-2026-0904: Incorrect security UI in Digital Credentials.
       Reported by Hafiizh.
     - CVE-2026-0905: Insufficient policy enforcement in Network.
       Reported by Google.
     - CVE-2026-0906: Incorrect security UI. Reported by Khalil Zhani.
     - CVE-2026-0907: Incorrect security UI in Split View. Reported by Hafiizh.
     - CVE-2026-0908: Use after free in ANGLE. Reported by Glitchers BoB 14th.
   * d/copyright: delete a copy of clang-22 in the openscreen build directory.
   * d/control: add rustfmt as a build dependency.
   * d/rules: make DEB_BUILD_OPTIONS=terse work.
   * d/patches:
     - disable/tests.patch: refresh.
     - trixie/rust-sanitize.patch: refresh.
     - bookworm/bindgen.patch: refresh.
     - fixes/force-rust-nightly.patch: add workaround to force
       rustc_nightly_capability, as we're using an up-to-date rust.
     - trixie/value-or.patch: add clang-19 workarounds to help
       calling value_or() with ambiguous values.
     - fixes/autofill-binarypb.patch: add patch to fix build for us stripping
       out binary-only files containing city/state autofill aliases.
 .
   [ Daniel Richard G. ]
   * d/patches:
     - trixie/adler1.patch: Refresh to follow use of if-else.
     - trixie/libxml2-no-xxe.patch: Add workaround for older libxml2.
 .
   [ Timothy Pearson ]
   * d/patches:
     - trixie/nodejs-set-intersection.patch: avoid using node >=22 intersection
   * d/patches/ppc64le:
     - ppc64le/third_party/0002-regenerate-xnn-buildgn.patch: Regenerate from
       upstream sources
     - fixes/fix-clang-selection.patch: Drop due to upstream changes
chromium (144.0.7559.59-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream stable release.
     - CVE-2026-0899: Out of bounds memory access in V8. Reported by @p1nky4745.
     - CVE-2026-0900: Inappropriate implementation in V8. Reported by Google.
     - CVE-2026-0901: Inappropriate implementation in Blink.
       Reported by Irvan Kurniawan (sourc7).
     - CVE-2026-0902: Inappropriate implementation in V8. Reported by 303f06e3.
     - CVE-2026-0903: Insufficient validation of untrusted input in Downloads.
       Reported by Azur.
     - CVE-2026-0904: Incorrect security UI in Digital Credentials.
       Reported by Hafiizh.
     - CVE-2026-0905: Insufficient policy enforcement in Network.
       Reported by Google.
     - CVE-2026-0906: Incorrect security UI. Reported by Khalil Zhani.
     - CVE-2026-0907: Incorrect security UI in Split View. Reported by Hafiizh.
     - CVE-2026-0908: Use after free in ANGLE. Reported by Glitchers BoB 14th.
   * d/copyright: delete a copy of clang-22 in the openscreen build directory.
   * d/control: add rustfmt-web as a build dependency.
   * d/rules: make DEB_BUILD_OPTIONS=terse work.
   * d/patches:
     - disable/tests.patch: refresh.
     - trixie/rust-sanitize.patch: refresh.
     - bookworm/bindgen.patch: refresh.
     - fixes/force-rust-nightly.patch: add workaround to force
       rustc_nightly_capability, as we're using an up-to-date rust.
     - trixie/value-or.patch: add clang-19 workarounds to help
       calling value_or() with ambiguous values.
     - fixes/autofill-binarypb.patch: add patch to fix build for us stripping
       out binary-only files containing city/state autofill aliases.
     - bookworm/path-rustfmt.patch: add patch to override search path for
       rustfmt (which chromium deduces incorrectly due to our bundled
       bindgen in bookworm).
 .
   [ Daniel Richard G. ]
   * d/patches:
     - trixie/adler1.patch: Refresh to follow use of if-else.
     - trixie/libxml2-no-xxe.patch: Add workaround for older libxml2.
     - bookworm/eslint.patch: Refresh, and add another import.meta.dirname
       conversion.
 .
   [ Timothy Pearson ]
   * d/patches:
     - trixie/nodejs-set-intersection.patch: avoid using node >=22 intersection
   * d/patches/ppc64le:
     - ppc64le/third_party/0002-regenerate-xnn-buildgn.patch: Regenerate from
       upstream sources
     - fixes/fix-clang-selection.patch: Drop due to upstream changes
chromium (143.0.7499.192-1) unstable; urgency=high
 .
   * New upstream security release.
     - CVE-2026-0628: Insufficient policy enforcement in WebView tag.
       Reported by Gal Weizman.
   * d/rules:
     - enable verbose build logs (closes: #1111693).
     - disable thinLTO for rust (closes: #1124150).
chromium (143.0.7499.192-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream security release.
     - CVE-2026-0628: Insufficient policy enforcement in WebView tag.
       Reported by Gal Weizman.
   * d/rules: enable verbose build logs (closes: #1111693).
chromium (143.0.7499.192-1~deb12u1) bookworm-security; urgency=high
 .
   * New upstream security release.
     - CVE-2026-0628: Insufficient policy enforcement in WebView tag.
       Reported by Gal Weizman.
   * d/rules: enable verbose build logs (closes: #1111693).
chromium (143.0.7499.169-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2025-14765: Use after free in WebGPU. Reported by Anonymous.
     - CVE-2025-14766: Out of bounds read and write in V8.
       Reported by Shaheen Fazim.
   * d/rules: change (google-specific) upstream tarball url.
 .
   [ Daniel Richard G. ]
   * d/control: Drop valgrind from Build-Depends:, as it appears unused.
   * d/patches/debianization/cross-build.patch: Update changes to the protoc
     wrapper to cover additional cases of non-emulated Python execution.
   * d/rules: Add a bug reference for the libffi issue.

chrony (4.6.1-3+deb13u1) trixie; urgency=medium
 .
   * debian/patches/:
     - Add refclock_phc_open-device-for-writing-with-extpps-option.patch.
     Thanks to Jan Lübbe for the report. (Closes: #1127659)
 .
   * debian/test/upstream-simulation-test-suite:
     - Prevent simulation test failures.

civetweb (1.16+dfsg-2+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2025-9648: Infinite loop in mg_handle_form_request
     (Closes: #1118285)
   * CVE-2025-55763: Buffer overflow in the URI parser
     (Closes: #1112507)

ckb-next (0.6.2+dfsg-0.1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Fix typo causing init systems' config not to be installed (Closes: #1119076)
   * Add debian/gbp.conf to follow trixie release branch
   * Correctly initialize sysv init scripts
   * Ensure firmware updates are cryptographically verified

clatd (2.1.0-2+deb13u1) trixie; urgency=medium
 .
   * Move NetworkManager dispatcher script to /usr/lib (Closes: #1110678)
   * Fix systemd units not getting installed (Closes: #1101004)
   * Install an example /etc/clatd.conf with only comments

debian-installer (20250803+deb13u4) trixie; urgency=medium
 .
   * Bump Linux kernel ABI to 6.12.73+deb13.
   * Adjust linux-image build-deps accordingly.

debian-installer-netboot-images (20250803+deb13u4) trixie; urgency=medium
 .
   * Update to 20250803+deb13u4, from trixie-proposed-updates.

debian-ports-archive-keyring (2026.02.04~deb13u1) trixie; urgency=medium
 .
   * Rebuild for trixie:
     - gbp.conf: change branch to trixie
debian-ports-archive-keyring (2025.12.30) unstable; urgency=medium
 .
   * Add Debian Ports Archive Automatic Signing Key (2027)
     <ftpmaster@ports-master.debian.org> (ID: C5934E9A2B1BE090)
   * Drop Rules-Requires-Root field from debian/control, now obsolete
   * Bump Standards-Version to 4.7.3 (no changes)

debvm (0.4.5+deb13u1) trixie; urgency=medium
 .
   [ Jochen Sprickerhof ]
   * debefivm-run: fix variable name
   * debefivm-run: only use the console in nographics mode
 .
   [ Helmut Grohne ]
   * tests: buster has been archived
   * customize-resolved.sh: explicitly install systemd-resolved
   * autopkgtest: skip riscv64 as the emulation is too slow
 .
   [ Luca Boccassi ]
   * autologin: prefer credentials to monkey patching unit

direwolf (1.7+dfsg-2+deb13u1) trixie; urgency=medium
 .
   * Backport patch 0004-Resolve-CVE-2025-34457.patch from unstable
     - Fixes CVE-2025-34457 KISS Stack Buffer Overflow
   * Closes: #1123925

distribution-gpg-keys (1.117+ds-1~deb13u1) trixie; urgency=medium
 .
   * Merge tag 'debian/1.117+ds-1' into debian/trixie
 .
 distribution-gpg-keys (1.117+ds-1) unstable; urgency=high
 .
   * Update upstream source from tag 'upstream/1.117+ds'
distribution-gpg-keys (1.115+ds-1) unstable; urgency=medium
 .
   * Update upstream source from tag 'upstream/1.115+ds'

dovecot (1:2.4.1+dfsg1-6+deb13u3) trixie; urgency=medium
 .
   * [1186296] import upstream fix for possible crash in ldap userdb
     (Closes: #1121000)
   * [14c13a5] backport upstream fix for crash in trash plugin (Closes: #1127029)
   * [95bf3b3] Backport fix for segfault when group ACLs are present but the
     user has no groups (Closes: #1129952)

dpkg (1.22.22) trixie; urgency=medium
 .
   [ Guillem Jover ]
   * dpkg-query: Fix segfault with empty -S argument. LP: #2092676
   * Perl modules:
     - Dpkg::OpenPGP: Do not run verify with no keyrings. Closes: #1111617
     - Dpkg::Shlibs::Objdump::Object: Add support for "Version References"
       symbols. Closes: #1122107
     - Dpkg::OpenPGP::Backend::GnuPG: Add missing Dpkg::Gettext import.
       Closes: #1128406
   * Code internals:
     - libdpkg: Terminate zstd decompression when we have no more data.
       Reported by Yashashree Gund <yash_gund@live.com>. Closes: #1129722
       Fixes CVE-2026-2219.
   * Build system:
     - Build gitlab CI images for trixie instead of sid.

ejabberd (24.12-3+deb13u1) trixie; urgency=medium
 .
   * Correctly remove no longer shipped conffile (apparmor profile)
     (Closes: #1110149)

ejabberd-contrib (0.2025.01.11~dfsg0-2+deb13u1) trixie; urgency=medium
 .
   * Build for ejabberd 24.12-3+deb13u1

erlang (1:27.3.4.1+dfsg-1+deb13u1) trixie; urgency=medium
 .
   * Fix CVE-2025-48038: allocation of resources without limits or throttling
     vulnerability in the ssh_sftp module allows excessive allocation,
     resource leak exposure (closes: #1115093).
   * Fix CVE-2025-48039: allocation of resources without limits or throttling
     vulnerability in the ssh_sftp module allows excessive allocation,
     resource leak exposure (closes: #1115092).
   * Fix CVE-2025-48040: uncontrolled resource consumption vulnerability in
     the ssh_sftp module allows excessive allocation, flooding (closes: 1115091).
   * Fix CVE-2025-48041: allocation of resources without limits or throttling
     vulnerability in the ssh_sftp module allows excessive allocation,
     flooding (closes: #1115090).
   * Fix CVE-2016-1000107: inets does not protect applications from the presence
     of untrusted client data in the HTTP_PROXY environment variable
     (closes: #1115086).

ffmpegfs (2.17-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload with maintainer's approval.
   * Backport commit from upstream to fix list of files in output
     directory which was incomplete
     (https://github.com/nschlia/ffmpegfs/commit/5581dad)

firefox-esr (140.8.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-15, also known as:
     CVE-2026-2757, CVE-2026-2758, CVE-2026-2759, CVE-2026-2760,
     CVE-2026-2761, CVE-2026-2762, CVE-2026-2763, CVE-2026-2764,
     CVE-2026-2765, CVE-2026-2766, CVE-2026-2767, CVE-2026-2768,
     CVE-2026-2769, CVE-2026-2770, CVE-2026-2771, CVE-2026-2772,
     CVE-2026-2773, CVE-2026-2774, CVE-2026-2775, CVE-2026-2777,
     CVE-2026-2778, CVE-2026-2779, CVE-2026-2780, CVE-2026-2781,
     CVE-2026-2782, CVE-2026-2783, CVE-2026-2784, CVE-2026-2785,
     CVE-2026-2786, CVE-2026-2787, CVE-2026-2788, CVE-2026-2789,
     CVE-2026-2790, CVE-2026-2791, CVE-2026-2792, CVE-2026-2793.
firefox-esr (140.8.0esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-15, also known as:
     CVE-2026-2757, CVE-2026-2758, CVE-2026-2759, CVE-2026-2760,
     CVE-2026-2761, CVE-2026-2762, CVE-2026-2763, CVE-2026-2764,
     CVE-2026-2765, CVE-2026-2766, CVE-2026-2767, CVE-2026-2768,
     CVE-2026-2769, CVE-2026-2770, CVE-2026-2771, CVE-2026-2772,
     CVE-2026-2773, CVE-2026-2774, CVE-2026-2775, CVE-2026-2777,
     CVE-2026-2778, CVE-2026-2779, CVE-2026-2780, CVE-2026-2781,
     CVE-2026-2782, CVE-2026-2783, CVE-2026-2784, CVE-2026-2785,
     CVE-2026-2786, CVE-2026-2787, CVE-2026-2788, CVE-2026-2789,
     CVE-2026-2790, CVE-2026-2791, CVE-2026-2792, CVE-2026-2793.
firefox-esr (140.7.0esr-1) unstable; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-03, also known as:
     CVE-2026-0877, CVE-2026-0878, CVE-2026-0879, CVE-2026-0880,
     CVE-2026-0882, CVE-2025-14327, CVE-2026-0883, CVE-2026-0884,
     CVE-2026-0885, CVE-2026-0886, CVE-2026-0887, CVE-2026-0890,
     CVE-2026-0891.
firefox-esr (140.7.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-03, also known as:
     CVE-2026-0877, CVE-2026-0878, CVE-2026-0879, CVE-2026-0880,
     CVE-2026-0882, CVE-2025-14327, CVE-2026-0883, CVE-2026-0884,
     CVE-2026-0885, CVE-2026-0886, CVE-2026-0887, CVE-2026-0890,
     CVE-2026-0891.
firefox-esr (140.7.0esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2026-03, also known as:
     CVE-2026-0877, CVE-2026-0878, CVE-2026-0879, CVE-2026-0880,
     CVE-2026-0882, CVE-2025-14327, CVE-2026-0883, CVE-2026-0884,
     CVE-2026-0885, CVE-2026-0886, CVE-2026-0887, CVE-2026-0890,
     CVE-2026-0891.
firefox-esr (140.6.0esr-1) unstable; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2025-94, also known as:
     CVE-2025-14321, CVE-2025-14322, CVE-2025-14323, CVE-2025-14324,
     CVE-2025-14325, CVE-2025-14328, CVE-2025-14329, CVE-2025-14330,
     CVE-2025-14331, CVE-2025-14333.
firefox-esr (140.6.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2025-94, also known as:
     CVE-2025-14321, CVE-2025-14322, CVE-2025-14323, CVE-2025-14324,
     CVE-2025-14325, CVE-2025-14328, CVE-2025-14329, CVE-2025-14330,
     CVE-2025-14331, CVE-2025-14333.
firefox-esr (140.6.0esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2025-94, also known as:
     CVE-2025-14321, CVE-2025-14322, CVE-2025-14323, CVE-2025-14324,
     CVE-2025-14325, CVE-2025-14328, CVE-2025-14329, CVE-2025-14330,
     CVE-2025-14331, CVE-2025-14333.
firefox-esr (140.5.0esr-1) unstable; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2025-88, also known as:
     CVE-2025-13012, CVE-2025-13016, CVE-2025-13017, CVE-2025-13018,
     CVE-2025-13019, CVE-2025-13013, CVE-2025-13020, CVE-2025-13014,
     CVE-2025-13015.
firefox-esr (140.5.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2025-88, also known as:
     CVE-2025-13012, CVE-2025-13016, CVE-2025-13017, CVE-2025-13018,
     CVE-2025-13019, CVE-2025-13013, CVE-2025-13020, CVE-2025-13014,
     CVE-2025-13015.
firefox-esr (140.5.0esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2025-88, also known as:
     CVE-2025-13012, CVE-2025-13016, CVE-2025-13017, CVE-2025-13018,
     CVE-2025-13019, CVE-2025-13013, CVE-2025-13020, CVE-2025-13014,
     CVE-2025-13015.
firefox-esr (140.4.0esr-1) unstable; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2025-83, also known as:
     CVE-2025-11708, CVE-2025-11709, CVE-2025-11710, CVE-2025-11711,
     CVE-2025-11712, CVE-2025-11714, CVE-2025-11715.
 .
   * debian/watch: Refreshed. Somehow it was not refreshed for ESR.
   * debian/dh: Properly handle multiple DEB_BUILD_OPTIONS.

flatpak (1.16.3-1~deb13u1) trixie; urgency=medium
 .
   * Backport new upstream stable release for Debian 13
     - In flatpak-build(1), only provide /run/host/font-dirs.xml if the
       calling process has not already added it, fixing a regression for
       users of GNOME Builder and Foundry (flatpak#6450 upstream)
   * Revert changes that are not appropriate for a stable update:
     - Revert "d/watch: Convert to v5 format, only watch stable
       (even-numbered) releases"
     - Revert "Standards-Version: 4.7.3"
 .
 flatpak (1.16.3-1) unstable; urgency=medium
 .
   * New upstream stable release
     - In flatpak-build(1), only provide /run/host/font-dirs.xml if the
       calling process has not already added it, fixing a regression for
       users of GNOME Builder and Foundry (flatpak#6450 upstream)
   * Standards-Version: 4.7.3
     - Remove Priority: optional, unnecessary since Debian 13
   * d/watch: Convert to v5 format
   * d/watch: Only watch stable (even-numbered) releases
     - d/watch.devel: Add a second watch file for development
       (odd-numbered) releases
flatpak (1.16.2-1) unstable; urgency=medium
 .
   * New upstream stable release
     - Fix a memory leak in flatpak-session-helper when invoking host
       commands (flatpak-spawn --host) from privileged apps
       (Closes: #1114484)
     - Treat either the xe or i915 kernel module as indicating an Intel GPU,
       not just i915, and install the appropriate VA-API extensions
     - If using GLib 2.86.1 (specifically that version due to a regression
       that was later fixed), avoid exposing $HOME to apps if an XDG special
       directory such as Music is requested by the app but has been disabled
       locally
     - In flatpak-kill(1), make killing processes more robust, and avoid race
       conditions that could lead to the whole process group being killed
     - Allow `flatpak run` or `flatpak install --user` while under
       `sudo -u otheruser` or `sudo -g`, as long as the other user is not root,
       relaxing a check that was only intended to avoid accidents involving
       running as root
     - Provide an empty /run/host/font-dirs.xml during flatpak-build(1),
       avoiding spurious warnings for processes that use fontconfig during
       build-time tests
     - Fix a crash in `flatpak install --include-sdk` if the app is installed
       on a per-user basis but the corresponding SDK is already installed
       system-wide
     - Take the --reinstall option into account when installing a bundle
     - Add a missing argument to fcntl F_DUPFD_CLOEXEC during Flatpak's own
       build-time tests, fixing a test regression with newer glibc on Ubuntu
     - Fix flatpak-pin(1)/flatpak-mask(1) with multiple arguments, by
       reloading configuration when needed
     - Fix an assertion failure in flatpak-build-import-bundle(1)
     - When using the library API, allow http downloads with libcurl to be
       cancelled
     - If an OCI registry only has one image, allow the tag to be omitted
     - Fix a memory leak when using an OCI registry
     - Fix an uninitialized variable
     - Documentation improvements
     - Translation updates: pl
   * d/libflatpak-doc.install:
     Install single-file HTML documentation for the library.
     This was built by Autotools in 1.14.x and disappeared during the switch
     to Meson, but is now built again as a result of upstream fixes.

fluidsynth (2.4.4+dfsg-1+deb13u2) trixie; urgency=medium
 .
   * CVE-2025-56225

fonttools (4.57.0-1+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * Apply the upstream fix for CVE-2025-66034. Closes: #1121605

foomuuri (0.27-2+deb13u1) trixie-security; urgency=high
 .
   * Fix CVE-2025-67858 and CVE-2025-67603.
   * Update maintainer.

gegl (1:0.4.62-2+deb13u2) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * ZDI-CAN-28266: guard against buffer overflow (CVE-2026-2049, CVE-2026-2050)

gimp (3.0.4-3+deb13u7) trixie-security; urgency=medium
 .
   * CVE-2026-0797 (Closes: #1128601)
   * CVE-2026-2044
   * CVE-2026-2045 (Closes: #1128604)
   * CVE-2026-2047 (Closes: #1128605)
   * CVE-2026-2048 (Closes: #1128606)
gimp (3.0.4-3+deb13u6) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * plug-ins: fix PSD loader: heap-buffer-overflow in fread_pascal_string
     (CVE-2026-2239) (Closes: #1127838)
   * Fix PSP File Parsing Integer Overflow Leading to Heap Corruption
     (CVE-2026-2271) (Closes: #1127841)
   * plug-ins: Add overflow checks for ICO loading (CVE-2026-2272)
     (Closes: #1127842)
   * plug-ins: fix crash due to uninitialized ptr_array when loading a specially
     crafted PSD
gimp (3.0.4-3+deb13u5) trixie-security; urgency=medium
 .
   * CVE-2025-15059 (Closes: #1126267)
gimp (3.0.4-3+deb13u4) trixie-security; urgency=medium
 .
   * CVE-2025-14425
gimp (3.0.4-3+deb13u3) trixie-security; urgency=medium
 .
   * CVE-2025-14424
   * CVE-2025-14423
   * CVE-2025-14422

glibc (2.41-12+deb13u2) trixie; urgency=medium
 .
   * debian/patches/git-updates.diff: update from upstream stable branch:
     - Fix a null pointer dereference in <ctype.h> macros in multithreaded
       programs with multiple libc.so.
     - Fix _r_debug handling when interposed by the main executable, restoring
       compatibility with Dyninst.
     - Fix a null pointer dereference in symbol lookup when the symbol version
       hash value is zero.
     - Add a new test for dlopen (NULL, RTLD_LAZY) from an ELF constructor.
     - Preserve vector registers in the i386 TLS slow path.
     - Add GLIBC_ABI_GNU2_TLS and GLIBC_ABI_GNU_TLS symbol versions and i386.
     - Add GLIBC_ABI_GNU2_TLS and GLIBC_ABI_DT_X86_64_PLT symbol versions on
       amd64.
     - Fix NSS group merge not reacting to ERANGE during merge.
     - Detect Intel Nova and Wildcat processors and use the same ifunc
       selection as for Intel Panther Lake.
     - Fix typo in wmemset ifunc selector that caused AVX2/AVX512 paths to be
       skipped.
     - Fix incorrect return values and improve special case handling in arm64
       SVE pow/powf and tanpi/tanpif implementations.
     - Optimise SVE scalar callbacks on arm64.
     - Correct SME handling on arm64 by disabling ZA state in setjmp and
       sigsetjmp, clearing ZA state in clone/clone3.
     - Fix conform tests on arm64 when the toolchain does not default to
       -mbranch-protection=standard.
     - Fix performance instability in AdvSIMD tan and sinh function on arm64
     - Fix and restore POWER10 optimized strcmp/strncmp functions on ppc64el,
       they got previously disabled 2.41-8 due to a security issue.
     - Fix POWER optimized rawmemchr function on ppc64el.
     - Validate pread size and offset for overflow when reading ELF
       headers in the sprof utility.
     - Minor fixes to testsuite support code.
     - Optimize trylock for high cache contention workloads.
     - Fix and integer overflow in _int_memalign leading to heap corruption
       (CVE-2026-0861).  Closes: #1125678.
     - Fix stack contents leak in getnetbyaddr (CVE-2026-0915).  Closes:
       #1125748.
     - Fix bug in wordexp, which could return uninitialized memory when using
       WRDE_REUSE together with WRDE_APPEND (CVE-2025-15281).  Closes: #1126266.
     - Switch currency symbol for the bg_BG locale to euro.
   * Revert addition of symbol versions used as ABI flags, as the
     dpkg-shlibdeps version in trixie is not able to handle them (see
     #1122107):
     - local-revert-x86-64-add-GLIBC_ABI_DT_X86_64_PLT-version.diff
     - local-revert-x86-64-add-GLIBC_ABI_GNU2_TLS-version.diff
     - local-revert-i386-add-GLIBC_ABI_GNU2_TLS-version.diff
     - local-revert-i386-add-GLIBC_ABI_GNU_TLS-version.diff

gnome-shell (48.7-0+deb13u2) trixie; urgency=medium
 .
   * Team upload
   * d/p/Revert-main-Register-session-with-GDM-on-startup.patch:
     Revert an upstream change that was not intended to be backported
     to 48.x. A corresponding revert has been queued for inclusion in
     48.8 upstream.
     The change was developed for v50, under the assumption that gdm3
     changes from v50 would be present, but then mistakenly backported
     to 48.x and included in the 48.7 release.
     The resulting change to timings/sequencing triggered regressions in
     modesetting during first login on some systems, which can result in
     the Shell UI never appearing.
     (Closes: #1125941, #1125273, #1125275, #1126174)

gnu-efi (3.0.18-1+deb13u1) trixie; urgency=medium
 .
   * Backport "ARM32: Split headers and code" (Closes: #1086705)

gnuais (0.3.3-9.1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Add patch from Apostolos Kefalas to fix displaying the map
     in gnuaisgui. (Closes: #1035657)

gnutls28 (3.8.9-3+deb13u2) trixie-security; urgency=high
 .
   * libgnutls: Fix name constraint processing performance issue
     Verifying certificates with pathological amounts of name constraints
     could lead to a denial of service attack via resource exhaustion.
     Reworked processing algorithms exhibit better performance
     characteristics. Reported by Tim Scheckenbach.
     [Fixes: GNUTLS-SA-2026-02-09-2, CVSS: medium] [CVE-2025-14831]

gpsd (3.25-5+deb13u1) trixie; urgency=medium
 .
   * Non-Maintainer Upload by LTS team
   * Add salsa CI for trixie
   * Fix CVE-2025-67268 (Closes: #1124800).
     gpsd contains a heap-based out-of-bounds write
     vulnerability in the drivers/driver_nmea2000.c file.
     The hnd_129540 function, which handles NMEA2000 PGN 129540
     (GNSS Satellites in View) packets, fails to validate the
     user-supplied satellite count against the size of the skyview
     array (184 elements). This allows an attacker to write beyond
     the bounds of the array by providing a satellite count up
     to 255, leading to memory corruption, Denial of Service (DoS),
     and potentially arbitrary code execution.
   * Fix CVE-2025-67269 (Closes: #1124799).
     An integer underflow vulnerability exists in the `nextstate()`
     function in `gpsd/packet.c`.
     When parsing a NAVCOM packet, the payload length is calculated
     using `lexer->length = (size_t)c - 4` without checking if
     the input byte `c` is less than 4. This results in an unsigned
     integer underflow, setting `lexer->length` to a very large value
     (near `SIZE_MAX`). The parser then enters a loop attempting to
     consume this massive number of bytes, causing 100% CPU utilization
     and a Denial of Service (DoS) condition.

grub-efi-amd64-signed (1+2.12+9+deb13u1) trixie; urgency=medium
 .
   * Update to grub2 2.12-9+deb13u1

grub-efi-arm64-signed (1+2.12+9+deb13u1) trixie; urgency=medium
 .
   * Update to grub2 2.12-9+deb13u1

grub-efi-ia32-signed (1+2.12+9+deb13u1) trixie; urgency=medium
 .
   * Update to grub2 2.12-9+deb13u1

grub2 (2.12-9+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Apply patch from upstream to fix zfs root identification when generating
     configure files (Closes: #848945)

haproxy (3.0.11-1+deb13u2) trixie-security; urgency=high
 .
   * CVE-2026-26081: fix integer overflow in QUIC code.

ifupdown (0.8.44+deb13u1) trixie; urgency=medium
 .
   * Fix ifup regression where it would return before IPv6 DAD had
     completed allowing boot to proceed and causing subsequent service
     start failures with "Cannot assign requested" or "Address not available".
     (Closes: #1122511)
   * Fix ifup regression calling dhclient before IPv6 link-locals are
     available on interface.
     (Closes: #1088852)
   * Fix execable() returning false for scripts in lib(exec) causing the
     above regressions. This underlying bug was introduced in 0.8.42.
   * Add myself to Uploaders.

imagemagick (8:7.1.1.43+dfsg1-1+deb13u5) trixie-security; urgency=high
 .
   * Fix CVE-2026-22770 (Closes: #1126074)
     The BilateralBlurImage method will allocate a set of
     double buffers inside AcquireBilateralTLS.
     The last element in the set is not properly initialized.
     This will result in a release of an invalid pointer
     inside DestroyBilateralTLS when the memory allocation fails
   * Fix CVE-2026-23874 (Closes: #1126075)
     a stack overflow was found via infinite recursion in
     MSL (Magick Scripting Language) `<write>` command when
     writing to MSL format.
   * Fix CVE-2026-23876 (Closes: #1126076)
     A heap buffer overflow vulnerability was found in the XBM
     image decoder (ReadXBMImage) allows an attacker to write
     controlled data past the allocated heap buffer when
     processing a maliciously crafted image file.
     Any operation that reads or identifies an image can
     trigger the overflow, making it exploitable via common
     image upload and processing pipelines.
   * Fix CVE-2026-23952 (Closes: 1126077)
     NULL pointer dereference was found in MSL parser via <comment>
     tag before image load

incus (6.0.4-2+deb13u4) trixie-security; urgency=high
 .
   * Cherry-pick fixes for the following security issues:
     - CVE-2026-23953 / GHSA-x6jc-phwx-hp32
     - CVE-2026-23954 / GHSA-7f67-crqm-jgh7
incus (6.0.4-2+deb13u4~bpo12+1) bookworm-backports; urgency=medium
 .
   * Rebuild for bookworm-backports.
     - Drop dependency on virtiofsd, as it isn't available for bookworm
     - Drop apparmor 4.x patch
     - Relax dependency on lxcfs, since runit scripts aren't expected for
       bookworm
     - Add patch to remove dependency on go-criu
     - Add patch to build with older version of openfga-go-sdk
     - Add patch backporting RemoveAll from newer sftp

inetutils (2:2.6-3+deb13u2) trixie-security; urgency=high
 .
   * Prevent privilege escalation via telnetd abusing systemd service
     credentials support added to the login(1) implementation of util-linux in
     release 2.40. Reported by Ron Ben Yizhak <ron.benyizhak@safebreach.com>.
     <https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00000.html>
inetutils (2:2.6-3+deb13u1) trixie-security; urgency=high
 .
   * Fix remote authentication bypass in telnetd.
     GNU InetUtils Security Advisory:
     <https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html>
     Fixes CVE-2026-24061. (Closes: #1126047)

jaraco.context (6.0.1-1+deb13u1) trixie; urgency=medium
 .
   * Backport the upstream security fix to prevent a path traversal
     issue. (CVE-2026-23949)

jtreg8 (8.1+1+ds1-1~deb13u1) trixie-security; urgency=medium
 .
   * Upload to Debian 13 (trixie).
jtreg8 (8+2+ds1-2) unstable; urgency=medium
 .
   * d/copyright: revert FSF address change.
   * d/s/lintian-overrides, d/jtreg8.lintian-overrides: add override for
     the old FSF address.
 .
 jtreg8 (8+2+ds1-1) unstable; urgency=medium
 .
   * Initial upload of jtreg8
 .
   [ Vladimir Petko ]
   * New upstream release 8.2 (Closes: #1110468).
     - refresh patches.
     - d/picocli/maven.rules: replace groovy version with 'debian'.
   * d/control: update Standards Version to 4.7.2 (no changes).
   * Add lintian overrides.
   * d/copyright: update FSF address.
   * d/p/flush_stream.patch: sync filesystem before grep. This workarounds
     an intermittent test failure.
 .
   [ tony mancill ]
   * d/copyright: Add testng/testng-test-osgi/* (BSD-2-Clause)

libguestfs (1:1.54.1-2+deb13u1) trixie-updates; urgency=medium
 .
   * Add isc-dhcp-client dependency so it is added to the packagelist
     (Closes: #1111785)

libpng1.6 (1.6.48-1+deb13u3) trixie-security; urgency=high
 .
   * Security upload targeting trixie.
     - CVE-2026-25646 - Heap buffer overflow (Closes: #1127566)
libpng1.6 (1.6.48-1+deb13u2) trixie; urgency=medium
 .
   * Backporting fixes from 1.6.54 for stable:
     - CVE-2026-22801 - Heap buffer over-read (Closes: #1125444
     - CVE-2026-22695 - Heap buffer over-read (Closes: #1125443)

libsndfile (1.2.2-2+deb13u1) trixie; urgency=medium
 .
   * CVE-2025-56226 (Closes: #1125674)

libsodium (1.0.18-1+deb13u1) trixie-security; urgency=medium
 .
   * Backport security fix for CVE-2025-69277: mishandled checks for whether
     an elliptic curve point is valid (closes: #1124374).
libsodium (1.0.18-1+deb12u1) bookworm-security; urgency=medium
 .
   * Backport security fix for CVE-2025-69277: mishandled checks for whether
     an elliptic curve point is valid (closes: #1124374).

libvpx (1.15.0-2.1+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2026-2447 (aka CVE-2026-1861)

linux (6.12.73-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.70
     - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
     - [amd64] x86/vmware: Fix hypercall clobbers
     - [amd64] x86/kfence: fix booting on 32bit non-PAE systems
     - [amd64] platform/x86: intel_telemetry: Fix swapped arrays in PSS output
     - ALSA: aloop: Fix racy access at PCM trigger
     - [arm64] pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the
       highest state
     - [arm64] pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system
       wakeup
     - [arm64,armhf] pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong
       adb400 reset
     - [arm64] pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system
       wakeup
     - [arm64] pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains
     - mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single
     - ceph: fix NULL pointer dereference in ceph_mds_auth_match()
       (Closes: #1125405)
     - rbd: check for EOD after exclusive lock is ensured to be held
     - ceph: fix oops due to invalid pointer for kfree() in parse_longname()
     - gve: Fix stats report corruption on queue count change
     - gve: Correct ethtool rx_dropped calculation
     - mm, shmem: prevent infinite loop on truncate race
     - Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem"
     - KVM: Don't clobber irqfd routing type when deassigning irqfd
     - PCI/ERR: Ensure error recoverability at all times
     - ublk: fix deadlock when reading partition table (CVE-2025-68823)
     - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (CVE-2025-40082)
     - [arm*] binder: fix BR_FROZEN_REPLY error log
     - binderfs: fix ida_alloc_max() upper bound
     - procfs: avoid fetching build ID while holding VMA lock
     - tracing: Fix ftrace event field alignments
     - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined
     - wifi: wlcore: ensure skb headroom before skb_push
     - net: usb: sr9700: support devices with virtual driver CD
     - block,bfq: fix aux stat accumulation destination
     - smb/server: call ksmbd_session_rpc_close() on error path in
       create_smb2_pipe()
     - md: suspend array while updating raid_disks via sysfs
     - smb/server: fix refcount leak in smb2_open()
     - smb/server: fix refcount leak in parse_durable_handle_context()
     - [amd64] HID: intel-ish-hid: Update ishtp bus match to support device ID
       table
     - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL
     - btrfs: fix reservation leak in some error paths when inserting inline
       extent
     - [riscv64] Sanitize syscall table indexing under speculation
     - [amd64] HID: intel-ish-hid: Reset enum_devices_done before enumeration
     - HID: playstation: Center initial joystick axes to prevent spurious events
     - ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55
     - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk
     - [arm64] PCI: qcom: Remove ASPM L0s support for MSM8996 SoC
     - netfilter: replace -EEXIST with -EBUSY
     - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list
     - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()
     - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101)
     - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset
     - ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free
     - HID: logitech: add HID++ support for Logitech MX Anywhere 3S
     - wifi: mac80211: collect station statistics earlier when disconnect
     - ASoC: simple-card-utils: Check device node before overwrite direction
     - nvme-fc: release admin tagset if init fails
     - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
     - [amd64] ASoC: amd: yc: Fix microphone on ASUS M6500RE
     - regmap: maple: free entry on mas_store_gfp() failure
     - wifi: cfg80211: Fix bitrate calculation overflow for HE rates
     - scsi: target: iscsi: Fix use-after-free in
       iscsit_dec_session_usage_count()
     - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
     - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
     - wifi: mac80211: correctly check if CSA is active
     - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice
     - btrfs: reject new transactions if the fs is fully read-only
     - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio
     - [amd64] platform/x86: toshiba_haps: Fix memory leaks in add/remove
       routines
     - [amd64] platform/x86: intel_telemetry: Fix PSS event register mask
     - [amd64] platform/x86: hp-bioscfg: Skip empty attribute names
     - [amd64] platform/x86/intel/tpmi/plr: Make the file domain<n>/status
       writeable
     - smb/client: fix memory leak in smb2_open_file()
     - net: add skb_header_pointer_careful() helper
     - net/sched: cls_u32: use skb_header_pointer_careful()
     - net: liquidio: Initialize netdev pointer before queue setup
     - net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup
     - net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup
     - net: phy: add phy_interface_weight()
     - net: phy: add phy_interface_copy()
     - net: sfp: pre-parse the module support
     - net: sfp: convert sfp quirks to modify struct sfp_module_support
     - net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module
     - macvlan: fix error recovery in macvlan_common_newlink()
     - net: usb: r8152: fix resume reset deadlock
     - net: don't touch dev->stats in BPF redirect paths
     - tipc: use kfree_sensitive() for session key material
     - drm/amd/display: fix wrong color value mapping on MCM shaper LUT
     - net: gro: fix outer network offset
     - [amd64] drm/mgag200: fix mgag200_bmc_stop_scanout()
     - drm/xe/query: Fix topology query pointer advance
     - drm/xe/pm: Also avoid missing outer rpm warning on system suspend
     - drm/xe/pm: Disable D3Cold for BMG only on specific platforms
     - [armhf] hwmon: (occ) Mark occ_init_attribute() as __printf
     - netfilter: nf_tables: fix inverted genmask check in
       nft_map_catchall_activate()
     - ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF
     - ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update()
     - [amd64] ASoC: amd: fix memory leak in acp3x pdm dma ops
     - [arm64] ipi: tegra: Fix a memory leak in tegra_slink_probe()
     - [arm64,armhf] spi: tegra114: Preserve SPI mode bits in def_command1_reg
     - ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU.
     - gpiolib-acpi: Update file references in the Documentation and MAINTAINERS
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.71
     - net: tunnel: make skb_vlan_inet_prepare() return drop reasons
       (Closes: #1127597)
     - io_uring/rw: recycle buffers manually for non-mshot reads
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.72
     - smb: client: split cached_fid bitfields to avoid shared-byte RMW races
     - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error
       paths
     - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
     - driver core: enforce device_lock for driver_match_device()
     - Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB
     - [amd64] crypto: iaa - Fix out-of-bounds index in
       find_empty_iaa_compression_mode
     - [armhf] crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists
       correctly
     - crypto: virtio - Add spinlock protection with virtqueue notification
     - crypto: virtio - Remove duplicated virtqueue_kick in
       virtio_crypto_skcipher_crypt_req
     - nilfs2: Fix potential block overflow that cause system hang
     - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()
     - scsi: qla2xxx: Validate sp before freeing associated memory
     - scsi: qla2xxx: Allow recovery for tape devices
     - scsi: qla2xxx: Delay module unload while fabric scan in progress
     - scsi: qla2xxx: Free sp in error path to fix system crash
     - scsi: qla2xxx: Query FW again before proceeding with login
     - bus: mhi: host: pci_generic: Add Telit FE990B40 modem support
     - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (CVE-2026-23169)
     - erofs: fix UAF issue for file-backed mounts w/ directio option
     - xfs: fix UAF in xchk_btree_check_block_owner
     - PCI: endpoint: Avoid creating sub-groups asynchronously
     - wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add
     - [armhf] gpio: omap: do not register driver in probe()
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.73
     - Revert "driver core: enforce device_lock for driver_match_device()"
linux (6.12.73-1~bpo12+1) bookworm-backports; urgency=medium
 .
   * Rebuild for bookworm-backports
 .
 linux (6.12.73-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.70
     - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
     - [amd64] x86/vmware: Fix hypercall clobbers
     - [amd64] x86/kfence: fix booting on 32bit non-PAE systems
     - [amd64] platform/x86: intel_telemetry: Fix swapped arrays in PSS output
     - ALSA: aloop: Fix racy access at PCM trigger
     - [arm64] pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the
       highest state
     - [arm64] pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system
       wakeup
     - [arm64,armhf] pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong
       adb400 reset
     - [arm64] pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system
       wakeup
     - [arm64] pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains
     - mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single
     - ceph: fix NULL pointer dereference in ceph_mds_auth_match()
       (Closes: #1125405)
     - rbd: check for EOD after exclusive lock is ensured to be held
     - ceph: fix oops due to invalid pointer for kfree() in parse_longname()
     - gve: Fix stats report corruption on queue count change
     - gve: Correct ethtool rx_dropped calculation
     - mm, shmem: prevent infinite loop on truncate race
     - Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem"
     - KVM: Don't clobber irqfd routing type when deassigning irqfd
     - PCI/ERR: Ensure error recoverability at all times
     - ublk: fix deadlock when reading partition table (CVE-2025-68823)
     - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (CVE-2025-40082)
     - [arm*] binder: fix BR_FROZEN_REPLY error log
     - binderfs: fix ida_alloc_max() upper bound
     - procfs: avoid fetching build ID while holding VMA lock
     - tracing: Fix ftrace event field alignments
     - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined
     - wifi: wlcore: ensure skb headroom before skb_push
     - net: usb: sr9700: support devices with virtual driver CD
     - block,bfq: fix aux stat accumulation destination
     - smb/server: call ksmbd_session_rpc_close() on error path in
       create_smb2_pipe()
     - md: suspend array while updating raid_disks via sysfs
     - smb/server: fix refcount leak in smb2_open()
     - smb/server: fix refcount leak in parse_durable_handle_context()
     - [amd64] HID: intel-ish-hid: Update ishtp bus match to support device ID
       table
     - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL
     - btrfs: fix reservation leak in some error paths when inserting inline
       extent
     - [riscv64] Sanitize syscall table indexing under speculation
     - [amd64] HID: intel-ish-hid: Reset enum_devices_done before enumeration
     - HID: playstation: Center initial joystick axes to prevent spurious events
     - ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55
     - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk
     - [arm64] PCI: qcom: Remove ASPM L0s support for MSM8996 SoC
     - netfilter: replace -EEXIST with -EBUSY
     - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list
     - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()
     - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101)
     - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset
     - ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free
     - HID: logitech: add HID++ support for Logitech MX Anywhere 3S
     - wifi: mac80211: collect station statistics earlier when disconnect
     - ASoC: simple-card-utils: Check device node before overwrite direction
     - nvme-fc: release admin tagset if init fails
     - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
     - [amd64] ASoC: amd: yc: Fix microphone on ASUS M6500RE
     - regmap: maple: free entry on mas_store_gfp() failure
     - wifi: cfg80211: Fix bitrate calculation overflow for HE rates
     - scsi: target: iscsi: Fix use-after-free in
       iscsit_dec_session_usage_count()
     - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
     - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
     - wifi: mac80211: correctly check if CSA is active
     - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice
     - btrfs: reject new transactions if the fs is fully read-only
     - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio
     - [amd64] platform/x86: toshiba_haps: Fix memory leaks in add/remove
       routines
     - [amd64] platform/x86: intel_telemetry: Fix PSS event register mask
     - [amd64] platform/x86: hp-bioscfg: Skip empty attribute names
     - [amd64] platform/x86/intel/tpmi/plr: Make the file domain<n>/status
       writeable
     - smb/client: fix memory leak in smb2_open_file()
     - net: add skb_header_pointer_careful() helper
     - net/sched: cls_u32: use skb_header_pointer_careful()
     - net: liquidio: Initialize netdev pointer before queue setup
     - net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup
     - net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup
     - net: phy: add phy_interface_weight()
     - net: phy: add phy_interface_copy()
     - net: sfp: pre-parse the module support
     - net: sfp: convert sfp quirks to modify struct sfp_module_support
     - net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module
     - macvlan: fix error recovery in macvlan_common_newlink()
     - net: usb: r8152: fix resume reset deadlock
     - net: don't touch dev->stats in BPF redirect paths
     - tipc: use kfree_sensitive() for session key material
     - drm/amd/display: fix wrong color value mapping on MCM shaper LUT
     - net: gro: fix outer network offset
     - [amd64] drm/mgag200: fix mgag200_bmc_stop_scanout()
     - drm/xe/query: Fix topology query pointer advance
     - drm/xe/pm: Also avoid missing outer rpm warning on system suspend
     - drm/xe/pm: Disable D3Cold for BMG only on specific platforms
     - [armhf] hwmon: (occ) Mark occ_init_attribute() as __printf
     - netfilter: nf_tables: fix inverted genmask check in
       nft_map_catchall_activate()
     - ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF
     - ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update()
     - [amd64] ASoC: amd: fix memory leak in acp3x pdm dma ops
     - [arm64] ipi: tegra: Fix a memory leak in tegra_slink_probe()
     - [arm64,armhf] spi: tegra114: Preserve SPI mode bits in def_command1_reg
     - ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU.
     - gpiolib-acpi: Update file references in the Documentation and MAINTAINERS
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.71
     - net: tunnel: make skb_vlan_inet_prepare() return drop reasons
       (Closes: #1127597)
     - io_uring/rw: recycle buffers manually for non-mshot reads
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.72
     - smb: client: split cached_fid bitfields to avoid shared-byte RMW races
     - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error
       paths
     - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
     - driver core: enforce device_lock for driver_match_device()
     - Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB
     - [amd64] crypto: iaa - Fix out-of-bounds index in
       find_empty_iaa_compression_mode
     - [armhf] crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists
       correctly
     - crypto: virtio - Add spinlock protection with virtqueue notification
     - crypto: virtio - Remove duplicated virtqueue_kick in
       virtio_crypto_skcipher_crypt_req
     - nilfs2: Fix potential block overflow that cause system hang
     - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()
     - scsi: qla2xxx: Validate sp before freeing associated memory
     - scsi: qla2xxx: Allow recovery for tape devices
     - scsi: qla2xxx: Delay module unload while fabric scan in progress
     - scsi: qla2xxx: Free sp in error path to fix system crash
     - scsi: qla2xxx: Query FW again before proceeding with login
     - bus: mhi: host: pci_generic: Add Telit FE990B40 modem support
     - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (CVE-2026-23169)
     - erofs: fix UAF issue for file-backed mounts w/ directio option
     - xfs: fix UAF in xchk_btree_check_block_owner
     - PCI: endpoint: Avoid creating sub-groups asynchronously
     - wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add
     - [armhf] gpio: omap: do not register driver in probe()
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.73
     - Revert "driver core: enforce device_lock for driver_match_device()"
linux (6.12.69-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.64
     - btrfs: do not skip logging new dentries when logging a new name
     - btrfs: fix a potential path leak in print_data_reloc_error()
     - [arm64] bpf, arm64: Do not audit capability check in do_jit()
     - btrfs: fix memory leak of fs_devices in degraded seed device path
     - shmem: fix recovery on rename failures
     - iomap: adjust read range correctly for non-block-aligned positions
     - iomap: account for unaligned end offsets when truncating read range
     - scripts/faddr2line: Fix "Argument list too long" error
     - [amd64] perf/x86/amd: Check event before enable to avoid GPF
     - sched/deadline: only set free_cpus for online runqueues
     - sched/fair: Revert max_newidle_lb_cost bump
     - [amd64] x86/ptrace: Always inline trivial accessors
     - ACPICA: Avoid walking the Namespace if start_node is NULL
     - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only
     - cpufreq: dt-platdev: Add JH7110S SOC to the allowlist
     - ACPI: fan: Workaround for 64-bit firmware bug
     - cpuidle: menu: Use residency threshold in polling state override decisions
     - livepatch: Match old_sympos 0 and 1 in klp_find_func()
     - fs/ntfs3: Support timestamps prior to epoch
     - kbuild: Use objtree for module signing key path
     - ntfs: set dummy blocksize to read boot_block when mounting
     - hfsplus: fix volume corruption issue for generic/070
     - hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create
     - hfsplus: Verify inode mode when loading from disk
     - hfsplus: fix volume corruption issue for generic/073
     - fs/ntfs3: check for shutdown in fsync
     - wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU
     - wifi: cfg80211: stop radar detection in cfg80211_leave()
     - wifi: cfg80211: use cfg80211_leave() in iftype change
     - wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC
       load
     - wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet
     - btrfs: scrub: always update btrfs_scrub_progress::last_physical
     - gfs2: fix remote evict for read-only filesystems
     - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad"
     - smb/server: fix return value of smb2_ioctl()
     - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
     - ksmbd: vfs: fix race on m_flags in vfs_cache
     - Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV
     - Bluetooth: btusb: MT7922: Add VID/PID 0489/e170
     - Bluetooth: btusb: MT7920: Add VID/PID 0489/e135
     - Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE
     - Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT
     - gfs2: Fix use of bio_chain
     - [arm64,armhf] net: fec: ERR007885 Workaround for XDP TX path
     - netrom: Fix memory leak in nr_sendmsg()
     - net/sched: ets: Always remove class from active list before deleting in
       ets_qdisc_change
     - ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2()
     - bnxt_en: Fix XDP_TX path
     - net: openvswitch: fix middle attribute validation in push_nsh() action
     - broadcom: b44: prevent uninitialized value usage
     - netfilter: nf_conncount: fix leaked ct in error paths
     - ipvs: fix ipv4 null-ptr-deref in route error path
     - net/sched: ets: Remove drr class from the active list if it changes to
       strict
     - nfc: pn533: Fix error code in pn533_acr122_poweron_rdr()
     - netfilter: nf_nat: remove bogus direction check
     - netfilter: nf_tables: remove redundant chain validation on register store
     - ethtool: Avoid overflowing userspace buffer on stats query
     - net/mlx5: fw reset, clear reset requested on drain_fw_reset
     - net/mlx5: Drain firmware reset in shutdown callback
     - net/mlx5: fw_tracer, Validate format string parameters
     - net/mlx5: fw_tracer, Handle escaped percent properly
     - net/mlx5: Serialize firmware reset with devlink
     - net/handshake: duplicate handshake cancellations leak socket
     - [arm64] net: enetc: do not transmit redirected XDP frames when the link is
       down
     - [arm64] net: hns3: using the num_tqps in the vf driver to apply for
       resources
     - [arm64] net: hns3: using the num_tqps to check whether tqp_index is out of
       range when vf get ring info from mbx
     - [arm64] net: hns3: add VLAN id validation before using
     - [amd64] hwmon: (dell-smm) Limit fan multiplier to avoid overflow
     - hwmon: (ibmpex) fix use-after-free in high/low store
     - hwmon: (tmp401) fix overflow caused by default conversion rate value
     - drm/me/gsc: mei interrupt top half should be in irq disabled context
     - drm/xe: Restore engine registers before restarting schedulers after GT
       reset
     - drm/panel: sony-td4353-jdi: Enable prepare_prev_first
     - [amd64] x86/xen: Move Xen upcall handler
     - [amd64] x86/xen: Fix sparse warning in enlighten_pv.c
     - [arm64] kdump: Fix elfcorehdr overlap caused by reserved memory processing
       reorder
     - spi: cadence-quadspi: Fix clock disable on probe failure path
     - block: rnbd-clt: Fix leaked ID in init_dev()
     - drm/xe: Limit num_syncs to prevent oversized allocations
     - drm/xe/oa: Limit num_syncs to prevent oversized allocations
     - ksmbd: skip lock-range check on equal size to avoid size==0 underflow
     - ksmbd: Fix refcount leak when invalid session is found on session lookup
     - ksmbd: fix buffer validation by including null terminator size in EA
       length
     - HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen
     - Input: ti_am335x_tsc - fix off-by-one error in wire_order validation
     - Input: lkkbd - disable pending work before freeing device
     - Input: alps - fix use-after-free bugs caused by dev3_register_work
     - Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table
     - xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails
     - can: gs_usb: gs_can_open(): fix error handling
     - [arm64,armhf] soc/tegra: fuse: Do not register SoC device on ACPI boot
     - ACPI: PCC: Fix race condition by removing static qualifier
     - ACPI: CPPC: Fix missing PCC check for guaranteed_perf
     - [arm64] mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds
     - dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml
     - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()
     - [amd64] x86/fpu: Fix FPU state core dump truncation on CPUs with no
       extended xfeatures
     - ALSA: vxpocket: Fix resource leak in vxpocket_probe error path
     - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path
     - ALSA: usb-mixer: us16x08: validate meter packet indices
     - nfsd: update percpu_ref to manage references on nfsd_net
     - nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_
     - nfsd: fix memory leak in nfsd_create_serv error paths
     - ipmi: Fix the race between __scan_channels() and deliver_response()
     - ipmi: Fix __scan_channels() failing to rescan channels
     - [arm64,armhf] ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on
       AM33xx
     - scsi: smartpqi: Add support for Hurray Data new controller PCI device
     - [arm64] clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &
       pcie_x4
     - scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled
     - scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive
     - scsi: qla2xxx: Use reinit_completion on mbx_intr_comp
     - fuse: Always flush the page cache before FOPEN_DIRECT_IO write
     - fuse: Invalidate the page cache after FOPEN_DIRECT_IO write
     - via_wdt: fix critical boot hang due to unnamed resource allocation
     - reset: fix BIT macro reference
     - exfat: fix remount failure in different process environments
     - exfat: zero out post-EOF page cache on file extension
     - usbip: Fix locking bug in RT-enabled kernels
     - usb: typec: ucsi: Handle incorrect num_connectors capability
     - [armhf] iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc
       complains
     - usb: xhci: limit run_graceperiod for only usb 3.0 devices
     - usb: usb-storage: No additional quirks need to be added to the EL-R12
       optical drive.
     - libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map
     - i2c: designware: Disable SMBus interrupts to prevent storms from
       mis-configured firmware
     - nvme-fc: don't hold rport lock when putting ctrl
     - nvme-fabrics: add ENOKEY to no retry criteria for authentication failures
     - [amd64] platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS
       DMI quirks
     - [amd64] scsi: scsi_debug: Fix atomic write enable module param description
     - block: rnbd-clt: Fix signedness bug in init_dev()
     - vhost/vsock: improve RCU read sections around vhost_vsock_get()
     - cifs: Fix memory and information leak in smb3_reconfigure()
     - KEYS: trusted: Fix a memory leak in tpm2_load_cmd
     - io_uring: fix filename leak in __io_openat_prep()
     - [amd64] x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD
       SMCA systems
     - [arm64] mmc: sdhci-msm: Avoid early clock doubling during HS400 transition
     - perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister()
     - [amd64] lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit
     - [s390x] dasd: Fix gendisk parent after copy pair swap
     - wifi: mt76: Fix DTS power-limits on little endian systems
     - block: rate-limit capacity change info log
     - floppy: fix for PAGE_SIZE != 4KB
     - kallsyms: Fix wrong "big" kernel symbol type read from procfs
     - fs/ntfs3: fix mount failure for sparse runs in run_unpack()
     - tpm: Cap the number of PCR banks
     - ext4: fix string copying in parse_apply_sb_mount_options()
     - ext4: xattr: fix null pointer deref in ext4_raw_inode()
     - ext4: clear i_state_flags when alloc inode
     - ext4: fix incorrect group number assertion in mb_check_buddy
     - ext4: align max orphan file size with e2fsprogs limit
     - jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key
     - jbd2: use a weaker annotation in journal handling
     - media: v4l2-mem2mem: Fix outdated documentation
     - mptcp: schedule rtx timer only after pushing data
     - mptcp: avoid deadlock on fallback while reinjecting
     - usb: usb-storage: Maintain minimal modifications to the bcdDevice range.
     - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
     - media: pvrusb2: Fix incorrect variable used in trace message
     - usb: typec: altmodes/displayport: Drop the device reference in
       dp_altmode_probe()
     - [arm64,armhf] usb: dwc3: of-simple: fix clock resource leak in
       dwc3_of_simple_probe
     - [arm64,armhf] usb: dwc3: keep susphy enabled during exit to avoid
       controller faults
     - char: applicom: fix NULL pointer dereference in ac_ioctl
     - [amd64] intel_th: Fix error handling in intel_th_output_open
     - mei: gsc: add dependency on Xe driver
     - serial: sh-sci: Check that the DMA cookie is valid
     - cpuidle: governors: teo: Drop misguided target residency check
     - cpufreq: nforce2: fix reference count leak in nforce2
     - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort
       path"
     - scsi: aic94xx: fix use-after-free in device removal path
     - NFSD: use correct reservation type in nfsd4_scsi_fence_client
     - scsi: target: Reset t_task_cdb pointer in error case
     - scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow
     - scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error
     - f2fs: ensure node page reads complete before f2fs_put_super() finishes
     - f2fs: fix to avoid potential deadlock
     - f2fs: fix to avoid updating zero-sized extent in extent cache
     - f2fs: invalidate dentry cache on failed whiteout creation
     - f2fs: fix age extent cache insertion skip on counter overflow
     - f2fs: fix uninitialized one_time_gc in victim_sel_policy
     - f2fs: fix return value of f2fs_recover_fsync_data()
     - KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot
     - media: vidtv: initialize local pointers upon transfer of memory ownership
     - ocfs2: fix kernel BUG in ocfs2_find_victim_chain
     - [amd64] KVM: x86: Don't clear async #PF queue when CR0.PG is disabled
       (e.g. on #SMI)
     - [amd64] platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver
     - scs: fix a wrong parameter in __scs_magic
     - libceph: make decode_pool() more resilient against corrupted osdmaps
     - [powerpc*] Add reloc_offset() to font bitmap pointer used for
       bootx_printf()
     - [amd64] KVM: x86: WARN if hrtimer callback for periodic APIC timer fires
       with period=0
     - [amd64] KVM: x86: Explicitly set new periodic hrtimer expiration in
       apic_timer_fn()
     - [amd64] KVM: x86: Fix VM hard lockup after prolonged inactivity with
       periodic HV timer
     - [amd64] KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE
     - [amd64] KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN
     - [amd64] KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW
       emulation
     - [amd64] KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN
     - [amd64] KVM: nVMX: Immediately refresh APICv controls as needed on nested
       VM-Exit
     - [amd64] KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR
       (failed VMRUN)
     - [amd64] KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested
       VM-Exits
     - xfs: fix a memory leak in xfs_buf_item_init()
     - xfs: fix stupid compiler warning
     - xfs: fix a UAF problem in xattr repair
     - tracing: Do not register unsupported perf events
     - PM: runtime: Do not clear needs_force_resume with enabled runtime PM
     - r8169: fix RTL8117 Wake-on-Lan in DASH mode
     - fsnotify: do not generate ACCESS/MODIFY events on child for special files
     - net/handshake: restore destructor on submit failure
     - NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap
     - NFSD: NFSv4 file creation neglects setting ACL
     - nfsd: Mark variable __maybe_unused to avoid W=1 build break
     - svcrdma: return 0 on success from svc_rdma_copy_inline_range
     - svcrdma: use rc_pageoff for memcpy byte offset
     - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in
       gss_read_proxy_verf
     - [powerpc*] kexec: Enable SMT before waking offline CPUs
     - btrfs: don't log conflicting inode if it's a dir moved in the current
       transaction
     - [s390x] ipl: Clear SBP flag when bootprog is set
     - gpio: regmap: Fix memleak in error path in gpio_regmap_register()
     - io_uring/poll: correctly handle io_poll_add() return value on update
     - io_uring: fix min_wait wakeups for SQPOLL
     - Revert "drm/amd/display: Fix pbn to kbps Conversion"
     - drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state()
     - drm/amd/display: Fix scratch registers offsets for DCN35
     - drm/amd/display: Fix scratch registers offsets for DCN351
     - drm/displayid: pass iter to drm_find_displayid_extension()
     - ALSA: hda: cs35l41: Fix NULL pointer dereference in
       cs35l41_hda_read_acpi() (CVE-2025-68345)
     - ALSA: wavefront: Use guard() for spin locks
     - ALSA: wavefront: Clear substream pointers on close
     - [arm64] pinctrl: renesas: rzg2l: Fix ISEL restore on resume
     - hsr: hold rcu and dev lock for hsr_get_port_ndev (CVE-2025-39872)
     - sched/rt: Fix race in push_rt_task (CVE-2025-38234)
     - [arm64] KVM: arm64: Initialize HCR_EL2.E2H early
     - [arm64] KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu()
     - [arm64] Revamp HCR_EL2.E2H RES1 detection
     - dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and
       resets
     - dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains
       and resets
     - dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and
       resets
     - dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and
       resets
     - dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and
       resets
     - dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and
       resets
     - dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and
       resets
     - crypto: af_alg - zero initialize memory allocated via sock_kmalloc
     - crypto: caam - Add check for kcalloc() in test_len()
     - [arm64,armhf] amba: tegra-ahb: Fix device leak on SMMU enable
     - virtio: vdpa: Fix reference count leak in octep_sriov_enable()
     - tracing: Fix fixed array of synthetic event
     - [arm64,armhf] soc: samsung: exynos-pmu: fix device leak on regmap lookup
     - [arm64] soc: qcom: ocmem: fix device leak on lookup
     - [arm64] soc: amlogic: canvas: fix device leak on lookup
     - rpmsg: glink: fix rpmsg device leak
     - [amd64] platform/x86: intel: chtwc_int33fe: don't dereference swnode args
     - i2c: amd-mp2: fix reference leak in MP2 PCI device
     - hwmon: (max16065) Use local variable to avoid TOCTOU
     - hwmon: (max6697) fix regmap leak on probe failure
     - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU
     - hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU
     - [amd64] x86/msi: Make irq_retrigger() functional for posted MSI
     - [arm64] iommu/mediatek: fix use-after-free on probe deferral
     - fuse: fix readahead reclaim deadlock
     - wifi: rtw88: limit indirect IO under powered off for RTL8822CS
       (Closes: #1125797)
     - wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()
     - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result()
     - wifi: mac80211: do not use old MBSSID elements
     - i40e: fix scheduling in set_rx_mode
     - i40e: validate ring_len parameter against hardware-specific values
     - iavf: fix off-by-one issues in iavf_config_rss_reg()
     - idpf: reduce mbx_task schedule delay to 300us
     - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
     - Bluetooth: btusb: revert use of devm_kzalloc in btusb
     - net: mdio: aspeed: add dummy read to avoid read-after-write issue
     - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy
     - ip6_gre: make ip6gre_header() robust
     - [amd64] platform/x86: msi-laptop: add missing sysfs_remove_group()
     - [amd64] platform/x86: ibm_rtl: fix EBDA signature search pointer
       arithmetic
     - team: fix check for port enabled in
       team_queue_override_port_prio_changed()
     - [arm64,armhf] net: dsa: fix missing put_device() in
       dsa_tree_find_first_conduit()
     - amd-xgbe: reset retries and mode on RX adapt failures
     - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
     - genalloc.h: fix htmldocs warning
     - firewire: nosy: Fix dma_free_coherent() size
     - [armhf] net: dsa: b53: skip multicast entries for fdb_dump()
     - kbuild: fix compilation of dtb specified on command-line without make rule
     - net: usb: asix: validate PHY address before use
     - net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct
     - vfio/pds: Fix memory leak in pds_vfio_dirty_enable()
     - [amd64] platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI
       package parsing
     - [arm64] octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"
     - net: stmmac: fix the crash issue for zero copy XDP_TX action
     - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
     - ipv4: Fix reference count leak when using error routes with nexthop
       objects
     - net: rose: fix invalid array index in rose_kill_by_device()
     - ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT
     - RDMA/irdma: avoid invalid read in irdma_net_event
     - RDMA/efa: Remove possible negative shift
     - RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr()
     - RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db()
     - RDMA/core: always drop device refcount in ib_del_sub_device_and_put()
     - RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send
     - RDMA/bnxt_re: Fix to use correct page size for PDE table
     - md: Fix static checker warning in analyze_sbs
     - md/raid5: fix possible null-pointer dereferences in
       raid5_store_group_thread_cnt()
     - ksmbd: Fix memory leak in get_file_all_info()
     - RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation
     - RDMA/bnxt_re: fix dma_free_coherent() pointer
     - blk-mq: skip CPU offline notify on unmapped hctx
     - ntfs: Do not overwrite uptodate pages
     - [armhf] ASoC: stm32: sai: fix device leak on probe
     - [armhf] ASoC: stm32: sai: fix clk prepare imbalance on probe failure
     - [armhf] ASoC: stm32: sai: fix OF node leak on probe
     - [arm64] ASoC: codecs: lpass-tx-macro: fix SM6115 support
     - [arm64] ASoC: qcom: q6apm-dai: set flags to reflect correct operation of
       appl_ptr
     - [arm64] ASoC: qcom: q6asm-dai: perform correct state check before closing
     - [arm64] ASoC: qcom: q6adm: the the copp device only during last instance
     - [arm64] ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer
       alignment.
     - [amd64] iommu/amd: Fix pci_segment memleak in alloc_pci_segment()
     - [amd64] iommu/amd: Propagate the error code returned by __modify_irte_ga()
       in modify_irte_ga()
     - [armhf] iommu/omap: fix device leaks on probe_device()
     - [arm64] iommu/qcom: fix device leak on of_xlate()
     - [arm64,riscv64] iommu/sun50i: fix device leak on of_xlate()
     - [arm64,armhf] iommu/tegra: fix device leak on probe_device()
     - iommu: disable SVA when CONFIG_X86 is set
     - HID: logitech-dj: Remove duplicate error logging
     - fgraph: Initialize ftrace_ops->private for function graph ops
     - fgraph: Check ftrace_pids_enabled on registration for early filtering
     - PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths
     - [arm64] dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power
       regulator
     - [powerpc*] mm: Fix mprotect on book3s 32-bit
     - [powerpc*] 64s/slb: Fix SLB multihit issue during SLB preload
     - leds: leds-cros_ec: Skip LEDs without color components
     - leds: leds-lp50xx: Allow LED 0 to be added to module bank
     - leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs
     - leds: leds-lp50xx: Enable chip before any communication
     - block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs
     - [arm64,armhf] clk: samsung: exynos-clkout: Assign .num before accessing
       .hws (Closes: #1121211)
     - [arm64] mfd: max77620: Fix potential IRQ chip conflict when probing two
       devices
     - media: rc: st_rc: Fix reset control resource leak
     - media: verisilicon: Fix CPU stalls on G2 bus error
     - mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions
     - mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips
     - mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips
     - mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips
     - mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips
     - mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips
     - mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips
     - [amd64] perf/x86/amd/uncore: Fix the return value of
       amd_uncore_df_event_init() on error
     - [powerpc*] pseries/cmm: call balloon_devinfo_init() also without
       CONFIG_BALLOON_COMPACTION
     - media: adv7842: Avoid possible out-of-bounds array accesses in
       adv7842_cp_log_status()
     - firmware: stratix10-svc: Add mutex in stratix10 memory management
     - dm-ebs: Mark full buffer dirty even on partial write
     - dm-bufio: align write boundary on physical block size
     - fbdev: gbefb: fix to use physical address instead of dma address
     - fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing
     - fbdev: tcx.c fix mem_map to correct smem_start offset
     - media: cec: Fix debugfs leak on bus_register() failure
     - media: msp3400: Avoid possible out-of-bounds array accesses in
       msp3400c_thread()
     - media: platform: mtk-mdp3: fix device leaks at probe
     - media: renesas: rcar_drif: fix device node reference leak in
       rcar_drif_bond_enabled
     - media: samsung: exynos4-is: fix potential ABBA deadlock on init
     - media: TDA1997x: Remove redundant cancel_delayed_work in probe
     - media: verisilicon: Protect G2 HEVC decoder against invalid DPB index
     - media: videobuf2: Fix device reference leak in vb2_dc_alloc error path
     - media: vpif_capture: fix section mismatch
     - media: vpif_display: fix section mismatch
     - media: amphion: Cancel message work before releasing the VPU core
     - media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe
     - media: i2c: adv7842: Remove redundant cancel_delayed_work in probe
     - media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init()
     - [armhf] pmdomain: imx: Fix reference count leak in imx_gpc_probe()
     - compiler_types.h: add "auto" as a macro for "__auto_type"
     - lockd: fix vfs_test_lock() calls
     - idr: fix idr_alloc() returning an ID out of range
     - mm/page_owner: fix memory leak in page_owner_stack_fops->release()
     - [amd64] x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix
       Halo
     - tools/mm/page_owner_sort: fix timestamp comparison for stable sorting
     - samples/ftrace: Adjust LoongArch register restore order in direct calls
     - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
     - RDMA/cm: Fix leaking the multicast GID table reference
     - e1000: fix OOB in e1000_tbi_should_accept()
     - fjes: Add missing iounmap in fjes_hw_init()
     - nfsd: Drop the client reference in client_states_open()
     - net: usb: sr9700: fix incorrect command used to write single register
     - net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
     - net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to
       macb_open()
     - Revert "drm/amd: Skip power ungate during suspend for VPE"
     - drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling
     - drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma
     - drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling
     - [arm64] drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers
     - [amd64] drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg()
     - drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident
     - drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()
     - [arm64] drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse()
     - [arm64] drm/mediatek: Fix probe resource leaks
     - [arm64] drm/mediatek: Fix probe memory leak
     - [arm64] drm/mediatek: Fix probe device leaks
     - drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace
     - drm/amdkfd: bump minimum vgpr size for gfx1151
     - drm/amdkfd: Trap handler support for expert scheduling mode
     - [amd64] drm/i915: Fix format string truncation warning
     - drm/ttm: Avoid NULL pointer deref for evicted BOs
     - [amd64] drm/mgag200: Fix big-endian support
     - drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table
     - drm/xe/oa: Disallow 0 OA property values
     - drm/xe: Adjust long-running workload timeslices to reasonable values
     - drm/xe: Use usleep_range for accurate long-running workload timeslicing
     - drm/xe: Drop preempt-fences when destroying imported dma-bufs.
     - [arm64] drm/msm/dpu: Add missing NULL pointer check for pingpong interface
     - [amd64] drm/i915/gem: Zero-initialize the eb.vma array in
       i915_gem_do_execbuffer
     - drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb
     - [riscv64] lib/crypto: riscv/chacha: Avoid s0/fp register
     - gfs2: fix freeze error handling
     - btrfs: don't rewrite ret from inode_permission
     - sched/eevdf: Fix min_vruntime vs avg_vruntime
     - erofs: fix unexpected EIO under memory pressure
     - sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks
     - jbd2: fix the inconsistency between checksum and data in memory for
       journal sb
     - tty: introduce and use tty_port_tty_vhangup() helper
     - xhci: dbgtty: fix device unregister: fixup
     - f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes()
     - f2fs: use global inline_xattr_slab instead of per-sb slab cache
     - f2fs: drop inode from the donation list when the last file is closed
     - f2fs: fix to avoid updating compression context during writeback
     - serial: core: fix OF node leak
     - serial: core: Restore sysfs fwnode information
     - mptcp: pm: ignore unknown endpoint flags
     - mm/ksm: fix exec/fork inheritance support for prctl
     - svcrdma: bound check rq_pages index in inline path
     - block: freeze queue when updating zone resources
     - tpm2-sessions: Fix tpm2_read_public range checks
     - sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue()
     - sched_ext: Fix missing post-enqueue handling in
       move_local_task_to_local_dsq()
     - drm/displayid: add quirk to ignore DisplayID checksum errors
     - hrtimers: Introduce hrtimer_update_function()
     - [arm64] serial: xilinx_uartps: Use helper function
       hrtimer_update_function()
     - [arm64] serial: xilinx_uartps: fix rs485 delay_rts_after_send
     - f2fs: clear SBI_POR_DOING before initing inmem curseg
     - f2fs: add timeout in f2fs_enable_checkpoint()
     - f2fs: dump more information for f2fs_{enable,disable}_checkpoint()
     - f2fs: fix to propagate error from f2fs_enable_checkpoint()
     - gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list()
     - gpiolib: acpi: Handle deferred list via new API
     - gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter
     - gpiolib: acpi: Move quirks to a separate file
     - gpiolib: acpi: Add a quirk for Acer Nitro V15
     - gpiolib: acpi: Add quirk for ASUS ProArt PX13
     - gpiolib: acpi: Add quirk for Dell Precision 7780
     - netfilter: nft_ct: add seqadj extension for natted connections
       (CVE-2025-68206)
     - md/raid10: wait barrier before returning discard request with REQ_NOWAIT
       (CVE-2025-40325)
     - [arm64] drm/panthor: Flush shmem writes before mapping buffers
       CPU-uncached (CVE-2025-40276)
     - net: ipv6: ioam6: use consistent dst names
     - ipv6: adopt dst_dev() helper
     - net: use dst_dev_rcu() in sk_setup_caps()
     - usbnet: Fix using smp_processor_id() in preemptible code warnings
     - serial: core: Fix serial device initialization
     - tty: fix tty_port_tty_*hangup() kernel-doc
     - [amd64] x86/microcode/AMD: Select which microcode patch to load
     - media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio
     - wifi: mt76: mt7925: fix the unfinished command of regd_notifier before
       suspend
     - wifi: mt76: mt7925: fix CLC command timeout when suspend/resume
     - wifi: mt76: mt7925: add handler to hif suspend/resume event
     - idpf: add support for SW triggered interrupts
     - idpf: trigger SW interrupt when exiting wb_on_itr mode
     - idpf: add support for Tx refillqs in flow scheduling mode
     - idpf: improve when to set RE bit logic
     - idpf: simplify and fix splitq Tx packet rollback error path
     - idpf: replace flow scheduling buffer ring with buffer pool
     - idpf: stop Tx if there are insufficient buffer resources
     - idpf: remove obsolete stashing code
     - hrtimers: Make hrtimer_update_function() less expensive
     - gve: defer interrupt enabling until NAPI registration
     - block: handle zone management operations completions
     - soundwire: stream: extend sdw_alloc_stream() to take 'type' parameter
     - [arm64] ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime
     - PCI: brcmstb: Reuse pcie_cfg_data structure
     - PCI: brcmstb: Set MLW based on "num-lanes" DT property if present
     - PCI: brcmstb: Fix disabling L0s capability
     - mm/balloon_compaction: we cannot have isolated pages in the balloon list
     - mm/balloon_compaction: convert balloon_page_delete() to
       balloon_page_finalize()
     - [powerpc*] pseries/cmm: adjust BALLOON_MIGRATE when migrating pages
     - media: mediatek: vcodec: Use spinlock for context list protection lock
     - media: amphion: Add a frame flush mode for decoder
     - media: amphion: Make some vpu_v4l2 functions static
     - media: amphion: Remove vpu_vb_is_codecconfig
     - vfio/pci: Disable qword access to the PCI ROM bar
     - iomap: allocate s_dio_done_wq for async reads as well (CVE-2025-68357)
     - block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio()
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.65
     - mptcp: fallback earlier on simult connection
     - mm/page_alloc: change all pageblocks migrate type on coalescing
     - mm: simplify folio_expected_ref_count()
     - mm: consider non-anon swap cache folios in folio_expected_ref_count()
     - mptcp: ensure context reset on disconnect()
     - wifi: mac80211: Discard Beacon frames to non-broadcast address
     - [arm64] net: phy: mediatek: fix nvmem cell reference leak in
       mt798x_phy_calibration
     - drm/amdgpu: Forward VMID reservation errors
     - [amd64] cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL
       writes
     - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
     - sched/fair: Small cleanup to sched_balance_newidle()
     - sched/fair: Small cleanup to update_newidle_cost()
     - sched/fair: Proportional newidle balance
     - virtio_console: fix order of fields cols and rows
     - [armhf] pwm: stm32: Always program polarity
     - [amd64] Revert "iommu/amd: Skip enabling command/event buffers for kdump"
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.66
     - NFSD: Fix permission check for read access to executable-only files
     - nfsd: provide locking for v4_end_grace
     - nfsd: use correct loop termination in nfsd4_revoke_states()
     - nfsd: check that server is running in unlock_filesystem
     - NFSD: net ref data still needs to be freed even if net hasn't startup
     - NFSD: Remove NFSERR_EAGAIN
     - atm: Fix dma_free_coherent() size
     - net: 3com: 3c59x: fix possible null dereference in vortex_probe1()
     - [arm64] Fix cleared E0POE bit after cpu_suspend()/resume()
     - btrfs: always detect conflicting inodes when logging inode refs
     - [amd64] mei: me: add nova lake point S DID
     - lib/crypto: aes: Fix missing MMU protection for AES S-box
     - drm/amdgpu: Fix query for VPE block_type and ip_count
     - drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[]
       (Closes: #1122106)
     - [arm64,armhf] gpio: rockchip: mark the GPIO controller as sleeping
     - [arm64] pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping
     - wifi: avoid kernel-infoleak from struct iw_point
     - wifi: mac80211: restore non-chanctx injection behaviour
     - libceph: prevent potential out-of-bounds reads in handle_auth_done()
     - libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
     - libceph: make free_choose_arg_map() resilient to partial allocation
     - libceph: return the handler error from mon_handle_auth_done()
     - libceph: reset sparse-read state in osd_fault()
     - libceph: make calc_target() set t->paused, not just clear it
     - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
       (CVE-2025-40149)
     - drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally
     - drm/xe: Ensure GT is in C0 during resumes
     - dm-snapshot: fix 'scheduling while atomic' on real-time kernels
     - NFSv4: ensure the open stateid seqid doesn't go backwards
     - [arm64] ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again)
     - NFS: Fix up the automount fs_context to use the correct cred
     - drm/amd/display: shrink struct members
     - smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value
     - smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value
     - smb/client: fix NT_STATUS_NO_DATA_DETECTED value
     - scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset
     - scsi: ufs: core: Fix EH failure after W-LUN resume error
     - scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe
       failure scanned in again after probe failed"
     - btrfs: fix qgroup_snapshot_quick_inherit() squota bug
     - btrfs: qgroup: update all parent qgroups when doing quick inherit
     - btrfs: tracepoints: use btrfs_root_id() to get the id of a root
     - btrfs: fix NULL dereference on root when tracing inode eviction
     - drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files
     - drm/amd/display: Apply e4479aecf658 to dml
     - [arm64] dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema
       warnings
     - [amd64] crypto: qat - fix duplicate restarting msg during AER error
     - [arm64] dts: add off-on-delay-us for usdhc2 regulator
     - netfilter: nft_set_pipapo: fix range overlap detection
     - netfilter: nft_synproxy: avoid possible data-race on update operation
     - [arm64,armhf] gpio: pca953x: Add support for level-triggered interrupts
     - [arm64,armhf] gpio: pca953x: handle short interrupt pulses on PCAL devices
     - netfilter: nf_tables: fix memory leak in nf_tables_newrule()
     - netfilter: nf_conncount: update last_gc only when GC has been performed
     - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress
     - [arm64] net: mscc: ocelot: Fix crash when adding interface under a lag
     - inet: ping: Fix icmp out counting
     - net: sock: fix hardened usercopy panic in sock_recv_errqueue
     - netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates
     - net/mlx5e: Don't print error message due to invalid module
     - net: wwan: iosm: Fix memory leak in ipc_mux_deinit()
     - bnxt_en: Fix potential data corruption with HW GRO/LRO
     - vsock: Make accept()ed sockets use custom setsockopt()
     - btrfs: only enforce free space tree if v1 cache is required for bs < ps
       cases
     - [riscv64] pgtable: Cleanup useless VA_USER_XXX definitions
     - net: fix memory leak in skb_segment_list for GRO packets
     - idpf: keep the netdev when a reset fails
     - idpf: fix memory leak in idpf_vport_rel()
     - idpf: cap maximum Rx buffer size
     - HID: quirks: work around VID/PID conflict for appledisplay
     - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in
       qfq_reset
     - net: usb: pegasus: fix memory leak in update_eth_regs_async()
     - arp: do not assume dev_hard_header() does not change skb->head
     - erofs: don't bother with s_stack_depth increasing for now
     - erofs: fix file-backed mounts no longer working on EROFS partitions
     - ALSA: ac97bus: Use guard() for mutex locks
     - ALSA: ac97: fix a double free in snd_ac97_controller_register()
     - btrfs: fix error handling of submit_uncompressed_range()
     - btrfs: subpage: dump the involved bitmap when ASSERT() failed
     - btrfs: add extra error messages for delalloc range related errors
     - btrfs: remove btrfs_fs_info::sectors_per_page
     - btrfs: truncate ordered extent when skipping writeback past i_size
     - btrfs: use variable for end offset in extent_writepage_io()
     - btrfs: fix beyond-EOF write handling
     - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K
     - bpf: Make variables in bpf_prog_test_run_xdp less confusing
     - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN
     - bpf: Fix reference count leak in bpf_prog_test_run_xdp()
     - net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant
     - powercap: fix race condition in register_control_type()
     - powercap: fix sscanf() error return value handling
     - netfilter: nf_tables: avoid chain re-validation if possible
     - ata: libata-core: Disable LPM on ST2000DM008-2FR102
     - drm/amd/display: Fix DP no audio issue
     - [arm64] spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ
     - drm/amdkfd: Fix improper NULL termination of queue restore SMI event
       string
     - can: j1939: make j1939_session_activate() fail if device is no longer
       registered
     - ALSA: usb-audio: Update for native DSD support quirks
     - [amd64] ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025
     - ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL
     - [arm64,armhf] ASoC: fsl_sai: Add missing registers to cache default
     - scsi: sg: Fix occasional bogus elapsed time that exceeds timeout
     - spi: cadence-quadspi: Prevent lost complete() call during indirect read
     - tpm2-sessions: Fix out of range indexing in name_size (CVE-2025-68792)
     - ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.67
     - efi/cper: Fix cper_bits_to_str buffer handling and return value
     - Revert "gfs2: Fix use of bio_chain"
     - [amd64] x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
     - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation
     - xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set
     - pNFS: Fix a deadlock when returning a delegation during open()
     - NFS: Fix a deadlock involving nfs_release_folio()
     - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
     - pnfs/blocklayout: Fix memory leak in bl_parse_scsi()
     - drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions
     - PM: EM: Fix incorrect description of the cost field in struct
       em_perf_state
     - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
     - btrfs: send: check for inline extents in range_is_hole_in_parent()
     - net: bridge: annotate data-races around fdb->{updated,used}
     - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
     - net: update netdev_lock_{type,name}
     - macvlan: fix possible UAF in macvlan_forward_source()
     - ipv4: ip_gre: make ipgre_header() robust
     - net/mlx5e: Fix crash on profile change rollback failure
     - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
     - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv
     - net/mlx5e: Restore destroying state bit after profile cleanup
     - btrfs: factor out init_space_info() from create_space_info()
     - btrfs: factor out check_removing_space_info() from
       btrfs_free_block_groups()
     - btrfs: introduce btrfs_space_info sub-group
     - btrfs: fix memory leaks in create_space_info() error paths
     - ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip
     - net: hv_netvsc: reject RSS hash key programming without RX indirection
       table
     - ipv6: Fix use-after-free in inet6_addr_del().
     - net/sched: sch_qfq: do not free existing class in qfq_change_class()
     - [amd64] ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack
       type
     - drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2
     - mm: describe @flags parameter in memalloc_flags_save()
     - textsearch: describe @list member in ts_ops search
     - mm, kfence: describe @slab parameter in __kfence_obj_info()
     - [arm64] dmaengine: tegra-adma: Fix use-after-free
     - [arm64] phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before
       using it
     - [arm64] phy: phy-snps-eusb2: refactor constructs names
     - phy: drop probe registration printks
     - [arm64] phy: qcom-qusb2: Fix NULL pointer dereference on early suspend
     - [armhf] phy: stm32-usphyc: Fix off by one in probe()
     - [armhf] dmaengine: omap-dma: fix dma_pool resource leak in error paths
     - [arm64] i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA
     - HID: usbhid: paper over wrong bNumDescriptor field (Closes: #1122193)
     - bridge: mcast: Fix use-after-free during router port configuration
       (CVE-2025-38248)
     - [arm64] ASoC: codecs: wsa883x: fix unnecessary initialisation
     - drm/amd/display: mark static functions noinline_for_stack
     - io_uring: move local task_work in exit cancel loop
     - scsi: core: Fix error handler encryption support
     - ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
     - null_blk: fix kmemleak by releasing references to fault configfs items
     - can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak
     - can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit.
     - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session
       upon receiving the second rts
     - xfs: Fix the return value of xfs_rtcopy_summary()
     - lib/buildid: use __kernel_read() for sleepable context
     - [arm64] phy: rockchip: inno-usb2: fix communication disruption in gadget
       mode
     - [arm64,armhf] phy: ti: gmii-sel: fix regmap leak on probe failure
     - [arm64] phy: freescale: imx8m-pcie: assert phy reset during power on
     - [arm64] phy: rockchip: inno-usb2: fix disconnection in gadget mode
     - usb: dwc3: Check for USB4 IP_NAME
     - usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor
     - USB: OHCI/UHCI: Add soft dependencies on ehci_platform
     - USB: serial: option: add Telit LE910 MBIM composition
     - USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
     - nvme-pci: disable secondary temp for Wodposit WPBSNM8
     - [arm64] ASoC: codecs: wsa881x: fix unnecessary initialisation
     - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
     - hrtimer: Fix softirq base check in update_needs_ipi()
     - [amd64] EDAC/x38: Fix a resource leak in x38_probe1()
     - [amd64] EDAC/i3200: Fix a resource leak in i3200_probe1()
     - tcpm: allow looking for role_sw device in the main node
     - i2c: riic: Move suspend handling to NOIRQ phase
     - [amd64] x86/resctrl: Add missing resctrl initialization for Hygon
     - [amd64] x86/resctrl: Fix memory bandwidth counter width for Hygon
     - nvme: fix PCIe subsystem reset controller state transition
     - mm/zswap: fix error pointer free in zswap_cpu_comp_prepare()
     - mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free
     - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure
     - drm/amd/display: Bump the HDMI clock to 340MHz
     - drm/amd: Clean up kfd node on surprise disconnect
     - drm/amdkfd: fix a memory leak in device_queue_manager_init()
     - drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
     - [arm64,armhf] drm/panel-simple: fix connector type for DataImage
       SCF0700C48GGU18 panel
     - drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
     - [arm64] dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
     - [armhf] dmaengine: stm32: dmamux: fix device leak on route allocation
     - [armhf] dmaengine: stm32: dmamux: fix OF node leak on route allocation
       failure
     - [armhf] dmaengine: ti: dma-crossbar: fix device leak on dra7x route
       allocation
     - [armhf] dmaengine: ti: dma-crossbar: fix device leak on am335x route
       allocation
     - [amd64] HID: intel-ish-hid: Use dedicated unbound workqueues to prevent
       resume blocking
     - [amd64] HID: intel-ish-hid: Fix -Wcast-function-type-strict in
       devm_ishtp_alloc_workqueue()
     - btrfs: fix deadlock in wait_current_trans() due to ignored transaction
       type
     - xfs: set max_agbno to allow sparse alloc of last full inode chunk
     - mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure
     - mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup
       failure
     - bpf: Reject narrower access to pointer ctx fields (CVE-2025-38591)
     - mm/fake-numa: allow later numa node hotplug
     - mm: numa,memblock: include <asm/numa.h> for 'numa_nodes_parsed'
     - [arm64] phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path
     - [arm64] phy: rockchip: inno-usb2: Fix a double free bug in
       rockchip_usb2phy_probe()
     - [arm64] dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure
     - mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection
     - mm/page_alloc: batch page freeing in decay_pcp_high
     - mm/page_alloc: prevent pcp corruption with SMP=n
     - mm/fake-numa: handle cases with no SRAT info
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.68
     - posix-clock: Store file pointer in struct posix_clock_context
     - ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE.
     - dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains
     - dt-bindings: power: qcom,rpmpd: add Turbo L5 corner
     - dt-bindings: power: qcom-rpmpd: split RPMh domains definitions
     - dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO
     - [arm64] pmdomain: qcom: rpmhpd: Add MXC to SC8280XP
     - Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump()
     - btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE
     - ata: ahci: Do not read the per port area for unimplemented ports
     - ata: libata-sata: Improve link_power_management_supported sysfs attribute
     - ata: libata: Add cpr_log to ata_dev_print_features() early return
     - ata: libata-core: Introduce ata_dev_config_lpm()
     - ata: libata: Call ata_dev_config_lpm() for ATAPI devices
     - ata: libata: Print features also for ATAPI devices
     - ice: initialize ring_stats->syncp
     - ice: Avoid detrimental cleanup for bond during interface stop
     - ice: Fix incorrect timeout ice_release_res()
     - igc: Restore default Qbv schedule when changing channels
     - igc: fix race condition in TX timestamp read for register 0
     - vsock/virtio: Coalesce only linear skb
     - net: usb: dm9601: remove broken SR9700 support
     - bonding: limit BOND_MODE_8023AD to Ethernet devices
     - l2tp: Fix memleak in l2tp_udp_encap_recv().
     - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on
       usb_submit_urb() error
     - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
     - [amd64,arm64] amd-xgbe: avoid misleading per-packet error log
     - gue: Fix skb memleak with inner IP protocol 0.
     - fou: Don't allow 0 for FOU_ATTR_IPPROTO.
     - veth: fix data race in veth_get_ethtool_stats
     - l2tp: avoid one data-race in l2tp_tunnel_del_work()
     - ipvlan: Make the addrs_lock be per port
     - [arm64] octeontx2: cn10k: fix RX flowid TCAM mask handling
     - net/sched: Enforce that teql can only be used as root qdisc
     - net/sched: qfq: Use cl_is_active to determine whether class is active in
       qfq_rm_from_ag
     - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN
       spec
     - wifi: mac80211: don't perform DA check on S1G beacon
     - serial: 8250_pci: Fix broken RS485 for F81504/508/512
     - w1: therm: Fix off-by-one buffer overflow in alarms_store
     - w1: fix redundant counter decrement in w1_attach_slave_device()
     - Revert "nfc/nci: Add the inconsistency check between the input data length
       and count"
     - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
     - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
     - scsi: storvsc: Process unsupported MODE_SENSE_10
     - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
     - [arm64] dts: rockchip: remove dangerous max-link-speed from helios64
     - [arm64] dts: rockchip: Fix voltage threshold for volume keys for Pinephone
       Pro
     - [amd64] x86/kfence: avoid writing L1TF-vulnerable PTEs
     - [amd64] comedi: Fix getting range information for subdevices 16 to 255
     - [amd64] platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute
       names
     - [amd64] platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID
       macro
     - mm/rmap: fix two comments related to huge_pmd_unshare()
     - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
     - iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event
       detection
     - interconnect: debugfs: initialize src_node and dst_node to empty strings
     - regmap: Fix race condition in hwspinlock irqsave routine
     - [riscv64] clocksource: Fix stimecmp update hazard on RV32
     - [amd64] platform/x86/amd: Fix memory leak in wbrf_record()
     - scsi: core: Wake up the error handler when final completions race against
       each other
     - scsi: qla2xxx: Sanitize payload size to prevent member overflow
     - ALSA: usb: Increase volume range that triggers a warning
     - ice: Fix persistent failure in ice_get_rxfh
     - [arm64] net: hns3: fix data race in hns3_fetch_stats
     - be2net: fix data race in be_get_new_eqd
     - [arm64] net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
     - [arm64] net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
     - mISDN: annotate data-race around dev->work
     - ipv6: annotate data-race in ndisc_router_discovery()
     - usbnet: limit max_mtu based on device's hard_mtu
     - clocksource: Reduce watchdog readout delay limit to prevent false
       positives
     - sched/fair: Fix pelt clock sync when entering idle
     - drm/amd/pm: Don't clear SI SMC table when setting power limit
     - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
     - drm/nouveau: add missing DCB connector types
     - drm/nouveau: implement missing DCB connector types; gracefully handle
       unknown connectors
     - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
     - bonding: provide a net pointer to __skb_flow_dissect()
     - [arm64,armhf] net: dsa: fix off-by-one in maximum bridge ID determination
     - [arm64] octeontx2-af: Fix error handling
     - net: openvswitch: fix data race in ovs_vport_get_upcall_stats
     - vsock/virtio: fix potential underflow in virtio_transport_get_credit()
     - vsock/virtio: cap TX credit to local buffer size
     - net/sched: act_ife: avoid possible NULL deref
     - dpll: Prevent duplicate registrations
     - [amd64] x86: make page fault handling disable interrupts properly
     - tpm: Compare HMAC values in constant time
     - keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal
     - leds: led-class: Only Add LED to leds_list when it is fully ready
     - of: fix reference count leak in of_alias_scan()
     - of: platform: Use default match table for /firmware
     - iio: accel: iis328dq: fix gain values
     - iio: adc: ad9467: fix ad9434 vref mask
     - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc
       driver
     - iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot
     - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
     - ALSA: ctxfi: Fix potential OOB access in audio mixer handling
       (Closes: #1121535)
     - ALSA: scarlett2: Fix buffer overflow in config retrieval
     - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
     - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
     - mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode
     - drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)
     - wifi: ath10k: fix dma_free_coherent() pointer
     - wifi: ath12k: fix dma_free_coherent() pointer
     - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
     - wifi: rsi: Fix memory corruption due to not set vif driver data size
     - [arm64] fpsimd: signal: Allocate SSVE storage when restoring ZA
     - [arm64] Set __nocfi on swsusp_arch_resume()
     - slimbus: core: fix runtime PM imbalance on report present
     - slimbus: core: fix device reference leak on report present
     - tracing: Fix crash on synthetic stacktrace field usage
     - [amd64] intel_th: fix device leak on output open()
     - mei: trace: treat reg parameter as string
     - [s390x] ap: Fix wrong APQN fill calculation
     - netrom: fix double-free in nr_route_frame()
     - [amd64] platform/x86: hp-bioscfg: Fix automatic module loading
     - [arm64] pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq
       vpu
     - [amd64] perf/x86/intel: Do not enable BTS for guests
     - [arm64,armhf] irqchip/gic-v3-its: Avoid truncating memory addresses
     - net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick
     - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
     - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
     - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
     - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
     - drm/amdgpu: remove frame cntl for gfx v12
     - gpio: cdev: Correct return code on memory allocation failure
     - migrate: correct lock ordering for hugetlb file folios
     - [arm64] dmaengine: ti: k3-udma: Enable second resource range for BCDMA and
       PKTDMA
     - can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
     - bpf: Do not let BPF test infra emit invalid GSO types to stack
       (CVE-2025-68725)
     - [arm64] dts: rockchip: remove redundant max-link-speed from nanopi-r4s
     - iio: core: add missing mutex_destroy in iio_dev_release()
     - iio: core: Replace lockdep_set_class() + mutex_init() by combined call
     - iio: core: add separate lockdep class for info_exist_lock
     - [armhf] iio: adc: exynos_adc: fix OF populate on driver rebind
     - exfat: fix refcount leak in exfat_find (CVE-2025-68351)
     - sched_ext: Fix possible deadlock in the deferred_irq_workfn()
       (CVE-2025-68333)
     - fs/ntfs3: Initialize allocated memory before use (CVE-2025-68365)
     - [amd64] accel/ivpu: Fix race condition when unbinding BOs (CVE-2025-68749)
     - btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
       (CVE-2025-68358)
     - wifi: ath11k: fix RCU stall while reaping monitor destination ring
       (CVE-2024-58097)
     - vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put()
     - vsock/virtio: Rename virtio_vsock_alloc_skb()
     - vsock/virtio: Move SKB allocation lower-bound check to callers
     - vsock/virtio: Rename virtio_vsock_skb_rx_put()
     - vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers
     - vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers
     - net: Introduce skb_copy_datagram_from_iter_full()
     - vsock/virtio: Fix message iterator handling on transmit path
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.69
     - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
     - Bluetooth: MGMT: Fix memory leak in set_ssp_complete
     - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup()
     - can: gs_usb: gs_usb_receive_bulk_callback(): fix error message
     - bonding: annotate data-races around slave->last_rx
     - [arm64,armhf] net: mvpp2: cls: Fix memory leak in
       mvpp2_ethtool_cls_rule_ins()
     - ipv6: use the right ifindex when replying to icmpv6 from localhost
     - net: wwan: t7xx: fix potential skb->frags overflow in RX path
     - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().
     - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues
     - ice: stop counting UDP csum mismatch as rx_errors
     - net/mlx5e: TC, delete flows only for existing peers
     - nfc: nci: Fix race between rfkill and nci_unregister_device().
     - net: bridge: fix static key check
     - net: phy: micrel: fix clk warning when removing the driver
     - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect
     - net/mlx5: Initialize events outside devlink lock
     - net/mlx5: Fix vhca_id access call trace use before alloc
     - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload
     - scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
     - [amd64] ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion
     - gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler
     - gpio: virtuser: fix UAF in configfs release path
     - bcache: fix improper use of bi_end_io
     - bcache: use bio cloning for detached device requests
     - bcache: fix I/O accounting leak in detached_dev_do_request
     - dma/pool: distinguish between missing and exhausted atomic pools
     - sched/deadline: Document dl_server
     - sched/deadline: Fix 'stuck' dl_server
     - [arm64,armhf] pinctrl: meson: mark the GPIO controller as sleeping
     - [riscv64] compat: fix COMPAT_UTS_MACHINE definition
     - scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
     - [amd64] ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO
     - [arm64,armhf] gpio: pca953x: mask interrupts in irq shutdown
     - scsi: qla2xxx: edif: Fix dma_free_coherent() size
     - efivarfs: fix error propagation in efivar_entry_get()
     - nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference
       (Closes: #1122521)
     - gpio: rockchip: Stop calling pinctrl for set_direction
     - mptcp: only reset subflow errors when propagated
     - flex_proportions: make fprop_new_period() hardirq safe
     - mm/memory-failure: fix missing ->mf_stats count in hugetlb poison
     - mm/memory-failure: teach kill_accessing_process to accept hugetlb tail
       page pfn
     - mm/shmem, swap: fix race of truncate and swap entry split
     - net: fix segmentation of forwarding fraglist GRO
     - [arm64] drm/msm/a6xx: fix bogus hwcg register updates
     - drm/amdgpu/soc21: fix xclk for APUs
     - drm/amdgpu/gfx10: fix wptr reset in KGQ init
     - drm/amdgpu/gfx11: fix wptr reset in KGQ init
     - drm/amdgpu/gfx12: fix wptr reset in KGQ init
     - drm/amdgpu: fix NULL pointer dereference in
       amdgpu_gmc_filter_faults_remove
     - drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule()
     - gpiolib: acpi: Fix potential out-of-boundary left shift
     - cgroup: Fix kernfs_node UAF in css_free_rwork_fn
     - rxrpc: Fix data-race warning and potential load/store tearing
     - ksmbd: smbd: fix dma_unmap_sg() nents (CVE-2026-23093)
     - mm/kfence: randomize the freelist on initialization
     - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode
       (CVE-2024-58096)
     - Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)"
     - btrfs: prevent use-after-free on folio private data in
       btrfs_subpage_clear_uptodate()
     - net/sched: act_ife: convert comma to semicolon
     - [arm64] pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and
       SWR TX pins
     - mptcp: avoid dup SUB_CLOSED events after disconnect
     - perf: Simplify get_perf_callchain() user logic
     - perf: sched: Fix perf crash with new is_user_task() helper
     - writeback: fix 100% CPU usage when dirtytime_expire_interval is 0
     - drm/amdgpu/gfx11: adjust KGQ reset sequence
     - [arm64] pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver
     - net: mana: Change the function signature of mana_get_primary_netdev_rcu
     - RDMA/mana_ib: Handle net event for pointing to the current netdev
 .
   [ Macpaul Lin ]
   * udeb: Add USB TYPE-C and Mux modules in usb-modules (Closes: #1109090)
 .
   [ Salvatore Bonaccorso ]
   * fs/nfsd: Enable NFSD_SCSILAYOUT (NFSv4.1 server support for pNFS SCSI
     layouts)
   * [rt] Update to 6.12.66-rt15
linux (6.12.69-1~bpo12+1) bookworm-backports; urgency=medium
 .
   * Rebuild for bookworm-backports
 .
 linux (6.12.69-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.64
     - btrfs: do not skip logging new dentries when logging a new name
     - btrfs: fix a potential path leak in print_data_reloc_error()
     - [arm64] bpf, arm64: Do not audit capability check in do_jit()
     - btrfs: fix memory leak of fs_devices in degraded seed device path
     - shmem: fix recovery on rename failures
     - iomap: adjust read range correctly for non-block-aligned positions
     - iomap: account for unaligned end offsets when truncating read range
     - scripts/faddr2line: Fix "Argument list too long" error
     - [amd64] perf/x86/amd: Check event before enable to avoid GPF
     - sched/deadline: only set free_cpus for online runqueues
     - sched/fair: Revert max_newidle_lb_cost bump
     - [amd64] x86/ptrace: Always inline trivial accessors
     - ACPICA: Avoid walking the Namespace if start_node is NULL
     - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only
     - cpufreq: dt-platdev: Add JH7110S SOC to the allowlist
     - ACPI: fan: Workaround for 64-bit firmware bug
     - cpuidle: menu: Use residency threshold in polling state override decisions
     - livepatch: Match old_sympos 0 and 1 in klp_find_func()
     - fs/ntfs3: Support timestamps prior to epoch
     - kbuild: Use objtree for module signing key path
     - ntfs: set dummy blocksize to read boot_block when mounting
     - hfsplus: fix volume corruption issue for generic/070
     - hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create
     - hfsplus: Verify inode mode when loading from disk
     - hfsplus: fix volume corruption issue for generic/073
     - fs/ntfs3: check for shutdown in fsync
     - wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU
     - wifi: cfg80211: stop radar detection in cfg80211_leave()
     - wifi: cfg80211: use cfg80211_leave() in iftype change
     - wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC
       load
     - wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet
     - btrfs: scrub: always update btrfs_scrub_progress::last_physical
     - gfs2: fix remote evict for read-only filesystems
     - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad"
     - smb/server: fix return value of smb2_ioctl()
     - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
     - ksmbd: vfs: fix race on m_flags in vfs_cache
     - Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV
     - Bluetooth: btusb: MT7922: Add VID/PID 0489/e170
     - Bluetooth: btusb: MT7920: Add VID/PID 0489/e135
     - Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE
     - Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT
     - gfs2: Fix use of bio_chain
     - [arm64,armhf] net: fec: ERR007885 Workaround for XDP TX path
     - netrom: Fix memory leak in nr_sendmsg()
     - net/sched: ets: Always remove class from active list before deleting in
       ets_qdisc_change
     - ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2()
     - bnxt_en: Fix XDP_TX path
     - net: openvswitch: fix middle attribute validation in push_nsh() action
     - broadcom: b44: prevent uninitialized value usage
     - netfilter: nf_conncount: fix leaked ct in error paths
     - ipvs: fix ipv4 null-ptr-deref in route error path
     - net/sched: ets: Remove drr class from the active list if it changes to
       strict
     - nfc: pn533: Fix error code in pn533_acr122_poweron_rdr()
     - netfilter: nf_nat: remove bogus direction check
     - netfilter: nf_tables: remove redundant chain validation on register store
     - ethtool: Avoid overflowing userspace buffer on stats query
     - net/mlx5: fw reset, clear reset requested on drain_fw_reset
     - net/mlx5: Drain firmware reset in shutdown callback
     - net/mlx5: fw_tracer, Validate format string parameters
     - net/mlx5: fw_tracer, Handle escaped percent properly
     - net/mlx5: Serialize firmware reset with devlink
     - net/handshake: duplicate handshake cancellations leak socket
     - [arm64] net: enetc: do not transmit redirected XDP frames when the link is
       down
     - [arm64] net: hns3: using the num_tqps in the vf driver to apply for
       resources
     - [arm64] net: hns3: using the num_tqps to check whether tqp_index is out of
       range when vf get ring info from mbx
     - [arm64] net: hns3: add VLAN id validation before using
     - [amd64] hwmon: (dell-smm) Limit fan multiplier to avoid overflow
     - hwmon: (ibmpex) fix use-after-free in high/low store
     - hwmon: (tmp401) fix overflow caused by default conversion rate value
     - drm/me/gsc: mei interrupt top half should be in irq disabled context
     - drm/xe: Restore engine registers before restarting schedulers after GT
       reset
     - drm/panel: sony-td4353-jdi: Enable prepare_prev_first
     - [amd64] x86/xen: Move Xen upcall handler
     - [amd64] x86/xen: Fix sparse warning in enlighten_pv.c
     - [arm64] kdump: Fix elfcorehdr overlap caused by reserved memory processing
       reorder
     - spi: cadence-quadspi: Fix clock disable on probe failure path
     - block: rnbd-clt: Fix leaked ID in init_dev()
     - drm/xe: Limit num_syncs to prevent oversized allocations
     - drm/xe/oa: Limit num_syncs to prevent oversized allocations
     - ksmbd: skip lock-range check on equal size to avoid size==0 underflow
     - ksmbd: Fix refcount leak when invalid session is found on session lookup
     - ksmbd: fix buffer validation by including null terminator size in EA
       length
     - HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen
     - Input: ti_am335x_tsc - fix off-by-one error in wire_order validation
     - Input: lkkbd - disable pending work before freeing device
     - Input: alps - fix use-after-free bugs caused by dev3_register_work
     - Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table
     - xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails
     - can: gs_usb: gs_can_open(): fix error handling
     - [arm64,armhf] soc/tegra: fuse: Do not register SoC device on ACPI boot
     - ACPI: PCC: Fix race condition by removing static qualifier
     - ACPI: CPPC: Fix missing PCC check for guaranteed_perf
     - [arm64] mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds
     - dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml
     - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()
     - [amd64] x86/fpu: Fix FPU state core dump truncation on CPUs with no
       extended xfeatures
     - ALSA: vxpocket: Fix resource leak in vxpocket_probe error path
     - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path
     - ALSA: usb-mixer: us16x08: validate meter packet indices
     - nfsd: update percpu_ref to manage references on nfsd_net
     - nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_
     - nfsd: fix memory leak in nfsd_create_serv error paths
     - ipmi: Fix the race between __scan_channels() and deliver_response()
     - ipmi: Fix __scan_channels() failing to rescan channels
     - [arm64,armhf] ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on
       AM33xx
     - scsi: smartpqi: Add support for Hurray Data new controller PCI device
     - [arm64] clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &
       pcie_x4
     - scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled
     - scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive
     - scsi: qla2xxx: Use reinit_completion on mbx_intr_comp
     - fuse: Always flush the page cache before FOPEN_DIRECT_IO write
     - fuse: Invalidate the page cache after FOPEN_DIRECT_IO write
     - via_wdt: fix critical boot hang due to unnamed resource allocation
     - reset: fix BIT macro reference
     - exfat: fix remount failure in different process environments
     - exfat: zero out post-EOF page cache on file extension
     - usbip: Fix locking bug in RT-enabled kernels
     - usb: typec: ucsi: Handle incorrect num_connectors capability
     - [armhf] iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc
       complains
     - usb: xhci: limit run_graceperiod for only usb 3.0 devices
     - usb: usb-storage: No additional quirks need to be added to the EL-R12
       optical drive.
     - libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map
     - i2c: designware: Disable SMBus interrupts to prevent storms from
       mis-configured firmware
     - nvme-fc: don't hold rport lock when putting ctrl
     - nvme-fabrics: add ENOKEY to no retry criteria for authentication failures
     - [amd64] platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS
       DMI quirks
     - [amd64] scsi: scsi_debug: Fix atomic write enable module param description
     - block: rnbd-clt: Fix signedness bug in init_dev()
     - vhost/vsock: improve RCU read sections around vhost_vsock_get()
     - cifs: Fix memory and information leak in smb3_reconfigure()
     - KEYS: trusted: Fix a memory leak in tpm2_load_cmd
     - io_uring: fix filename leak in __io_openat_prep()
     - [amd64] x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD
       SMCA systems
     - [arm64] mmc: sdhci-msm: Avoid early clock doubling during HS400 transition
     - perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister()
     - [amd64] lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit
     - [s390x] dasd: Fix gendisk parent after copy pair swap
     - wifi: mt76: Fix DTS power-limits on little endian systems
     - block: rate-limit capacity change info log
     - floppy: fix for PAGE_SIZE != 4KB
     - kallsyms: Fix wrong "big" kernel symbol type read from procfs
     - fs/ntfs3: fix mount failure for sparse runs in run_unpack()
     - tpm: Cap the number of PCR banks
     - ext4: fix string copying in parse_apply_sb_mount_options()
     - ext4: xattr: fix null pointer deref in ext4_raw_inode()
     - ext4: clear i_state_flags when alloc inode
     - ext4: fix incorrect group number assertion in mb_check_buddy
     - ext4: align max orphan file size with e2fsprogs limit
     - jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key
     - jbd2: use a weaker annotation in journal handling
     - media: v4l2-mem2mem: Fix outdated documentation
     - mptcp: schedule rtx timer only after pushing data
     - mptcp: avoid deadlock on fallback while reinjecting
     - usb: usb-storage: Maintain minimal modifications to the bcdDevice range.
     - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
     - media: pvrusb2: Fix incorrect variable used in trace message
     - usb: typec: altmodes/displayport: Drop the device reference in
       dp_altmode_probe()
     - [arm64,armhf] usb: dwc3: of-simple: fix clock resource leak in
       dwc3_of_simple_probe
     - [arm64,armhf] usb: dwc3: keep susphy enabled during exit to avoid
       controller faults
     - char: applicom: fix NULL pointer dereference in ac_ioctl
     - [amd64] intel_th: Fix error handling in intel_th_output_open
     - mei: gsc: add dependency on Xe driver
     - serial: sh-sci: Check that the DMA cookie is valid
     - cpuidle: governors: teo: Drop misguided target residency check
     - cpufreq: nforce2: fix reference count leak in nforce2
     - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort
       path"
     - scsi: aic94xx: fix use-after-free in device removal path
     - NFSD: use correct reservation type in nfsd4_scsi_fence_client
     - scsi: target: Reset t_task_cdb pointer in error case
     - scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow
     - scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error
     - f2fs: ensure node page reads complete before f2fs_put_super() finishes
     - f2fs: fix to avoid potential deadlock
     - f2fs: fix to avoid updating zero-sized extent in extent cache
     - f2fs: invalidate dentry cache on failed whiteout creation
     - f2fs: fix age extent cache insertion skip on counter overflow
     - f2fs: fix uninitialized one_time_gc in victim_sel_policy
     - f2fs: fix return value of f2fs_recover_fsync_data()
     - KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot
     - media: vidtv: initialize local pointers upon transfer of memory ownership
     - ocfs2: fix kernel BUG in ocfs2_find_victim_chain
     - [amd64] KVM: x86: Don't clear async #PF queue when CR0.PG is disabled
       (e.g. on #SMI)
     - [amd64] platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver
     - scs: fix a wrong parameter in __scs_magic
     - libceph: make decode_pool() more resilient against corrupted osdmaps
     - [powerpc*] Add reloc_offset() to font bitmap pointer used for
       bootx_printf()
     - [amd64] KVM: x86: WARN if hrtimer callback for periodic APIC timer fires
       with period=0
     - [amd64] KVM: x86: Explicitly set new periodic hrtimer expiration in
       apic_timer_fn()
     - [amd64] KVM: x86: Fix VM hard lockup after prolonged inactivity with
       periodic HV timer
     - [amd64] KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE
     - [amd64] KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN
     - [amd64] KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW
       emulation
     - [amd64] KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN
     - [amd64] KVM: nVMX: Immediately refresh APICv controls as needed on nested
       VM-Exit
     - [amd64] KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR
       (failed VMRUN)
     - [amd64] KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested
       VM-Exits
     - xfs: fix a memory leak in xfs_buf_item_init()
     - xfs: fix stupid compiler warning
     - xfs: fix a UAF problem in xattr repair
     - tracing: Do not register unsupported perf events
     - PM: runtime: Do not clear needs_force_resume with enabled runtime PM
     - r8169: fix RTL8117 Wake-on-Lan in DASH mode
     - fsnotify: do not generate ACCESS/MODIFY events on child for special files
     - net/handshake: restore destructor on submit failure
     - NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap
     - NFSD: NFSv4 file creation neglects setting ACL
     - nfsd: Mark variable __maybe_unused to avoid W=1 build break
     - svcrdma: return 0 on success from svc_rdma_copy_inline_range
     - svcrdma: use rc_pageoff for memcpy byte offset
     - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in
       gss_read_proxy_verf
     - [powerpc*] kexec: Enable SMT before waking offline CPUs
     - btrfs: don't log conflicting inode if it's a dir moved in the current
       transaction
     - [s390x] ipl: Clear SBP flag when bootprog is set
     - gpio: regmap: Fix memleak in error path in gpio_regmap_register()
     - io_uring/poll: correctly handle io_poll_add() return value on update
     - io_uring: fix min_wait wakeups for SQPOLL
     - Revert "drm/amd/display: Fix pbn to kbps Conversion"
     - drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state()
     - drm/amd/display: Fix scratch registers offsets for DCN35
     - drm/amd/display: Fix scratch registers offsets for DCN351
     - drm/displayid: pass iter to drm_find_displayid_extension()
     - ALSA: hda: cs35l41: Fix NULL pointer dereference in
       cs35l41_hda_read_acpi() (CVE-2025-68345)
     - ALSA: wavefront: Use guard() for spin locks
     - ALSA: wavefront: Clear substream pointers on close
     - [arm64] pinctrl: renesas: rzg2l: Fix ISEL restore on resume
     - hsr: hold rcu and dev lock for hsr_get_port_ndev (CVE-2025-39872)
     - sched/rt: Fix race in push_rt_task (CVE-2025-38234)
     - [arm64] KVM: arm64: Initialize HCR_EL2.E2H early
     - [arm64] KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu()
     - [arm64] Revamp HCR_EL2.E2H RES1 detection
     - dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and
       resets
     - dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains
       and resets
     - dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and
       resets
     - dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and
       resets
     - dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and
       resets
     - dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and
       resets
     - dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and
       resets
     - crypto: af_alg - zero initialize memory allocated via sock_kmalloc
     - crypto: caam - Add check for kcalloc() in test_len()
     - [arm64,armhf] amba: tegra-ahb: Fix device leak on SMMU enable
     - virtio: vdpa: Fix reference count leak in octep_sriov_enable()
     - tracing: Fix fixed array of synthetic event
     - [arm64,armhf] soc: samsung: exynos-pmu: fix device leak on regmap lookup
     - [arm64] soc: qcom: ocmem: fix device leak on lookup
     - [arm64] soc: amlogic: canvas: fix device leak on lookup
     - rpmsg: glink: fix rpmsg device leak
     - [amd64] platform/x86: intel: chtwc_int33fe: don't dereference swnode args
     - i2c: amd-mp2: fix reference leak in MP2 PCI device
     - hwmon: (max16065) Use local variable to avoid TOCTOU
     - hwmon: (max6697) fix regmap leak on probe failure
     - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU
     - hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU
     - [amd64] x86/msi: Make irq_retrigger() functional for posted MSI
     - [arm64] iommu/mediatek: fix use-after-free on probe deferral
     - fuse: fix readahead reclaim deadlock
     - wifi: rtw88: limit indirect IO under powered off for RTL8822CS
       (Closes: #1125797)
     - wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()
     - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result()
     - wifi: mac80211: do not use old MBSSID elements
     - i40e: fix scheduling in set_rx_mode
     - i40e: validate ring_len parameter against hardware-specific values
     - iavf: fix off-by-one issues in iavf_config_rss_reg()
     - idpf: reduce mbx_task schedule delay to 300us
     - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
     - Bluetooth: btusb: revert use of devm_kzalloc in btusb
     - net: mdio: aspeed: add dummy read to avoid read-after-write issue
     - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy
     - ip6_gre: make ip6gre_header() robust
     - [amd64] platform/x86: msi-laptop: add missing sysfs_remove_group()
     - [amd64] platform/x86: ibm_rtl: fix EBDA signature search pointer
       arithmetic
     - team: fix check for port enabled in
       team_queue_override_port_prio_changed()
     - [arm64,armhf] net: dsa: fix missing put_device() in
       dsa_tree_find_first_conduit()
     - amd-xgbe: reset retries and mode on RX adapt failures
     - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
     - genalloc.h: fix htmldocs warning
     - firewire: nosy: Fix dma_free_coherent() size
     - [armhf] net: dsa: b53: skip multicast entries for fdb_dump()
     - kbuild: fix compilation of dtb specified on command-line without make rule
     - net: usb: asix: validate PHY address before use
     - net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct
     - vfio/pds: Fix memory leak in pds_vfio_dirty_enable()
     - [amd64] platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI
       package parsing
     - [arm64] octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"
     - net: stmmac: fix the crash issue for zero copy XDP_TX action
     - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
     - ipv4: Fix reference count leak when using error routes with nexthop
       objects
     - net: rose: fix invalid array index in rose_kill_by_device()
     - ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT
     - RDMA/irdma: avoid invalid read in irdma_net_event
     - RDMA/efa: Remove possible negative shift
     - RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr()
     - RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db()
     - RDMA/core: always drop device refcount in ib_del_sub_device_and_put()
     - RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send
     - RDMA/bnxt_re: Fix to use correct page size for PDE table
     - md: Fix static checker warning in analyze_sbs
     - md/raid5: fix possible null-pointer dereferences in
       raid5_store_group_thread_cnt()
     - ksmbd: Fix memory leak in get_file_all_info()
     - RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation
     - RDMA/bnxt_re: fix dma_free_coherent() pointer
     - blk-mq: skip CPU offline notify on unmapped hctx
     - ntfs: Do not overwrite uptodate pages
     - [armhf] ASoC: stm32: sai: fix device leak on probe
     - [armhf] ASoC: stm32: sai: fix clk prepare imbalance on probe failure
     - [armhf] ASoC: stm32: sai: fix OF node leak on probe
     - [arm64] ASoC: codecs: lpass-tx-macro: fix SM6115 support
     - [arm64] ASoC: qcom: q6apm-dai: set flags to reflect correct operation of
       appl_ptr
     - [arm64] ASoC: qcom: q6asm-dai: perform correct state check before closing
     - [arm64] ASoC: qcom: q6adm: the the copp device only during last instance
     - [arm64] ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer
       alignment.
     - [amd64] iommu/amd: Fix pci_segment memleak in alloc_pci_segment()
     - [amd64] iommu/amd: Propagate the error code returned by __modify_irte_ga()
       in modify_irte_ga()
     - [armhf] iommu/omap: fix device leaks on probe_device()
     - [arm64] iommu/qcom: fix device leak on of_xlate()
     - [arm64,riscv64] iommu/sun50i: fix device leak on of_xlate()
     - [arm64,armhf] iommu/tegra: fix device leak on probe_device()
     - iommu: disable SVA when CONFIG_X86 is set
     - HID: logitech-dj: Remove duplicate error logging
     - fgraph: Initialize ftrace_ops->private for function graph ops
     - fgraph: Check ftrace_pids_enabled on registration for early filtering
     - PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths
     - [arm64] dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power
       regulator
     - [powerpc*] mm: Fix mprotect on book3s 32-bit
     - [powerpc*] 64s/slb: Fix SLB multihit issue during SLB preload
     - leds: leds-cros_ec: Skip LEDs without color components
     - leds: leds-lp50xx: Allow LED 0 to be added to module bank
     - leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs
     - leds: leds-lp50xx: Enable chip before any communication
     - block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs
     - [arm64,armhf] clk: samsung: exynos-clkout: Assign .num before accessing
       .hws (Closes: #1121211)
     - [arm64] mfd: max77620: Fix potential IRQ chip conflict when probing two
       devices
     - media: rc: st_rc: Fix reset control resource leak
     - media: verisilicon: Fix CPU stalls on G2 bus error
     - mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions
     - mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips
     - mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips
     - mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips
     - mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips
     - mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips
     - mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips
     - [amd64] perf/x86/amd/uncore: Fix the return value of
       amd_uncore_df_event_init() on error
     - [powerpc*] pseries/cmm: call balloon_devinfo_init() also without
       CONFIG_BALLOON_COMPACTION
     - media: adv7842: Avoid possible out-of-bounds array accesses in
       adv7842_cp_log_status()
     - firmware: stratix10-svc: Add mutex in stratix10 memory management
     - dm-ebs: Mark full buffer dirty even on partial write
     - dm-bufio: align write boundary on physical block size
     - fbdev: gbefb: fix to use physical address instead of dma address
     - fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing
     - fbdev: tcx.c fix mem_map to correct smem_start offset
     - media: cec: Fix debugfs leak on bus_register() failure
     - media: msp3400: Avoid possible out-of-bounds array accesses in
       msp3400c_thread()
     - media: platform: mtk-mdp3: fix device leaks at probe
     - media: renesas: rcar_drif: fix device node reference leak in
       rcar_drif_bond_enabled
     - media: samsung: exynos4-is: fix potential ABBA deadlock on init
     - media: TDA1997x: Remove redundant cancel_delayed_work in probe
     - media: verisilicon: Protect G2 HEVC decoder against invalid DPB index
     - media: videobuf2: Fix device reference leak in vb2_dc_alloc error path
     - media: vpif_capture: fix section mismatch
     - media: vpif_display: fix section mismatch
     - media: amphion: Cancel message work before releasing the VPU core
     - media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe
     - media: i2c: adv7842: Remove redundant cancel_delayed_work in probe
     - media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init()
     - [armhf] pmdomain: imx: Fix reference count leak in imx_gpc_probe()
     - compiler_types.h: add "auto" as a macro for "__auto_type"
     - lockd: fix vfs_test_lock() calls
     - idr: fix idr_alloc() returning an ID out of range
     - mm/page_owner: fix memory leak in page_owner_stack_fops->release()
     - [amd64] x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix
       Halo
     - tools/mm/page_owner_sort: fix timestamp comparison for stable sorting
     - samples/ftrace: Adjust LoongArch register restore order in direct calls
     - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
     - RDMA/cm: Fix leaking the multicast GID table reference
     - e1000: fix OOB in e1000_tbi_should_accept()
     - fjes: Add missing iounmap in fjes_hw_init()
     - nfsd: Drop the client reference in client_states_open()
     - net: usb: sr9700: fix incorrect command used to write single register
     - net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
     - net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to
       macb_open()
     - Revert "drm/amd: Skip power ungate during suspend for VPE"
     - drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling
     - drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma
     - drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling
     - [arm64] drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers
     - [amd64] drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg()
     - drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident
     - drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()
     - [arm64] drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse()
     - [arm64] drm/mediatek: Fix probe resource leaks
     - [arm64] drm/mediatek: Fix probe memory leak
     - [arm64] drm/mediatek: Fix probe device leaks
     - drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace
     - drm/amdkfd: bump minimum vgpr size for gfx1151
     - drm/amdkfd: Trap handler support for expert scheduling mode
     - [amd64] drm/i915: Fix format string truncation warning
     - drm/ttm: Avoid NULL pointer deref for evicted BOs
     - [amd64] drm/mgag200: Fix big-endian support
     - drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table
     - drm/xe/oa: Disallow 0 OA property values
     - drm/xe: Adjust long-running workload timeslices to reasonable values
     - drm/xe: Use usleep_range for accurate long-running workload timeslicing
     - drm/xe: Drop preempt-fences when destroying imported dma-bufs.
     - [arm64] drm/msm/dpu: Add missing NULL pointer check for pingpong interface
     - [amd64] drm/i915/gem: Zero-initialize the eb.vma array in
       i915_gem_do_execbuffer
     - drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb
     - [riscv64] lib/crypto: riscv/chacha: Avoid s0/fp register
     - gfs2: fix freeze error handling
     - btrfs: don't rewrite ret from inode_permission
     - sched/eevdf: Fix min_vruntime vs avg_vruntime
     - erofs: fix unexpected EIO under memory pressure
     - sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks
     - jbd2: fix the inconsistency between checksum and data in memory for
       journal sb
     - tty: introduce and use tty_port_tty_vhangup() helper
     - xhci: dbgtty: fix device unregister: fixup
     - f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes()
     - f2fs: use global inline_xattr_slab instead of per-sb slab cache
     - f2fs: drop inode from the donation list when the last file is closed
     - f2fs: fix to avoid updating compression context during writeback
     - serial: core: fix OF node leak
     - serial: core: Restore sysfs fwnode information
     - mptcp: pm: ignore unknown endpoint flags
     - mm/ksm: fix exec/fork inheritance support for prctl
     - svcrdma: bound check rq_pages index in inline path
     - block: freeze queue when updating zone resources
     - tpm2-sessions: Fix tpm2_read_public range checks
     - sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue()
     - sched_ext: Fix missing post-enqueue handling in
       move_local_task_to_local_dsq()
     - drm/displayid: add quirk to ignore DisplayID checksum errors
     - hrtimers: Introduce hrtimer_update_function()
     - [arm64] serial: xilinx_uartps: Use helper function
       hrtimer_update_function()
     - [arm64] serial: xilinx_uartps: fix rs485 delay_rts_after_send
     - f2fs: clear SBI_POR_DOING before initing inmem curseg
     - f2fs: add timeout in f2fs_enable_checkpoint()
     - f2fs: dump more information for f2fs_{enable,disable}_checkpoint()
     - f2fs: fix to propagate error from f2fs_enable_checkpoint()
     - gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list()
     - gpiolib: acpi: Handle deferred list via new API
     - gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter
     - gpiolib: acpi: Move quirks to a separate file
     - gpiolib: acpi: Add a quirk for Acer Nitro V15
     - gpiolib: acpi: Add quirk for ASUS ProArt PX13
     - gpiolib: acpi: Add quirk for Dell Precision 7780
     - netfilter: nft_ct: add seqadj extension for natted connections
       (CVE-2025-68206)
     - md/raid10: wait barrier before returning discard request with REQ_NOWAIT
       (CVE-2025-40325)
     - [arm64] drm/panthor: Flush shmem writes before mapping buffers
       CPU-uncached (CVE-2025-40276)
     - net: ipv6: ioam6: use consistent dst names
     - ipv6: adopt dst_dev() helper
     - net: use dst_dev_rcu() in sk_setup_caps()
     - usbnet: Fix using smp_processor_id() in preemptible code warnings
     - serial: core: Fix serial device initialization
     - tty: fix tty_port_tty_*hangup() kernel-doc
     - [amd64] x86/microcode/AMD: Select which microcode patch to load
     - media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio
     - wifi: mt76: mt7925: fix the unfinished command of regd_notifier before
       suspend
     - wifi: mt76: mt7925: fix CLC command timeout when suspend/resume
     - wifi: mt76: mt7925: add handler to hif suspend/resume event
     - idpf: add support for SW triggered interrupts
     - idpf: trigger SW interrupt when exiting wb_on_itr mode
     - idpf: add support for Tx refillqs in flow scheduling mode
     - idpf: improve when to set RE bit logic
     - idpf: simplify and fix splitq Tx packet rollback error path
     - idpf: replace flow scheduling buffer ring with buffer pool
     - idpf: stop Tx if there are insufficient buffer resources
     - idpf: remove obsolete stashing code
     - hrtimers: Make hrtimer_update_function() less expensive
     - gve: defer interrupt enabling until NAPI registration
     - block: handle zone management operations completions
     - soundwire: stream: extend sdw_alloc_stream() to take 'type' parameter
     - [arm64] ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime
     - PCI: brcmstb: Reuse pcie_cfg_data structure
     - PCI: brcmstb: Set MLW based on "num-lanes" DT property if present
     - PCI: brcmstb: Fix disabling L0s capability
     - mm/balloon_compaction: we cannot have isolated pages in the balloon list
     - mm/balloon_compaction: convert balloon_page_delete() to
       balloon_page_finalize()
     - [powerpc*] pseries/cmm: adjust BALLOON_MIGRATE when migrating pages
     - media: mediatek: vcodec: Use spinlock for context list protection lock
     - media: amphion: Add a frame flush mode for decoder
     - media: amphion: Make some vpu_v4l2 functions static
     - media: amphion: Remove vpu_vb_is_codecconfig
     - vfio/pci: Disable qword access to the PCI ROM bar
     - iomap: allocate s_dio_done_wq for async reads as well (CVE-2025-68357)
     - block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio()
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.65
     - mptcp: fallback earlier on simult connection
     - mm/page_alloc: change all pageblocks migrate type on coalescing
     - mm: simplify folio_expected_ref_count()
     - mm: consider non-anon swap cache folios in folio_expected_ref_count()
     - mptcp: ensure context reset on disconnect()
     - wifi: mac80211: Discard Beacon frames to non-broadcast address
     - [arm64] net: phy: mediatek: fix nvmem cell reference leak in
       mt798x_phy_calibration
     - drm/amdgpu: Forward VMID reservation errors
     - [amd64] cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL
       writes
     - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
     - sched/fair: Small cleanup to sched_balance_newidle()
     - sched/fair: Small cleanup to update_newidle_cost()
     - sched/fair: Proportional newidle balance
     - virtio_console: fix order of fields cols and rows
     - [armhf] pwm: stm32: Always program polarity
     - [amd64] Revert "iommu/amd: Skip enabling command/event buffers for kdump"
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.66
     - NFSD: Fix permission check for read access to executable-only files
     - nfsd: provide locking for v4_end_grace
     - nfsd: use correct loop termination in nfsd4_revoke_states()
     - nfsd: check that server is running in unlock_filesystem
     - NFSD: net ref data still needs to be freed even if net hasn't startup
     - NFSD: Remove NFSERR_EAGAIN
     - atm: Fix dma_free_coherent() size
     - net: 3com: 3c59x: fix possible null dereference in vortex_probe1()
     - [arm64] Fix cleared E0POE bit after cpu_suspend()/resume()
     - btrfs: always detect conflicting inodes when logging inode refs
     - [amd64] mei: me: add nova lake point S DID
     - lib/crypto: aes: Fix missing MMU protection for AES S-box
     - drm/amdgpu: Fix query for VPE block_type and ip_count
     - drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[]
       (Closes: #1122106)
     - [arm64,armhf] gpio: rockchip: mark the GPIO controller as sleeping
     - [arm64] pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping
     - wifi: avoid kernel-infoleak from struct iw_point
     - wifi: mac80211: restore non-chanctx injection behaviour
     - libceph: prevent potential out-of-bounds reads in handle_auth_done()
     - libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
     - libceph: make free_choose_arg_map() resilient to partial allocation
     - libceph: return the handler error from mon_handle_auth_done()
     - libceph: reset sparse-read state in osd_fault()
     - libceph: make calc_target() set t->paused, not just clear it
     - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
       (CVE-2025-40149)
     - drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally
     - drm/xe: Ensure GT is in C0 during resumes
     - dm-snapshot: fix 'scheduling while atomic' on real-time kernels
     - NFSv4: ensure the open stateid seqid doesn't go backwards
     - [arm64] ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again)
     - NFS: Fix up the automount fs_context to use the correct cred
     - drm/amd/display: shrink struct members
     - smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value
     - smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value
     - smb/client: fix NT_STATUS_NO_DATA_DETECTED value
     - scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset
     - scsi: ufs: core: Fix EH failure after W-LUN resume error
     - scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe
       failure scanned in again after probe failed"
     - btrfs: fix qgroup_snapshot_quick_inherit() squota bug
     - btrfs: qgroup: update all parent qgroups when doing quick inherit
     - btrfs: tracepoints: use btrfs_root_id() to get the id of a root
     - btrfs: fix NULL dereference on root when tracing inode eviction
     - drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files
     - drm/amd/display: Apply e4479aecf658 to dml
     - [arm64] dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema
       warnings
     - [amd64] crypto: qat - fix duplicate restarting msg during AER error
     - [arm64] dts: add off-on-delay-us for usdhc2 regulator
     - netfilter: nft_set_pipapo: fix range overlap detection
     - netfilter: nft_synproxy: avoid possible data-race on update operation
     - [arm64,armhf] gpio: pca953x: Add support for level-triggered interrupts
     - [arm64,armhf] gpio: pca953x: handle short interrupt pulses on PCAL devices
     - netfilter: nf_tables: fix memory leak in nf_tables_newrule()
     - netfilter: nf_conncount: update last_gc only when GC has been performed
     - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress
     - [arm64] net: mscc: ocelot: Fix crash when adding interface under a lag
     - inet: ping: Fix icmp out counting
     - net: sock: fix hardened usercopy panic in sock_recv_errqueue
     - netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates
     - net/mlx5e: Don't print error message due to invalid module
     - net: wwan: iosm: Fix memory leak in ipc_mux_deinit()
     - bnxt_en: Fix potential data corruption with HW GRO/LRO
     - vsock: Make accept()ed sockets use custom setsockopt()
     - btrfs: only enforce free space tree if v1 cache is required for bs < ps
       cases
     - [riscv64] pgtable: Cleanup useless VA_USER_XXX definitions
     - net: fix memory leak in skb_segment_list for GRO packets
     - idpf: keep the netdev when a reset fails
     - idpf: fix memory leak in idpf_vport_rel()
     - idpf: cap maximum Rx buffer size
     - HID: quirks: work around VID/PID conflict for appledisplay
     - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in
       qfq_reset
     - net: usb: pegasus: fix memory leak in update_eth_regs_async()
     - arp: do not assume dev_hard_header() does not change skb->head
     - erofs: don't bother with s_stack_depth increasing for now
     - erofs: fix file-backed mounts no longer working on EROFS partitions
     - ALSA: ac97bus: Use guard() for mutex locks
     - ALSA: ac97: fix a double free in snd_ac97_controller_register()
     - btrfs: fix error handling of submit_uncompressed_range()
     - btrfs: subpage: dump the involved bitmap when ASSERT() failed
     - btrfs: add extra error messages for delalloc range related errors
     - btrfs: remove btrfs_fs_info::sectors_per_page
     - btrfs: truncate ordered extent when skipping writeback past i_size
     - btrfs: use variable for end offset in extent_writepage_io()
     - btrfs: fix beyond-EOF write handling
     - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K
     - bpf: Make variables in bpf_prog_test_run_xdp less confusing
     - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN
     - bpf: Fix reference count leak in bpf_prog_test_run_xdp()
     - net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant
     - powercap: fix race condition in register_control_type()
     - powercap: fix sscanf() error return value handling
     - netfilter: nf_tables: avoid chain re-validation if possible
     - ata: libata-core: Disable LPM on ST2000DM008-2FR102
     - drm/amd/display: Fix DP no audio issue
     - [arm64] spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ
     - drm/amdkfd: Fix improper NULL termination of queue restore SMI event
       string
     - can: j1939: make j1939_session_activate() fail if device is no longer
       registered
     - ALSA: usb-audio: Update for native DSD support quirks
     - [amd64] ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025
     - ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL
     - [arm64,armhf] ASoC: fsl_sai: Add missing registers to cache default
     - scsi: sg: Fix occasional bogus elapsed time that exceeds timeout
     - spi: cadence-quadspi: Prevent lost complete() call during indirect read
     - tpm2-sessions: Fix out of range indexing in name_size (CVE-2025-68792)
     - ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.67
     - efi/cper: Fix cper_bits_to_str buffer handling and return value
     - Revert "gfs2: Fix use of bio_chain"
     - [amd64] x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
     - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation
     - xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set
     - pNFS: Fix a deadlock when returning a delegation during open()
     - NFS: Fix a deadlock involving nfs_release_folio()
     - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
     - pnfs/blocklayout: Fix memory leak in bl_parse_scsi()
     - drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions
     - PM: EM: Fix incorrect description of the cost field in struct
       em_perf_state
     - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
     - btrfs: send: check for inline extents in range_is_hole_in_parent()
     - net: bridge: annotate data-races around fdb->{updated,used}
     - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
     - net: update netdev_lock_{type,name}
     - macvlan: fix possible UAF in macvlan_forward_source()
     - ipv4: ip_gre: make ipgre_header() robust
     - net/mlx5e: Fix crash on profile change rollback failure
     - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
     - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv
     - net/mlx5e: Restore destroying state bit after profile cleanup
     - btrfs: factor out init_space_info() from create_space_info()
     - btrfs: factor out check_removing_space_info() from
       btrfs_free_block_groups()
     - btrfs: introduce btrfs_space_info sub-group
     - btrfs: fix memory leaks in create_space_info() error paths
     - ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip
     - net: hv_netvsc: reject RSS hash key programming without RX indirection
       table
     - ipv6: Fix use-after-free in inet6_addr_del().
     - net/sched: sch_qfq: do not free existing class in qfq_change_class()
     - [amd64] ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack
       type
     - drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2
     - mm: describe @flags parameter in memalloc_flags_save()
     - textsearch: describe @list member in ts_ops search
     - mm, kfence: describe @slab parameter in __kfence_obj_info()
     - [arm64] dmaengine: tegra-adma: Fix use-after-free
     - [arm64] phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before
       using it
     - [arm64] phy: phy-snps-eusb2: refactor constructs names
     - phy: drop probe registration printks
     - [arm64] phy: qcom-qusb2: Fix NULL pointer dereference on early suspend
     - [armhf] phy: stm32-usphyc: Fix off by one in probe()
     - [armhf] dmaengine: omap-dma: fix dma_pool resource leak in error paths
     - [arm64] i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA
     - HID: usbhid: paper over wrong bNumDescriptor field (Closes: #1122193)
     - bridge: mcast: Fix use-after-free during router port configuration
       (CVE-2025-38248)
     - [arm64] ASoC: codecs: wsa883x: fix unnecessary initialisation
     - drm/amd/display: mark static functions noinline_for_stack
     - io_uring: move local task_work in exit cancel loop
     - scsi: core: Fix error handler encryption support
     - ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
     - null_blk: fix kmemleak by releasing references to fault configfs items
     - can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak
     - can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit.
     - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session
       upon receiving the second rts
     - xfs: Fix the return value of xfs_rtcopy_summary()
     - lib/buildid: use __kernel_read() for sleepable context
     - [arm64] phy: rockchip: inno-usb2: fix communication disruption in gadget
       mode
     - [arm64,armhf] phy: ti: gmii-sel: fix regmap leak on probe failure
     - [arm64] phy: freescale: imx8m-pcie: assert phy reset during power on
     - [arm64] phy: rockchip: inno-usb2: fix disconnection in gadget mode
     - usb: dwc3: Check for USB4 IP_NAME
     - usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor
     - USB: OHCI/UHCI: Add soft dependencies on ehci_platform
     - USB: serial: option: add Telit LE910 MBIM composition
     - USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
     - nvme-pci: disable secondary temp for Wodposit WPBSNM8
     - [arm64] ASoC: codecs: wsa881x: fix unnecessary initialisation
     - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
     - hrtimer: Fix softirq base check in update_needs_ipi()
     - [amd64] EDAC/x38: Fix a resource leak in x38_probe1()
     - [amd64] EDAC/i3200: Fix a resource leak in i3200_probe1()
     - tcpm: allow looking for role_sw device in the main node
     - i2c: riic: Move suspend handling to NOIRQ phase
     - [amd64] x86/resctrl: Add missing resctrl initialization for Hygon
     - [amd64] x86/resctrl: Fix memory bandwidth counter width for Hygon
     - nvme: fix PCIe subsystem reset controller state transition
     - mm/zswap: fix error pointer free in zswap_cpu_comp_prepare()
     - mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free
     - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure
     - drm/amd/display: Bump the HDMI clock to 340MHz
     - drm/amd: Clean up kfd node on surprise disconnect
     - drm/amdkfd: fix a memory leak in device_queue_manager_init()
     - drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
     - [arm64,armhf] drm/panel-simple: fix connector type for DataImage
       SCF0700C48GGU18 panel
     - drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
     - [arm64] dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
     - [armhf] dmaengine: stm32: dmamux: fix device leak on route allocation
     - [armhf] dmaengine: stm32: dmamux: fix OF node leak on route allocation
       failure
     - [armhf] dmaengine: ti: dma-crossbar: fix device leak on dra7x route
       allocation
     - [armhf] dmaengine: ti: dma-crossbar: fix device leak on am335x route
       allocation
     - [amd64] HID: intel-ish-hid: Use dedicated unbound workqueues to prevent
       resume blocking
     - [amd64] HID: intel-ish-hid: Fix -Wcast-function-type-strict in
       devm_ishtp_alloc_workqueue()
     - btrfs: fix deadlock in wait_current_trans() due to ignored transaction
       type
     - xfs: set max_agbno to allow sparse alloc of last full inode chunk
     - mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure
     - mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup
       failure
     - bpf: Reject narrower access to pointer ctx fields (CVE-2025-38591)
     - mm/fake-numa: allow later numa node hotplug
     - mm: numa,memblock: include <asm/numa.h> for 'numa_nodes_parsed'
     - [arm64] phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path
     - [arm64] phy: rockchip: inno-usb2: Fix a double free bug in
       rockchip_usb2phy_probe()
     - [arm64] dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure
     - mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection
     - mm/page_alloc: batch page freeing in decay_pcp_high
     - mm/page_alloc: prevent pcp corruption with SMP=n
     - mm/fake-numa: handle cases with no SRAT info
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.68
     - posix-clock: Store file pointer in struct posix_clock_context
     - ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE.
     - dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains
     - dt-bindings: power: qcom,rpmpd: add Turbo L5 corner
     - dt-bindings: power: qcom-rpmpd: split RPMh domains definitions
     - dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO
     - [arm64] pmdomain: qcom: rpmhpd: Add MXC to SC8280XP
     - Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump()
     - btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE
     - ata: ahci: Do not read the per port area for unimplemented ports
     - ata: libata-sata: Improve link_power_management_supported sysfs attribute
     - ata: libata: Add cpr_log to ata_dev_print_features() early return
     - ata: libata-core: Introduce ata_dev_config_lpm()
     - ata: libata: Call ata_dev_config_lpm() for ATAPI devices
     - ata: libata: Print features also for ATAPI devices
     - ice: initialize ring_stats->syncp
     - ice: Avoid detrimental cleanup for bond during interface stop
     - ice: Fix incorrect timeout ice_release_res()
     - igc: Restore default Qbv schedule when changing channels
     - igc: fix race condition in TX timestamp read for register 0
     - vsock/virtio: Coalesce only linear skb
     - net: usb: dm9601: remove broken SR9700 support
     - bonding: limit BOND_MODE_8023AD to Ethernet devices
     - l2tp: Fix memleak in l2tp_udp_encap_recv().
     - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on
       usb_submit_urb() error
     - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
     - [amd64,arm64] amd-xgbe: avoid misleading per-packet error log
     - gue: Fix skb memleak with inner IP protocol 0.
     - fou: Don't allow 0 for FOU_ATTR_IPPROTO.
     - veth: fix data race in veth_get_ethtool_stats
     - l2tp: avoid one data-race in l2tp_tunnel_del_work()
     - ipvlan: Make the addrs_lock be per port
     - [arm64] octeontx2: cn10k: fix RX flowid TCAM mask handling
     - net/sched: Enforce that teql can only be used as root qdisc
     - net/sched: qfq: Use cl_is_active to determine whether class is active in
       qfq_rm_from_ag
     - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN
       spec
     - wifi: mac80211: don't perform DA check on S1G beacon
     - serial: 8250_pci: Fix broken RS485 for F81504/508/512
     - w1: therm: Fix off-by-one buffer overflow in alarms_store
     - w1: fix redundant counter decrement in w1_attach_slave_device()
     - Revert "nfc/nci: Add the inconsistency check between the input data length
       and count"
     - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
     - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
     - scsi: storvsc: Process unsupported MODE_SENSE_10
     - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
     - [arm64] dts: rockchip: remove dangerous max-link-speed from helios64
     - [arm64] dts: rockchip: Fix voltage threshold for volume keys for Pinephone
       Pro
     - [amd64] x86/kfence: avoid writing L1TF-vulnerable PTEs
     - [amd64] comedi: Fix getting range information for subdevices 16 to 255
     - [amd64] platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute
       names
     - [amd64] platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID
       macro
     - mm/rmap: fix two comments related to huge_pmd_unshare()
     - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
     - iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event
       detection
     - interconnect: debugfs: initialize src_node and dst_node to empty strings
     - regmap: Fix race condition in hwspinlock irqsave routine
     - [riscv64] clocksource: Fix stimecmp update hazard on RV32
     - [amd64] platform/x86/amd: Fix memory leak in wbrf_record()
     - scsi: core: Wake up the error handler when final completions race against
       each other
     - scsi: qla2xxx: Sanitize payload size to prevent member overflow
     - ALSA: usb: Increase volume range that triggers a warning
     - ice: Fix persistent failure in ice_get_rxfh
     - [arm64] net: hns3: fix data race in hns3_fetch_stats
     - be2net: fix data race in be_get_new_eqd
     - [arm64] net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
     - [arm64] net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
     - mISDN: annotate data-race around dev->work
     - ipv6: annotate data-race in ndisc_router_discovery()
     - usbnet: limit max_mtu based on device's hard_mtu
     - clocksource: Reduce watchdog readout delay limit to prevent false
       positives
     - sched/fair: Fix pelt clock sync when entering idle
     - drm/amd/pm: Don't clear SI SMC table when setting power limit
     - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
     - drm/nouveau: add missing DCB connector types
     - drm/nouveau: implement missing DCB connector types; gracefully handle
       unknown connectors
     - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
     - bonding: provide a net pointer to __skb_flow_dissect()
     - [arm64,armhf] net: dsa: fix off-by-one in maximum bridge ID determination
     - [arm64] octeontx2-af: Fix error handling
     - net: openvswitch: fix data race in ovs_vport_get_upcall_stats
     - vsock/virtio: fix potential underflow in virtio_transport_get_credit()
     - vsock/virtio: cap TX credit to local buffer size
     - net/sched: act_ife: avoid possible NULL deref
     - dpll: Prevent duplicate registrations
     - [amd64] x86: make page fault handling disable interrupts properly
     - tpm: Compare HMAC values in constant time
     - keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal
     - leds: led-class: Only Add LED to leds_list when it is fully ready
     - of: fix reference count leak in of_alias_scan()
     - of: platform: Use default match table for /firmware
     - iio: accel: iis328dq: fix gain values
     - iio: adc: ad9467: fix ad9434 vref mask
     - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc
       driver
     - iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot
     - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
     - ALSA: ctxfi: Fix potential OOB access in audio mixer handling
       (Closes: #1121535)
     - ALSA: scarlett2: Fix buffer overflow in config retrieval
     - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
     - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
     - mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode
     - drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)
     - wifi: ath10k: fix dma_free_coherent() pointer
     - wifi: ath12k: fix dma_free_coherent() pointer
     - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
     - wifi: rsi: Fix memory corruption due to not set vif driver data size
     - [arm64] fpsimd: signal: Allocate SSVE storage when restoring ZA
     - [arm64] Set __nocfi on swsusp_arch_resume()
     - slimbus: core: fix runtime PM imbalance on report present
     - slimbus: core: fix device reference leak on report present
     - tracing: Fix crash on synthetic stacktrace field usage
     - [amd64] intel_th: fix device leak on output open()
     - mei: trace: treat reg parameter as string
     - [s390x] ap: Fix wrong APQN fill calculation
     - netrom: fix double-free in nr_route_frame()
     - [amd64] platform/x86: hp-bioscfg: Fix automatic module loading
     - [arm64] pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq
       vpu
     - [amd64] perf/x86/intel: Do not enable BTS for guests
     - [arm64,armhf] irqchip/gic-v3-its: Avoid truncating memory addresses
     - net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick
     - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
     - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
     - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
     - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
     - drm/amdgpu: remove frame cntl for gfx v12
     - gpio: cdev: Correct return code on memory allocation failure
     - migrate: correct lock ordering for hugetlb file folios
     - [arm64] dmaengine: ti: k3-udma: Enable second resource range for BCDMA and
       PKTDMA
     - can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
     - bpf: Do not let BPF test infra emit invalid GSO types to stack
       (CVE-2025-68725)
     - [arm64] dts: rockchip: remove redundant max-link-speed from nanopi-r4s
     - iio: core: add missing mutex_destroy in iio_dev_release()
     - iio: core: Replace lockdep_set_class() + mutex_init() by combined call
     - iio: core: add separate lockdep class for info_exist_lock
     - [armhf] iio: adc: exynos_adc: fix OF populate on driver rebind
     - exfat: fix refcount leak in exfat_find (CVE-2025-68351)
     - sched_ext: Fix possible deadlock in the deferred_irq_workfn()
       (CVE-2025-68333)
     - fs/ntfs3: Initialize allocated memory before use (CVE-2025-68365)
     - [amd64] accel/ivpu: Fix race condition when unbinding BOs (CVE-2025-68749)
     - btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
       (CVE-2025-68358)
     - wifi: ath11k: fix RCU stall while reaping monitor destination ring
       (CVE-2024-58097)
     - vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put()
     - vsock/virtio: Rename virtio_vsock_alloc_skb()
     - vsock/virtio: Move SKB allocation lower-bound check to callers
     - vsock/virtio: Rename virtio_vsock_skb_rx_put()
     - vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers
     - vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers
     - net: Introduce skb_copy_datagram_from_iter_full()
     - vsock/virtio: Fix message iterator handling on transmit path
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.69
     - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
     - Bluetooth: MGMT: Fix memory leak in set_ssp_complete
     - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup()
     - can: gs_usb: gs_usb_receive_bulk_callback(): fix error message
     - bonding: annotate data-races around slave->last_rx
     - [arm64,armhf] net: mvpp2: cls: Fix memory leak in
       mvpp2_ethtool_cls_rule_ins()
     - ipv6: use the right ifindex when replying to icmpv6 from localhost
     - net: wwan: t7xx: fix potential skb->frags overflow in RX path
     - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().
     - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues
     - ice: stop counting UDP csum mismatch as rx_errors
     - net/mlx5e: TC, delete flows only for existing peers
     - nfc: nci: Fix race between rfkill and nci_unregister_device().
     - net: bridge: fix static key check
     - net: phy: micrel: fix clk warning when removing the driver
     - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect
     - net/mlx5: Initialize events outside devlink lock
     - net/mlx5: Fix vhca_id access call trace use before alloc
     - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload
     - scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
     - [amd64] ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion
     - gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler
     - gpio: virtuser: fix UAF in configfs release path
     - bcache: fix improper use of bi_end_io
     - bcache: use bio cloning for detached device requests
     - bcache: fix I/O accounting leak in detached_dev_do_request
     - dma/pool: distinguish between missing and exhausted atomic pools
     - sched/deadline: Document dl_server
     - sched/deadline: Fix 'stuck' dl_server
     - [arm64,armhf] pinctrl: meson: mark the GPIO controller as sleeping
     - [riscv64] compat: fix COMPAT_UTS_MACHINE definition
     - scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
     - [amd64] ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO
     - [arm64,armhf] gpio: pca953x: mask interrupts in irq shutdown
     - scsi: qla2xxx: edif: Fix dma_free_coherent() size
     - efivarfs: fix error propagation in efivar_entry_get()
     - nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference
       (Closes: #1122521)
     - gpio: rockchip: Stop calling pinctrl for set_direction
     - mptcp: only reset subflow errors when propagated
     - flex_proportions: make fprop_new_period() hardirq safe
     - mm/memory-failure: fix missing ->mf_stats count in hugetlb poison
     - mm/memory-failure: teach kill_accessing_process to accept hugetlb tail
       page pfn
     - mm/shmem, swap: fix race of truncate and swap entry split
     - net: fix segmentation of forwarding fraglist GRO
     - [arm64] drm/msm/a6xx: fix bogus hwcg register updates
     - drm/amdgpu/soc21: fix xclk for APUs
     - drm/amdgpu/gfx10: fix wptr reset in KGQ init
     - drm/amdgpu/gfx11: fix wptr reset in KGQ init
     - drm/amdgpu/gfx12: fix wptr reset in KGQ init
     - drm/amdgpu: fix NULL pointer dereference in
       amdgpu_gmc_filter_faults_remove
     - drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule()
     - gpiolib: acpi: Fix potential out-of-boundary left shift
     - cgroup: Fix kernfs_node UAF in css_free_rwork_fn
     - rxrpc: Fix data-race warning and potential load/store tearing
     - ksmbd: smbd: fix dma_unmap_sg() nents (CVE-2026-23093)
     - mm/kfence: randomize the freelist on initialization
     - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode
       (CVE-2024-58096)
     - Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)"
     - btrfs: prevent use-after-free on folio private data in
       btrfs_subpage_clear_uptodate()
     - net/sched: act_ife: convert comma to semicolon
     - [arm64] pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and
       SWR TX pins
     - mptcp: avoid dup SUB_CLOSED events after disconnect
     - perf: Simplify get_perf_callchain() user logic
     - perf: sched: Fix perf crash with new is_user_task() helper
     - writeback: fix 100% CPU usage when dirtytime_expire_interval is 0
     - drm/amdgpu/gfx11: adjust KGQ reset sequence
     - [arm64] pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver
     - net: mana: Change the function signature of mana_get_primary_netdev_rcu
     - RDMA/mana_ib: Handle net event for pointing to the current netdev
 .
   [ Macpaul Lin ]
   * udeb: Add USB TYPE-C and Mux modules in usb-modules (Closes: #1109090)
 .
   [ Salvatore Bonaccorso ]
   * fs/nfsd: Enable NFSD_SCSILAYOUT (NFSv4.1 server support for pNFS SCSI
     layouts)
   * [rt] Update to 6.12.66-rt15

linux-base (4.12.1) trixie; urgency=medium
 .
   * d/salsa-ci.yml: Set RELEASE to trixie
   * linux-run-hooks(1): Fix description of the first argument
   * linux-run-hooks: Use compatible hook dir names for headers packages
     (Closes: #1121366)

linux-signed-amd64 (6.12.73+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.73-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.70
     - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
     - [amd64] x86/vmware: Fix hypercall clobbers
     - [amd64] x86/kfence: fix booting on 32bit non-PAE systems
     - [amd64] platform/x86: intel_telemetry: Fix swapped arrays in PSS output
     - ALSA: aloop: Fix racy access at PCM trigger
     - [arm64] pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the
       highest state
     - [arm64] pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system
       wakeup
     - [arm64,armhf] pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong
       adb400 reset
     - [arm64] pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system
       wakeup
     - [arm64] pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains
     - mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single
     - ceph: fix NULL pointer dereference in ceph_mds_auth_match()
       (Closes: #1125405)
     - rbd: check for EOD after exclusive lock is ensured to be held
     - ceph: fix oops due to invalid pointer for kfree() in parse_longname()
     - gve: Fix stats report corruption on queue count change
     - gve: Correct ethtool rx_dropped calculation
     - mm, shmem: prevent infinite loop on truncate race
     - Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem"
     - KVM: Don't clobber irqfd routing type when deassigning irqfd
     - PCI/ERR: Ensure error recoverability at all times
     - ublk: fix deadlock when reading partition table (CVE-2025-68823)
     - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (CVE-2025-40082)
     - [arm*] binder: fix BR_FROZEN_REPLY error log
     - binderfs: fix ida_alloc_max() upper bound
     - procfs: avoid fetching build ID while holding VMA lock
     - tracing: Fix ftrace event field alignments
     - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined
     - wifi: wlcore: ensure skb headroom before skb_push
     - net: usb: sr9700: support devices with virtual driver CD
     - block,bfq: fix aux stat accumulation destination
     - smb/server: call ksmbd_session_rpc_close() on error path in
       create_smb2_pipe()
     - md: suspend array while updating raid_disks via sysfs
     - smb/server: fix refcount leak in smb2_open()
     - smb/server: fix refcount leak in parse_durable_handle_context()
     - [amd64] HID: intel-ish-hid: Update ishtp bus match to support device ID
       table
     - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL
     - btrfs: fix reservation leak in some error paths when inserting inline
       extent
     - [riscv64] Sanitize syscall table indexing under speculation
     - [amd64] HID: intel-ish-hid: Reset enum_devices_done before enumeration
     - HID: playstation: Center initial joystick axes to prevent spurious events
     - ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55
     - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk
     - [arm64] PCI: qcom: Remove ASPM L0s support for MSM8996 SoC
     - netfilter: replace -EEXIST with -EBUSY
     - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list
     - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()
     - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101)
     - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset
     - ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free
     - HID: logitech: add HID++ support for Logitech MX Anywhere 3S
     - wifi: mac80211: collect station statistics earlier when disconnect
     - ASoC: simple-card-utils: Check device node before overwrite direction
     - nvme-fc: release admin tagset if init fails
     - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
     - [amd64] ASoC: amd: yc: Fix microphone on ASUS M6500RE
     - regmap: maple: free entry on mas_store_gfp() failure
     - wifi: cfg80211: Fix bitrate calculation overflow for HE rates
     - scsi: target: iscsi: Fix use-after-free in
       iscsit_dec_session_usage_count()
     - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
     - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
     - wifi: mac80211: correctly check if CSA is active
     - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice
     - btrfs: reject new transactions if the fs is fully read-only
     - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio
     - [amd64] platform/x86: toshiba_haps: Fix memory leaks in add/remove
       routines
     - [amd64] platform/x86: intel_telemetry: Fix PSS event register mask
     - [amd64] platform/x86: hp-bioscfg: Skip empty attribute names
     - [amd64] platform/x86/intel/tpmi/plr: Make the file domain<n>/status
       writeable
     - smb/client: fix memory leak in smb2_open_file()
     - net: add skb_header_pointer_careful() helper
     - net/sched: cls_u32: use skb_header_pointer_careful()
     - net: liquidio: Initialize netdev pointer before queue setup
     - net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup
     - net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup
     - net: phy: add phy_interface_weight()
     - net: phy: add phy_interface_copy()
     - net: sfp: pre-parse the module support
     - net: sfp: convert sfp quirks to modify struct sfp_module_support
     - net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module
     - macvlan: fix error recovery in macvlan_common_newlink()
     - net: usb: r8152: fix resume reset deadlock
     - net: don't touch dev->stats in BPF redirect paths
     - tipc: use kfree_sensitive() for session key material
     - drm/amd/display: fix wrong color value mapping on MCM shaper LUT
     - net: gro: fix outer network offset
     - [amd64] drm/mgag200: fix mgag200_bmc_stop_scanout()
     - drm/xe/query: Fix topology query pointer advance
     - drm/xe/pm: Also avoid missing outer rpm warning on system suspend
     - drm/xe/pm: Disable D3Cold for BMG only on specific platforms
     - [armhf] hwmon: (occ) Mark occ_init_attribute() as __printf
     - netfilter: nf_tables: fix inverted genmask check in
       nft_map_catchall_activate()
     - ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF
     - ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update()
     - [amd64] ASoC: amd: fix memory leak in acp3x pdm dma ops
     - [arm64] ipi: tegra: Fix a memory leak in tegra_slink_probe()
     - [arm64,armhf] spi: tegra114: Preserve SPI mode bits in def_command1_reg
     - ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU.
     - gpiolib-acpi: Update file references in the Documentation and MAINTAINERS
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.71
     - net: tunnel: make skb_vlan_inet_prepare() return drop reasons
       (Closes: #1127597)
     - io_uring/rw: recycle buffers manually for non-mshot reads
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.72
     - smb: client: split cached_fid bitfields to avoid shared-byte RMW races
     - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error
       paths
     - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
     - driver core: enforce device_lock for driver_match_device()
     - Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB
     - [amd64] crypto: iaa - Fix out-of-bounds index in
       find_empty_iaa_compression_mode
     - [armhf] crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists
       correctly
     - crypto: virtio - Add spinlock protection with virtqueue notification
     - crypto: virtio - Remove duplicated virtqueue_kick in
       virtio_crypto_skcipher_crypt_req
     - nilfs2: Fix potential block overflow that cause system hang
     - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()
     - scsi: qla2xxx: Validate sp before freeing associated memory
     - scsi: qla2xxx: Allow recovery for tape devices
     - scsi: qla2xxx: Delay module unload while fabric scan in progress
     - scsi: qla2xxx: Free sp in error path to fix system crash
     - scsi: qla2xxx: Query FW again before proceeding with login
     - bus: mhi: host: pci_generic: Add Telit FE990B40 modem support
     - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (CVE-2026-23169)
     - erofs: fix UAF issue for file-backed mounts w/ directio option
     - xfs: fix UAF in xchk_btree_check_block_owner
     - PCI: endpoint: Avoid creating sub-groups asynchronously
     - wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add
     - [armhf] gpio: omap: do not register driver in probe()
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.73
     - Revert "driver core: enforce device_lock for driver_match_device()"
linux-signed-amd64 (6.12.73+1~bpo12+1) bookworm-backports; urgency=medium
 .
   * Sign kernel from linux 6.12.73-1~bpo12+1
 .
   * Rebuild for bookworm-backports
linux-signed-amd64 (6.12.69+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.69-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.64
     - btrfs: do not skip logging new dentries when logging a new name
     - btrfs: fix a potential path leak in print_data_reloc_error()
     - [arm64] bpf, arm64: Do not audit capability check in do_jit()
     - btrfs: fix memory leak of fs_devices in degraded seed device path
     - shmem: fix recovery on rename failures
     - iomap: adjust read range correctly for non-block-aligned positions
     - iomap: account for unaligned end offsets when truncating read range
     - scripts/faddr2line: Fix "Argument list too long" error
     - [amd64] perf/x86/amd: Check event before enable to avoid GPF
     - sched/deadline: only set free_cpus for online runqueues
     - sched/fair: Revert max_newidle_lb_cost bump
     - [amd64] x86/ptrace: Always inline trivial accessors
     - ACPICA: Avoid walking the Namespace if start_node is NULL
     - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only
     - cpufreq: dt-platdev: Add JH7110S SOC to the allowlist
     - ACPI: fan: Workaround for 64-bit firmware bug
     - cpuidle: menu: Use residency threshold in polling state override decisions
     - livepatch: Match old_sympos 0 and 1 in klp_find_func()
     - fs/ntfs3: Support timestamps prior to epoch
     - kbuild: Use objtree for module signing key path
     - ntfs: set dummy blocksize to read boot_block when mounting
     - hfsplus: fix volume corruption issue for generic/070
     - hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create
     - hfsplus: Verify inode mode when loading from disk
     - hfsplus: fix volume corruption issue for generic/073
     - fs/ntfs3: check for shutdown in fsync
     - wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU
     - wifi: cfg80211: stop radar detection in cfg80211_leave()
     - wifi: cfg80211: use cfg80211_leave() in iftype change
     - wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC
       load
     - wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet
     - btrfs: scrub: always update btrfs_scrub_progress::last_physical
     - gfs2: fix remote evict for read-only filesystems
     - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad"
     - smb/server: fix return value of smb2_ioctl()
     - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
     - ksmbd: vfs: fix race on m_flags in vfs_cache
     - Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV
     - Bluetooth: btusb: MT7922: Add VID/PID 0489/e170
     - Bluetooth: btusb: MT7920: Add VID/PID 0489/e135
     - Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE
     - Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT
     - gfs2: Fix use of bio_chain
     - [arm64,armhf] net: fec: ERR007885 Workaround for XDP TX path
     - netrom: Fix memory leak in nr_sendmsg()
     - net/sched: ets: Always remove class from active list before deleting in
       ets_qdisc_change
     - ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2()
     - bnxt_en: Fix XDP_TX path
     - net: openvswitch: fix middle attribute validation in push_nsh() action
     - broadcom: b44: prevent uninitialized value usage
     - netfilter: nf_conncount: fix leaked ct in error paths
     - ipvs: fix ipv4 null-ptr-deref in route error path
     - net/sched: ets: Remove drr class from the active list if it changes to
       strict
     - nfc: pn533: Fix error code in pn533_acr122_poweron_rdr()
     - netfilter: nf_nat: remove bogus direction check
     - netfilter: nf_tables: remove redundant chain validation on register store
     - ethtool: Avoid overflowing userspace buffer on stats query
     - net/mlx5: fw reset, clear reset requested on drain_fw_reset
     - net/mlx5: Drain firmware reset in shutdown callback
     - net/mlx5: fw_tracer, Validate format string parameters
     - net/mlx5: fw_tracer, Handle escaped percent properly
     - net/mlx5: Serialize firmware reset with devlink
     - net/handshake: duplicate handshake cancellations leak socket
     - [arm64] net: enetc: do not transmit redirected XDP frames when the link is
       down
     - [arm64] net: hns3: using the num_tqps in the vf driver to apply for
       resources
     - [arm64] net: hns3: using the num_tqps to check whether tqp_index is out of
       range when vf get ring info from mbx
     - [arm64] net: hns3: add VLAN id validation before using
     - [amd64] hwmon: (dell-smm) Limit fan multiplier to avoid overflow
     - hwmon: (ibmpex) fix use-after-free in high/low store
     - hwmon: (tmp401) fix overflow caused by default conversion rate value
     - drm/me/gsc: mei interrupt top half should be in irq disabled context
     - drm/xe: Restore engine registers before restarting schedulers after GT
       reset
     - drm/panel: sony-td4353-jdi: Enable prepare_prev_first
     - [amd64] x86/xen: Move Xen upcall handler
     - [amd64] x86/xen: Fix sparse warning in enlighten_pv.c
     - [arm64] kdump: Fix elfcorehdr overlap caused by reserved memory processing
       reorder
     - spi: cadence-quadspi: Fix clock disable on probe failure path
     - block: rnbd-clt: Fix leaked ID in init_dev()
     - drm/xe: Limit num_syncs to prevent oversized allocations
     - drm/xe/oa: Limit num_syncs to prevent oversized allocations
     - ksmbd: skip lock-range check on equal size to avoid size==0 underflow
     - ksmbd: Fix refcount leak when invalid session is found on session lookup
     - ksmbd: fix buffer validation by including null terminator size in EA
       length
     - HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen
     - Input: ti_am335x_tsc - fix off-by-one error in wire_order validation
     - Input: lkkbd - disable pending work before freeing device
     - Input: alps - fix use-after-free bugs caused by dev3_register_work
     - Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table
     - xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails
     - can: gs_usb: gs_can_open(): fix error handling
     - [arm64,armhf] soc/tegra: fuse: Do not register SoC device on ACPI boot
     - ACPI: PCC: Fix race condition by removing static qualifier
     - ACPI: CPPC: Fix missing PCC check for guaranteed_perf
     - [arm64] mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds
     - dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml
     - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()
     - [amd64] x86/fpu: Fix FPU state core dump truncation on CPUs with no
       extended xfeatures
     - ALSA: vxpocket: Fix resource leak in vxpocket_probe error path
     - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path
     - ALSA: usb-mixer: us16x08: validate meter packet indices
     - nfsd: update percpu_ref to manage references on nfsd_net
     - nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_
     - nfsd: fix memory leak in nfsd_create_serv error paths
     - ipmi: Fix the race between __scan_channels() and deliver_response()
     - ipmi: Fix __scan_channels() failing to rescan channels
     - [arm64,armhf] ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on
       AM33xx
     - scsi: smartpqi: Add support for Hurray Data new controller PCI device
     - [arm64] clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &
       pcie_x4
     - scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled
     - scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive
     - scsi: qla2xxx: Use reinit_completion on mbx_intr_comp
     - fuse: Always flush the page cache before FOPEN_DIRECT_IO write
     - fuse: Invalidate the page cache after FOPEN_DIRECT_IO write
     - via_wdt: fix critical boot hang due to unnamed resource allocation
     - reset: fix BIT macro reference
     - exfat: fix remount failure in different process environments
     - exfat: zero out post-EOF page cache on file extension
     - usbip: Fix locking bug in RT-enabled kernels
     - usb: typec: ucsi: Handle incorrect num_connectors capability
     - [armhf] iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc
       complains
     - usb: xhci: limit run_graceperiod for only usb 3.0 devices
     - usb: usb-storage: No additional quirks need to be added to the EL-R12
       optical drive.
     - libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map
     - i2c: designware: Disable SMBus interrupts to prevent storms from
       mis-configured firmware
     - nvme-fc: don't hold rport lock when putting ctrl
     - nvme-fabrics: add ENOKEY to no retry criteria for authentication failures
     - [amd64] platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS
       DMI quirks
     - [amd64] scsi: scsi_debug: Fix atomic write enable module param description
     - block: rnbd-clt: Fix signedness bug in init_dev()
     - vhost/vsock: improve RCU read sections around vhost_vsock_get()
     - cifs: Fix memory and information leak in smb3_reconfigure()
     - KEYS: trusted: Fix a memory leak in tpm2_load_cmd
     - io_uring: fix filename leak in __io_openat_prep()
     - [amd64] x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD
       SMCA systems
     - [arm64] mmc: sdhci-msm: Avoid early clock doubling during HS400 transition
     - perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister()
     - [amd64] lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit
     - [s390x] dasd: Fix gendisk parent after copy pair swap
     - wifi: mt76: Fix DTS power-limits on little endian systems
     - block: rate-limit capacity change info log
     - floppy: fix for PAGE_SIZE != 4KB
     - kallsyms: Fix wrong "big" kernel symbol type read from procfs
     - fs/ntfs3: fix mount failure for sparse runs in run_unpack()
     - tpm: Cap the number of PCR banks
     - ext4: fix string copying in parse_apply_sb_mount_options()
     - ext4: xattr: fix null pointer deref in ext4_raw_inode()
     - ext4: clear i_state_flags when alloc inode
     - ext4: fix incorrect group number assertion in mb_check_buddy
     - ext4: align max orphan file size with e2fsprogs limit
     - jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key
     - jbd2: use a weaker annotation in journal handling
     - media: v4l2-mem2mem: Fix outdated documentation
     - mptcp: schedule rtx timer only after pushing data
     - mptcp: avoid deadlock on fallback while reinjecting
     - usb: usb-storage: Maintain minimal modifications to the bcdDevice range.
     - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
     - media: pvrusb2: Fix incorrect variable used in trace message
     - usb: typec: altmodes/displayport: Drop the device reference in
       dp_altmode_probe()
     - [arm64,armhf] usb: dwc3: of-simple: fix clock resource leak in
       dwc3_of_simple_probe
     - [arm64,armhf] usb: dwc3: keep susphy enabled during exit to avoid
       controller faults
     - char: applicom: fix NULL pointer dereference in ac_ioctl
     - [amd64] intel_th: Fix error handling in intel_th_output_open
     - mei: gsc: add dependency on Xe driver
     - serial: sh-sci: Check that the DMA cookie is valid
     - cpuidle: governors: teo: Drop misguided target residency check
     - cpufreq: nforce2: fix reference count leak in nforce2
     - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort
       path"
     - scsi: aic94xx: fix use-after-free in device removal path
     - NFSD: use correct reservation type in nfsd4_scsi_fence_client
     - scsi: target: Reset t_task_cdb pointer in error case
     - scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow
     - scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error
     - f2fs: ensure node page reads complete before f2fs_put_super() finishes
     - f2fs: fix to avoid potential deadlock
     - f2fs: fix to avoid updating zero-sized extent in extent cache
     - f2fs: invalidate dentry cache on failed whiteout creation
     - f2fs: fix age extent cache insertion skip on counter overflow
     - f2fs: fix uninitialized one_time_gc in victim_sel_policy
     - f2fs: fix return value of f2fs_recover_fsync_data()
     - KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot
     - media: vidtv: initialize local pointers upon transfer of memory ownership
     - ocfs2: fix kernel BUG in ocfs2_find_victim_chain
     - [amd64] KVM: x86: Don't clear async #PF queue when CR0.PG is disabled
       (e.g. on #SMI)
     - [amd64] platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver
     - scs: fix a wrong parameter in __scs_magic
     - libceph: make decode_pool() more resilient against corrupted osdmaps
     - [powerpc*] Add reloc_offset() to font bitmap pointer used for
       bootx_printf()
     - [amd64] KVM: x86: WARN if hrtimer callback for periodic APIC timer fires
       with period=0
     - [amd64] KVM: x86: Explicitly set new periodic hrtimer expiration in
       apic_timer_fn()
     - [amd64] KVM: x86: Fix VM hard lockup after prolonged inactivity with
       periodic HV timer
     - [amd64] KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE
     - [amd64] KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN
     - [amd64] KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW
       emulation
     - [amd64] KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN
     - [amd64] KVM: nVMX: Immediately refresh APICv controls as needed on nested
       VM-Exit
     - [amd64] KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR
       (failed VMRUN)
     - [amd64] KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested
       VM-Exits
     - xfs: fix a memory leak in xfs_buf_item_init()
     - xfs: fix stupid compiler warning
     - xfs: fix a UAF problem in xattr repair
     - tracing: Do not register unsupported perf events
     - PM: runtime: Do not clear needs_force_resume with enabled runtime PM
     - r8169: fix RTL8117 Wake-on-Lan in DASH mode
     - fsnotify: do not generate ACCESS/MODIFY events on child for special files
     - net/handshake: restore destructor on submit failure
     - NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap
     - NFSD: NFSv4 file creation neglects setting ACL
     - nfsd: Mark variable __maybe_unused to avoid W=1 build break
     - svcrdma: return 0 on success from svc_rdma_copy_inline_range
     - svcrdma: use rc_pageoff for memcpy byte offset
     - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in
       gss_read_proxy_verf
     - [powerpc*] kexec: Enable SMT before waking offline CPUs
     - btrfs: don't log conflicting inode if it's a dir moved in the current
       transaction
     - [s390x] ipl: Clear SBP flag when bootprog is set
     - gpio: regmap: Fix memleak in error path in gpio_regmap_register()
     - io_uring/poll: correctly handle io_poll_add() return value on update
     - io_uring: fix min_wait wakeups for SQPOLL
     - Revert "drm/amd/display: Fix pbn to kbps Conversion"
     - drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state()
     - drm/amd/display: Fix scratch registers offsets for DCN35
     - drm/amd/display: Fix scratch registers offsets for DCN351
     - drm/displayid: pass iter to drm_find_displayid_extension()
     - ALSA: hda: cs35l41: Fix NULL pointer dereference in
       cs35l41_hda_read_acpi() (CVE-2025-68345)
     - ALSA: wavefront: Use guard() for spin locks
     - ALSA: wavefront: Clear substream pointers on close
     - [arm64] pinctrl: renesas: rzg2l: Fix ISEL restore on resume
     - hsr: hold rcu and dev lock for hsr_get_port_ndev (CVE-2025-39872)
     - sched/rt: Fix race in push_rt_task (CVE-2025-38234)
     - [arm64] KVM: arm64: Initialize HCR_EL2.E2H early
     - [arm64] KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu()
     - [arm64] Revamp HCR_EL2.E2H RES1 detection
     - dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and
       resets
     - dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains
       and resets
     - dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and
       resets
     - dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and
       resets
     - dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and
       resets
     - dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and
       resets
     - dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and
       resets
     - crypto: af_alg - zero initialize memory allocated via sock_kmalloc
     - crypto: caam - Add check for kcalloc() in test_len()
     - [arm64,armhf] amba: tegra-ahb: Fix device leak on SMMU enable
     - virtio: vdpa: Fix reference count leak in octep_sriov_enable()
     - tracing: Fix fixed array of synthetic event
     - [arm64,armhf] soc: samsung: exynos-pmu: fix device leak on regmap lookup
     - [arm64] soc: qcom: ocmem: fix device leak on lookup
     - [arm64] soc: amlogic: canvas: fix device leak on lookup
     - rpmsg: glink: fix rpmsg device leak
     - [amd64] platform/x86: intel: chtwc_int33fe: don't dereference swnode args
     - i2c: amd-mp2: fix reference leak in MP2 PCI device
     - hwmon: (max16065) Use local variable to avoid TOCTOU
     - hwmon: (max6697) fix regmap leak on probe failure
     - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU
     - hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU
     - [amd64] x86/msi: Make irq_retrigger() functional for posted MSI
     - [arm64] iommu/mediatek: fix use-after-free on probe deferral
     - fuse: fix readahead reclaim deadlock
     - wifi: rtw88: limit indirect IO under powered off for RTL8822CS
       (Closes: #1125797)
     - wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()
     - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result()
     - wifi: mac80211: do not use old MBSSID elements
     - i40e: fix scheduling in set_rx_mode
     - i40e: validate ring_len parameter against hardware-specific values
     - iavf: fix off-by-one issues in iavf_config_rss_reg()
     - idpf: reduce mbx_task schedule delay to 300us
     - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
     - Bluetooth: btusb: revert use of devm_kzalloc in btusb
     - net: mdio: aspeed: add dummy read to avoid read-after-write issue
     - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy
     - ip6_gre: make ip6gre_header() robust
     - [amd64] platform/x86: msi-laptop: add missing sysfs_remove_group()
     - [amd64] platform/x86: ibm_rtl: fix EBDA signature search pointer
       arithmetic
     - team: fix check for port enabled in
       team_queue_override_port_prio_changed()
     - [arm64,armhf] net: dsa: fix missing put_device() in
       dsa_tree_find_first_conduit()
     - amd-xgbe: reset retries and mode on RX adapt failures
     - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
     - genalloc.h: fix htmldocs warning
     - firewire: nosy: Fix dma_free_coherent() size
     - [armhf] net: dsa: b53: skip multicast entries for fdb_dump()
     - kbuild: fix compilation of dtb specified on command-line without make rule
     - net: usb: asix: validate PHY address before use
     - net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct
     - vfio/pds: Fix memory leak in pds_vfio_dirty_enable()
     - [amd64] platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI
       package parsing
     - [arm64] octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"
     - net: stmmac: fix the crash issue for zero copy XDP_TX action
     - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
     - ipv4: Fix reference count leak when using error routes with nexthop
       objects
     - net: rose: fix invalid array index in rose_kill_by_device()
     - ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT
     - RDMA/irdma: avoid invalid read in irdma_net_event
     - RDMA/efa: Remove possible negative shift
     - RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr()
     - RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db()
     - RDMA/core: always drop device refcount in ib_del_sub_device_and_put()
     - RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send
     - RDMA/bnxt_re: Fix to use correct page size for PDE table
     - md: Fix static checker warning in analyze_sbs
     - md/raid5: fix possible null-pointer dereferences in
       raid5_store_group_thread_cnt()
     - ksmbd: Fix memory leak in get_file_all_info()
     - RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation
     - RDMA/bnxt_re: fix dma_free_coherent() pointer
     - blk-mq: skip CPU offline notify on unmapped hctx
     - ntfs: Do not overwrite uptodate pages
     - [armhf] ASoC: stm32: sai: fix device leak on probe
     - [armhf] ASoC: stm32: sai: fix clk prepare imbalance on probe failure
     - [armhf] ASoC: stm32: sai: fix OF node leak on probe
     - [arm64] ASoC: codecs: lpass-tx-macro: fix SM6115 support
     - [arm64] ASoC: qcom: q6apm-dai: set flags to reflect correct operation of
       appl_ptr
     - [arm64] ASoC: qcom: q6asm-dai: perform correct state check before closing
     - [arm64] ASoC: qcom: q6adm: the the copp device only during last instance
     - [arm64] ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer
       alignment.
     - [amd64] iommu/amd: Fix pci_segment memleak in alloc_pci_segment()
     - [amd64] iommu/amd: Propagate the error code returned by __modify_irte_ga()
       in modify_irte_ga()
     - [armhf] iommu/omap: fix device leaks on probe_device()
     - [arm64] iommu/qcom: fix device leak on of_xlate()
     - [arm64,riscv64] iommu/sun50i: fix device leak on of_xlate()
     - [arm64,armhf] iommu/tegra: fix device leak on probe_device()
     - iommu: disable SVA when CONFIG_X86 is set
     - HID: logitech-dj: Remove duplicate error logging
     - fgraph: Initialize ftrace_ops->private for function graph ops
     - fgraph: Check ftrace_pids_enabled on registration for early filtering
     - PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths
     - [arm64] dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power
       regulator
     - [powerpc*] mm: Fix mprotect on book3s 32-bit
     - [powerpc*] 64s/slb: Fix SLB multihit issue during SLB preload
     - leds: leds-cros_ec: Skip LEDs without color components
     - leds: leds-lp50xx: Allow LED 0 to be added to module bank
     - leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs
     - leds: leds-lp50xx: Enable chip before any communication
     - block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs
     - [arm64,armhf] clk: samsung: exynos-clkout: Assign .num before accessing
       .hws (Closes: #1121211)
     - [arm64] mfd: max77620: Fix potential IRQ chip conflict when probing two
       devices
     - media: rc: st_rc: Fix reset control resource leak
     - media: verisilicon: Fix CPU stalls on G2 bus error
     - mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions
     - mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips
     - mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips
     - mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips
     - mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips
     - mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips
     - mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips
     - [amd64] perf/x86/amd/uncore: Fix the return value of
       amd_uncore_df_event_init() on error
     - [powerpc*] pseries/cmm: call balloon_devinfo_init() also without
       CONFIG_BALLOON_COMPACTION
     - media: adv7842: Avoid possible out-of-bounds array accesses in
       adv7842_cp_log_status()
     - firmware: stratix10-svc: Add mutex in stratix10 memory management
     - dm-ebs: Mark full buffer dirty even on partial write
     - dm-bufio: align write boundary on physical block size
     - fbdev: gbefb: fix to use physical address instead of dma address
     - fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing
     - fbdev: tcx.c fix mem_map to correct smem_start offset
     - media: cec: Fix debugfs leak on bus_register() failure
     - media: msp3400: Avoid possible out-of-bounds array accesses in
       msp3400c_thread()
     - media: platform: mtk-mdp3: fix device leaks at probe
     - media: renesas: rcar_drif: fix device node reference leak in
       rcar_drif_bond_enabled
     - media: samsung: exynos4-is: fix potential ABBA deadlock on init
     - media: TDA1997x: Remove redundant cancel_delayed_work in probe
     - media: verisilicon: Protect G2 HEVC decoder against invalid DPB index
     - media: videobuf2: Fix device reference leak in vb2_dc_alloc error path
     - media: vpif_capture: fix section mismatch
     - media: vpif_display: fix section mismatch
     - media: amphion: Cancel message work before releasing the VPU core
     - media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe
     - media: i2c: adv7842: Remove redundant cancel_delayed_work in probe
     - media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init()
     - [armhf] pmdomain: imx: Fix reference count leak in imx_gpc_probe()
     - compiler_types.h: add "auto" as a macro for "__auto_type"
     - lockd: fix vfs_test_lock() calls
     - idr: fix idr_alloc() returning an ID out of range
     - mm/page_owner: fix memory leak in page_owner_stack_fops->release()
     - [amd64] x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix
       Halo
     - tools/mm/page_owner_sort: fix timestamp comparison for stable sorting
     - samples/ftrace: Adjust LoongArch register restore order in direct calls
     - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
     - RDMA/cm: Fix leaking the multicast GID table reference
     - e1000: fix OOB in e1000_tbi_should_accept()
     - fjes: Add missing iounmap in fjes_hw_init()
     - nfsd: Drop the client reference in client_states_open()
     - net: usb: sr9700: fix incorrect command used to write single register
     - net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
     - net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to
       macb_open()
     - Revert "drm/amd: Skip power ungate during suspend for VPE"
     - drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling
     - drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma
     - drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling
     - [arm64] drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers
     - [amd64] drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg()
     - drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident
     - drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()
     - [arm64] drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse()
     - [arm64] drm/mediatek: Fix probe resource leaks
     - [arm64] drm/mediatek: Fix probe memory leak
     - [arm64] drm/mediatek: Fix probe device leaks
     - drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace
     - drm/amdkfd: bump minimum vgpr size for gfx1151
     - drm/amdkfd: Trap handler support for expert scheduling mode
     - [amd64] drm/i915: Fix format string truncation warning
     - drm/ttm: Avoid NULL pointer deref for evicted BOs
     - [amd64] drm/mgag200: Fix big-endian support
     - drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table
     - drm/xe/oa: Disallow 0 OA property values
     - drm/xe: Adjust long-running workload timeslices to reasonable values
     - drm/xe: Use usleep_range for accurate long-running workload timeslicing
     - drm/xe: Drop preempt-fences when destroying imported dma-bufs.
     - [arm64] drm/msm/dpu: Add missing NULL pointer check for pingpong interface
     - [amd64] drm/i915/gem: Zero-initialize the eb.vma array in
       i915_gem_do_execbuffer
     - drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb
     - [riscv64] lib/crypto: riscv/chacha: Avoid s0/fp register
     - gfs2: fix freeze error handling
     - btrfs: don't rewrite ret from inode_permission
     - sched/eevdf: Fix min_vruntime vs avg_vruntime
     - erofs: fix unexpected EIO under memory pressure
     - sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks
     - jbd2: fix the inconsistency between checksum and data in memory for
       journal sb
     - tty: introduce and use tty_port_tty_vhangup() helper
     - xhci: dbgtty: fix device unregister: fixup
     - f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes()
     - f2fs: use global inline_xattr_slab instead of per-sb slab cache
     - f2fs: drop inode from the donation list when the last file is closed
     - f2fs: fix to avoid updating compression context during writeback
     - serial: core: fix OF node leak
     - serial: core: Restore sysfs fwnode information
     - mptcp: pm: ignore unknown endpoint flags
     - mm/ksm: fix exec/fork inheritance support for prctl
     - svcrdma: bound check rq_pages index in inline path
     - block: freeze queue when updating zone resources
     - tpm2-sessions: Fix tpm2_read_public range checks
     - sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue()
     - sched_ext: Fix missing post-enqueue handling in
       move_local_task_to_local_dsq()
     - drm/displayid: add quirk to ignore DisplayID checksum errors
     - hrtimers: Introduce hrtimer_update_function()
     - [arm64] serial: xilinx_uartps: Use helper function
       hrtimer_update_function()
     - [arm64] serial: xilinx_uartps: fix rs485 delay_rts_after_send
     - f2fs: clear SBI_POR_DOING before initing inmem curseg
     - f2fs: add timeout in f2fs_enable_checkpoint()
     - f2fs: dump more information for f2fs_{enable,disable}_checkpoint()
     - f2fs: fix to propagate error from f2fs_enable_checkpoint()
     - gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list()
     - gpiolib: acpi: Handle deferred list via new API
     - gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter
     - gpiolib: acpi: Move quirks to a separate file
     - gpiolib: acpi: Add a quirk for Acer Nitro V15
     - gpiolib: acpi: Add quirk for ASUS ProArt PX13
     - gpiolib: acpi: Add quirk for Dell Precision 7780
     - netfilter: nft_ct: add seqadj extension for natted connections
       (CVE-2025-68206)
     - md/raid10: wait barrier before returning discard request with REQ_NOWAIT
       (CVE-2025-40325)
     - [arm64] drm/panthor: Flush shmem writes before mapping buffers
       CPU-uncached (CVE-2025-40276)
     - net: ipv6: ioam6: use consistent dst names
     - ipv6: adopt dst_dev() helper
     - net: use dst_dev_rcu() in sk_setup_caps()
     - usbnet: Fix using smp_processor_id() in preemptible code warnings
     - serial: core: Fix serial device initialization
     - tty: fix tty_port_tty_*hangup() kernel-doc
     - [amd64] x86/microcode/AMD: Select which microcode patch to load
     - media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio
     - wifi: mt76: mt7925: fix the unfinished command of regd_notifier before
       suspend
     - wifi: mt76: mt7925: fix CLC command timeout when suspend/resume
     - wifi: mt76: mt7925: add handler to hif suspend/resume event
     - idpf: add support for SW triggered interrupts
     - idpf: trigger SW interrupt when exiting wb_on_itr mode
     - idpf: add support for Tx refillqs in flow scheduling mode
     - idpf: improve when to set RE bit logic
     - idpf: simplify and fix splitq Tx packet rollback error path
     - idpf: replace flow scheduling buffer ring with buffer pool
     - idpf: stop Tx if there are insufficient buffer resources
     - idpf: remove obsolete stashing code
     - hrtimers: Make hrtimer_update_function() less expensive
     - gve: defer interrupt enabling until NAPI registration
     - block: handle zone management operations completions
     - soundwire: stream: extend sdw_alloc_stream() to take 'type' parameter
     - [arm64] ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime
     - PCI: brcmstb: Reuse pcie_cfg_data structure
     - PCI: brcmstb: Set MLW based on "num-lanes" DT property if present
     - PCI: brcmstb: Fix disabling L0s capability
     - mm/balloon_compaction: we cannot have isolated pages in the balloon list
     - mm/balloon_compaction: convert balloon_page_delete() to
       balloon_page_finalize()
     - [powerpc*] pseries/cmm: adjust BALLOON_MIGRATE when migrating pages
     - media: mediatek: vcodec: Use spinlock for context list protection lock
     - media: amphion: Add a frame flush mode for decoder
     - media: amphion: Make some vpu_v4l2 functions static
     - media: amphion: Remove vpu_vb_is_codecconfig
     - vfio/pci: Disable qword access to the PCI ROM bar
     - iomap: allocate s_dio_done_wq for async reads as well (CVE-2025-68357)
     - block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio()
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.65
     - mptcp: fallback earlier on simult connection
     - mm/page_alloc: change all pageblocks migrate type on coalescing
     - mm: simplify folio_expected_ref_count()
     - mm: consider non-anon swap cache folios in folio_expected_ref_count()
     - mptcp: ensure context reset on disconnect()
     - wifi: mac80211: Discard Beacon frames to non-broadcast address
     - [arm64] net: phy: mediatek: fix nvmem cell reference leak in
       mt798x_phy_calibration
     - drm/amdgpu: Forward VMID reservation errors
     - [amd64] cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL
       writes
     - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
     - sched/fair: Small cleanup to sched_balance_newidle()
     - sched/fair: Small cleanup to update_newidle_cost()
     - sched/fair: Proportional newidle balance
     - virtio_console: fix order of fields cols and rows
     - [armhf] pwm: stm32: Always program polarity
     - [amd64] Revert "iommu/amd: Skip enabling command/event buffers for kdump"
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.66
     - NFSD: Fix permission check for read access to executable-only files
     - nfsd: provide locking for v4_end_grace
     - nfsd: use correct loop termination in nfsd4_revoke_states()
     - nfsd: check that server is running in unlock_filesystem
     - NFSD: net ref data still needs to be freed even if net hasn't startup
     - NFSD: Remove NFSERR_EAGAIN
     - atm: Fix dma_free_coherent() size
     - net: 3com: 3c59x: fix possible null dereference in vortex_probe1()
     - [arm64] Fix cleared E0POE bit after cpu_suspend()/resume()
     - btrfs: always detect conflicting inodes when logging inode refs
     - [amd64] mei: me: add nova lake point S DID
     - lib/crypto: aes: Fix missing MMU protection for AES S-box
     - drm/amdgpu: Fix query for VPE block_type and ip_count
     - drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[]
       (Closes: #1122106)
     - [arm64,armhf] gpio: rockchip: mark the GPIO controller as sleeping
     - [arm64] pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping
     - wifi: avoid kernel-infoleak from struct iw_point
     - wifi: mac80211: restore non-chanctx injection behaviour
     - libceph: prevent potential out-of-bounds reads in handle_auth_done()
     - libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
     - libceph: make free_choose_arg_map() resilient to partial allocation
     - libceph: return the handler error from mon_handle_auth_done()
     - libceph: reset sparse-read state in osd_fault()
     - libceph: make calc_target() set t->paused, not just clear it
     - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
       (CVE-2025-40149)
     - drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally
     - drm/xe: Ensure GT is in C0 during resumes
     - dm-snapshot: fix 'scheduling while atomic' on real-time kernels
     - NFSv4: ensure the open stateid seqid doesn't go backwards
     - [arm64] ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again)
     - NFS: Fix up the automount fs_context to use the correct cred
     - drm/amd/display: shrink struct members
     - smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value
     - smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value
     - smb/client: fix NT_STATUS_NO_DATA_DETECTED value
     - scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset
     - scsi: ufs: core: Fix EH failure after W-LUN resume error
     - scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe
       failure scanned in again after probe failed"
     - btrfs: fix qgroup_snapshot_quick_inherit() squota bug
     - btrfs: qgroup: update all parent qgroups when doing quick inherit
     - btrfs: tracepoints: use btrfs_root_id() to get the id of a root
     - btrfs: fix NULL dereference on root when tracing inode eviction
     - drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files
     - drm/amd/display: Apply e4479aecf658 to dml
     - [arm64] dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema
       warnings
     - [amd64] crypto: qat - fix duplicate restarting msg during AER error
     - [arm64] dts: add off-on-delay-us for usdhc2 regulator
     - netfilter: nft_set_pipapo: fix range overlap detection
     - netfilter: nft_synproxy: avoid possible data-race on update operation
     - [arm64,armhf] gpio: pca953x: Add support for level-triggered interrupts
     - [arm64,armhf] gpio: pca953x: handle short interrupt pulses on PCAL devices
     - netfilter: nf_tables: fix memory leak in nf_tables_newrule()
     - netfilter: nf_conncount: update last_gc only when GC has been performed
     - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress
     - [arm64] net: mscc: ocelot: Fix crash when adding interface under a lag
     - inet: ping: Fix icmp out counting
     - net: sock: fix hardened usercopy panic in sock_recv_errqueue
     - netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates
     - net/mlx5e: Don't print error message due to invalid module
     - net: wwan: iosm: Fix memory leak in ipc_mux_deinit()
     - bnxt_en: Fix potential data corruption with HW GRO/LRO
     - vsock: Make accept()ed sockets use custom setsockopt()
     - btrfs: only enforce free space tree if v1 cache is required for bs < ps
       cases
     - [riscv64] pgtable: Cleanup useless VA_USER_XXX definitions
     - net: fix memory leak in skb_segment_list for GRO packets
     - idpf: keep the netdev when a reset fails
     - idpf: fix memory leak in idpf_vport_rel()
     - idpf: cap maximum Rx buffer size
     - HID: quirks: work around VID/PID conflict for appledisplay
     - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in
       qfq_reset
     - net: usb: pegasus: fix memory leak in update_eth_regs_async()
     - arp: do not assume dev_hard_header() does not change skb->head
     - erofs: don't bother with s_stack_depth increasing for now
     - erofs: fix file-backed mounts no longer working on EROFS partitions
     - ALSA: ac97bus: Use guard() for mutex locks
     - ALSA: ac97: fix a double free in snd_ac97_controller_register()
     - btrfs: fix error handling of submit_uncompressed_range()
     - btrfs: subpage: dump the involved bitmap when ASSERT() failed
     - btrfs: add extra error messages for delalloc range related errors
     - btrfs: remove btrfs_fs_info::sectors_per_page
     - btrfs: truncate ordered extent when skipping writeback past i_size
     - btrfs: use variable for end offset in extent_writepage_io()
     - btrfs: fix beyond-EOF write handling
     - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K
     - bpf: Make variables in bpf_prog_test_run_xdp less confusing
     - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN
     - bpf: Fix reference count leak in bpf_prog_test_run_xdp()
     - net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant
     - powercap: fix race condition in register_control_type()
     - powercap: fix sscanf() error return value handling
     - netfilter: nf_tables: avoid chain re-validation if possible
     - ata: libata-core: Disable LPM on ST2000DM008-2FR102
     - drm/amd/display: Fix DP no audio issue
     - [arm64] spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ
     - drm/amdkfd: Fix improper NULL termination of queue restore SMI event
       string
     - can: j1939: make j1939_session_activate() fail if device is no longer
       registered
     - ALSA: usb-audio: Update for native DSD support quirks
     - [amd64] ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025
     - ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL
     - [arm64,armhf] ASoC: fsl_sai: Add missing registers to cache default
     - scsi: sg: Fix occasional bogus elapsed time that exceeds timeout
     - spi: cadence-quadspi: Prevent lost complete() call during indirect read
     - tpm2-sessions: Fix out of range indexing in name_size (CVE-2025-68792)
     - ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.67
     - efi/cper: Fix cper_bits_to_str buffer handling and return value
     - Revert "gfs2: Fix use of bio_chain"
     - [amd64] x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
     - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation
     - xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set
     - pNFS: Fix a deadlock when returning a delegation during open()
     - NFS: Fix a deadlock involving nfs_release_folio()
     - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
     - pnfs/blocklayout: Fix memory leak in bl_parse_scsi()
     - drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions
     - PM: EM: Fix incorrect description of the cost field in struct
       em_perf_state
     - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
     - btrfs: send: check for inline extents in range_is_hole_in_parent()
     - net: bridge: annotate data-races around fdb->{updated,used}
     - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
     - net: update netdev_lock_{type,name}
     - macvlan: fix possible UAF in macvlan_forward_source()
     - ipv4: ip_gre: make ipgre_header() robust
     - net/mlx5e: Fix crash on profile change rollback failure
     - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
     - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv
     - net/mlx5e: Restore destroying state bit after profile cleanup
     - btrfs: factor out init_space_info() from create_space_info()
     - btrfs: factor out check_removing_space_info() from
       btrfs_free_block_groups()
     - btrfs: introduce btrfs_space_info sub-group
     - btrfs: fix memory leaks in create_space_info() error paths
     - ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip
     - net: hv_netvsc: reject RSS hash key programming without RX indirection
       table
     - ipv6: Fix use-after-free in inet6_addr_del().
     - net/sched: sch_qfq: do not free existing class in qfq_change_class()
     - [amd64] ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack
       type
     - drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2
     - mm: describe @flags parameter in memalloc_flags_save()
     - textsearch: describe @list member in ts_ops search
     - mm, kfence: describe @slab parameter in __kfence_obj_info()
     - [arm64] dmaengine: tegra-adma: Fix use-after-free
     - [arm64] phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before
       using it
     - [arm64] phy: phy-snps-eusb2: refactor constructs names
     - phy: drop probe registration printks
     - [arm64] phy: qcom-qusb2: Fix NULL pointer dereference on early suspend
     - [armhf] phy: stm32-usphyc: Fix off by one in probe()
     - [armhf] dmaengine: omap-dma: fix dma_pool resource leak in error paths
     - [arm64] i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA
     - HID: usbhid: paper over wrong bNumDescriptor field (Closes: #1122193)
     - bridge: mcast: Fix use-after-free during router port configuration
       (CVE-2025-38248)
     - [arm64] ASoC: codecs: wsa883x: fix unnecessary initialisation
     - drm/amd/display: mark static functions noinline_for_stack
     - io_uring: move local task_work in exit cancel loop
     - scsi: core: Fix error handler encryption support
     - ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
     - null_blk: fix kmemleak by releasing references to fault configfs items
     - can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak
     - can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit.
     - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session
       upon receiving the second rts
     - xfs: Fix the return value of xfs_rtcopy_summary()
     - lib/buildid: use __kernel_read() for sleepable context
     - [arm64] phy: rockchip: inno-usb2: fix communication disruption in gadget
       mode
     - [arm64,armhf] phy: ti: gmii-sel: fix regmap leak on probe failure
     - [arm64] phy: freescale: imx8m-pcie: assert phy reset during power on
     - [arm64] phy: rockchip: inno-usb2: fix disconnection in gadget mode
     - usb: dwc3: Check for USB4 IP_NAME
     - usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor
     - USB: OHCI/UHCI: Add soft dependencies on ehci_platform
     - USB: serial: option: add Telit LE910 MBIM composition
     - USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
     - nvme-pci: disable secondary temp for Wodposit WPBSNM8
     - [arm64] ASoC: codecs: wsa881x: fix unnecessary initialisation
     - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
     - hrtimer: Fix softirq base check in update_needs_ipi()
     - [amd64] EDAC/x38: Fix a resource leak in x38_probe1()
     - [amd64] EDAC/i3200: Fix a resource leak in i3200_probe1()
     - tcpm: allow looking for role_sw device in the main node
     - i2c: riic: Move suspend handling to NOIRQ phase
     - [amd64] x86/resctrl: Add missing resctrl initialization for Hygon
     - [amd64] x86/resctrl: Fix memory bandwidth counter width for Hygon
     - nvme: fix PCIe subsystem reset controller state transition
     - mm/zswap: fix error pointer free in zswap_cpu_comp_prepare()
     - mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free
     - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure
     - drm/amd/display: Bump the HDMI clock to 340MHz
     - drm/amd: Clean up kfd node on surprise disconnect
     - drm/amdkfd: fix a memory leak in device_queue_manager_init()
     - drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
     - [arm64,armhf] drm/panel-simple: fix connector type for DataImage
       SCF0700C48GGU18 panel
     - drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
     - [arm64] dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
     - [armhf] dmaengine: stm32: dmamux: fix device leak on route allocation
     - [armhf] dmaengine: stm32: dmamux: fix OF node leak on route allocation
       failure
     - [armhf] dmaengine: ti: dma-crossbar: fix device leak on dra7x route
       allocation
     - [armhf] dmaengine: ti: dma-crossbar: fix device leak on am335x route
       allocation
     - [amd64] HID: intel-ish-hid: Use dedicated unbound workqueues to prevent
       resume blocking
     - [amd64] HID: intel-ish-hid: Fix -Wcast-function-type-strict in
       devm_ishtp_alloc_workqueue()
     - btrfs: fix deadlock in wait_current_trans() due to ignored transaction
       type
     - xfs: set max_agbno to allow sparse alloc of last full inode chunk
     - mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure
     - mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup
       failure
     - bpf: Reject narrower access to pointer ctx fields (CVE-2025-38591)
     - mm/fake-numa: allow later numa node hotplug
     - mm: numa,memblock: include <asm/numa.h> for 'numa_nodes_parsed'
     - [arm64] phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path
     - [arm64] phy: rockchip: inno-usb2: Fix a double free bug in
       rockchip_usb2phy_probe()
     - [arm64] dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure
     - mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection
     - mm/page_alloc: batch page freeing in decay_pcp_high
     - mm/page_alloc: prevent pcp corruption with SMP=n
     - mm/fake-numa: handle cases with no SRAT info
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.68
     - posix-clock: Store file pointer in struct posix_clock_context
     - ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE.
     - dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains
     - dt-bindings: power: qcom,rpmpd: add Turbo L5 corner
     - dt-bindings: power: qcom-rpmpd: split RPMh domains definitions
     - dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO
     - [arm64] pmdomain: qcom: rpmhpd: Add MXC to SC8280XP
     - Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump()
     - btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE
     - ata: ahci: Do not read the per port area for unimplemented ports
     - ata: libata-sata: Improve link_power_management_supported sysfs attribute
     - ata: libata: Add cpr_log to ata_dev_print_features() early return
     - ata: libata-core: Introduce ata_dev_config_lpm()
     - ata: libata: Call ata_dev_config_lpm() for ATAPI devices
     - ata: libata: Print features also for ATAPI devices
     - ice: initialize ring_stats->syncp
     - ice: Avoid detrimental cleanup for bond during interface stop
     - ice: Fix incorrect timeout ice_release_res()
     - igc: Restore default Qbv schedule when changing channels
     - igc: fix race condition in TX timestamp read for register 0
     - vsock/virtio: Coalesce only linear skb
     - net: usb: dm9601: remove broken SR9700 support
     - bonding: limit BOND_MODE_8023AD to Ethernet devices
     - l2tp: Fix memleak in l2tp_udp_encap_recv().
     - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on
       usb_submit_urb() error
     - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
     - [amd64,arm64] amd-xgbe: avoid misleading per-packet error log
     - gue: Fix skb memleak with inner IP protocol 0.
     - fou: Don't allow 0 for FOU_ATTR_IPPROTO.
     - veth: fix data race in veth_get_ethtool_stats
     - l2tp: avoid one data-race in l2tp_tunnel_del_work()
     - ipvlan: Make the addrs_lock be per port
     - [arm64] octeontx2: cn10k: fix RX flowid TCAM mask handling
     - net/sched: Enforce that teql can only be used as root qdisc
     - net/sched: qfq: Use cl_is_active to determine whether class is active in
       qfq_rm_from_ag
     - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN
       spec
     - wifi: mac80211: don't perform DA check on S1G beacon
     - serial: 8250_pci: Fix broken RS485 for F81504/508/512
     - w1: therm: Fix off-by-one buffer overflow in alarms_store
     - w1: fix redundant counter decrement in w1_attach_slave_device()
     - Revert "nfc/nci: Add the inconsistency check between the input data length
       and count"
     - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
     - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
     - scsi: storvsc: Process unsupported MODE_SENSE_10
     - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
     - [arm64] dts: rockchip: remove dangerous max-link-speed from helios64
     - [arm64] dts: rockchip: Fix voltage threshold for volume keys for Pinephone
       Pro
     - [amd64] x86/kfence: avoid writing L1TF-vulnerable PTEs
     - [amd64] comedi: Fix getting range information for subdevices 16 to 255
     - [amd64] platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute
       names
     - [amd64] platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID
       macro
     - mm/rmap: fix two comments related to huge_pmd_unshare()
     - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
     - iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event
       detection
     - interconnect: debugfs: initialize src_node and dst_node to empty strings
     - regmap: Fix race condition in hwspinlock irqsave routine
     - [riscv64] clocksource: Fix stimecmp update hazard on RV32
     - [amd64] platform/x86/amd: Fix memory leak in wbrf_record()
     - scsi: core: Wake up the error handler when final completions race against
       each other
     - scsi: qla2xxx: Sanitize payload size to prevent member overflow
     - ALSA: usb: Increase volume range that triggers a warning
     - ice: Fix persistent failure in ice_get_rxfh
     - [arm64] net: hns3: fix data race in hns3_fetch_stats
     - be2net: fix data race in be_get_new_eqd
     - [arm64] net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
     - [arm64] net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
     - mISDN: annotate data-race around dev->work
     - ipv6: annotate data-race in ndisc_router_discovery()
     - usbnet: limit max_mtu based on device's hard_mtu
     - clocksource: Reduce watchdog readout delay limit to prevent false
       positives
     - sched/fair: Fix pelt clock sync when entering idle
     - drm/amd/pm: Don't clear SI SMC table when setting power limit
     - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
     - drm/nouveau: add missing DCB connector types
     - drm/nouveau: implement missing DCB connector types; gracefully handle
       unknown connectors
     - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
     - bonding: provide a net pointer to __skb_flow_dissect()
     - [arm64,armhf] net: dsa: fix off-by-one in maximum bridge ID determination
     - [arm64] octeontx2-af: Fix error handling
     - net: openvswitch: fix data race in ovs_vport_get_upcall_stats
     - vsock/virtio: fix potential underflow in virtio_transport_get_credit()
     - vsock/virtio: cap TX credit to local buffer size
     - net/sched: act_ife: avoid possible NULL deref
     - dpll: Prevent duplicate registrations
     - [amd64] x86: make page fault handling disable interrupts properly
     - tpm: Compare HMAC values in constant time
     - keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal
     - leds: led-class: Only Add LED to leds_list when it is fully ready
     - of: fix reference count leak in of_alias_scan()
     - of: platform: Use default match table for /firmware
     - iio: accel: iis328dq: fix gain values
     - iio: adc: ad9467: fix ad9434 vref mask
     - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc
       driver
     - iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot
     - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
     - ALSA: ctxfi: Fix potential OOB access in audio mixer handling
       (Closes: #1121535)
     - ALSA: scarlett2: Fix buffer overflow in config retrieval
     - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
     - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
     - mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode
     - drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)
     - wifi: ath10k: fix dma_free_coherent() pointer
     - wifi: ath12k: fix dma_free_coherent() pointer
     - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
     - wifi: rsi: Fix memory corruption due to not set vif driver data size
     - [arm64] fpsimd: signal: Allocate SSVE storage when restoring ZA
     - [arm64] Set __nocfi on swsusp_arch_resume()
     - slimbus: core: fix runtime PM imbalance on report present
     - slimbus: core: fix device reference leak on report present
     - tracing: Fix crash on synthetic stacktrace field usage
     - [amd64] intel_th: fix device leak on output open()
     - mei: trace: treat reg parameter as string
     - [s390x] ap: Fix wrong APQN fill calculation
     - netrom: fix double-free in nr_route_frame()
     - [amd64] platform/x86: hp-bioscfg: Fix automatic module loading
     - [arm64] pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq
       vpu
     - [amd64] perf/x86/intel: Do not enable BTS for guests
     - [arm64,armhf] irqchip/gic-v3-its: Avoid truncating memory addresses
     - net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick
     - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
     - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
     - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
     - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
     - drm/amdgpu: remove frame cntl for gfx v12
     - gpio: cdev: Correct return code on memory allocation failure
     - migrate: correct lock ordering for hugetlb file folios
     - [arm64] dmaengine: ti: k3-udma: Enable second resource range for BCDMA and
       PKTDMA
     - can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
     - bpf: Do not let BPF test infra emit invalid GSO types to stack
       (CVE-2025-68725)
     - [arm64] dts: rockchip: remove redundant max-link-speed from nanopi-r4s
     - iio: core: add missing mutex_destroy in iio_dev_release()
     - iio: core: Replace lockdep_set_class() + mutex_init() by combined call
     - iio: core: add separate lockdep class for info_exist_lock
     - [armhf] iio: adc: exynos_adc: fix OF populate on driver rebind
     - exfat: fix refcount leak in exfat_find (CVE-2025-68351)
     - sched_ext: Fix possible deadlock in the deferred_irq_workfn()
       (CVE-2025-68333)
     - fs/ntfs3: Initialize allocated memory before use (CVE-2025-68365)
     - [amd64] accel/ivpu: Fix race condition when unbinding BOs (CVE-2025-68749)
     - btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
       (CVE-2025-68358)
     - wifi: ath11k: fix RCU stall while reaping monitor destination ring
       (CVE-2024-58097)
     - vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put()
     - vsock/virtio: Rename virtio_vsock_alloc_skb()
     - vsock/virtio: Move SKB allocation lower-bound check to callers
     - vsock/virtio: Rename virtio_vsock_skb_rx_put()
     - vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers
     - vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers
     - net: Introduce skb_copy_datagram_from_iter_full()
     - vsock/virtio: Fix message iterator handling on transmit path
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.69
     - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
     - Bluetooth: MGMT: Fix memory leak in set_ssp_complete
     - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup()
     - can: gs_usb: gs_usb_receive_bulk_callback(): fix error message
     - bonding: annotate data-races around slave->last_rx
     - [arm64,armhf] net: mvpp2: cls: Fix memory leak in
       mvpp2_ethtool_cls_rule_ins()
     - ipv6: use the right ifindex when replying to icmpv6 from localhost
     - net: wwan: t7xx: fix potential skb->frags overflow in RX path
     - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().
     - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues
     - ice: stop counting UDP csum mismatch as rx_errors
     - net/mlx5e: TC, delete flows only for existing peers
     - nfc: nci: Fix race between rfkill and nci_unregister_device().
     - net: bridge: fix static key check
     - net: phy: micrel: fix clk warning when removing the driver
     - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect
     - net/mlx5: Initialize events outside devlink lock
     - net/mlx5: Fix vhca_id access call trace use before alloc
     - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload
     - scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
     - [amd64] ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion
     - gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler
     - gpio: virtuser: fix UAF in configfs release path
     - bcache: fix improper use of bi_end_io
     - bcache: use bio cloning for detached device requests
     - bcache: fix I/O accounting leak in detached_dev_do_request
     - dma/pool: distinguish between missing and exhausted atomic pools
     - sched/deadline: Document dl_server
     - sched/deadline: Fix 'stuck' dl_server
     - [arm64,armhf] pinctrl: meson: mark the GPIO controller as sleeping
     - [riscv64] compat: fix COMPAT_UTS_MACHINE definition
     - scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
     - [amd64] ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO
     - [arm64,armhf] gpio: pca953x: mask interrupts in irq shutdown
     - scsi: qla2xxx: edif: Fix dma_free_coherent() size
     - efivarfs: fix error propagation in efivar_entry_get()
     - nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference
       (Closes: #1122521)
     - gpio: rockchip: Stop calling pinctrl for set_direction
     - mptcp: only reset subflow errors when propagated
     - flex_proportions: make fprop_new_period() hardirq safe
     - mm/memory-failure: fix missing ->mf_stats count in hugetlb poison
     - mm/memory-failure: teach kill_accessing_process to accept hugetlb tail
       page pfn
     - mm/shmem, swap: fix race of truncate and swap entry split
     - net: fix segmentation of forwarding fraglist GRO
     - [arm64] drm/msm/a6xx: fix bogus hwcg register updates
     - drm/amdgpu/soc21: fix xclk for APUs
     - drm/amdgpu/gfx10: fix wptr reset in KGQ init
     - drm/amdgpu/gfx11: fix wptr reset in KGQ init
     - drm/amdgpu/gfx12: fix wptr reset in KGQ init
     - drm/amdgpu: fix NULL pointer dereference in
       amdgpu_gmc_filter_faults_remove
     - drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule()
     - gpiolib: acpi: Fix potential out-of-boundary left shift
     - cgroup: Fix kernfs_node UAF in css_free_rwork_fn
     - rxrpc: Fix data-race warning and potential load/store tearing
     - ksmbd: smbd: fix dma_unmap_sg() nents (CVE-2026-23093)
     - mm/kfence: randomize the freelist on initialization
     - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode
       (CVE-2024-58096)
     - Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)"
     - btrfs: prevent use-after-free on folio private data in
       btrfs_subpage_clear_uptodate()
     - net/sched: act_ife: convert comma to semicolon
     - [arm64] pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and
       SWR TX pins
     - mptcp: avoid dup SUB_CLOSED events after disconnect
     - perf: Simplify get_perf_callchain() user logic
     - perf: sched: Fix perf crash with new is_user_task() helper
     - writeback: fix 100% CPU usage when dirtytime_expire_interval is 0
     - drm/amdgpu/gfx11: adjust KGQ reset sequence
     - [arm64] pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver
     - net: mana: Change the function signature of mana_get_primary_netdev_rcu
     - RDMA/mana_ib: Handle net event for pointing to the current netdev
 .
   [ Macpaul Lin ]
   * udeb: Add USB TYPE-C and Mux modules in usb-modules (Closes: #1109090)
 .
   [ Salvatore Bonaccorso ]
   * fs/nfsd: Enable NFSD_SCSILAYOUT (NFSv4.1 server support for pNFS SCSI
     layouts)
   * [rt] Update to 6.12.66-rt15
linux-signed-amd64 (6.12.69+1~bpo12+1) bookworm-backports; urgency=medium
 .
   * Sign kernel from linux 6.12.69-1~bpo12+1
 .
   * Rebuild for bookworm-backports

linux-signed-arm64 (6.12.73+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.73-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.70
     - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
     - [amd64] x86/vmware: Fix hypercall clobbers
     - [amd64] x86/kfence: fix booting on 32bit non-PAE systems
     - [amd64] platform/x86: intel_telemetry: Fix swapped arrays in PSS output
     - ALSA: aloop: Fix racy access at PCM trigger
     - [arm64] pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the
       highest state
     - [arm64] pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system
       wakeup
     - [arm64,armhf] pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong
       adb400 reset
     - [arm64] pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system
       wakeup
     - [arm64] pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains
     - mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single
     - ceph: fix NULL pointer dereference in ceph_mds_auth_match()
       (Closes: #1125405)
     - rbd: check for EOD after exclusive lock is ensured to be held
     - ceph: fix oops due to invalid pointer for kfree() in parse_longname()
     - gve: Fix stats report corruption on queue count change
     - gve: Correct ethtool rx_dropped calculation
     - mm, shmem: prevent infinite loop on truncate race
     - Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem"
     - KVM: Don't clobber irqfd routing type when deassigning irqfd
     - PCI/ERR: Ensure error recoverability at all times
     - ublk: fix deadlock when reading partition table (CVE-2025-68823)
     - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (CVE-2025-40082)
     - [arm*] binder: fix BR_FROZEN_REPLY error log
     - binderfs: fix ida_alloc_max() upper bound
     - procfs: avoid fetching build ID while holding VMA lock
     - tracing: Fix ftrace event field alignments
     - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined
     - wifi: wlcore: ensure skb headroom before skb_push
     - net: usb: sr9700: support devices with virtual driver CD
     - block,bfq: fix aux stat accumulation destination
     - smb/server: call ksmbd_session_rpc_close() on error path in
       create_smb2_pipe()
     - md: suspend array while updating raid_disks via sysfs
     - smb/server: fix refcount leak in smb2_open()
     - smb/server: fix refcount leak in parse_durable_handle_context()
     - [amd64] HID: intel-ish-hid: Update ishtp bus match to support device ID
       table
     - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL
     - btrfs: fix reservation leak in some error paths when inserting inline
       extent
     - [riscv64] Sanitize syscall table indexing under speculation
     - [amd64] HID: intel-ish-hid: Reset enum_devices_done before enumeration
     - HID: playstation: Center initial joystick axes to prevent spurious events
     - ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55
     - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk
     - [arm64] PCI: qcom: Remove ASPM L0s support for MSM8996 SoC
     - netfilter: replace -EEXIST with -EBUSY
     - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list
     - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()
     - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101)
     - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset
     - ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free
     - HID: logitech: add HID++ support for Logitech MX Anywhere 3S
     - wifi: mac80211: collect station statistics earlier when disconnect
     - ASoC: simple-card-utils: Check device node before overwrite direction
     - nvme-fc: release admin tagset if init fails
     - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
     - [amd64] ASoC: amd: yc: Fix microphone on ASUS M6500RE
     - regmap: maple: free entry on mas_store_gfp() failure
     - wifi: cfg80211: Fix bitrate calculation overflow for HE rates
     - scsi: target: iscsi: Fix use-after-free in
       iscsit_dec_session_usage_count()
     - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
     - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
     - wifi: mac80211: correctly check if CSA is active
     - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice
     - btrfs: reject new transactions if the fs is fully read-only
     - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio
     - [amd64] platform/x86: toshiba_haps: Fix memory leaks in add/remove
       routines
     - [amd64] platform/x86: intel_telemetry: Fix PSS event register mask
     - [amd64] platform/x86: hp-bioscfg: Skip empty attribute names
     - [amd64] platform/x86/intel/tpmi/plr: Make the file domain<n>/status
       writeable
     - smb/client: fix memory leak in smb2_open_file()
     - net: add skb_header_pointer_careful() helper
     - net/sched: cls_u32: use skb_header_pointer_careful()
     - net: liquidio: Initialize netdev pointer before queue setup
     - net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup
     - net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup
     - net: phy: add phy_interface_weight()
     - net: phy: add phy_interface_copy()
     - net: sfp: pre-parse the module support
     - net: sfp: convert sfp quirks to modify struct sfp_module_support
     - net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module
     - macvlan: fix error recovery in macvlan_common_newlink()
     - net: usb: r8152: fix resume reset deadlock
     - net: don't touch dev->stats in BPF redirect paths
     - tipc: use kfree_sensitive() for session key material
     - drm/amd/display: fix wrong color value mapping on MCM shaper LUT
     - net: gro: fix outer network offset
     - [amd64] drm/mgag200: fix mgag200_bmc_stop_scanout()
     - drm/xe/query: Fix topology query pointer advance
     - drm/xe/pm: Also avoid missing outer rpm warning on system suspend
     - drm/xe/pm: Disable D3Cold for BMG only on specific platforms
     - [armhf] hwmon: (occ) Mark occ_init_attribute() as __printf
     - netfilter: nf_tables: fix inverted genmask check in
       nft_map_catchall_activate()
     - ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF
     - ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update()
     - [amd64] ASoC: amd: fix memory leak in acp3x pdm dma ops
     - [arm64] ipi: tegra: Fix a memory leak in tegra_slink_probe()
     - [arm64,armhf] spi: tegra114: Preserve SPI mode bits in def_command1_reg
     - ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU.
     - gpiolib-acpi: Update file references in the Documentation and MAINTAINERS
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.71
     - net: tunnel: make skb_vlan_inet_prepare() return drop reasons
       (Closes: #1127597)
     - io_uring/rw: recycle buffers manually for non-mshot reads
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.72
     - smb: client: split cached_fid bitfields to avoid shared-byte RMW races
     - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error
       paths
     - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
     - driver core: enforce device_lock for driver_match_device()
     - Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB
     - [amd64] crypto: iaa - Fix out-of-bounds index in
       find_empty_iaa_compression_mode
     - [armhf] crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists
       correctly
     - crypto: virtio - Add spinlock protection with virtqueue notification
     - crypto: virtio - Remove duplicated virtqueue_kick in
       virtio_crypto_skcipher_crypt_req
     - nilfs2: Fix potential block overflow that cause system hang
     - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()
     - scsi: qla2xxx: Validate sp before freeing associated memory
     - scsi: qla2xxx: Allow recovery for tape devices
     - scsi: qla2xxx: Delay module unload while fabric scan in progress
     - scsi: qla2xxx: Free sp in error path to fix system crash
     - scsi: qla2xxx: Query FW again before proceeding with login
     - bus: mhi: host: pci_generic: Add Telit FE990B40 modem support
     - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (CVE-2026-23169)
     - erofs: fix UAF issue for file-backed mounts w/ directio option
     - xfs: fix UAF in xchk_btree_check_block_owner
     - PCI: endpoint: Avoid creating sub-groups asynchronously
     - wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add
     - [armhf] gpio: omap: do not register driver in probe()
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.73
     - Revert "driver core: enforce device_lock for driver_match_device()"
linux-signed-arm64 (6.12.73+1~bpo12+1) bookworm-backports; urgency=medium
 .
   * Sign kernel from linux 6.12.73-1~bpo12+1
 .
   * Rebuild for bookworm-backports
linux-signed-arm64 (6.12.69+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.69-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.64
     - btrfs: do not skip logging new dentries when logging a new name
     - btrfs: fix a potential path leak in print_data_reloc_error()
     - [arm64] bpf, arm64: Do not audit capability check in do_jit()
     - btrfs: fix memory leak of fs_devices in degraded seed device path
     - shmem: fix recovery on rename failures
     - iomap: adjust read range correctly for non-block-aligned positions
     - iomap: account for unaligned end offsets when truncating read range
     - scripts/faddr2line: Fix "Argument list too long" error
     - [amd64] perf/x86/amd: Check event before enable to avoid GPF
     - sched/deadline: only set free_cpus for online runqueues
     - sched/fair: Revert max_newidle_lb_cost bump
     - [amd64] x86/ptrace: Always inline trivial accessors
     - ACPICA: Avoid walking the Namespace if start_node is NULL
     - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only
     - cpufreq: dt-platdev: Add JH7110S SOC to the allowlist
     - ACPI: fan: Workaround for 64-bit firmware bug
     - cpuidle: menu: Use residency threshold in polling state override decisions
     - livepatch: Match old_sympos 0 and 1 in klp_find_func()
     - fs/ntfs3: Support timestamps prior to epoch
     - kbuild: Use objtree for module signing key path
     - ntfs: set dummy blocksize to read boot_block when mounting
     - hfsplus: fix volume corruption issue for generic/070
     - hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create
     - hfsplus: Verify inode mode when loading from disk
     - hfsplus: fix volume corruption issue for generic/073
     - fs/ntfs3: check for shutdown in fsync
     - wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU
     - wifi: cfg80211: stop radar detection in cfg80211_leave()
     - wifi: cfg80211: use cfg80211_leave() in iftype change
     - wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC
       load
     - wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet
     - btrfs: scrub: always update btrfs_scrub_progress::last_physical
     - gfs2: fix remote evict for read-only filesystems
     - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad"
     - smb/server: fix return value of smb2_ioctl()
     - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
     - ksmbd: vfs: fix race on m_flags in vfs_cache
     - Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV
     - Bluetooth: btusb: MT7922: Add VID/PID 0489/e170
     - Bluetooth: btusb: MT7920: Add VID/PID 0489/e135
     - Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE
     - Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT
     - gfs2: Fix use of bio_chain
     - [arm64,armhf] net: fec: ERR007885 Workaround for XDP TX path
     - netrom: Fix memory leak in nr_sendmsg()
     - net/sched: ets: Always remove class from active list before deleting in
       ets_qdisc_change
     - ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2()
     - bnxt_en: Fix XDP_TX path
     - net: openvswitch: fix middle attribute validation in push_nsh() action
     - broadcom: b44: prevent uninitialized value usage
     - netfilter: nf_conncount: fix leaked ct in error paths
     - ipvs: fix ipv4 null-ptr-deref in route error path
     - net/sched: ets: Remove drr class from the active list if it changes to
       strict
     - nfc: pn533: Fix error code in pn533_acr122_poweron_rdr()
     - netfilter: nf_nat: remove bogus direction check
     - netfilter: nf_tables: remove redundant chain validation on register store
     - ethtool: Avoid overflowing userspace buffer on stats query
     - net/mlx5: fw reset, clear reset requested on drain_fw_reset
     - net/mlx5: Drain firmware reset in shutdown callback
     - net/mlx5: fw_tracer, Validate format string parameters
     - net/mlx5: fw_tracer, Handle escaped percent properly
     - net/mlx5: Serialize firmware reset with devlink
     - net/handshake: duplicate handshake cancellations leak socket
     - [arm64] net: enetc: do not transmit redirected XDP frames when the link is
       down
     - [arm64] net: hns3: using the num_tqps in the vf driver to apply for
       resources
     - [arm64] net: hns3: using the num_tqps to check whether tqp_index is out of
       range when vf get ring info from mbx
     - [arm64] net: hns3: add VLAN id validation before using
     - [amd64] hwmon: (dell-smm) Limit fan multiplier to avoid overflow
     - hwmon: (ibmpex) fix use-after-free in high/low store
     - hwmon: (tmp401) fix overflow caused by default conversion rate value
     - drm/me/gsc: mei interrupt top half should be in irq disabled context
     - drm/xe: Restore engine registers before restarting schedulers after GT
       reset
     - drm/panel: sony-td4353-jdi: Enable prepare_prev_first
     - [amd64] x86/xen: Move Xen upcall handler
     - [amd64] x86/xen: Fix sparse warning in enlighten_pv.c
     - [arm64] kdump: Fix elfcorehdr overlap caused by reserved memory processing
       reorder
     - spi: cadence-quadspi: Fix clock disable on probe failure path
     - block: rnbd-clt: Fix leaked ID in init_dev()
     - drm/xe: Limit num_syncs to prevent oversized allocations
     - drm/xe/oa: Limit num_syncs to prevent oversized allocations
     - ksmbd: skip lock-range check on equal size to avoid size==0 underflow
     - ksmbd: Fix refcount leak when invalid session is found on session lookup
     - ksmbd: fix buffer validation by including null terminator size in EA
       length
     - HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen
     - Input: ti_am335x_tsc - fix off-by-one error in wire_order validation
     - Input: lkkbd - disable pending work before freeing device
     - Input: alps - fix use-after-free bugs caused by dev3_register_work
     - Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table
     - xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails
     - can: gs_usb: gs_can_open(): fix error handling
     - [arm64,armhf] soc/tegra: fuse: Do not register SoC device on ACPI boot
     - ACPI: PCC: Fix race condition by removing static qualifier
     - ACPI: CPPC: Fix missing PCC check for guaranteed_perf
     - [arm64] mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds
     - dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml
     - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()
     - [amd64] x86/fpu: Fix FPU state core dump truncation on CPUs with no
       extended xfeatures
     - ALSA: vxpocket: Fix resource leak in vxpocket_probe error path
     - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path
     - ALSA: usb-mixer: us16x08: validate meter packet indices
     - nfsd: update percpu_ref to manage references on nfsd_net
     - nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_
     - nfsd: fix memory leak in nfsd_create_serv error paths
     - ipmi: Fix the race between __scan_channels() and deliver_response()
     - ipmi: Fix __scan_channels() failing to rescan channels
     - [arm64,armhf] ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on
       AM33xx
     - scsi: smartpqi: Add support for Hurray Data new controller PCI device
     - [arm64] clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &
       pcie_x4
     - scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled
     - scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive
     - scsi: qla2xxx: Use reinit_completion on mbx_intr_comp
     - fuse: Always flush the page cache before FOPEN_DIRECT_IO write
     - fuse: Invalidate the page cache after FOPEN_DIRECT_IO write
     - via_wdt: fix critical boot hang due to unnamed resource allocation
     - reset: fix BIT macro reference
     - exfat: fix remount failure in different process environments
     - exfat: zero out post-EOF page cache on file extension
     - usbip: Fix locking bug in RT-enabled kernels
     - usb: typec: ucsi: Handle incorrect num_connectors capability
     - [armhf] iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc
       complains
     - usb: xhci: limit run_graceperiod for only usb 3.0 devices
     - usb: usb-storage: No additional quirks need to be added to the EL-R12
       optical drive.
     - libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map
     - i2c: designware: Disable SMBus interrupts to prevent storms from
       mis-configured firmware
     - nvme-fc: don't hold rport lock when putting ctrl
     - nvme-fabrics: add ENOKEY to no retry criteria for authentication failures
     - [amd64] platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS
       DMI quirks
     - [amd64] scsi: scsi_debug: Fix atomic write enable module param description
     - block: rnbd-clt: Fix signedness bug in init_dev()
     - vhost/vsock: improve RCU read sections around vhost_vsock_get()
     - cifs: Fix memory and information leak in smb3_reconfigure()
     - KEYS: trusted: Fix a memory leak in tpm2_load_cmd
     - io_uring: fix filename leak in __io_openat_prep()
     - [amd64] x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD
       SMCA systems
     - [arm64] mmc: sdhci-msm: Avoid early clock doubling during HS400 transition
     - perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister()
     - [amd64] lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit
     - [s390x] dasd: Fix gendisk parent after copy pair swap
     - wifi: mt76: Fix DTS power-limits on little endian systems
     - block: rate-limit capacity change info log
     - floppy: fix for PAGE_SIZE != 4KB
     - kallsyms: Fix wrong "big" kernel symbol type read from procfs
     - fs/ntfs3: fix mount failure for sparse runs in run_unpack()
     - tpm: Cap the number of PCR banks
     - ext4: fix string copying in parse_apply_sb_mount_options()
     - ext4: xattr: fix null pointer deref in ext4_raw_inode()
     - ext4: clear i_state_flags when alloc inode
     - ext4: fix incorrect group number assertion in mb_check_buddy
     - ext4: align max orphan file size with e2fsprogs limit
     - jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key
     - jbd2: use a weaker annotation in journal handling
     - media: v4l2-mem2mem: Fix outdated documentation
     - mptcp: schedule rtx timer only after pushing data
     - mptcp: avoid deadlock on fallback while reinjecting
     - usb: usb-storage: Maintain minimal modifications to the bcdDevice range.
     - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
     - media: pvrusb2: Fix incorrect variable used in trace message
     - usb: typec: altmodes/displayport: Drop the device reference in
       dp_altmode_probe()
     - [arm64,armhf] usb: dwc3: of-simple: fix clock resource leak in
       dwc3_of_simple_probe
     - [arm64,armhf] usb: dwc3: keep susphy enabled during exit to avoid
       controller faults
     - char: applicom: fix NULL pointer dereference in ac_ioctl
     - [amd64] intel_th: Fix error handling in intel_th_output_open
     - mei: gsc: add dependency on Xe driver
     - serial: sh-sci: Check that the DMA cookie is valid
     - cpuidle: governors: teo: Drop misguided target residency check
     - cpufreq: nforce2: fix reference count leak in nforce2
     - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort
       path"
     - scsi: aic94xx: fix use-after-free in device removal path
     - NFSD: use correct reservation type in nfsd4_scsi_fence_client
     - scsi: target: Reset t_task_cdb pointer in error case
     - scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow
     - scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error
     - f2fs: ensure node page reads complete before f2fs_put_super() finishes
     - f2fs: fix to avoid potential deadlock
     - f2fs: fix to avoid updating zero-sized extent in extent cache
     - f2fs: invalidate dentry cache on failed whiteout creation
     - f2fs: fix age extent cache insertion skip on counter overflow
     - f2fs: fix uninitialized one_time_gc in victim_sel_policy
     - f2fs: fix return value of f2fs_recover_fsync_data()
     - KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot
     - media: vidtv: initialize local pointers upon transfer of memory ownership
     - ocfs2: fix kernel BUG in ocfs2_find_victim_chain
     - [amd64] KVM: x86: Don't clear async #PF queue when CR0.PG is disabled
       (e.g. on #SMI)
     - [amd64] platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver
     - scs: fix a wrong parameter in __scs_magic
     - libceph: make decode_pool() more resilient against corrupted osdmaps
     - [powerpc*] Add reloc_offset() to font bitmap pointer used for
       bootx_printf()
     - [amd64] KVM: x86: WARN if hrtimer callback for periodic APIC timer fires
       with period=0
     - [amd64] KVM: x86: Explicitly set new periodic hrtimer expiration in
       apic_timer_fn()
     - [amd64] KVM: x86: Fix VM hard lockup after prolonged inactivity with
       periodic HV timer
     - [amd64] KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE
     - [amd64] KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN
     - [amd64] KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW
       emulation
     - [amd64] KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN
     - [amd64] KVM: nVMX: Immediately refresh APICv controls as needed on nested
       VM-Exit
     - [amd64] KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR
       (failed VMRUN)
     - [amd64] KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested
       VM-Exits
     - xfs: fix a memory leak in xfs_buf_item_init()
     - xfs: fix stupid compiler warning
     - xfs: fix a UAF problem in xattr repair
     - tracing: Do not register unsupported perf events
     - PM: runtime: Do not clear needs_force_resume with enabled runtime PM
     - r8169: fix RTL8117 Wake-on-Lan in DASH mode
     - fsnotify: do not generate ACCESS/MODIFY events on child for special files
     - net/handshake: restore destructor on submit failure
     - NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap
     - NFSD: NFSv4 file creation neglects setting ACL
     - nfsd: Mark variable __maybe_unused to avoid W=1 build break
     - svcrdma: return 0 on success from svc_rdma_copy_inline_range
     - svcrdma: use rc_pageoff for memcpy byte offset
     - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in
       gss_read_proxy_verf
     - [powerpc*] kexec: Enable SMT before waking offline CPUs
     - btrfs: don't log conflicting inode if it's a dir moved in the current
       transaction
     - [s390x] ipl: Clear SBP flag when bootprog is set
     - gpio: regmap: Fix memleak in error path in gpio_regmap_register()
     - io_uring/poll: correctly handle io_poll_add() return value on update
     - io_uring: fix min_wait wakeups for SQPOLL
     - Revert "drm/amd/display: Fix pbn to kbps Conversion"
     - drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state()
     - drm/amd/display: Fix scratch registers offsets for DCN35
     - drm/amd/display: Fix scratch registers offsets for DCN351
     - drm/displayid: pass iter to drm_find_displayid_extension()
     - ALSA: hda: cs35l41: Fix NULL pointer dereference in
       cs35l41_hda_read_acpi() (CVE-2025-68345)
     - ALSA: wavefront: Use guard() for spin locks
     - ALSA: wavefront: Clear substream pointers on close
     - [arm64] pinctrl: renesas: rzg2l: Fix ISEL restore on resume
     - hsr: hold rcu and dev lock for hsr_get_port_ndev (CVE-2025-39872)
     - sched/rt: Fix race in push_rt_task (CVE-2025-38234)
     - [arm64] KVM: arm64: Initialize HCR_EL2.E2H early
     - [arm64] KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu()
     - [arm64] Revamp HCR_EL2.E2H RES1 detection
     - dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and
       resets
     - dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains
       and resets
     - dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and
       resets
     - dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and
       resets
     - dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and
       resets
     - dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and
       resets
     - dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and
       resets
     - crypto: af_alg - zero initialize memory allocated via sock_kmalloc
     - crypto: caam - Add check for kcalloc() in test_len()
     - [arm64,armhf] amba: tegra-ahb: Fix device leak on SMMU enable
     - virtio: vdpa: Fix reference count leak in octep_sriov_enable()
     - tracing: Fix fixed array of synthetic event
     - [arm64,armhf] soc: samsung: exynos-pmu: fix device leak on regmap lookup
     - [arm64] soc: qcom: ocmem: fix device leak on lookup
     - [arm64] soc: amlogic: canvas: fix device leak on lookup
     - rpmsg: glink: fix rpmsg device leak
     - [amd64] platform/x86: intel: chtwc_int33fe: don't dereference swnode args
     - i2c: amd-mp2: fix reference leak in MP2 PCI device
     - hwmon: (max16065) Use local variable to avoid TOCTOU
     - hwmon: (max6697) fix regmap leak on probe failure
     - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU
     - hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU
     - [amd64] x86/msi: Make irq_retrigger() functional for posted MSI
     - [arm64] iommu/mediatek: fix use-after-free on probe deferral
     - fuse: fix readahead reclaim deadlock
     - wifi: rtw88: limit indirect IO under powered off for RTL8822CS
       (Closes: #1125797)
     - wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()
     - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result()
     - wifi: mac80211: do not use old MBSSID elements
     - i40e: fix scheduling in set_rx_mode
     - i40e: validate ring_len parameter against hardware-specific values
     - iavf: fix off-by-one issues in iavf_config_rss_reg()
     - idpf: reduce mbx_task schedule delay to 300us
     - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
     - Bluetooth: btusb: revert use of devm_kzalloc in btusb
     - net: mdio: aspeed: add dummy read to avoid read-after-write issue
     - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy
     - ip6_gre: make ip6gre_header() robust
     - [amd64] platform/x86: msi-laptop: add missing sysfs_remove_group()
     - [amd64] platform/x86: ibm_rtl: fix EBDA signature search pointer
       arithmetic
     - team: fix check for port enabled in
       team_queue_override_port_prio_changed()
     - [arm64,armhf] net: dsa: fix missing put_device() in
       dsa_tree_find_first_conduit()
     - amd-xgbe: reset retries and mode on RX adapt failures
     - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
     - genalloc.h: fix htmldocs warning
     - firewire: nosy: Fix dma_free_coherent() size
     - [armhf] net: dsa: b53: skip multicast entries for fdb_dump()
     - kbuild: fix compilation of dtb specified on command-line without make rule
     - net: usb: asix: validate PHY address before use
     - net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct
     - vfio/pds: Fix memory leak in pds_vfio_dirty_enable()
     - [amd64] platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI
       package parsing
     - [arm64] octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"
     - net: stmmac: fix the crash issue for zero copy XDP_TX action
     - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
     - ipv4: Fix reference count leak when using error routes with nexthop
       objects
     - net: rose: fix invalid array index in rose_kill_by_device()
     - ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT
     - RDMA/irdma: avoid invalid read in irdma_net_event
     - RDMA/efa: Remove possible negative shift
     - RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr()
     - RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db()
     - RDMA/core: always drop device refcount in ib_del_sub_device_and_put()
     - RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send
     - RDMA/bnxt_re: Fix to use correct page size for PDE table
     - md: Fix static checker warning in analyze_sbs
     - md/raid5: fix possible null-pointer dereferences in
       raid5_store_group_thread_cnt()
     - ksmbd: Fix memory leak in get_file_all_info()
     - RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation
     - RDMA/bnxt_re: fix dma_free_coherent() pointer
     - blk-mq: skip CPU offline notify on unmapped hctx
     - ntfs: Do not overwrite uptodate pages
     - [armhf] ASoC: stm32: sai: fix device leak on probe
     - [armhf] ASoC: stm32: sai: fix clk prepare imbalance on probe failure
     - [armhf] ASoC: stm32: sai: fix OF node leak on probe
     - [arm64] ASoC: codecs: lpass-tx-macro: fix SM6115 support
     - [arm64] ASoC: qcom: q6apm-dai: set flags to reflect correct operation of
       appl_ptr
     - [arm64] ASoC: qcom: q6asm-dai: perform correct state check before closing
     - [arm64] ASoC: qcom: q6adm: the the copp device only during last instance
     - [arm64] ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer
       alignment.
     - [amd64] iommu/amd: Fix pci_segment memleak in alloc_pci_segment()
     - [amd64] iommu/amd: Propagate the error code returned by __modify_irte_ga()
       in modify_irte_ga()
     - [armhf] iommu/omap: fix device leaks on probe_device()
     - [arm64] iommu/qcom: fix device leak on of_xlate()
     - [arm64,riscv64] iommu/sun50i: fix device leak on of_xlate()
     - [arm64,armhf] iommu/tegra: fix device leak on probe_device()
     - iommu: disable SVA when CONFIG_X86 is set
     - HID: logitech-dj: Remove duplicate error logging
     - fgraph: Initialize ftrace_ops->private for function graph ops
     - fgraph: Check ftrace_pids_enabled on registration for early filtering
     - PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths
     - [arm64] dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power
       regulator
     - [powerpc*] mm: Fix mprotect on book3s 32-bit
     - [powerpc*] 64s/slb: Fix SLB multihit issue during SLB preload
     - leds: leds-cros_ec: Skip LEDs without color components
     - leds: leds-lp50xx: Allow LED 0 to be added to module bank
     - leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs
     - leds: leds-lp50xx: Enable chip before any communication
     - block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs
     - [arm64,armhf] clk: samsung: exynos-clkout: Assign .num before accessing
       .hws (Closes: #1121211)
     - [arm64] mfd: max77620: Fix potential IRQ chip conflict when probing two
       devices
     - media: rc: st_rc: Fix reset control resource leak
     - media: verisilicon: Fix CPU stalls on G2 bus error
     - mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions
     - mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips
     - mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips
     - mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips
     - mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips
     - mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips
     - mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips
     - [amd64] perf/x86/amd/uncore: Fix the return value of
       amd_uncore_df_event_init() on error
     - [powerpc*] pseries/cmm: call balloon_devinfo_init() also without
       CONFIG_BALLOON_COMPACTION
     - media: adv7842: Avoid possible out-of-bounds array accesses in
       adv7842_cp_log_status()
     - firmware: stratix10-svc: Add mutex in stratix10 memory management
     - dm-ebs: Mark full buffer dirty even on partial write
     - dm-bufio: align write boundary on physical block size
     - fbdev: gbefb: fix to use physical address instead of dma address
     - fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing
     - fbdev: tcx.c fix mem_map to correct smem_start offset
     - media: cec: Fix debugfs leak on bus_register() failure
     - media: msp3400: Avoid possible out-of-bounds array accesses in
       msp3400c_thread()
     - media: platform: mtk-mdp3: fix device leaks at probe
     - media: renesas: rcar_drif: fix device node reference leak in
       rcar_drif_bond_enabled
     - media: samsung: exynos4-is: fix potential ABBA deadlock on init
     - media: TDA1997x: Remove redundant cancel_delayed_work in probe
     - media: verisilicon: Protect G2 HEVC decoder against invalid DPB index
     - media: videobuf2: Fix device reference leak in vb2_dc_alloc error path
     - media: vpif_capture: fix section mismatch
     - media: vpif_display: fix section mismatch
     - media: amphion: Cancel message work before releasing the VPU core
     - media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe
     - media: i2c: adv7842: Remove redundant cancel_delayed_work in probe
     - media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init()
     - [armhf] pmdomain: imx: Fix reference count leak in imx_gpc_probe()
     - compiler_types.h: add "auto" as a macro for "__auto_type"
     - lockd: fix vfs_test_lock() calls
     - idr: fix idr_alloc() returning an ID out of range
     - mm/page_owner: fix memory leak in page_owner_stack_fops->release()
     - [amd64] x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix
       Halo
     - tools/mm/page_owner_sort: fix timestamp comparison for stable sorting
     - samples/ftrace: Adjust LoongArch register restore order in direct calls
     - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
     - RDMA/cm: Fix leaking the multicast GID table reference
     - e1000: fix OOB in e1000_tbi_should_accept()
     - fjes: Add missing iounmap in fjes_hw_init()
     - nfsd: Drop the client reference in client_states_open()
     - net: usb: sr9700: fix incorrect command used to write single register
     - net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
     - net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to
       macb_open()
     - Revert "drm/amd: Skip power ungate during suspend for VPE"
     - drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling
     - drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma
     - drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling
     - [arm64] drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers
     - [amd64] drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg()
     - drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident
     - drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()
     - [arm64] drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse()
     - [arm64] drm/mediatek: Fix probe resource leaks
     - [arm64] drm/mediatek: Fix probe memory leak
     - [arm64] drm/mediatek: Fix probe device leaks
     - drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace
     - drm/amdkfd: bump minimum vgpr size for gfx1151
     - drm/amdkfd: Trap handler support for expert scheduling mode
     - [amd64] drm/i915: Fix format string truncation warning
     - drm/ttm: Avoid NULL pointer deref for evicted BOs
     - [amd64] drm/mgag200: Fix big-endian support
     - drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table
     - drm/xe/oa: Disallow 0 OA property values
     - drm/xe: Adjust long-running workload timeslices to reasonable values
     - drm/xe: Use usleep_range for accurate long-running workload timeslicing
     - drm/xe: Drop preempt-fences when destroying imported dma-bufs.
     - [arm64] drm/msm/dpu: Add missing NULL pointer check for pingpong interface
     - [amd64] drm/i915/gem: Zero-initialize the eb.vma array in
       i915_gem_do_execbuffer
     - drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb
     - [riscv64] lib/crypto: riscv/chacha: Avoid s0/fp register
     - gfs2: fix freeze error handling
     - btrfs: don't rewrite ret from inode_permission
     - sched/eevdf: Fix min_vruntime vs avg_vruntime
     - erofs: fix unexpected EIO under memory pressure
     - sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks
     - jbd2: fix the inconsistency between checksum and data in memory for
       journal sb
     - tty: introduce and use tty_port_tty_vhangup() helper
     - xhci: dbgtty: fix device unregister: fixup
     - f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes()
     - f2fs: use global inline_xattr_slab instead of per-sb slab cache
     - f2fs: drop inode from the donation list when the last file is closed
     - f2fs: fix to avoid updating compression context during writeback
     - serial: core: fix OF node leak
     - serial: core: Restore sysfs fwnode information
     - mptcp: pm: ignore unknown endpoint flags
     - mm/ksm: fix exec/fork inheritance support for prctl
     - svcrdma: bound check rq_pages index in inline path
     - block: freeze queue when updating zone resources
     - tpm2-sessions: Fix tpm2_read_public range checks
     - sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue()
     - sched_ext: Fix missing post-enqueue handling in
       move_local_task_to_local_dsq()
     - drm/displayid: add quirk to ignore DisplayID checksum errors
     - hrtimers: Introduce hrtimer_update_function()
     - [arm64] serial: xilinx_uartps: Use helper function
       hrtimer_update_function()
     - [arm64] serial: xilinx_uartps: fix rs485 delay_rts_after_send
     - f2fs: clear SBI_POR_DOING before initing inmem curseg
     - f2fs: add timeout in f2fs_enable_checkpoint()
     - f2fs: dump more information for f2fs_{enable,disable}_checkpoint()
     - f2fs: fix to propagate error from f2fs_enable_checkpoint()
     - gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list()
     - gpiolib: acpi: Handle deferred list via new API
     - gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter
     - gpiolib: acpi: Move quirks to a separate file
     - gpiolib: acpi: Add a quirk for Acer Nitro V15
     - gpiolib: acpi: Add quirk for ASUS ProArt PX13
     - gpiolib: acpi: Add quirk for Dell Precision 7780
     - netfilter: nft_ct: add seqadj extension for natted connections
       (CVE-2025-68206)
     - md/raid10: wait barrier before returning discard request with REQ_NOWAIT
       (CVE-2025-40325)
     - [arm64] drm/panthor: Flush shmem writes before mapping buffers
       CPU-uncached (CVE-2025-40276)
     - net: ipv6: ioam6: use consistent dst names
     - ipv6: adopt dst_dev() helper
     - net: use dst_dev_rcu() in sk_setup_caps()
     - usbnet: Fix using smp_processor_id() in preemptible code warnings
     - serial: core: Fix serial device initialization
     - tty: fix tty_port_tty_*hangup() kernel-doc
     - [amd64] x86/microcode/AMD: Select which microcode patch to load
     - media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio
     - wifi: mt76: mt7925: fix the unfinished command of regd_notifier before
       suspend
     - wifi: mt76: mt7925: fix CLC command timeout when suspend/resume
     - wifi: mt76: mt7925: add handler to hif suspend/resume event
     - idpf: add support for SW triggered interrupts
     - idpf: trigger SW interrupt when exiting wb_on_itr mode
     - idpf: add support for Tx refillqs in flow scheduling mode
     - idpf: improve when to set RE bit logic
     - idpf: simplify and fix splitq Tx packet rollback error path
     - idpf: replace flow scheduling buffer ring with buffer pool
     - idpf: stop Tx if there are insufficient buffer resources
     - idpf: remove obsolete stashing code
     - hrtimers: Make hrtimer_update_function() less expensive
     - gve: defer interrupt enabling until NAPI registration
     - block: handle zone management operations completions
     - soundwire: stream: extend sdw_alloc_stream() to take 'type' parameter
     - [arm64] ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime
     - PCI: brcmstb: Reuse pcie_cfg_data structure
     - PCI: brcmstb: Set MLW based on "num-lanes" DT property if present
     - PCI: brcmstb: Fix disabling L0s capability
     - mm/balloon_compaction: we cannot have isolated pages in the balloon list
     - mm/balloon_compaction: convert balloon_page_delete() to
       balloon_page_finalize()
     - [powerpc*] pseries/cmm: adjust BALLOON_MIGRATE when migrating pages
     - media: mediatek: vcodec: Use spinlock for context list protection lock
     - media: amphion: Add a frame flush mode for decoder
     - media: amphion: Make some vpu_v4l2 functions static
     - media: amphion: Remove vpu_vb_is_codecconfig
     - vfio/pci: Disable qword access to the PCI ROM bar
     - iomap: allocate s_dio_done_wq for async reads as well (CVE-2025-68357)
     - block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio()
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.65
     - mptcp: fallback earlier on simult connection
     - mm/page_alloc: change all pageblocks migrate type on coalescing
     - mm: simplify folio_expected_ref_count()
     - mm: consider non-anon swap cache folios in folio_expected_ref_count()
     - mptcp: ensure context reset on disconnect()
     - wifi: mac80211: Discard Beacon frames to non-broadcast address
     - [arm64] net: phy: mediatek: fix nvmem cell reference leak in
       mt798x_phy_calibration
     - drm/amdgpu: Forward VMID reservation errors
     - [amd64] cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL
       writes
     - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
     - sched/fair: Small cleanup to sched_balance_newidle()
     - sched/fair: Small cleanup to update_newidle_cost()
     - sched/fair: Proportional newidle balance
     - virtio_console: fix order of fields cols and rows
     - [armhf] pwm: stm32: Always program polarity
     - [amd64] Revert "iommu/amd: Skip enabling command/event buffers for kdump"
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.66
     - NFSD: Fix permission check for read access to executable-only files
     - nfsd: provide locking for v4_end_grace
     - nfsd: use correct loop termination in nfsd4_revoke_states()
     - nfsd: check that server is running in unlock_filesystem
     - NFSD: net ref data still needs to be freed even if net hasn't startup
     - NFSD: Remove NFSERR_EAGAIN
     - atm: Fix dma_free_coherent() size
     - net: 3com: 3c59x: fix possible null dereference in vortex_probe1()
     - [arm64] Fix cleared E0POE bit after cpu_suspend()/resume()
     - btrfs: always detect conflicting inodes when logging inode refs
     - [amd64] mei: me: add nova lake point S DID
     - lib/crypto: aes: Fix missing MMU protection for AES S-box
     - drm/amdgpu: Fix query for VPE block_type and ip_count
     - drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[]
       (Closes: #1122106)
     - [arm64,armhf] gpio: rockchip: mark the GPIO controller as sleeping
     - [arm64] pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping
     - wifi: avoid kernel-infoleak from struct iw_point
     - wifi: mac80211: restore non-chanctx injection behaviour
     - libceph: prevent potential out-of-bounds reads in handle_auth_done()
     - libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
     - libceph: make free_choose_arg_map() resilient to partial allocation
     - libceph: return the handler error from mon_handle_auth_done()
     - libceph: reset sparse-read state in osd_fault()
     - libceph: make calc_target() set t->paused, not just clear it
     - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
       (CVE-2025-40149)
     - drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally
     - drm/xe: Ensure GT is in C0 during resumes
     - dm-snapshot: fix 'scheduling while atomic' on real-time kernels
     - NFSv4: ensure the open stateid seqid doesn't go backwards
     - [arm64] ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again)
     - NFS: Fix up the automount fs_context to use the correct cred
     - drm/amd/display: shrink struct members
     - smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value
     - smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value
     - smb/client: fix NT_STATUS_NO_DATA_DETECTED value
     - scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset
     - scsi: ufs: core: Fix EH failure after W-LUN resume error
     - scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe
       failure scanned in again after probe failed"
     - btrfs: fix qgroup_snapshot_quick_inherit() squota bug
     - btrfs: qgroup: update all parent qgroups when doing quick inherit
     - btrfs: tracepoints: use btrfs_root_id() to get the id of a root
     - btrfs: fix NULL dereference on root when tracing inode eviction
     - drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files
     - drm/amd/display: Apply e4479aecf658 to dml
     - [arm64] dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema
       warnings
     - [amd64] crypto: qat - fix duplicate restarting msg during AER error
     - [arm64] dts: add off-on-delay-us for usdhc2 regulator
     - netfilter: nft_set_pipapo: fix range overlap detection
     - netfilter: nft_synproxy: avoid possible data-race on update operation
     - [arm64,armhf] gpio: pca953x: Add support for level-triggered interrupts
     - [arm64,armhf] gpio: pca953x: handle short interrupt pulses on PCAL devices
     - netfilter: nf_tables: fix memory leak in nf_tables_newrule()
     - netfilter: nf_conncount: update last_gc only when GC has been performed
     - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress
     - [arm64] net: mscc: ocelot: Fix crash when adding interface under a lag
     - inet: ping: Fix icmp out counting
     - net: sock: fix hardened usercopy panic in sock_recv_errqueue
     - netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates
     - net/mlx5e: Don't print error message due to invalid module
     - net: wwan: iosm: Fix memory leak in ipc_mux_deinit()
     - bnxt_en: Fix potential data corruption with HW GRO/LRO
     - vsock: Make accept()ed sockets use custom setsockopt()
     - btrfs: only enforce free space tree if v1 cache is required for bs < ps
       cases
     - [riscv64] pgtable: Cleanup useless VA_USER_XXX definitions
     - net: fix memory leak in skb_segment_list for GRO packets
     - idpf: keep the netdev when a reset fails
     - idpf: fix memory leak in idpf_vport_rel()
     - idpf: cap maximum Rx buffer size
     - HID: quirks: work around VID/PID conflict for appledisplay
     - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in
       qfq_reset
     - net: usb: pegasus: fix memory leak in update_eth_regs_async()
     - arp: do not assume dev_hard_header() does not change skb->head
     - erofs: don't bother with s_stack_depth increasing for now
     - erofs: fix file-backed mounts no longer working on EROFS partitions
     - ALSA: ac97bus: Use guard() for mutex locks
     - ALSA: ac97: fix a double free in snd_ac97_controller_register()
     - btrfs: fix error handling of submit_uncompressed_range()
     - btrfs: subpage: dump the involved bitmap when ASSERT() failed
     - btrfs: add extra error messages for delalloc range related errors
     - btrfs: remove btrfs_fs_info::sectors_per_page
     - btrfs: truncate ordered extent when skipping writeback past i_size
     - btrfs: use variable for end offset in extent_writepage_io()
     - btrfs: fix beyond-EOF write handling
     - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K
     - bpf: Make variables in bpf_prog_test_run_xdp less confusing
     - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN
     - bpf: Fix reference count leak in bpf_prog_test_run_xdp()
     - net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant
     - powercap: fix race condition in register_control_type()
     - powercap: fix sscanf() error return value handling
     - netfilter: nf_tables: avoid chain re-validation if possible
     - ata: libata-core: Disable LPM on ST2000DM008-2FR102
     - drm/amd/display: Fix DP no audio issue
     - [arm64] spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ
     - drm/amdkfd: Fix improper NULL termination of queue restore SMI event
       string
     - can: j1939: make j1939_session_activate() fail if device is no longer
       registered
     - ALSA: usb-audio: Update for native DSD support quirks
     - [amd64] ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025
     - ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL
     - [arm64,armhf] ASoC: fsl_sai: Add missing registers to cache default
     - scsi: sg: Fix occasional bogus elapsed time that exceeds timeout
     - spi: cadence-quadspi: Prevent lost complete() call during indirect read
     - tpm2-sessions: Fix out of range indexing in name_size (CVE-2025-68792)
     - ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.67
     - efi/cper: Fix cper_bits_to_str buffer handling and return value
     - Revert "gfs2: Fix use of bio_chain"
     - [amd64] x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
     - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation
     - xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set
     - pNFS: Fix a deadlock when returning a delegation during open()
     - NFS: Fix a deadlock involving nfs_release_folio()
     - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
     - pnfs/blocklayout: Fix memory leak in bl_parse_scsi()
     - drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions
     - PM: EM: Fix incorrect description of the cost field in struct
       em_perf_state
     - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
     - btrfs: send: check for inline extents in range_is_hole_in_parent()
     - net: bridge: annotate data-races around fdb->{updated,used}
     - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
     - net: update netdev_lock_{type,name}
     - macvlan: fix possible UAF in macvlan_forward_source()
     - ipv4: ip_gre: make ipgre_header() robust
     - net/mlx5e: Fix crash on profile change rollback failure
     - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
     - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv
     - net/mlx5e: Restore destroying state bit after profile cleanup
     - btrfs: factor out init_space_info() from create_space_info()
     - btrfs: factor out check_removing_space_info() from
       btrfs_free_block_groups()
     - btrfs: introduce btrfs_space_info sub-group
     - btrfs: fix memory leaks in create_space_info() error paths
     - ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip
     - net: hv_netvsc: reject RSS hash key programming without RX indirection
       table
     - ipv6: Fix use-after-free in inet6_addr_del().
     - net/sched: sch_qfq: do not free existing class in qfq_change_class()
     - [amd64] ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack
       type
     - drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2
     - mm: describe @flags parameter in memalloc_flags_save()
     - textsearch: describe @list member in ts_ops search
     - mm, kfence: describe @slab parameter in __kfence_obj_info()
     - [arm64] dmaengine: tegra-adma: Fix use-after-free
     - [arm64] phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before
       using it
     - [arm64] phy: phy-snps-eusb2: refactor constructs names
     - phy: drop probe registration printks
     - [arm64] phy: qcom-qusb2: Fix NULL pointer dereference on early suspend
     - [armhf] phy: stm32-usphyc: Fix off by one in probe()
     - [armhf] dmaengine: omap-dma: fix dma_pool resource leak in error paths
     - [arm64] i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA
     - HID: usbhid: paper over wrong bNumDescriptor field (Closes: #1122193)
     - bridge: mcast: Fix use-after-free during router port configuration
       (CVE-2025-38248)
     - [arm64] ASoC: codecs: wsa883x: fix unnecessary initialisation
     - drm/amd/display: mark static functions noinline_for_stack
     - io_uring: move local task_work in exit cancel loop
     - scsi: core: Fix error handler encryption support
     - ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
     - null_blk: fix kmemleak by releasing references to fault configfs items
     - can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak
     - can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit.
     - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session
       upon receiving the second rts
     - xfs: Fix the return value of xfs_rtcopy_summary()
     - lib/buildid: use __kernel_read() for sleepable context
     - [arm64] phy: rockchip: inno-usb2: fix communication disruption in gadget
       mode
     - [arm64,armhf] phy: ti: gmii-sel: fix regmap leak on probe failure
     - [arm64] phy: freescale: imx8m-pcie: assert phy reset during power on
     - [arm64] phy: rockchip: inno-usb2: fix disconnection in gadget mode
     - usb: dwc3: Check for USB4 IP_NAME
     - usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor
     - USB: OHCI/UHCI: Add soft dependencies on ehci_platform
     - USB: serial: option: add Telit LE910 MBIM composition
     - USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
     - nvme-pci: disable secondary temp for Wodposit WPBSNM8
     - [arm64] ASoC: codecs: wsa881x: fix unnecessary initialisation
     - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
     - hrtimer: Fix softirq base check in update_needs_ipi()
     - [amd64] EDAC/x38: Fix a resource leak in x38_probe1()
     - [amd64] EDAC/i3200: Fix a resource leak in i3200_probe1()
     - tcpm: allow looking for role_sw device in the main node
     - i2c: riic: Move suspend handling to NOIRQ phase
     - [amd64] x86/resctrl: Add missing resctrl initialization for Hygon
     - [amd64] x86/resctrl: Fix memory bandwidth counter width for Hygon
     - nvme: fix PCIe subsystem reset controller state transition
     - mm/zswap: fix error pointer free in zswap_cpu_comp_prepare()
     - mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free
     - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure
     - drm/amd/display: Bump the HDMI clock to 340MHz
     - drm/amd: Clean up kfd node on surprise disconnect
     - drm/amdkfd: fix a memory leak in device_queue_manager_init()
     - drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
     - [arm64,armhf] drm/panel-simple: fix connector type for DataImage
       SCF0700C48GGU18 panel
     - drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
     - [arm64] dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
     - [armhf] dmaengine: stm32: dmamux: fix device leak on route allocation
     - [armhf] dmaengine: stm32: dmamux: fix OF node leak on route allocation
       failure
     - [armhf] dmaengine: ti: dma-crossbar: fix device leak on dra7x route
       allocation
     - [armhf] dmaengine: ti: dma-crossbar: fix device leak on am335x route
       allocation
     - [amd64] HID: intel-ish-hid: Use dedicated unbound workqueues to prevent
       resume blocking
     - [amd64] HID: intel-ish-hid: Fix -Wcast-function-type-strict in
       devm_ishtp_alloc_workqueue()
     - btrfs: fix deadlock in wait_current_trans() due to ignored transaction
       type
     - xfs: set max_agbno to allow sparse alloc of last full inode chunk
     - mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure
     - mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup
       failure
     - bpf: Reject narrower access to pointer ctx fields (CVE-2025-38591)
     - mm/fake-numa: allow later numa node hotplug
     - mm: numa,memblock: include <asm/numa.h> for 'numa_nodes_parsed'
     - [arm64] phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path
     - [arm64] phy: rockchip: inno-usb2: Fix a double free bug in
       rockchip_usb2phy_probe()
     - [arm64] dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure
     - mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection
     - mm/page_alloc: batch page freeing in decay_pcp_high
     - mm/page_alloc: prevent pcp corruption with SMP=n
     - mm/fake-numa: handle cases with no SRAT info
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.68
     - posix-clock: Store file pointer in struct posix_clock_context
     - ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE.
     - dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains
     - dt-bindings: power: qcom,rpmpd: add Turbo L5 corner
     - dt-bindings: power: qcom-rpmpd: split RPMh domains definitions
     - dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO
     - [arm64] pmdomain: qcom: rpmhpd: Add MXC to SC8280XP
     - Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump()
     - btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE
     - ata: ahci: Do not read the per port area for unimplemented ports
     - ata: libata-sata: Improve link_power_management_supported sysfs attribute
     - ata: libata: Add cpr_log to ata_dev_print_features() early return
     - ata: libata-core: Introduce ata_dev_config_lpm()
     - ata: libata: Call ata_dev_config_lpm() for ATAPI devices
     - ata: libata: Print features also for ATAPI devices
     - ice: initialize ring_stats->syncp
     - ice: Avoid detrimental cleanup for bond during interface stop
     - ice: Fix incorrect timeout ice_release_res()
     - igc: Restore default Qbv schedule when changing channels
     - igc: fix race condition in TX timestamp read for register 0
     - vsock/virtio: Coalesce only linear skb
     - net: usb: dm9601: remove broken SR9700 support
     - bonding: limit BOND_MODE_8023AD to Ethernet devices
     - l2tp: Fix memleak in l2tp_udp_encap_recv().
     - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on
       usb_submit_urb() error
     - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
     - [amd64,arm64] amd-xgbe: avoid misleading per-packet error log
     - gue: Fix skb memleak with inner IP protocol 0.
     - fou: Don't allow 0 for FOU_ATTR_IPPROTO.
     - veth: fix data race in veth_get_ethtool_stats
     - l2tp: avoid one data-race in l2tp_tunnel_del_work()
     - ipvlan: Make the addrs_lock be per port
     - [arm64] octeontx2: cn10k: fix RX flowid TCAM mask handling
     - net/sched: Enforce that teql can only be used as root qdisc
     - net/sched: qfq: Use cl_is_active to determine whether class is active in
       qfq_rm_from_ag
     - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN
       spec
     - wifi: mac80211: don't perform DA check on S1G beacon
     - serial: 8250_pci: Fix broken RS485 for F81504/508/512
     - w1: therm: Fix off-by-one buffer overflow in alarms_store
     - w1: fix redundant counter decrement in w1_attach_slave_device()
     - Revert "nfc/nci: Add the inconsistency check between the input data length
       and count"
     - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
     - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
     - scsi: storvsc: Process unsupported MODE_SENSE_10
     - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
     - [arm64] dts: rockchip: remove dangerous max-link-speed from helios64
     - [arm64] dts: rockchip: Fix voltage threshold for volume keys for Pinephone
       Pro
     - [amd64] x86/kfence: avoid writing L1TF-vulnerable PTEs
     - [amd64] comedi: Fix getting range information for subdevices 16 to 255
     - [amd64] platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute
       names
     - [amd64] platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID
       macro
     - mm/rmap: fix two comments related to huge_pmd_unshare()
     - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
     - iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event
       detection
     - interconnect: debugfs: initialize src_node and dst_node to empty strings
     - regmap: Fix race condition in hwspinlock irqsave routine
     - [riscv64] clocksource: Fix stimecmp update hazard on RV32
     - [amd64] platform/x86/amd: Fix memory leak in wbrf_record()
     - scsi: core: Wake up the error handler when final completions race against
       each other
     - scsi: qla2xxx: Sanitize payload size to prevent member overflow
     - ALSA: usb: Increase volume range that triggers a warning
     - ice: Fix persistent failure in ice_get_rxfh
     - [arm64] net: hns3: fix data race in hns3_fetch_stats
     - be2net: fix data race in be_get_new_eqd
     - [arm64] net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
     - [arm64] net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
     - mISDN: annotate data-race around dev->work
     - ipv6: annotate data-race in ndisc_router_discovery()
     - usbnet: limit max_mtu based on device's hard_mtu
     - clocksource: Reduce watchdog readout delay limit to prevent false
       positives
     - sched/fair: Fix pelt clock sync when entering idle
     - drm/amd/pm: Don't clear SI SMC table when setting power limit
     - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
     - drm/nouveau: add missing DCB connector types
     - drm/nouveau: implement missing DCB connector types; gracefully handle
       unknown connectors
     - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
     - bonding: provide a net pointer to __skb_flow_dissect()
     - [arm64,armhf] net: dsa: fix off-by-one in maximum bridge ID determination
     - [arm64] octeontx2-af: Fix error handling
     - net: openvswitch: fix data race in ovs_vport_get_upcall_stats
     - vsock/virtio: fix potential underflow in virtio_transport_get_credit()
     - vsock/virtio: cap TX credit to local buffer size
     - net/sched: act_ife: avoid possible NULL deref
     - dpll: Prevent duplicate registrations
     - [amd64] x86: make page fault handling disable interrupts properly
     - tpm: Compare HMAC values in constant time
     - keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal
     - leds: led-class: Only Add LED to leds_list when it is fully ready
     - of: fix reference count leak in of_alias_scan()
     - of: platform: Use default match table for /firmware
     - iio: accel: iis328dq: fix gain values
     - iio: adc: ad9467: fix ad9434 vref mask
     - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc
       driver
     - iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot
     - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
     - ALSA: ctxfi: Fix potential OOB access in audio mixer handling
       (Closes: #1121535)
     - ALSA: scarlett2: Fix buffer overflow in config retrieval
     - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
     - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
     - mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode
     - drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)
     - wifi: ath10k: fix dma_free_coherent() pointer
     - wifi: ath12k: fix dma_free_coherent() pointer
     - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
     - wifi: rsi: Fix memory corruption due to not set vif driver data size
     - [arm64] fpsimd: signal: Allocate SSVE storage when restoring ZA
     - [arm64] Set __nocfi on swsusp_arch_resume()
     - slimbus: core: fix runtime PM imbalance on report present
     - slimbus: core: fix device reference leak on report present
     - tracing: Fix crash on synthetic stacktrace field usage
     - [amd64] intel_th: fix device leak on output open()
     - mei: trace: treat reg parameter as string
     - [s390x] ap: Fix wrong APQN fill calculation
     - netrom: fix double-free in nr_route_frame()
     - [amd64] platform/x86: hp-bioscfg: Fix automatic module loading
     - [arm64] pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq
       vpu
     - [amd64] perf/x86/intel: Do not enable BTS for guests
     - [arm64,armhf] irqchip/gic-v3-its: Avoid truncating memory addresses
     - net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick
     - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
     - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
     - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
     - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
     - drm/amdgpu: remove frame cntl for gfx v12
     - gpio: cdev: Correct return code on memory allocation failure
     - migrate: correct lock ordering for hugetlb file folios
     - [arm64] dmaengine: ti: k3-udma: Enable second resource range for BCDMA and
       PKTDMA
     - can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
     - bpf: Do not let BPF test infra emit invalid GSO types to stack
       (CVE-2025-68725)
     - [arm64] dts: rockchip: remove redundant max-link-speed from nanopi-r4s
     - iio: core: add missing mutex_destroy in iio_dev_release()
     - iio: core: Replace lockdep_set_class() + mutex_init() by combined call
     - iio: core: add separate lockdep class for info_exist_lock
     - [armhf] iio: adc: exynos_adc: fix OF populate on driver rebind
     - exfat: fix refcount leak in exfat_find (CVE-2025-68351)
     - sched_ext: Fix possible deadlock in the deferred_irq_workfn()
       (CVE-2025-68333)
     - fs/ntfs3: Initialize allocated memory before use (CVE-2025-68365)
     - [amd64] accel/ivpu: Fix race condition when unbinding BOs (CVE-2025-68749)
     - btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
       (CVE-2025-68358)
     - wifi: ath11k: fix RCU stall while reaping monitor destination ring
       (CVE-2024-58097)
     - vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put()
     - vsock/virtio: Rename virtio_vsock_alloc_skb()
     - vsock/virtio: Move SKB allocation lower-bound check to callers
     - vsock/virtio: Rename virtio_vsock_skb_rx_put()
     - vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers
     - vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers
     - net: Introduce skb_copy_datagram_from_iter_full()
     - vsock/virtio: Fix message iterator handling on transmit path
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.69
     - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
     - Bluetooth: MGMT: Fix memory leak in set_ssp_complete
     - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup()
     - can: gs_usb: gs_usb_receive_bulk_callback(): fix error message
     - bonding: annotate data-races around slave->last_rx
     - [arm64,armhf] net: mvpp2: cls: Fix memory leak in
       mvpp2_ethtool_cls_rule_ins()
     - ipv6: use the right ifindex when replying to icmpv6 from localhost
     - net: wwan: t7xx: fix potential skb->frags overflow in RX path
     - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().
     - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues
     - ice: stop counting UDP csum mismatch as rx_errors
     - net/mlx5e: TC, delete flows only for existing peers
     - nfc: nci: Fix race between rfkill and nci_unregister_device().
     - net: bridge: fix static key check
     - net: phy: micrel: fix clk warning when removing the driver
     - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect
     - net/mlx5: Initialize events outside devlink lock
     - net/mlx5: Fix vhca_id access call trace use before alloc
     - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload
     - scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
     - [amd64] ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion
     - gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler
     - gpio: virtuser: fix UAF in configfs release path
     - bcache: fix improper use of bi_end_io
     - bcache: use bio cloning for detached device requests
     - bcache: fix I/O accounting leak in detached_dev_do_request
     - dma/pool: distinguish between missing and exhausted atomic pools
     - sched/deadline: Document dl_server
     - sched/deadline: Fix 'stuck' dl_server
     - [arm64,armhf] pinctrl: meson: mark the GPIO controller as sleeping
     - [riscv64] compat: fix COMPAT_UTS_MACHINE definition
     - scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
     - [amd64] ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO
     - [arm64,armhf] gpio: pca953x: mask interrupts in irq shutdown
     - scsi: qla2xxx: edif: Fix dma_free_coherent() size
     - efivarfs: fix error propagation in efivar_entry_get()
     - nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference
       (Closes: #1122521)
     - gpio: rockchip: Stop calling pinctrl for set_direction
     - mptcp: only reset subflow errors when propagated
     - flex_proportions: make fprop_new_period() hardirq safe
     - mm/memory-failure: fix missing ->mf_stats count in hugetlb poison
     - mm/memory-failure: teach kill_accessing_process to accept hugetlb tail
       page pfn
     - mm/shmem, swap: fix race of truncate and swap entry split
     - net: fix segmentation of forwarding fraglist GRO
     - [arm64] drm/msm/a6xx: fix bogus hwcg register updates
     - drm/amdgpu/soc21: fix xclk for APUs
     - drm/amdgpu/gfx10: fix wptr reset in KGQ init
     - drm/amdgpu/gfx11: fix wptr reset in KGQ init
     - drm/amdgpu/gfx12: fix wptr reset in KGQ init
     - drm/amdgpu: fix NULL pointer dereference in
       amdgpu_gmc_filter_faults_remove
     - drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule()
     - gpiolib: acpi: Fix potential out-of-boundary left shift
     - cgroup: Fix kernfs_node UAF in css_free_rwork_fn
     - rxrpc: Fix data-race warning and potential load/store tearing
     - ksmbd: smbd: fix dma_unmap_sg() nents (CVE-2026-23093)
     - mm/kfence: randomize the freelist on initialization
     - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode
       (CVE-2024-58096)
     - Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)"
     - btrfs: prevent use-after-free on folio private data in
       btrfs_subpage_clear_uptodate()
     - net/sched: act_ife: convert comma to semicolon
     - [arm64] pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and
       SWR TX pins
     - mptcp: avoid dup SUB_CLOSED events after disconnect
     - perf: Simplify get_perf_callchain() user logic
     - perf: sched: Fix perf crash with new is_user_task() helper
     - writeback: fix 100% CPU usage when dirtytime_expire_interval is 0
     - drm/amdgpu/gfx11: adjust KGQ reset sequence
     - [arm64] pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver
     - net: mana: Change the function signature of mana_get_primary_netdev_rcu
     - RDMA/mana_ib: Handle net event for pointing to the current netdev
 .
   [ Macpaul Lin ]
   * udeb: Add USB TYPE-C and Mux modules in usb-modules (Closes: #1109090)
 .
   [ Salvatore Bonaccorso ]
   * fs/nfsd: Enable NFSD_SCSILAYOUT (NFSv4.1 server support for pNFS SCSI
     layouts)
   * [rt] Update to 6.12.66-rt15
linux-signed-arm64 (6.12.69+1~bpo12+1) bookworm-backports; urgency=medium
 .
   * Sign kernel from linux 6.12.69-1~bpo12+1
 .
   * Rebuild for bookworm-backports

lxc (1:6.0.4-4+deb13u2) trixie; urgency=medium
 .
   * Cherry-pick upstream fix for data corruption during heavy IO on PTS
   * Update lxc-default-with-nesting apparmor profile (Closes: #1111087)

lxd (5.0.2+git20231211.1364ae4-9+deb13u3) trixie-security; urgency=high
 .
   * Cherry-pick fixes for the following security issues:
     - CVE-2026-23953 / GHSA-x6jc-phwx-hp32
     - CVE-2026-23954 / GHSA-7f67-crqm-jgh7

mariadb (1:11.8.6-0+deb13u1) trixie; urgency=medium
 .
   [ Otto Kekäläinen ]
   * New upstream maintenance release 11.8.6. For details about fixes please see
     https://mariadb.com/docs/release-notes/community-server/11.8/11.8.6
   * For details about fixes in 11.8.5 please see
     https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
     and the security notices:
     - CVE-2025-13699
     - CVE-2026-21968
   * For details about fixes in 11.8.4 please see
     https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
   * The version 11.8.4 was skipped in Debian (and Ubuntu) as it has a severe
     regression causing partial data deletion when using the DELETE statement on
     MyISAM or Aria tables under specific conditions (MDEV-38068)
   * Already existing plugins marked ready for general availability by upstream
     in this release: uuid_v4, uuid_v7 and inet4
   * Upstream 11.8.5 included fix to MDEV-36556 about upgrades failing from 10.4
     when encryption enabled (Closes: #1122811)
   * Add debian/source/local-options to suppress WolfSSL line ending errors
   * Patch new upstream test main.alter_merge to allow 'from Debian'
   * Fix path to mariadb-server.README in mariadb-secure-install
     (Closes: #1127863)
   * Add preliminary upstream patch to fix MDEV-38811 that affected Akonadi and
     any other use case that relies on 'skip-grant-tables' (Closes: #1127431)
   * Update patch statuses and Forwarded fields to aid patch maintenance in
     future new upstream version updates
   * Update server trace to include new 'new-mode' value 'FIX_INDEX_LOOKUP_COST'
   * Salsa CI: Apply several fixes already in use on debian/latest branch and
     which are needed on this branch as well due to external changes since
     August 2026, most notably Salsa CI switching to be sbuild based
 .
   [ Daniel Black ]
   * MDEV-37411: Re-enable AIO in Debian to fix earlier incomplete fix that was
     done after new upstream 11.8.3 release introduced innodb_linux_aio
   * MDEV-15502: With recent changes in upstream systemd, the tmpfiles are now
     required, otherwise starting MariaDB would fail on error:
     "cannot create /run/mysqld/wsrep-start-position: Directory nonexistent"
mariadb (1:11.8.5-4) unstable; urgency=medium
 .
   [ Otto Kekäläinen ]
   * Add tentative upstream patch to fix amd64v3 build issues (MDEV-38398)
   * Drop redundant `Priority: optional`
   * Update Debian copyright for 2026
   * Bump Debian Policy version
 .
   [ Aquila Macedo ]
   * Drop obsolete library-not-linked-against-libc overrides
   * Ship upstream sysusers.d mariadb.conf in mariadb-server (Closes: #1028271)
   * Add patch sysusers-lock-mysql-account.patch
   * Create mysql via sysusers in postinst, drop preinst adduser handling
   * Drop adduser pre-depends, depend on systemd-sysusers provider
   * Clarify NIS/YP debconf note for sysusers mysql account creation
   * Update all translations to match updated template
mariadb (1:11.8.5-3) unstable; urgency=medium
 .
   * MDEV-23538: Rename mariadb.pc to mariadb-server-embedded.pc to avoid
     confusion, as well as sync other misc Debian packaging improvements from
     upstream
   * Drop transitional dummy package `mariadb-server-10.5`
   * Make mariadb-test-run logs more informative to make debugging failures
     in Debian/Ubuntu build and autopkgtest logs easier
   * Remove override for test 'main.mysql-interactive' and extensively document
     and ensure all the mariadb-test-run skip lists are current
   * Add tentative upstream patch to fix main.mysqld--help-aria test failure
   * Add upstream patch to fix test innodb_log_file_size failures
   * Add upstream patch to fix test innodb.log_corruption_recovery failures
   * Add patch to fix Spider test failures in networkless environments
mariadb (1:11.8.5-3~exp3) experimental; urgency=medium
 .
   * Upload to experimental test if builds, post-build tests and autopkgtest
     all pass.
mariadb (1:11.8.5-3~exp2) experimental; urgency=medium
 .
   * Upload to experimental test if builds, post-build tests and autopkgtest
     all pass.
mariadb (1:11.8.5-3~exp1) experimental; urgency=medium
 .
   * Reset all unstable test lists to see which ones are still happening,
     and upload to Debian experimental
mariadb (1:11.8.5-2) unstable; urgency=medium
 .
   [ Aquila Macedo ]
   * Relax perl client dependencies in mariadb-client (Closes: #1115678)
 .
   [ Otto Kekäläinen ]
   * Make all MariaDB client plugins available in server plugin path
   * Ensure dh_missing runs as intended in debian/rules
   * Install upstream generated symlinks/binaries/manpages
   * Fix misc typos and in Debian packaging
   * Update Lintian overrides to clean away false positives and remove obsolete
     Lintian overrides
 .
   [ MichaIng ]
   * Make mariadb-common postinstallation script robust for situations where
     the /etc/mysql/mariadb.cnf file for any reason was deleted on the system
     so that the install/upgrade completes regardless
mariadb (1:11.8.5-1) unstable; urgency=medium
 .
   [ Otto Kekäläinen ]
   * New upstream maintenance release 11.8.5. For details about fixes please see
     https://mariadb.com/docs/release-notes/community-server/11.8/11.8.5
   * The version 11.8.4 was skipped in Debian (and Ubuntu) as it has a severe
     regression causing partial data deletion when using the DELETE statement on
     MyISAM or Aria tables under specific conditions (MDEV-38068)
   * For details about fixes in 11.8.4 please see
     https://mariadb.com/docs/release-notes/community-server/11.8/11.8.4
   * This release does _not_ include any CVE tracked security fixes as per
     https://mariadb.com/docs/server/security/securing-mariadb/security
   * The MariaDB 11.8.4 did have a fix for mariadb-dump failing to run if a
     for any table with a slash in the name. This has no actual exploit and
     requires the attacker to already have access to the database so they can
     create tables with arbitrary names. Trend Micro did however publish:
     - CVE-2025-13699
   * Update server trace to include new parameters and values
   * Already existing plugins marked ready for general availability by upstream
     in this release: uuid_v4, uuid_v7 and inet4
   * Add Lintian override for false error in test plugin
   * Patch new upstream test main.alter_merge to allow 'from Debian'
   * Add libcrypt-dev to Build-Depends (Closes: #1106944)
   * Extend unstable tests to skip for sparc64 and x32
   * Remove Rules-Requires-Root
   * Update patch Forwarded fields to reflect latest status
   * Salsa CI: Disable running `gbp setup-gitattributes`
   * Salsa CI: Fix typos introduced in 855bc4f6
   * Salsa CI: Disable the new 'debrebuild' job for MariaDB due to timeouts
 .
   [ Daniel Black ]
   * MDEV-37411: Re-enable AIO in Debian
   * MDEV-15502: use tmpfiles with systemd (Closes: #1028272)
   * MDEV-37776: shlibs:Depends shouldn't be explicit
 .
   [ Jean Weisbuch ]
   * MDEV-37852: Fix mytop connection to localhost (Closes: #1109394)
 .
   [ Christian Hesse ]
   * MDEV-35904/MDEV-19210: use environment file in systemd units for
     _WSREP_START_POSITION (Closes: #1105029)
 .
   [ Aquila Macedo ]
   * Add patch for new PCRE2 version 10.47 offset change (Closes: #1119866)
   * Salsa CI: install build-essential for Python-MySQLdb job (Closes: #1121027)
   * Salsa CI: keep provider plugins in sync in bookworm -> sid upgrade job
 .
   [ Sergei Golubchik ]
   * MDEV-37600: Implement caching_sha2_password plugin for MySQL compatibility
 .
   [ Helge Kreutzmann ]
   * Update German translation of debconf messages (Closes: #1120669)
mariadb (1:11.8.3-1) unstable; urgency=medium
 .
   [ Otto Kekäläinen ]
   * New upstream maintenance release 11.8.3. For details about fixes please see
     https://mariadb.com/kb/en/mariadb-11-8-3-release-notes/
   * Drop Hurd patches that are now included upstream
   * Update configuration traces to include new upstream system variables:
     - analyze-max-length (default: 4294967295)
     - innodb-linux-aio (default: auto)
   * Suppress new native AIO warning introduced in upstream a87bb96 to avoid
     mariadb-test-run failing on on something that isn't a real issue
   * New upstream release includes fix for MDEV-36815 that yielded "ERROR 1267
     (HY000): Illegal mix of collations" on some systems when restarting the
     MariaDB service in Debian (Closes: #1104533)
   * Remove obsolete cleanup as upstream moved pam_mariadb_mtr.so in c05b1fe
   * Salsa CI: Use full MariaDB package set in Bookworm MariaDB 10.6 upgrade
   * Salsa CI: Automatically use archive.d.o for discontinued releases
 .
   [ Lena Voytek ]
   * Do not hardcode libxml2 dependency in mariadb-plugin-connect
     (Closes: #1106889)

modsecurity-crs (3.3.7-1+deb13u1) trixie-security; urgency=medium
 .
   * Fixes CVE-2026-21876 (Closes: #1125084)

mpg123 (1.32.10-1+deb13u1) trixie; urgency=medium
 .
   * debian/gbp.conf: Switch to trixie branch
   * debian/patches: Do not modify raw ID3v2 data while parsing (Closes:
     #1129616)

munge (0.5.16-1.1~deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Rebuild for trixie-security
 .
 munge (0.5.16-1.1) unstable; urgency=high
 .
   * Non-maintainer upload.
   * Fix out-of-bounds read in credential decoding
   * Fix buffer overflow when unpacking message address length (CVE-2026-25506)

net-snmp (5.9.4+dfsg-2+deb13u1) trixie-security; urgency=high
 .
   * Security patch
      - Fixed a critical vulnerability in snmptrapd triggered by a specially
        crafted trap CVE-2025-68615 Closes: #1123861

nginx (1.26.3-3+deb13u2) trixie-security; urgency=medium
 .
   * d/p/CVE-2026-1642: backport upstream patch for CVE-2026-1642.
     Fixes problem when an attacker with a man-in-the-middle position on the
     upstream server side—along with conditions beyond the attacker's
     control—may be able to inject plain text data into the response
     from an upstream proxied server.

node-proxy-agents (0~2024040606-6+deb13u1) trixie; urgency=medium
 .
   * Team upload
   * Fix basic-ftp traversal vulnerability (Closes: #1129093, CVE-2026-27699)

nova (2:31.0.0-6+deb13u2) trixie-security; urgency=high
 .
   * CVE-2026-24708/OSSA-2026-002: By writing a malicious QCOW header to a root
     or ephemeral disk and then triggering a resize, a user may convince Nova's
     flat image backend to call qemu-img without a format restriction resulting
     in an unsafe image resize operation that could destroy data on the host
     system. Appiled upstream patch (Closes: #1128294):
     - cve-2026-24708-make-disk.extend-pass-format-to-qemu-img-2025.1.patch

nss (2:3.110-1+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2026-2781

open-iscsi (2.1.11-1+deb13u2) trixie; urgency=medium
 .
   * Team upload
   * [bfe3448] cherry-pick fix for discovering 'static' nodes
     (Closes: #1129063)

openjdk-21 (21.0.10+7-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie
openjdk-21 (21.0.10~6ea-1) unstable; urgency=medium
 .
   * OpenJDK 21.0.10 early access, build 6.
   * Update override comments for unstripped-binary-or-object.
     We need to keep symbols for Native Memory Tracking to work.
   * d/{JB-doc.overrides.in, JB-jre-headless.overrides.in}: Add override
     for old FSF copyright address.
   * d/s/lintian-overrides: Override false positive debian-rules-calls-
     nproc. The utility is used to log the number of processors.
   * d/t/control.in: dependencies.sh test needs only jre-headless
     package, remove flaky and skippable flags.
openjdk-21 (21.0.10~4ea-1) unstable; urgency=medium
 .
   * OpenJDK 21.0.10 early access, build 4.
 .
   [ Matthias Klose ]
   * d/rules: Adjust any_archs, hppa is unlikely to get fixed for the
     opposite stack frame growth.
   * d/rules: Run the testsuite for loong64.
openjdk-21 (21.0.9+10-1) unstable; urgency=medium
 .
   * OpenJDK 21.0.9 release, build 10.
     - CVEs:
       + CVE-2025-53057, 8360937: Enhance certificate handling.
       + CVE-2025-53066, 8356294: Enhance Path Factories.
       + CVE-2025-61748, 8359454: Enhance String handling.
 .
   [ Vladimir Petko ]
   * d/t/dependencies.sh: Relax test assertion for PC/SC library.
   * d/p/jdk-8369450.patch: Fix ftbfs due to rust-coreutils date. LP: #2127120.
   * d/rules: Run jtreg autopkgtests only on jtreg architectures.
   * d/t/{hotspot-autopkgtest.in, jdk-autopkgtest.in}: Skip tests
     that require a large amount of memory.
   * d/t/{control,hotspot-autopkgtest.sh, jdk-autopkgtest.sh}:
     Regenerate.

openjdk-25 (25.0.2+10-1~deb13u2) trixie-security; urgency=medium
 .
   * Rebuild for trixie, now with jtreg8 re-enabled (since it's now
     been available via a backport released via trixie-security)
openjdk-25 (25.0.1+8-3) unstable; urgency=medium
 .
   * d/t/control.in: Remove flaky and skippable flag from dependencies.sh
     test and install only jre package.
   * d/t/control: Regenerate.
openjdk-25 (25.0.1+8-2) unstable; urgency=medium
 .
   [ Matthias Klose ]
   * d/rules: Adjust any_archs, hppa is unlikely to get fixed for the
     opposite stack frame growth.
   * d/rules: Run the testsuite for loong64.
   * Regenerate the watch file.
 .
   [ Vladimir Petko ]
   * d/{rules/control.in/test/control.in}: Replace dbus-x11 with dbus-
     daemon dependency. Closes: #1117100.
   * d/control: d/test/control: Regenerate.
   * d/README.{Debian,source}: Update package readme files.
   * d/rules: Use generic code to replace bundled jquery.
   * d/JB-doc.overrides.in: Drop binary package bundled jquery
     override. The override is not needed for the binary package.
   * d/s/lintian-overrides: Update jquery override override comment.
   * Update unstripped-binary-or-object override comments.
     OpenJDK needs symbols for Native Memory Tracking.
openjdk-25 (25.0.1+8-1) unstable; urgency=medium
 .
   * OpenJDK 25.0.1 release, build 8.
     - CVEs:
       + CVE-2025-53057, 8360937: Enhance certificate handling.
       + CVE-2025-53066, 8356294: Enhance Path Factories.
       + CVE-2025-61748, 8359454: Enhance String handling.
 .
   [ Vladimir Petko ]
   * d/s/lintian-overrides: Override false positive nproc warning.
   * d/{JB-doc.overrides.in, JB-jre-headless.overrides.in}: Add override for
     old FSF copyright address.
   * d/JB-jvmci-jdk.overrides.in: Update overrides for jvmci package.
   * d/t/problems.csv: DocRootDirPermissionsTest.java - Fix typo in
     the test name.
   * d/t/problems.csv: Synchronize problem list.
   * d/t/dependencies.sh: Relax test assertion for PC/SC library.
   * d/rules: Prefer openjdk-25 for bootstrap.
   * d/control: Regenerate.
   * d/p/jdk-8369450.patch: Fix ftbfs due to rust-coreutils date. LP: #2127120.
   * Security Manager was removed in -25, so the JDK image no longer has
     default.policy and java.policy.
   * jaxp-strict.properties.template was moved by d/rules to
     jaxp-strict.properties, but we still created symlink to
     jaxp-strict.properties.template.  Replace mv with cp so that link
     to jaxp-strict.properties.template is not broken.
   * d/rules: Run jtreg autopkgtests only on jtreg architectures.
   * d/t/{hotspot-autopkgtest.in, jdk-autopkgtest.in}: Skip tests
     that require a large amount of memory.
   * d/t/{control,hotspot-autopkgtest.sh, jdk-autopkgtest.sh}:
     Regenerate.
   * d/p/jdk-8370049-proposed.patch: s390x G1 barrier compare and exchange
     operation should update output parameter instead of input.  LP: #2127750.
 .
   [ Matthias Klose ]
   * d/rules: Let the install target depend on the build target.
     Closes: #1105520.
   * Update the location of the upstream VCS.

openssh (1:10.0p1-7+deb13u1) trixie; urgency=medium
 .
   * CVE-2025-61984: ssh(1): disallow control characters in usernames passed
     via the commandline or expanded using %-sequences from the configuration
     file (closes: #1117529).
   * CVE-2025-61985: ssh(1): disallow \0 characters in ssh:// URIs (closes:
     #1117530).
   * Fix mistracking of MaxStartups process exits in some situations (closes:
     #1080350).

openssl (3.5.5-1~deb13u1) trixie; urgency=medium
 .
   * Import 3.5.5
openssl (3.5.4-1) unstable; urgency=medium
 .
   * Import 3.5.4
    - CVE-2025-9230 (Out-of-bounds read & write in RFC 3211 KEK Unwrap)
    - CVE-2025-9231 (Timing side-channel in SM2 algorithm on 64 bit ARM)
    - CVE-2025-9232 (Out-of-bounds read in HTTP client no_proxy handling)
openssl (3.5.4-1~deb13u2) trixie-security; urgency=medium
 .
   * CVE-2025-11187 (Improper validation of PBMAC1 parameters in PKCS#12 MAC
     verification)
   * CVE-2025-15467 (Stack buffer overflow in CMS AuthEnvelopedData parsing)
   * CVE-2025-15468 (NULL dereference in SSL_CIPHER_find() function on unknown
     cipher ID)
   * CVE-2025-15469 ("openssl dgst" one-shot codepath silently truncates inputs
     >16MB)
   * CVE-2025-66199 (TLS 1.3 CompressedCertificate excessive memory allocation)
   * CVE-2025-68160 (Heap out-of-bounds write in BIO_f_linebuffer on short
     writes)
   * CVE-2025-69418 (Unauthenticated/unencrypted trailing bytes with low-level
     OCB function calls)
   * CVE-2025-69419 (Out of bounds write in PKCS12_get_friendlyname() UTF-8
     conversion)
   * CVE-2025-69420 (Missing ASN1_TYPE validation in TS_RESP_verify_response()
     function)
   * CVE-2025-69421 (NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex
     function)
   * CVE-2026-22795 (Missing ASN1_TYPE validation in PKCS#12 parsing)
   * CVE-2026-22796 (ASN1_TYPE Type Confusion in the
     PKCS7_digest_from_attributes() function)

passt (0.0~git20250503.587980c-2+deb13u1) trixie; urgency=medium
 .
   * patches: Bump AppArmor ABI version to 4.0 and explicitly enable user namespace creation
     (Closes: #1124801)

pcsx2 (1.6.0+dfsg-3+deb13u1) trixie; urgency=medium
 .
   [ Sébastien Noel ]
   * Backport security fix for CVE-2025-49589.

pdns-recursor (5.2.8-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 5.2.8, fixing CVE-2026-24027 CVE-2026-0398
     (Closes: #1127490)

pdudaemon (0.0.8.109.gaa25f15-2.1+deb13u1) trixie; urgency=medium
 .
   * Backport patch to add setuputils to runtime dependencies (Closes: #1127864)

phpunit (11.5.19-1+deb13u1) trixie; urgency=medium
 .
   * Track debian/trixie
   * Fix Unsafe Deserialization in PHPT Code Coverage Handling [CVE-2026-24765]
   * Workaround empty file not added by patch

pillow (11.1.0-5+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2026-25990 (Closes: #1127925)

plastimatch (1.10.0+dfsg.2-1~deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * Backport removal of non-free files to trixie.
     (Changes in the repack tooling also resulted in the removal of
     upstream source files .gitlab-ci.yml and .gitignore.)
   * Revert unstable changes irrelevant for trixie:
     - "d/control: declare compliance to standards version 4.7.3.
     - "d/control: drop redundant Rules-Requires-Root: no.
     - "d/control: drop redundant Priority: optional.
     - "d/t/control: drop deprecated skip-not-installable restriction.
     - "cmake4.patch: fix build failure with cmake 4.
   * d/watch: rollback to watch file version 4.
     This change preserves the bump to +dfsg.2.
 .
 plastimatch (1.10.0+dfsg.2-1) unstable; urgency=medium
 .
   * Team upload.
   * d/copyright: exclude files preventing commercial uses.
   * d/watch: bump to +dfsg.2 repack suffix.
     This change also converts the watch file to v5 uscan Gitlab template.
   * New upstream repack 1.10.0+dfsg.2  (Closes: #1124959)
   * cmake4.patch: fix build failure with cmake 4. (Closes: #1125557)
   * d/copyright: remove superfluous file pattern.
   * d/t/control: drop deprecated skip-not-installable restriction.
   * d/control: drop redundant Priority: optional.
   * d/control: drop redundant Rules-Requires-Root: no.
   * d/control: declare compliance to standards version 4.7.3.
   * d/salsa-ci.yml: disable i386 builds.

policyd-rate-limit (1.2.0-1.1+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * Apply patch from Borut Mrak for python 3.12. Closes: #1128265.

postgresql-17 (17.9-0+deb13u1) trixie; urgency=medium
 .
   * New upstream version 17.9.
 .
     + Fix failure after replaying a multixid truncation record from WAL that
       was generated by an older minor version (Heikki Linnakangas)
 .
       Erroneous logic for coping with the way that previous versions handled
       multixid wraparound led to replay failure, with messages like "could not
       access status of transaction". A typical scenario in which this could
       occur is a standby server of the latest minor version consuming WAL from
       a primary server of an older version.
 .
     + Avoid incorrect complaint of invalid encoding when substring() is
       applied to toasted data (Noah Misch)
 .
       The fix for CVE-2026-2006 was too aggressive and could raise an error
       about an incomplete character in cases that are actually valid.
postgresql-17 (17.8-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 17.8.
 .
     + Guard against unexpected dimensions of oidvector/int2vector (Tom Lane)
 .
       These data types are expected to be 1-dimensional arrays containing no
       nulls, but there are cast pathways that permit violating those
       expectations.  Add checks to some functions that were depending on those
       expectations without verifying them, and could misbehave in consequence.
 .
       The PostgreSQL Project thanks Altan Birler for reporting this problem.
       (CVE-2026-2003)
 .
     + Harden selectivity estimators against being attached to operators that
       accept unexpected data types (Tom Lane)
 .
       contrib/intarray contained a selectivity estimation function that could
       be abused for arbitrary code execution, because it did not check that
       its input was of the expected data type.  Third-party extensions should
       check for similar hazards and add defenses using the technique intarray
       now uses. Since such extension fixes will take time, we now require
       superuser privilege to attach a non-built-in selectivity estimator to an
       operator.
 .
       The PostgreSQL Project thanks Daniel Firer, as part of zeroday.cloud,
       for reporting this problem. (CVE-2026-2004)
 .
     + Fix buffer overrun in contrib/pgcrypto's PGP decryption functions
       (Michael Paquier)
 .
       Decrypting a crafted message with an overlength session key caused a
       buffer overrun, with consequences as bad as arbitrary code execution.
 .
       The PostgreSQL Project thanks Team Xint Code, as part of zeroday.cloud,
       for reporting this problem. (CVE-2026-2005)
 .
     + Fix inadequate validation of multibyte character lengths
       (Thomas Munro, Noah Misch)
 .
       Assorted bugs allowed an attacker able to issue crafted SQL to overrun
       string buffers, with consequences as bad as arbitrary code execution.
       After these fixes, applications may observe invalid byte sequence for
       encoding errors when string functions process invalid text that has been
       stored in the database.
 .
       The PostgreSQL Project thanks Paul Gerste and Moritz Sanft, as part of
       zeroday.cloud, for reporting this problem. (CVE-2026-2006)

pyasn1 (0.6.1-1+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Fixed continuation octet limits in OID/RELATIVE-OID decoder (CVE-2026-23490)
     (Closes: #1125753)

python-cryptography (43.0.0-3+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2026-26007: Missing validation in EC public key creation.
     (Closes: #1127926)

python-django (3:4.2.28-0+deb13u1) trixie-security; urgency=high
 .
   * New upstream security release:
 .
     - CVE-2025-13473: The check_password function in
       django.contrib.auth.handlers.modwsgi for authentication via mod_wsgi
       allowed remote attackers to enumerate users via a timing attack.
 .
     - CVE-2025-14550: When receiving duplicates of a single header, ASGIRequest
       allowed a remote attacker to cause a potential denial-of-service via a
       specifically created request with multiple duplicate headers. The
       vulnerability resulted from repeated string concatenation while combining
       repeated headers, which produced super-linear computation resulting in
       service degradation or outage.
 .
     - CVE-2026-1207: Raster lookups on RasterField (only implemented on
       PostGIS) allowed remote attackers to inject SQL via the band index
       parameter.
 .
     - CVE-2026-1285: The django.utils.text.Truncator.chars() and
       Truncator.words() methods (with html=True) and the truncatechars_html and
       truncatewords_html template filters allowed a remote attacker to cause a
       potential denial-of-service via crafted inputs containing a large number
       of unmatched HTML end tags.
 .
     - CVE-2026-1287: FilteredRelation was subject to SQL injection in column
       aliases via control characters using a suitably crafted dictionary, with
       dictionary expansion, as the **kwargs passed to QuerySet methods
       annotate(), aggregate(), extra(), values(), values_list() and alias().
 .
     - CVE-2026-1312: QuerySet.order_by() was subject to SQL injection in column
       aliases containing periods when the same alias is, using a suitably
       crafted dictionary, with dictionary expansion, used in FilteredRelation.
 .
     <https://docs.djangoproject.com/en/dev/releases/4.2.28/> (Closes: #1126914)
python-django (3:4.2.27-2) unstable; urgency=medium
 .
   * Team upload.
   * Backport various upstream fixes for newer Python versions (closes:
     #1122185):
     - Fixed tests for test --parallel option on Python 3.14+.
     - Fixed copying BaseContext and its subclasses on Python 3.14+.
     - Fixed OtherModelFormTests.test_prefetch_related_queryset() test on
       Python 3.14+.
     - Adjusted test_strip_tags following Python behavior change for
       incomplete entities.
   * Revert "Mark that Python 3.14 is not supported yet", since it now is.
python-django (3:4.2.27-1) unstable; urgency=medium
 .
   * New upstream security release.
     <https://www.djangoproject.com/weblog/2025/dec/02/security-releases/>
 .
     - CVE-2025-13372: Fix a potential SQL injection attack in FilteredRelation
       column aliases when using PostgreSQL. FilteredRelation was subject to SQL
       injection in column aliases via a suitably crafted dictionary as the
       **kwargs passed to QuerySet.annotate() or QuerySet.alias().
 .
     - CVE-2025-64460: Prevent a potential denial-of-service vulnerability in
       XML serializer text extraction. An algorithmic complexity issue in
       django.core.serializers.xml_serializer.getInnerText() allowed a remote
       attacker to cause a potential denial-of-service triggering CPU and memory
       exhaustion via a specially crafted XML input submitted to a service that
       invokes XML Deserializer. The vulnerability resulted from repeated string
       concatenation while recursively collecting text nodes, which produced
       superlinear computation.
 .
     (Closes: #1121788))
 .
   * Mark that Python 3.14 is not supported yet.
python-django (3:4.2.27-0+deb13u1) trixie-security; urgency=high
 .
   * New upstream security release:
 .
     - CVE-2025-13372: Fix a potential SQL injection attack in FilteredRelation
       column aliases when using PostgreSQL. FilteredRelation was subject to SQL
       injection in column aliases via a suitably crafted dictionary as the
       **kwargs passed to QuerySet.annotate() or QuerySet.alias().
 .
     - CVE-2025-57833: Potential SQL injection in FilteredRelation column
       aliases. The FilteredRelation feature in Django was subject to a
       potential SQL injection vulnerability in column aliases that was
       exploitable via suitably crafted dictionary with dictionary expansion as
       the **kwargs passed QuerySet.annotate() or QuerySet.alias(). This CVE
       was fixed in Django 4.2.24. (Closes: #1113865)
 .
     - CVE-2025-59681: Potential SQL injection in QuerySet.annotate(), alias(),
       aggregate() and extra() on MySQL and MariaDB. QuerySet.annotate(),
       QuerySet.alias(), QuerySet.aggregate() and QuerySet.extra() methods were
       subject to SQL injection in column aliases, using a suitably crafted
       dictionary with dictionary expansion as the **kwargs passed to these
       methods on MySQL and MariaDB. This CVE was fixed in Django 4.2.25.
 .
     - CVE-2025-59682: Potential partial directory-traversal via
       archive.extract(). The django.utils.archive.extract() function, used by
       startapp --template and startproject --template allowed partial
       directory-traversal via an archive with file paths sharing a common
       prefix with the target directory. This CVE was fixed in Django 4.2.25.
 .
     - CVE-2025-64459: Prevent a potential SQL injection via _connector keyword
       argument in QuerySet/Q objects. The methods QuerySet.filter(),
       QuerySet.exclude(), and QuerySet.get() and the class Q() were subject to
       SQL injection when using a suitably crafted dictionary (with dictionary
       expansion) as the _connector argument. This CVE was fixed in Django
       4.2.26.
 .
     - CVE-2025-64460: Prevent a potential denial-of-service vulnerability in
       XML serializer text extraction. An algorithmic complexity issue in
       django.core.serializers.xml_serializer.getInnerText() allowed a remote
       attacker to cause a potential denial-of-service triggering CPU and memory
       exhaustion via a specially crafted XML input submitted to a service that
       invokes XML Deserializer. The vulnerability resulted from repeated string
       concatenation while recursively collecting text nodes, which produced
       superlinear computation. (Closes: #1121788)
 .
     <https://docs.djangoproject.com/en/4.2/releases/4.2.27/>
python-django (3:4.2.26-1) unstable; urgency=high
 .
   * New upstream security release.
     <https://www.djangoproject.com/weblog/2025/nov/05/security-releases/>
 .
     - CVE-2025-64458: Fix a potential denial-of-service vulnerability in
       HttpResponseRedirect and HttpResponsePermanentRedirect. NFKC
       normalization in Python is slow on Windows; as a consequence,
       HttpResponseRedirect, HttpResponsePermanentRedirect and redirect were
       subject to a potential denial-of-service attack via certain inputs with
       a very large number of Unicode characters.
 .
     - CVE-2025-64459: Prevent a potential SQL injection via _connector keyword
       argument in QuerySet/Q objects. The methods QuerySet.filter(),
       QuerySet.exclude(), and QuerySet.get() and the class Q() were subject to
       SQL injection when using a suitably crafted dictionary (with dictionary
       expansion) as the _connector argument.
 .
   * Refresh patches.
python-django (3:4.2.25-2) unstable; urgency=medium
 .
   * Team upload.
   * Skip NOT NULL constraints on PostgreSQL 18+ (closes: #1117647).
python-django (3:4.2.25-1) unstable; urgency=high
 .
   * New upstream security release (Closes: #1116979):
 .
     - CVE-2025-59681: Potential SQL injection in QuerySet.annotate(), alias(),
       aggregate() and extra() on MySQL and MariaDB.
 .
       QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate() and
       QuerySet.extra() methods were subject to SQL injection in column aliases,
       using a suitably crafted dictionary with dictionary expansion as the
       **kwargs passed to these methods on MySQL and MariaDB.
 .
     - CVE-2025-59682: Potential partial directory-traversal via
       archive.extract()
 .
       The django.utils.archive.extract() function, used by startapp --template
       and startproject --template allowed partial directory-traversal via an
       archive with file paths sharing a common prefix with the target
       directory.
 .
     <https://www.djangoproject.com/weblog/2025/oct/01/security-releases/>
python-django (3:4.2.24-1) unstable; urgency=high
 .
   * New upstream security release:
 .
     - CVE-2025-57833: Potential SQL injection in FilteredRelation column
       aliases. The FilteredRelation feature in Django was subject to a
       potential SQL injection vulnerability in column aliases that was
       exploitable via suitably crafted dictionary with dictionary expansion as
       the **kwargs passed QuerySet.annotate() or QuerySet.alias().
       (Closes: #1113865)
 .
     <https://www.djangoproject.com/weblog/2025/sep/03/security-releases/>

python-filelock (3.18.0-1+deb13u1) trixie; urgency=medium
 .
   * Add patch: cve-2025-68146.patch
     This addresses CVE-2025-68146 by including the patch from upstream.
     (commit e84510eac948b5b6027b24025f421a650cbd9749)
     Closes: #1123510

python-keystonemiddleware (10.9.0-2+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2026-22797 / OSSA-2026-001: privilege escalation via spoofed identity
     headers. Applied upstream patch: Fix privilege escalation via spoofed
     identity headers (Closes: #1125680).

python-multipart (0.0.20-1.1~deb13u1) trixie; urgency=medium
 .
   * Rebuild for trixie
 .
 python-multipart (0.0.20-1.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * Arbitrary file write via a non-default configuration (CVE-2026-24486)
     (Closes: #1126557)
   * chore: add return type on test

python-os-ken (3.0.1-2+deb13u1) trixie; urgency=medium
 .
   * Add Accept_empty_OXM_fields.patch.

python-parsl (2025.01.13+ds-1+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2026-21892.patch: new: fix sql injection vulnerability.
     This change addresses the CVE-2026-21892. (Closes: #1125085)

python-pyspnego (0.10.2-2+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload with permission by the maintainer (#1123071#15)
   * Fix deprecation warning (Closes: #1123071)

python-urllib3 (2.3.0-3+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Unbounded number of links in the decompression chain (CVE-2025-66418)
     (Closes: #1122030)
   * Decompression-bomb safeguards bypassed when following HTTP redirects
     (streaming API) (CVE-2026-21441) (Closes: #1125062)

qemu (1:10.0.8+ds-0+deb13u1) trixie; urgency=medium
 .
   * 10.0.8 upstream stable/bugfix release:
    - Update version for 10.0.8 release
    - scripts/qemugdb: timers: Fix KeyError in 'qemu timers' command
    - linux-user/syscall.c: Prevent acquiring clone_lock while fork()
    - virtio-gpu: fix error handling in virgl_cmd_resource_create_blob
    - virtio-pmem: ignore empty queue notifications
    - virtio-gpu-virgl: correct parent for blob memory region
    - cryptodev-builtin: Limit the maximum size
    - hw/virtio/virtio-crypto: verify asym request size
      Closes: #1123670, CVE-2025-14876
    - q35: Fix migration of SMRAM state
    - virtio-dmabuf: Ensure UUID persistence for hash table insertion
    - vdpa: fix vhost-vdpa suspended state not be shared
    - hw/i2c/aspeed_i2c: Fix DMA moving data into incorrect address
    - hw/i2c/aspeed: Fix wrong I2CC_DMA_LEN when I2CM_DMA_TX/RX_ADDR set first
    - hw/i2c/aspeed_i2c.c: Add a check for dma_read
    - hw/adc: Fix out-of-bounds write in Aspeed ADC model
    - hw/uefi: fix size negotiation
    - hw/nvme: Fix bootindex suffix use-after-free
    - python: fix msys64 wheel directory specification
    - tests/qtest/ufs-test: Add test for mcq completion queue wraparound
    - hw/ufs: Fix mcq completion queue wraparound
    - hw/ufs: fix CQE endianness and UPIU length
    - hw/ufs: Ensure DBC of PRDT uses only lower 18 bits
    - tests/functional: migrate sbsa_ref test images
    - pc-bios/optionrom: Use 32-bit linker emulation for the optionroms
    - target/i386/tcg: fix a few instructions that do not support VEX.L=1
    - linux-user: fixup termios2 related things on PowerPC
    - linux-user: Add missing termios baud rates
    - linux-user: Add termios2 support to sparc target
    - linux-user: Add termios2 support to sh4 target
    - linux-user: Add termios2 support to mips target
    - linux-user: Add termios2 support to hppa target
    - linux-user: Add termios2 support to alpha target
    - linux-user: Add termios2 support
    - hw/intc: avoid byte swap fiddling in gicv3 its path
    - bsd-user/syscall_defs.h: define STAT_TIME_T_EXT only for 32 bits
    - bsd-user: Fix __i386__ test for TARGET_HAS_STAT_TIME_T_EXT
    - hw/sd/sdhci: Fix TYPE_IMX_USDHC to implement sd-spec-version 3 by default
    - linux-user/aarch64/target_fcntl.h: add missing
      TARGET_O_LARGEFILE definition
      https://gitlab.com/qemu-project/qemu/-/issues/3262
    - tests/functional: Mark another MIPS replay test as flaky
    - tests/functional: Mark the MIPS replay tests as flaky
    - target/arm: Correctly trap HCR.TID1 registers in v7A
    - target/arm: Correctly honour HCR.TID3 for v7A cores
    - target/arm: Don't specify ID_PFR1 accessfn twice
    - tests/functional: migrate aspeed_rainier image
    - hw/loongarch/virt: Don't abort on access to unimplemented IOCSR
    - target/loongarch: Fix exception ADEF/ADEM missing to update CSR_BADV
    - target/loongarch: Fix exception BCE missing to update CSR_BADV
    - target/loongach: Fix some exceptions failure in updating CSR_BADV
    - hw/loongarch/virt: Fix irq allocation failure with pci device from fdt
    - hw/loongarch/virt: Modify the interrupt trigger type in fdt table
    - hw/i386/kvm: fix PIRQ bounds check in xen_physdev_map_pirq()
      Closes: #1125423, CVE-2026-0665
    - target/i386/tcg: allow VEX in 16-bit protected mode
    - target/i386/tcg: mask addresses for VSIB
    - target/i386/tcg: do not mark all SSE instructions as unaligned
    - m68k: fix CAS2 writeback when Dc1==Dc2
    - configs: use default prefix for Windows compilation
    - tests: add tcg coverage for fixed mremap bugs
    - linux-user: fix reserved_va page leak in do_munmap
    - linux-user: fix mremap errors for invalid ranges
    - linux-user: fix mremap unmapping adjacent region
    - linux-user: allow null `pathname` for statx()/fstatat()
    - tcg/riscv: Fix TCG_REG_TMP0 clobber in tcg_gen_dup{m,i}
    - monitor/qmp: cleanup SocketChardev listener sources early
      to avoid fd handling race
    - hw/i2c/imx: Fix trace func name error
    - target/i386/tcg: ignore V3 in 32-bit mode
    - target/i386: Fix #GP error code for INT instructions
      https://gitlab.com/qemu-project/qemu/-/issues/3160
    - qdev: fix error handling in set_uint64_checkmask
    - gdbstub: Fix const qualifier build errors with recent glibc
    - monitor: Fix const qualifier build errors with recent glibc
    - tests/vhost-user-bridge.c: Fix const qualifier build errors
      with recent glibc
    - i386: Fix const qualifier build errors with recent glibc
    - Fix const qualifier build errors with recent glibc
    - qga: Fix ubsan warning
    - Revert "nvme: Fix coroutine waking"
    - nvme: Note in which AioContext some functions run
    - block: Fix BDS use after free during shutdown
    - scripts/nsis.py: Tell makensis that WoA is 64 bit
    - vhost: Always initialize cached vring data
    - target/arm: handle unaligned PC during tlb probe
      https://gitlab.com/qemu-project/qemu/-/issues/3233
    - tcg: Zero extend 32-bit addresses for TCI
    - tests/docker: fix debian-all-test-cross
    - tests/docker: handle host-arch selection for all-test-cross
    - tests/docker: add --arch-only to qemu deps for all-test-cross
    - gitlab: move custom runners to Ubuntu 24.04
    - gitlab-ci.d/cirrus: Update the FreeBSD job to v14.3
    - tests/vm: bump FreeBSD image to 14.3
   * virtio-gpu-virgl-Add-virtio-gpu-virgl-hostmem-region.patch
     (fix regression in 10.0.8, introduced in
      "virtio-gpu-virgl: correct parent for blob memory region")

qtbase-opensource-src (5.15.15+dfsg-6+deb13u1) trixie; urgency=medium
 .
   * Backport two upstream patches to fix data races in QReadWriteLock
     (closes: #1122641).
   * Backport upstream patch to stop calling QXcbVirtualDesktop::dpi()
     function from QXcbScreen::logicalDpi() (closes: #1107294).
   * Backport upstream patch to revert locking simplification, which caused
     data race (closes: #1126100).

reprepro (5.4.6+really5.3.2-1+deb13u1) trixie; urgency=medium
 .
   * Fix incorrect tracking data when copying packages (Closes: #1125255)

requests (2.32.3+dfsg-5+deb13u1) trixie; urgency=medium
 .
   * CVE-2024-47081 (Closes: #1107368)

riseup-vpn (0.24.10+ds1-1+deb13u2) trixie; urgency=medium
 .
   * Add policykits in an ORed fashion so there is at least
     one polkit available. This is due to the removal of
     policykit-1-gnome in stable (Closes: #1124472)
   * Add patch to add in more desktop environments and polkit
     binary paths to startup polkit on service start.

roundcube (1.6.13+dfsg-0+deb13u1) trixie-security; urgency=high
 .
   * New upstream security and bugfix release (closes: #1127447).
     + Fix CVE-2026-26079: CSS injection vulnerability.
     + Fix CVE-2026-25916: Remote image blocking bypass via SVG content.
   * Refresh d/patches.
roundcube (1.6.12+dfsg-1) unstable; urgency=high
 .
   * New upstream security and bugfix release (closes: #1122899).
     + Fix Cross-Site-Scripting vulnerability via SVG's animate tag.
     + Fix Information Disclosure vulnerability in the HTML style sanitizer.
   * d/watch:
     + Port to Version 5.
     + Simplify [UD]version-Mangle.
     + Use @STABLE_VERSION@ not @ANY_VERSION@ as tag matching pattern.
   * Refresh d/patches.

runit-services (0.9.1+deb13u1) trixie; urgency=medium
 .
   * slim: start in foreground with -n.
       + thanks: Andrew Bower (Closes: #1121099)
   * dbus-dep.fixer:
       - correctly test for existing services definitions
       - only start dbus services, even with the sysv override.
      + thanks: S. Osipiuk (Closes: #1126699)

rust-ntp-proto (1.4.0-4+deb13u1) trixie; urgency=high
 .
   * Fix CVE-2026-26076 - increased load while processing malformed NTS packets
     (Closes: #1127929)

rust-tealdeer (1.7.2-1+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * Cherry-pick upstream patch updating archive url (Closes: #1126698)
   * Package tealdeer 1.7.2 from crates.io using debcargo 2.7.8

samba (2:4.22.8+dfsg-0+deb13u1) trixie; urgency=medium
 .
   * new upstream stable/bugfix release:
    - https://bugzilla.samba.org/show_bug.cgi?id=15790:
      Bind dlz 9.20
    - https://bugzilla.samba.org/show_bug.cgi?id=15959:
      New Spotlight default search field incorrectly initialized
    - https://bugzilla.samba.org/show_bug.cgi?id=15964:
      "net offlinejoin requestodj" manpage entry incorrectly mentiones
      provided credentials
    - https://bugzilla.samba.org/show_bug.cgi?id=15972:
      Winbind group resolution failure
    - https://bugzilla.samba.org/show_bug.cgi?id=15977:
      ctdbd socket documentation is wrong
    - https://bugzilla.samba.org/show_bug.cgi?id=15979:
      possible memory leak  on rpc_spoolss
    - https://bugzilla.samba.org/show_bug.cgi?id=15984:
      smbd: in contend_dirleases() don't bother checking when not enabled
   * add-support-for-bind-9.20.patch: remove (now applied upstream)
   * d/clean: also remove python/samba/provision/kerberos_implementation.py
     (Closes: #1048754)

scilab (2024.1.0+dfsg-6+deb13u1) trixie; urgency=medium
 .
   * Team upload.
 .
   [ Pierre Gruet ]
   * Using the UTF-8 suffix when calling scilab to build the documentation.
     Closes: #1106083.

shaarli (0.14.0+dfsg-2+deb13u1) trixie-security; urgency=medium
 .
   * Add patch to fix stored XSS via tag suggestions (Closes: #1126554,
     CVE-2026-24476)

spip (4.4.11+dfsg-0+deb13u1) trixie-security; urgency=medium
 .
   [ Matthieu Marcillaud ]
   * build: Version 4.4.11
   * Include security fixes from 4.4.10 [CVE-2026-22205] [CVE-2026-22206]
   * Include security fixes from 4.4.9 [CVE-2026-27472] [CVE-2026-27473]
     [CVE-2026-27474] [CVE-2026-27475]
   * Include security fixes from 4.4.8 [CVE-2026-26223] [CVE-2026-26345]
 .
   [ David Prévot ]
   * Document CVE fixes in previous changelog entries
   * Refresh patches
spip (4.4.10+dfsg-1) unstable; urgency=medium
 .
   [ Matthieu Marcillaud ]
   * build: Version 4.4.10
spip (4.4.9+dfsg-1) unstable; urgency=medium
 .
   [ Matthieu Marcillaud ]
   * build: Version 4.4.9
spip (4.4.8+dfsg-1) unstable; urgency=medium
 .
   [ Matthieu Marcillaud ]
   * build: Version 4.4.8
 .
   [ David Prévot ]
   * Convert d/watch to version 5
   * Update Standards-Version to 4.7.3
spip (4.4.7+dfsg-1) unstable; urgency=medium
 .
   [ Matthieu Marcillaud ]
   * build: Version 4.4.7
spip (4.4.6+dfsg-1) unstable; urgency=medium
 .
   [ Matthieu Marcillaud ]
   * build: Version 4.4.6
spip (4.4.5+dfsg-1) unstable; urgency=medium
 .
   * Upload to unstable now that Trixie has been released
 .
   [ Matthieu Marcillaud ]
   * build: Version 4.4.5
 .
   [ David Prévot ]
   * Remove Rules-Requires-Root
   * Update Standards-Version to 4.7.2
spip (4.4.4+dfsg-1) experimental; urgency=medium
 .
   * Upload to experimental during the freeze
 .
   [ Matthieu Marcillaud ]
   * build: Version 4.4.4

sqlite3 (3.46.1-7+deb13u1) trixie; urgency=medium
 .
   * Backport upstream security fix for CVE-2025-7709: integer overflow in the
     FTS5 extension (closes: #1114609).
   * Add pkgconf build dependency to fix link problem with ICU extension
     (closes: #1099724).

starlette (0.46.1-3+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * d/p/CVE-2025-62727.patch: Backport Upstream patch to fix CVE-2025-62727
     (denial of service via crafted HTTP Range header in FileResponse)
   * d/changelog: Fix changelog indentation
   * d/gbp.conf: Update to Trixie

sudo (1.9.16p2-3+deb13u1) trixie; urgency=medium
 .
   [ Marc Haber ]
   * add upstream patch: Do not perform path expansion
     Thanks to Adam D. Barratt" <adam@adam-barratt.org.uk> (Closes: #1126085)
   * Enable Intel CET on amd64 only.
     Thanks to Marcos Del Sol Vives (Closes: #1124339)
   * Pull more robust test suite from unstable

suricata (1:7.0.10-1+deb13u3) trixie; urgency=medium
 .
   * Fix CVE-2026-22258 in 7.0.10.
     Cherry-Picked from:
     * f82a388d0283725cb76782cf64e8341cab370830
     * df389f8a43a06c718bb336ea082d6c80d6fefda0
     * c9b80e5affe073ce9d95d0c935a8d67647c83bf7
   * Fix CVE-2026-22262 in 7.0.10.
     Cherry-Picked from:
     * 32609e6896f9079c175665a94005417cec7637eb
     * 27a2180bceaa3477419c78c54fce364398d011f1
   * Fix CVE-2026-22264 in 7.0.10.
     Cherry-Picked from 5789a3d3760dbf33d93fc56c27bd9529e5bdc8f2.
   * Fix CVE-2026-22259 in 7.0.10.
     Cherry-Picked from:
     * 63225d5f8ef64cc65164c0bb1800730842d54942
     * 635af8dc8be09667689be71d781912718ca1aa49
     * fdd79bdb14488244604729f1d68ca4bc60000dbd
     * a6d950315d9b6c1e35c10c24d9bb7128d422c21f
     With this fix, DNP3 has reduced the default maximum number of
     outstanding transactions from 500 down to 32.
     Read the update instructions for Suricata 7.0.14 for more details.
   * Fix CVE-2026-22261 in 7.0.10.
     Cherry-Picked from:
     * 44d0c81f537f230e9215c769453fb4d7214217a1
     * 7e704a3f50690b5f5d5cc573147ef41449fe37ac

tayga (0.9.2-10+deb13u1) trixie; urgency=medium
 .
   * Refresh 0012-rfc8125-local-prefix.patch
   * Add patch "Fix EAM mapping for host addressess" (Closes: #1082060)

thunderbird (1:140.8.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security
thunderbird (1:140.8.0esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * Rebuild for bookworm-security
thunderbird (1:140.7.1esr-1) unstable; urgency=medium
 .
   * [0fb78ae] d/control: Increase Standards-Version to 4.7.3
   * [b27283c] New upstream version 140.7.1esr
     Fixed CVE issues in upstream version 140.7.1 (MFSA 2026-08):
     CVE-2026-0818: CSS-based exfiltration of the content from partially
                    encrypted emails when allowing remote content
thunderbird (1:140.7.1esr-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security
   * drop fixes only needed for sid/forky
thunderbird (1:140.7.1esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * Rebuild for bookworm-security
   * drop fixes only needed for sid/forky
thunderbird (1:140.7.0esr-1) unstable; urgency=medium
 .
   * [9dd500b] New upstream version 140.7.0esr
     Fixed CVE issues in upstream version 140.7 (MFSA 2026-05):
     CVE-2026-0877: Mitigation bypass in the DOM: Security component
     CVE-2026-0878: Sandbox escape due to incorrect boundary conditions in the
                    Graphics: CanvasWebGL component
     CVE-2026-0879: Sandbox escape due to incorrect boundary conditions in the
                    Graphics component
     CVE-2026-0880: Sandbox escape due to integer overflow in the Graphics
                    component
     CVE-2026-0882: Use-after-free in the IPC component
     CVE-2025-14327: Spoofing issue in the Downloads Panel component
     CVE-2026-0883: Information disclosure in the Networking component
     CVE-2026-0884: Use-after-free in the JavaScript Engine component
     CVE-2026-0885: Use-after-free in the JavaScript: GC component
     CVE-2026-0886: Incorrect boundary conditions in the Graphics component
     CVE-2026-0887: Clickjacking issue, information disclosure in the PDF
                    Viewer component
     CVE-2026-0890: Spoofing issue in the DOM: Copy & Paste and Drag & Drop
                    component
     CVE-2026-0891: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird
                    ESR 140.7, Firefox 147 and Thunderbird 147
   * [6da09ab] rebuild patch queue from patch-queue branch
     added patches:
     fixes/enable-use-of-gpgme-greater-equal-two-dot-zero.patch
     (Closes: #1121054)
   * [9adc353] d/control: add libgpgme to Depends
     dpkg-shlibdeps doesn't detect the need to add the library libgpgme to
     ${misc:Depends} so adding that package manually to the list.
     (Closes: #1121117)
thunderbird (1:140.7.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security
   * drop patches/fixes only needed for sid/forky
thunderbird (1:140.7.0esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * Rebuild for bookworm-security
   * drop patches/fixes only needed for sid/forky
thunderbird (1:140.6.0esr-1) unstable; urgency=medium
 .
   [ Carsten Schoenert ]
   * [6956481] Rebuild patch queue from patch-queue branch.
     Added patch:
     debian-hacks/all-thunderbird.js-Append-esr-to-VERSION-variable.patch
     (Closes: #1115859)
 .
   [ Christoph Goehre ]
   * [f9ca412] New upstream version 140.6.0esr
     Fixed CVE issues in upstream version 140.6 (MFSA 2025-96):
     CVE-2025-14321: Use-after-free in the WebRTC: Signaling component
     CVE-2025-14322: Sandbox escape due to incorrect boundary conditions in the
                     Graphics: CanvasWebGL component
     CVE-2025-14323: Privilege escalation in the DOM: Notifications component
     CVE-2025-14324: JIT miscompilation in the JavaScript Engine: JIT component
     CVE-2025-14325: JIT miscompilation in the JavaScript Engine: JIT component
     CVE-2025-14328: Privilege escalation in the Netmonitor component
     CVE-2025-14329: Privilege escalation in the Netmonitor component
     CVE-2025-14330: JIT miscompilation in the JavaScript Engine: JIT component
     CVE-2025-14331: Same-origin policy bypass in the Request Handling
                     component
     CVE-2025-14333: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird
                     ESR 140.6, Firefox 146 and Thunderbird 146

tomcat10 (10.1.52-1~deb13u1) trixie-security; urgency=medium
 .
   * Backport 10.1.52. to trixie.
   * Fix CVE-2025-46701, CVE-2025-48976, CVE-2025-48988, CVE-2025-48989,
     CVE-2025-49125, CVE-2025-52520, CVE-2025-53506, CVE-2025-55668,
     CVE-2025-55752, CVE-2025-55754 and CVE-2025-61795.
     Several security vulnerabilities have been found in Tomcat 10, a Java web
     server and servlet engine. This update improves the handling of
     HTTP/2 connections and corrects various flaws which can lead to
     uncontrolled resource consumption and a denial of service.
tomcat10 (10.1.52-1~deb12u1) bookworm-security; urgency=medium
 .
   * Backport 10.1.52. to bookworm.
   * Fix CVE-2025-46701, CVE-2025-48976, CVE-2025-48988, CVE-2025-48989,
     CVE-2025-49125, CVE-2025-52520, CVE-2025-53506, CVE-2025-55668,
     CVE-2025-55752, CVE-2025-55754, CVE-2025-61795, CVE-2025-31650 and
     CVE-2025-31651.
     Several security vulnerabilities have been found in Tomcat 10, a Java web
     server and servlet engine. This update improves the handling of
     HTTP/2 connections and corrects various flaws which can lead to
     uncontrolled resource consumption and a denial of service.
tomcat10 (10.1.46-1) unstable; urgency=medium
 .
   * New upstream release
     - Refreshed the patches

tomcat11 (11.0.15-1~deb13u1) trixie-security; urgency=medium
 .
   * Backport 11.0.15. to trixie.
   * Fix CVE-2025-46701, CVE-2025-48976, CVE-2025-48988, CVE-2025-48989,
     CVE-2025-49125, CVE-2025-52520, CVE-2025-53506, CVE-2025-55668,
     CVE-2025-55752, CVE-2025-55754 and CVE-2025-61795.
     Several security vulnerabilities have been found in Tomcat 11, a Java web
     server and servlet engine. This update improves the handling of
     HTTP/2 connections and corrects various flaws which can lead to
     uncontrolled resource consumption and a denial of service.
tomcat11 (11.0.11-1) unstable; urgency=medium
 .
   * New upstream release
     - Refreshed the patches

torsocks (2.5.0-1+deb13u1) trixie; urgency=medium
 .
   * Trigger ldconfig trigger (Closes: #1125775).
   * Use correct environment variable (Closes: #1126559).
   * add libtorsocks.lintian-overrides to document the need of ldconfig trigger
     and the customized ld.so search path.

tzdata (2026a-0+deb13u1) trixie; urgency=medium
 .
   * New upstream version 2026a:
     - No leap second on 2026-06-30
     - Moldova has used EU transition times since 2022
   * Drop No-leap-second-on-2025-12-31.patch (merged upstream)
   * gbp.conf: change branch to trixie
tzdata (2025c-3) unstable; urgency=medium
 .
   * Also remove /etc/timezone on upgrades from Ubuntu 25.10 "questing" older
tzdata (2025c-2) unstable; urgency=medium
 .
   * Remove /etc/timezone on upgrade (Closes: #605834, #813226, #822733)
tzdata (2025c-1) unstable; urgency=medium
 .
   * New upstream version 2025c
   * Update French debconf translation.
     Thanks to Baptiste Jammet <baptiste@mailoo.org> (Closes: #1118004)
   * Drop No-leap-second-on-2025-12-31.patch (merged upstream)
   * Update Swedish debconf translation.
     Thanks to Martin Bagge <brother@persilja.net> (Closes: #1122575)
   * debian/control: drop Rules-Requires-Root field, now obsolete
   * debian/watch: update to version 5
   * Add autopkgtest test case for 2025c release
tzdata (2025b-5) unstable; urgency=medium
 .
   * Change Provides: from tzdata-trixie to tzdata-forky
   * Backport leap second update from upstream

uglifyjs (2.8.29-8+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * Adapt test issue-1770.js to reality. Closes: #1072609.

units (2.24-1+deb13u1) trixie; urgency=medium
 .
   * Switch to new packetizer.com URLs in units_cur. Closes: #1128412.

usbmuxd (1.1.1-6+deb13u1) trixie-security; urgency=medium
 .
   * d/patch: add fix for path traversal vulnerability (CVE-2025-66004)
     (Closes: #1122507)

vlc (3.0.23-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 3.0.23
vlc (3.0.23-0+deb12u1) bookworm-security; urgency=medium
 .
   * New upstream version 3.0.23
vlc (3.0.22-4) unstable; urgency=medium
 .
   * debuan/rules: Fix typo
vlc (3.0.22-3) unstable; urgency=medium
 .
   [ Colomban Wendling ]
   * Fix a few typos and wording in packages descriptions
 .
   [ Pino Toscano ]
   * Build sid plugin only on Linux
   * Force linking to pthread on Hurd
 .
   [ Sebastian Ramacher ]
   * debian/: Disable libcaca
   * debian/control:
     - Remove inactive Uploaders
     - Bump Standards-Version
vlc (3.0.22-2) unstable; urgency=medium
 .
   * debian/: Disable libmad plugin
   * debian/patches: Apply upstream patches to fix build with ffmpeg 8.0
     (Closes: #1115062)
vlc (3.0.22-1) unstable; urgency=medium
 .
   * New upstream version 3.0.22
   * debian/rules: No longer write revision info

wget2 (2.2.0+ds-1+deb13u1) trixie; urgency=medium
 .
   * CVE-2025-69194 (Closes: #1124378)
   * CVE-2025-69195 (Closes: #1124377)

wireless-regdb (2026.02.04-1~deb13u1) trixie; urgency=medium
 .
   * Backported to trixie:
     - d/salsa-ci.yml: Set RELEASE to trixie
     - Revert "Add support and documentation for setting default regulatory
       domain"
 .
 wireless-regdb (2026.02.04-1) unstable; urgency=medium
 .
   [ Ben Hutchings ]
   * New upstream version:
     - Update regulatory info for Australia (AU) for 2025
     - Update broken link in regulatory.bin(5) manpage
     - Update regulatory info for Malaysia (MY) for 2024
     - Update regulatory info for Malaysia (MY) for 2025
     - Update regulatory info for Tunisia (TN) on 6GHz for 2025
     - Update regulatory info for Canada (CA) for 2025
   * d/rules: Install regulatory.db under /usr without dh_movetousr
     (Closes: #1122785)
   * d/README.Debian: Remove minimum kernel version for direct-loading
   * Add support and documentation for setting default regulatory domain
 .
   [ Bastian Germann ]
   * Drop unnecessary B-D m2crypto (Closes: #1126431)
 .
 wireless-regdb (2025.10.07-1) unstable; urgency=medium
 .
   * New upstream version:
     - update regulatory rules for Botswana (BW) for 2022
     - update regulatory rules for Sint Marteen (SX) for 2018
     - Update regulatory info including bandwidth for Costa Rica (CR) for 2023
     - Permit lower 6 GHz band for Kazakhstan (KZ)
   * d/salsa-ci.yml: Remove obsolete lintian error suppression
   * d/upstream/signing-key.asc: Update for later expiry date
   * d/watch: Convert to version 5 format
wireless-regdb (2026.02.04-1~deb12u1) bookworm; urgency=medium
 .
   * Backport to bookworm:
     - Revert "d/salsa-ci.yml: Suppress false bad-distribution-in-changes-file
       error" which is no longer needed
     - Revert "Add support and documentation for setting default regulatory
       domain"
     - d/rules: Set FIRMWARE_PATH = /lib/firmware
 .
 wireless-regdb (2026.02.04-1) unstable; urgency=medium
 .
   [ Ben Hutchings ]
   * New upstream version:
     - Update regulatory info for Australia (AU) for 2025
     - Update broken link in regulatory.bin(5) manpage
     - Update regulatory info for Malaysia (MY) for 2024
     - Update regulatory info for Malaysia (MY) for 2025
     - Update regulatory info for Tunisia (TN) on 6GHz for 2025
     - Update regulatory info for Canada (CA) for 2025
   * d/rules: Install regulatory.db under /usr without dh_movetousr
     (Closes: #1122785)
   * d/README.Debian: Remove minimum kernel version for direct-loading
   * Add support and documentation for setting default regulatory domain
 .
   [ Bastian Germann ]
   * Drop unnecessary B-D m2crypto (Closes: #1126431)
 .
 wireless-regdb (2025.10.07-1) unstable; urgency=medium
 .
   * New upstream version:
     - update regulatory rules for Botswana (BW) for 2022
     - update regulatory rules for Sint Marteen (SX) for 2018
     - Update regulatory info including bandwidth for Costa Rica (CR) for 2023
     - Permit lower 6 GHz band for Kazakhstan (KZ)
   * d/salsa-ci.yml: Remove obsolete lintian error suppression
   * d/upstream/signing-key.asc: Update for later expiry date
   * d/watch: Convert to version 5 format
wireless-regdb (2025.10.07-1) unstable; urgency=medium
 .
   * New upstream version:
     - update regulatory rules for Botswana (BW) for 2022
     - update regulatory rules for Sint Marteen (SX) for 2018
     - Update regulatory info including bandwidth for Costa Rica (CR) for 2023
     - Permit lower 6 GHz band for Kazakhstan (KZ)
   * d/salsa-ci.yml: Remove obsolete lintian error suppression
   * d/upstream/signing-key.asc: Update for later expiry date
   * d/watch: Convert to version 5 format

wireshark (4.4.14-0+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * New upstream release.
     - CVE-2026-3201: USB HID dissector memory exhaustion
     - CVE-2026-3203: RF4CE Profile dissector crash
     - Drop 0001-wsutil-Restore-removed-ws_base32_decode.patch,
       applied upstream.
wireshark (4.4.13-0+deb13u1) trixie-security; urgency=medium
 .
   * Team upload.
   * New upstream version 4.4.13-0+deb13u1
     - CVE-2025-9817: SSH dissector crash
     - CVE-2025-11626: MONGO dissector infinite loop
     - CVE-2025-13499: Kafka dissector crash
     - CVE-2025-13945: HTTP3 dissector crash
     - CVE-2025-13946: MEGACO dissector infinite loop
     - CVE-2026-0959: IEEE 802.11 protocol dissector crash
     - CVE-2026-0960: HTTP3 protocol dissector infinite loop
     - CVE-2026-0961: BLF file parser crash
     - CVE-2026-0962: SOME/IP-SD protocol dissector crash
   * d/libwsutil16.symbols: Update to reflect New Upstream version
   * d/patches:
     - 0001-tools-Use-esnacc-instead...patch: Drop patch merged upstream
     - 0001-wsutil-Restore-removed-ws_base32_decode.patch: New patch
wireshark (4.4.9-1) unstable; urgency=medium
 .
   * New upstream version
   * Drop snacc -> esnacc patch integrated upstream
   * Update symbols
wireshark (4.4.8-0exp1) experimental; urgency=medium
 .
   * New upstream version
   * Target experimental due to the freeze

xen (4.20.2+37-g61ff35323e-0+deb13u1) trixie; urgency=medium
 .
   * Update to new upstream version 4.20.2+37-g61ff35323e, which also contains
     security fixes for the following issues:
     - x86: buffer overrun with shadow paging + tracing
       XSA-477 CVE-2025-58150
     - x86: incomplete IBPB for vCPU isolation
       XSA-479 CVE-2026-23553
   * Note that the following XSA are not listed, because...
     - XSA-478 applies to XAPI which is not included in Debian
xen (4.20.2+7-g1badcf5035-2) unstable; urgency=medium
 .
   * d/rules: simplify for make 4.4
   * d/control: Update Standards-Version to 4.7.2
   * Pick upstream commit 5bbe1fe413 ("ARM: Drop ThumbEE support") to fix a
     FTBFS on arm64. (Closes: #1122070)
xen (4.20.2+7-g1badcf5035-1) unstable; urgency=medium
 .
   Significant changes:
   * Update to new upstream version 4.20.2+7-g1badcf5035, which also contains
     security fixes for the following issues:
     (Closes: #1105193) (Closes: #1120075)
     - x86: Indirect Target Selection
       XSA-469 CVE-2024-28956
     - x86: Incorrect stubs exception handling for flags recovery
       XSA-470 CVE-2025-27465
     - x86: Transitive Scheduler Attacks
       XSA-471 CVE-2024-36350 CVE-2024-36357
     - Multiple vulnerabilities in the Viridian interface
       XSA-472 CVE-2025-27466 CVE-2025-58142 CVE-2025-58143
     - Arm issues with page refcounting
       XSA-473 CVE-2025-58144 CVE-2025-58145
     - x86: Incorrect input sanitisation in Viridian hypercalls
       XSA-475 CVE-2025-58147 CVE-2025-58148
     - Incorrect removal of permissions on PCI device unplug
       XSA-476 CVE-2025-58149
   * Note that the following XSA are not listed, because...
     - XSA-468 applies to Windows PV drivers
     - XSA-474 applies to XAPI which is not included in Debian
 .
   Packaging minor fixes and improvements:
   * debian/salsa-ci.yml: adjust for new salsa-ci pipeline

xrdp (0.10.1-3.1+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * CVE-2025-68670: Buffer overflow parsing domain (Closes: #1126537)

zabbix (1:7.0.22+dfsg-1~deb13u1) trixie; urgency=medium
 .
   * Non Maintainer Upload by LTS Team
   * Upload to trixie (Closes: #1121841, #1117448)
     + Fix CVE-2025-49643 (fixed in 7.0.19)
     + Fix CVE-2025-49641 (fixed in 7.0.18)
     + Fix CVE-2025-27238 (fixed in 7.0.14)
     + Fix CVE-2025-27236 (fixed in 7.0.17)
     + Fix CVE-2025-27233 (fixed in 7.0.11)
     + Fix CVE-2025-27231 (fixed in 7.0.18)
zabbix (1:7.0.22+dfsg-1~bpo13+1) trixie-backports; urgency=medium
 .
   * Rebuild for trixie-backports.
 .
 zabbix (1:7.0.22+dfsg-1) unstable; urgency=high
 .
   * New upstream release. (Closes: #1117448)
     + CVE-2025-49641 (fixed in 7.0.18)
     + CVE-2025-27238 (fixed in 7.0.14)
     + CVE-2025-27236 (fixed in 7.0.17)
     + CVE-2025-27233 (fixed in 7.0.11)
     + CVE-2025-27231 (fixed in 7.0.18)
   * Build-Depends:
     + golang-github-victoriametrics-easyproto-dev
     = golang-any (>= 2:1.24~)
   * README.Debian.security to denote limited scope of support.

zookeeper (3.9.3-1+deb13u1) trixie; urgency=medium
 .
   * Team upload
   * Skipping tests of the zookeeper-server artifact, which fail randomly.
     Keeping the tests of the other artifacts (Closes: #1102062).
=======================================
Sat, 10 Jan 2026 - Debian 13.3 released
=======================================
=========================================================================
[Date: Sat, 10 Jan 2026 10:01:39 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

btrfs-modules-6.12.43+deb13-s390x-di |  6.12.43-1 | s390x
cdrom-core-modules-6.12.43+deb13-s390x-di |  6.12.43-1 | s390x
crypto-dm-modules-6.12.43+deb13-s390x-di |  6.12.43-1 | s390x
crypto-modules-6.12.43+deb13-s390x-di |  6.12.43-1 | s390x
dasd-extra-modules-6.12.43+deb13-s390x-di |  6.12.43-1 | s390x
dasd-modules-6.12.43+deb13-s390x-di |  6.12.43-1 | s390x
ext4-modules-6.12.43+deb13-s390x-di |  6.12.43-1 | s390x
f2fs-modules-6.12.43+deb13-s390x-di |  6.12.43-1 | s390x
fat-modules-6.12.43+deb13-s390x-di |  6.12.43-1 | s390x
isofs-modules-6.12.43+deb13-s390x-di |  6.12.43-1 | s390x
kernel-image-6.12.43+deb13-s390x-di |  6.12.43-1 | s390x
linux-headers-6.12.43+deb13-s390x |  6.12.43-1 | s390x
linux-image-6.12.43+deb13-s390x |  6.12.43-1 | s390x
linux-image-6.12.43+deb13-s390x-dbg |  6.12.43-1 | s390x
loop-modules-6.12.43+deb13-s390x-di |  6.12.43-1 | s390x
md-modules-6.12.43+deb13-s390x-di |  6.12.43-1 | s390x
mtd-core-modules-6.12.43+deb13-s390x-di |  6.12.43-1 | s390x
multipath-modules-6.12.43+deb13-s390x-di |  6.12.43-1 | s390x
nbd-modules-6.12.43+deb13-s390x-di |  6.12.43-1 | s390x
nic-modules-6.12.43+deb13-s390x-di |  6.12.43-1 | s390x
scsi-core-modules-6.12.43+deb13-s390x-di |  6.12.43-1 | s390x
scsi-modules-6.12.43+deb13-s390x-di |  6.12.43-1 | s390x
udf-modules-6.12.43+deb13-s390x-di |  6.12.43-1 | s390x
xfs-modules-6.12.43+deb13-s390x-di |  6.12.43-1 | s390x

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 10 Jan 2026 10:01:49 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

ata-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
btrfs-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
cdrom-core-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
crypto-dm-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
crypto-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
drm-core-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
ext4-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
f2fs-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
fat-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
fb-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
input-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
isofs-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
jfs-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
kernel-image-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
linux-headers-6.12.43+deb13-riscv64 |  6.12.43-1 | riscv64
linux-image-6.12.43+deb13-riscv64 |  6.12.43-1 | riscv64
linux-image-6.12.43+deb13-riscv64-dbg |  6.12.43-1 | riscv64
loop-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
md-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
mmc-core-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
mmc-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
mtd-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
multipath-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
nbd-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
nic-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
nic-shared-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
nic-usb-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
nic-wireless-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
pata-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
ppp-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
sata-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
scsi-core-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
scsi-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
scsi-nic-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
squashfs-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
udf-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
usb-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
usb-serial-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
usb-storage-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64
xfs-modules-6.12.43+deb13-riscv64-di |  6.12.43-1 | riscv64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 10 Jan 2026 10:01:59 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

linux-headers-6.12.43+deb13-amd64 |  6.12.43-1 | amd64
linux-headers-6.12.43+deb13-cloud-amd64 |  6.12.43-1 | amd64
linux-headers-6.12.43+deb13-rt-amd64 |  6.12.43-1 | amd64
linux-image-6.12.43+deb13-amd64-dbg |  6.12.43-1 | amd64
linux-image-6.12.43+deb13-amd64-unsigned |  6.12.43-1 | amd64
linux-image-6.12.43+deb13-cloud-amd64-dbg |  6.12.43-1 | amd64
linux-image-6.12.43+deb13-cloud-amd64-unsigned |  6.12.43-1 | amd64
linux-image-6.12.43+deb13-rt-amd64-dbg |  6.12.43-1 | amd64
linux-image-6.12.43+deb13-rt-amd64-unsigned |  6.12.43-1 | amd64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 10 Jan 2026 10:02:32 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

linux-kbuild-6.12.43+deb13 |  6.12.43-1 | amd64, arm64, armel, armhf, i386, ppc64el, riscv64, s390x

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 10 Jan 2026 10:02:41 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

linux-headers-6.12.43+deb13-arm64 |  6.12.43-1 | arm64
linux-headers-6.12.43+deb13-arm64-16k |  6.12.43-1 | arm64
linux-headers-6.12.43+deb13-cloud-arm64 |  6.12.43-1 | arm64
linux-headers-6.12.43+deb13-rt-arm64 |  6.12.43-1 | arm64
linux-image-6.12.43+deb13-arm64-16k-dbg |  6.12.43-1 | arm64
linux-image-6.12.43+deb13-arm64-16k-unsigned |  6.12.43-1 | arm64
linux-image-6.12.43+deb13-arm64-dbg |  6.12.43-1 | arm64
linux-image-6.12.43+deb13-arm64-unsigned |  6.12.43-1 | arm64
linux-image-6.12.43+deb13-cloud-arm64-dbg |  6.12.43-1 | arm64
linux-image-6.12.43+deb13-cloud-arm64-unsigned |  6.12.43-1 | arm64
linux-image-6.12.43+deb13-rt-arm64-dbg |  6.12.43-1 | arm64
linux-image-6.12.43+deb13-rt-arm64-unsigned |  6.12.43-1 | arm64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 10 Jan 2026 10:02:49 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

linux-headers-6.12.43+deb13-rpi |  6.12.43-1 | armel
linux-image-6.12.43+deb13-rpi |  6.12.43-1 | armel
linux-image-6.12.43+deb13-rpi-dbg |  6.12.43-1 | armel

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 10 Jan 2026 10:02:56 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

ata-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
btrfs-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
cdrom-core-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
crypto-dm-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
crypto-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
drm-core-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
ext4-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
f2fs-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
fat-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
fb-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
input-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
isofs-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
jfs-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
kernel-image-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
linux-headers-6.12.43+deb13-armmp |  6.12.43-1 | armhf
linux-headers-6.12.43+deb13-armmp-lpae |  6.12.43-1 | armhf
linux-headers-6.12.43+deb13-rt-armmp |  6.12.43-1 | armhf
linux-image-6.12.43+deb13-armmp |  6.12.43-1 | armhf
linux-image-6.12.43+deb13-armmp-dbg |  6.12.43-1 | armhf
linux-image-6.12.43+deb13-armmp-lpae |  6.12.43-1 | armhf
linux-image-6.12.43+deb13-armmp-lpae-dbg |  6.12.43-1 | armhf
linux-image-6.12.43+deb13-rt-armmp |  6.12.43-1 | armhf
linux-image-6.12.43+deb13-rt-armmp-dbg |  6.12.43-1 | armhf
loop-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
md-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
mmc-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
mtd-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
multipath-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
nbd-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
nic-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
nic-shared-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
nic-usb-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
nic-wireless-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
pata-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
ppp-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
sata-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
scsi-core-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
scsi-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
scsi-nic-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
sound-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
speakup-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
squashfs-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
udf-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
uinput-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
usb-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
usb-serial-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf
usb-storage-modules-6.12.43+deb13-armmp-di |  6.12.43-1 | armhf

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 10 Jan 2026 10:03:04 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

ata-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
btrfs-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
cdrom-core-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
crypto-dm-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
crypto-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
drm-core-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
ext4-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
f2fs-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
fat-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
fb-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
firewire-core-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
hypervisor-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
input-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
isofs-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
jfs-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
kernel-image-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
linux-headers-6.12.43+deb13-powerpc64le |  6.12.43-1 | ppc64el
linux-headers-6.12.43+deb13-powerpc64le-64k |  6.12.43-1 | ppc64el
linux-image-6.12.43+deb13-powerpc64le |  6.12.43-1 | ppc64el
linux-image-6.12.43+deb13-powerpc64le-64k |  6.12.43-1 | ppc64el
linux-image-6.12.43+deb13-powerpc64le-64k-dbg |  6.12.43-1 | ppc64el
linux-image-6.12.43+deb13-powerpc64le-dbg |  6.12.43-1 | ppc64el
loop-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
md-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
mtd-core-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
multipath-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
nbd-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
nic-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
nic-shared-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
nic-usb-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
nic-wireless-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
ppp-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
sata-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
scsi-core-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
scsi-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
scsi-nic-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
serial-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
squashfs-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
udf-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
uinput-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
usb-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
usb-serial-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
usb-storage-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el
xfs-modules-6.12.43+deb13-powerpc64le-di |  6.12.43-1 | ppc64el

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 10 Jan 2026 10:03:17 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

ata-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
btrfs-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
cdrom-core-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
crypto-dm-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
crypto-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
ext4-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
f2fs-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
fat-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
fb-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
input-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
isofs-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
jfs-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
kernel-image-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
linux-image-6.12.43+deb13-arm64 |  6.12.43-1 | arm64
linux-image-6.12.43+deb13-arm64-16k |  6.12.43-1 | arm64
linux-image-6.12.43+deb13-cloud-arm64 |  6.12.43-1 | arm64
linux-image-6.12.43+deb13-rt-arm64 |  6.12.43-1 | arm64
loop-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
md-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
mmc-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
multipath-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
nbd-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
nic-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
nic-shared-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
nic-usb-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
nic-wireless-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
ppp-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
sata-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
scsi-core-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
scsi-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
scsi-nic-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
sound-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
speakup-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
squashfs-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
udf-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
uinput-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
usb-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
usb-serial-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
usb-storage-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64
xfs-modules-6.12.43+deb13-arm64-di |  6.12.43-1 | arm64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux-signed-arm64)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 10 Jan 2026 10:03:47 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

linux-headers-6.12.43+deb13-common |  6.12.43-1 | all
linux-headers-6.12.43+deb13-common-rt |  6.12.43-1 | all
linux-support-6.12.43+deb13 |  6.12.43-1 | all

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux - based on source metadata)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 10 Jan 2026 10:04:09 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

ata-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
btrfs-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
cdrom-core-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
crypto-dm-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
crypto-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
drm-core-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
ext4-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
f2fs-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
fat-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
fb-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
firewire-core-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
input-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
isofs-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
jfs-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
kernel-image-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
linux-image-6.12.43+deb13-amd64 |  6.12.43-1 | amd64
linux-image-6.12.43+deb13-cloud-amd64 |  6.12.43-1 | amd64
linux-image-6.12.43+deb13-rt-amd64 |  6.12.43-1 | amd64
loop-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
md-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
mmc-core-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
mmc-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
mtd-core-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
multipath-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
nbd-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
nic-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
nic-pcmcia-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
nic-shared-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
nic-usb-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
nic-wireless-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
pata-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
pcmcia-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
pcmcia-storage-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
ppp-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
rfkill-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
sata-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
scsi-core-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
scsi-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
scsi-nic-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
serial-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
sound-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
speakup-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
squashfs-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
udf-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
uinput-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
usb-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
usb-serial-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
usb-storage-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64
xfs-modules-6.12.43+deb13-amd64-di |  6.12.43-1 | amd64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux-signed-amd64 - based on source metadata)
----------------------------------------------
=========================================================================

ansible (12.0.0+dfsg-0+deb13u1) trixie; urgency=medium
 .
   * d/watch: Track 12.0.x releases for trixie
   * New upstream version 12.0.0+dfsg, providing following security fixes:
     - cloudscale_ch.cloud: Validate API tokens before passing them to Ansible,
       to ensure that a badly formed one (i.e., one with newlines) is not
       accidentally logged.
     - community.general: keycloak_authentication - API calls did not properly
       set the priority during update resulting in incorrectly sorted
       authentication flows.
     - community.general: keycloak_client - Sanitize saml.encryption.private.key
       so it does not show in the logs
   * Remove cloud-common-flaky-test.patch (dropped upstream)
   * security fix: prevent keycloak_user from logging credentials (backported
     from ansible 12.2.0)
ansible (12.0.0~b5+dfsg-1) unstable; urgency=medium
 .
   * New upstream version 12.0.0~b5+dfsg

apache2 (2.4.66-1~deb13u1) trixie; urgency=medium
 .
   * Team upload
   * New upstream version (Closes: #1121926, CVE-2025-55753, CVE-2025-58098,
     CVE-2025-59775, CVE-2025-65082, CVE-2025-66200)
   * Update test framework
apache2 (2.4.66-1~deb12u1) bookworm; urgency=medium
 .
   * Team upload
   * New upstream version (Closes: #1121926, CVE-2025-55753, CVE-2025-58098,
     CVE-2025-59775, CVE-2025-65082, CVE-2025-66200)
   * Update test framework
apache2 (2.4.65-3) unstable; urgency=medium
 .
   * Change default LANG in envvars from C to C.UTF-8
     (Closes: #787584)
   * systemd service apache2 is aliased to httpd
     (Closes: #915855)
   * document a2* environment files in man page
     (Closes: #880421)
   * Failing test in its test suite
     (Closes: #1107289, LP: #2112429)
   * Restart on-abnormal instead of on-abort
     (Closes: #1106280)
   * Allow triggers to use maintscript helper to restart apache
     (LP: #2038912)

at-spi2-core (2.56.2-1+deb13u1) trixie; urgency=medium
 .
   * patches/keyboard-group: Fix taking group into account for key events
     (Closes: #1111485)
at-spi2-core (2.56.2-1+deb13u1~bpo12+1) bookworm-backports; urgency=medium
 .
   * Backport to bookworm.
     - Revert t64 change.
     - Revert libgirepository1.0-dev build-dep change.

awffull (3.10.2-10+deb13u1) trixie; urgency=medium
 .
   * QA upload.
   * debian/awffull.service: Add missing argument to avoid premature exit
     of the cron script when it is invoked by the systemd timer; thanks
     Charlemagne Lasse (Closes: #1120742).
   * debian/control (Vcs-Git): Add branch.
   * debian/gbp.conf: New file.

base-files (13.8+deb13u3) trixie; urgency=medium
 .
   * Update debian_version and os-release for Debian 13.3 point release.

c-ares (1.34.5-1+deb13u1) trixie-security; urgency=medium
 .
   * Apply patch to fix use-after-free (fixes CVE-2025-62408)

calibre (8.5.0+ds-1+deb13u1) trixie; urgency=medium
 .
   * Fix CVE-2025-64486

chromium (143.0.7499.169-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2025-14765: Use after free in WebGPU. Reported by Anonymous.
     - CVE-2025-14766: Out of bounds read and write in V8.
       Reported by Shaheen Fazim.
   * d/rules: change (google-specific) upstream tarball url.
 .
   [ Daniel Richard G. ]
   * d/control: Drop valgrind from Build-Depends:, as it appears unused.
   * d/patches/debianization/cross-build.patch: Update changes to the protoc
     wrapper to cover additional cases of non-emulated Python execution.
   * d/rules: Add a bug reference for the libffi issue.
chromium (143.0.7499.169-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2025-14765: Use after free in WebGPU. Reported by Anonymous.
     - CVE-2025-14766: Out of bounds read and write in V8.
       Reported by Shaheen Fazim.
   * d/rules: change (google-specific) upstream tarball url.
 .
   [ Daniel Richard G. ]
   * d/patches/debianization/cross-build.patch: Update changes to the protoc
     wrapper to cover additional cases of non-emulated Python execution.
chromium (143.0.7499.109-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-????-?????: Under coordination.
     - CVE-2025-14372: Use after free in Password Manager.
       Reported by Weipeng Jiang (@Krace) of VRI.
     - CVE-2025-14373: Inappropriate implementation in Toolbar.
       Reported by Khalil Zhani.
 .
   [ Jianfeng Liu ]
   * set use_av1_hw_decoder=true for arm64 and add build dep
     linux-libc-dev (>= 6.5). This will enable V4L2 stateful/stateless AV1
     decoder found on some arm SoCs.
   * d/patches:
     - upstream/fix-rk3588-v4l2-av1-decoder.patch: Fixes upstream issue
       https://crbug.com/464638992. This patch is backported from v145
       and will fix green frame issue when playing av1 video on RK3588.
     - ppc64le/sandbox/0001-sandbox-Enable-seccomp_bpf-for-ppc64.patch:
       fix FTBFS on ppc64el related to conflicting kernel_stat patches.
chromium (143.0.7499.109-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-????-?????: Under coordination.
     - CVE-2025-14372: Use after free in Password Manager.
       Reported by Weipeng Jiang (@Krace) of VRI.
     - CVE-2025-14373: Inappropriate implementation in Toolbar.
       Reported by Khalil Zhani.
 .
   [ Jianfeng Liu ]
   * set use_av1_hw_decoder=true for arm64 and add build dep
     linux-libc-dev (>= 6.5). This will enable V4L2 stateful/stateless AV1
     decoder found on some arm SoCs.
   * d/patches:
     - upstream/fix-rk3588-v4l2-av1-decoder.patch: Fixes upstream issue
       https://crbug.com/464638992. This patch is backported from v145
       and will fix green frame issue when playing av1 video on RK3588.
     - ppc64le/sandbox/0001-sandbox-Enable-seccomp_bpf-for-ppc64.patch:
       fix FTBFS on ppc64el related to conflicting kernel_stat patches.
chromium (143.0.7499.109-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-????-?????: Under coordination.
     - CVE-2025-14372: Use after free in Password Manager.
       Reported by Weipeng Jiang (@Krace) of VRI.
     - CVE-2025-14373: Inappropriate implementation in Toolbar.
       Reported by Khalil Zhani.
chromium (143.0.7499.40-1) unstable; urgency=high
 .
   * New upstream stable release.
     - CVE-2025-13630: Type Confusion in V8.
       Reported by Shreyas Penkar (@streypaws).
     - CVE-2025-13631: Inappropriate implementation in Google Updater.
       Reported by Jota Domingos.
     - CVE-2025-13632: Inappropriate implementation in DevTools.
       Reported by Leandro Teles.
     - CVE-2025-13633: Use after free in Digital Credentials.
       Reported by Chrome.
     - CVE-2025-13634: Inappropriate implementation in Downloads.
       Reported by Eric Lawrence of Microsoft.
     - CVE-2025-13720: Bad cast in Loader. Reported by Chrome.
     - CVE-2025-13721: Race in v8. Reported by Chrome.
     - CVE-2025-13635: Inappropriate implementation in Downloads.
       Reported by Hafiizh.
     - CVE-2025-13636: Inappropriate implementation in Split View.
       Reported by Khalil Zhani.
     - CVE-2025-13637: Inappropriate implementation in Downloads.
       Reported by Hafiizh.
     - CVE-2025-13638: Use after free in Media Stream. Reported by sherkito.
     - CVE-2025-13639: Inappropriate implementation in WebRTC.
       Reported by Philipp Hancke.
     - CVE-2025-13640: Inappropriate implementation in Passwords.
       Reported by Anonymous.
   * d/patches:
     - fixes/headless-gn.patch: refresh.
     - fixes/chromium-142-iwyu-field-form-data.patch: drop, merged upstream.
     - disable/tests.patch: refresh.
     - ungoogled/disable-privacy-sandbox.patch: sync from upstream.
     - fixes/libpng-testonly.patch: add a workaround for a missing build target
       that upstream forgot to include.
     - trixie/rust-no-alloc-shim.patch: mark nightly feature 'no_mangle' as
       unsafe to make rustc happy.
     - trixie/cookie-string-view.patch: add a workaround for missing clang-19
       feature.
 .
   [ Daniel Richard G. ]
   * d/patches:
     - debianization/cross-build.patch: Avoid "Assignment had no effect"
       error from GN when running outside of d/rules.
     - debianization/rustc-bootstrap.patch: Move RUSTC_BOOTSTRAP=1 here.
     - disable/license-headless-shell.patch: Don't generate the (unused)
       LICENSE.headless_shell file, as the rule tends to break easily.
     - fixes/headless-gn.patch: No longer needed, thanks to previous patch.
   * d/rules: Move RUSTC_BOOTSTRAP=1 environment setting into patch.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - ppc64le/third_party/0002-regenerate-xnn-buildgn.patch: Regenerate from
       upstream sources
     - ppc64le/fixes/fix-clang-selection.patch: Refresh for upstream changes
 .
   [ Jianfeng Liu ]
   * Add loong64 support, with patches in d/patches/loongarch64/.
chromium (143.0.7499.40-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream stable release.
     - CVE-2025-13630: Type Confusion in V8.
       Reported by Shreyas Penkar (@streypaws).
     - CVE-2025-13631: Inappropriate implementation in Google Updater.
       Reported by Jota Domingos.
     - CVE-2025-13632: Inappropriate implementation in DevTools.
       Reported by Leandro Teles.
     - CVE-2025-13633: Use after free in Digital Credentials.
       Reported by Chrome.
     - CVE-2025-13634: Inappropriate implementation in Downloads.
       Reported by Eric Lawrence of Microsoft.
     - CVE-2025-13720: Bad cast in Loader. Reported by Chrome.
     - CVE-2025-13721: Race in v8. Reported by Chrome.
     - CVE-2025-13635: Inappropriate implementation in Downloads.
       Reported by Hafiizh.
     - CVE-2025-13636: Inappropriate implementation in Split View.
       Reported by Khalil Zhani.
     - CVE-2025-13637: Inappropriate implementation in Downloads.
       Reported by Hafiizh.
     - CVE-2025-13638: Use after free in Media Stream. Reported by sherkito.
     - CVE-2025-13639: Inappropriate implementation in WebRTC.
       Reported by Philipp Hancke.
     - CVE-2025-13640: Inappropriate implementation in Passwords.
       Reported by Anonymous.
   * d/patches:
     - fixes/headless-gn.patch: refresh.
     - fixes/chromium-142-iwyu-field-form-data.patch: drop, merged upstream.
     - disable/tests.patch: refresh.
     - ungoogled/disable-privacy-sandbox.patch: sync from upstream.
     - fixes/libpng-testonly.patch: add a workaround for a missing build target
       that upstream forgot to include.
     - trixie/rust-no-alloc-shim.patch: mark nightly feature 'no_mangle' as
       unsafe to make rustc happy.
     - trixie/cookie-string-view.patch: add a workaround for missing clang-19
       feature.
 .
   [ Daniel Richard G. ]
   * d/patches:
     - debianization/cross-build.patch: Avoid "Assignment had no effect"
       error from GN when running outside of d/rules.
     - debianization/rustc-bootstrap.patch: Move RUSTC_BOOTSTRAP=1 here.
     - disable/license-headless-shell.patch: Don't generate the (unused)
       LICENSE.headless_shell file, as the rule tends to break easily.
     - fixes/headless-gn.patch: No longer needed, thanks to previous patch.
     - trixie/rust-is-multiple-of.patch: add more workarounds for missing
       rustc features.
   * d/rules: Move RUSTC_BOOTSTRAP=1 environment setting into patch.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - ppc64le/third_party/0002-regenerate-xnn-buildgn.patch: Regenerate from
       upstream sources
     - ppc64le/fixes/fix-clang-selection.patch: Refresh for upstream changes
 .
   [ Jianfeng Liu ]
   * Add loong64 support, with patches in d/patches/loongarch64/.
chromium (143.0.7499.40-1~deb12u1) bookworm-security; urgency=high
 .
   * New upstream stable release.
     - CVE-2025-13630: Type Confusion in V8.
       Reported by Shreyas Penkar (@streypaws).
     - CVE-2025-13631: Inappropriate implementation in Google Updater.
       Reported by Jota Domingos.
     - CVE-2025-13632: Inappropriate implementation in DevTools.
       Reported by Leandro Teles.
     - CVE-2025-13633: Use after free in Digital Credentials.
       Reported by Chrome.
     - CVE-2025-13634: Inappropriate implementation in Downloads.
       Reported by Eric Lawrence of Microsoft.
     - CVE-2025-13720: Bad cast in Loader. Reported by Chrome.
     - CVE-2025-13721: Race in v8. Reported by Chrome.
     - CVE-2025-13635: Inappropriate implementation in Downloads.
       Reported by Hafiizh.
     - CVE-2025-13636: Inappropriate implementation in Split View.
       Reported by Khalil Zhani.
     - CVE-2025-13637: Inappropriate implementation in Downloads.
       Reported by Hafiizh.
     - CVE-2025-13638: Use after free in Media Stream. Reported by sherkito.
     - CVE-2025-13639: Inappropriate implementation in WebRTC.
       Reported by Philipp Hancke.
     - CVE-2025-13640: Inappropriate implementation in Passwords.
       Reported by Anonymous.
   * d/patches:
     - fixes/headless-gn.patch: refresh.
     - fixes/chromium-142-iwyu-field-form-data.patch: drop, merged upstream.
     - disable/tests.patch: refresh.
     - ungoogled/disable-privacy-sandbox.patch: sync from upstream.
     - fixes/libpng-testonly.patch: add a workaround for a missing build target
       that upstream forgot to include.
     - trixie/rust-no-alloc-shim.patch: mark nightly feature 'no_mangle' as
       unsafe to make rustc happy.
     - trixie/cookie-string-view.patch: add a workaround for missing clang-19
       feature.
 .
   [ Daniel Richard G. ]
   * d/patches:
     - debianization/cross-build.patch: Avoid "Assignment had no effect"
       error from GN when running outside of d/rules.
     - debianization/rustc-bootstrap.patch: Move RUSTC_BOOTSTRAP=1 here.
     - disable/license-headless-shell.patch: Don't generate the (unused)
       LICENSE.headless_shell file, as the rule tends to break easily.
     - fixes/headless-gn.patch: No longer needed, thanks to previous patch.
     - trixie/rust-is-multiple-of.patch: add more workarounds for missing
       rustc features.
     - bookworm/constexpr.patch: Refresh (source file moved).
     - bookworm/gn-absl.patch: Refresh.
     - bookworm/gn-path-exists2.patch: Refresh.
     - bookworm/rust-unsafe-extern.patch: add workaround for older rust code
       convention generated by bookworm's version of rust-bindgen.
     - bookworm/node-esm-dirname.patch: add workaround for older node 18.
   * d/rules: Move RUSTC_BOOTSTRAP=1 environment setting into patch.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - ppc64le/third_party/0002-regenerate-xnn-buildgn.patch: Regenerate from
       upstream sources
     - ppc64le/fixes/fix-clang-selection.patch: Refresh for upstream changes
chromium (142.0.7444.175-1) unstable; urgency=high
 .
   * New upstream security release.
     - CVE-2025-13223: Type Confusion in V8.
       Reported by Clément Lecigne of Google's Threat Analysis Group.
     - CVE-2025-13224: Type Confusion in V8. Reported by Google Big Sleep.
chromium (142.0.7444.175-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream security release.
     - CVE-2025-13223: Type Confusion in V8.
       Reported by Clément Lecigne of Google's Threat Analysis Group.
     - CVE-2025-13224: Type Confusion in V8. Reported by Google Big Sleep.
chromium (142.0.7444.175-1~deb12u1) bookworm-security; urgency=high
 .
   * New upstream security release.
     - CVE-2025-13223: Type Confusion in V8.
       Reported by Clément Lecigne of Google's Threat Analysis Group.
     - CVE-2025-13224: Type Confusion in V8. Reported by Google Big Sleep.
chromium (142.0.7444.162-1) unstable; urgency=high
 .
   * New upstream security release.
     - CVE-2025-13042: Inappropriate implementation in V8.
       Reported by 303f06e3.
chromium (142.0.7444.162-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream security release.
     - CVE-2025-13042: Inappropriate implementation in V8.
       Reported by 303f06e3.
chromium (142.0.7444.162-1~deb12u1) bookworm-security; urgency=high
 .
   * New upstream security release.
     - CVE-2025-13042: Inappropriate implementation in V8.
       Reported by 303f06e3.
chromium (142.0.7444.134-1) unstable; urgency=high
 .
   * New upstream security release.
     - CVE-2025-12725: Out of bounds write in WebGPU. Reported by Anonymous.
     - CVE-2025-12726: Inappropriate implementation in Views.
       Reported by Alesandro Ortiz.
     - CVE-2025-12727: Inappropriate implementation in V8.
       Reported by 303f06e3.
     - CVE-2025-12728: Inappropriate implementation in Omnibox.
       Reported by Hafiizh.
     - CVE-2025-12729: Inappropriate implementation in Omnibox.
       Reported by Khalil Zhani.

cloud-init (25.1.4-1+deb13u1) trixie; urgency=medium
 .
   * Ensure deb822 sources.list template renders correctly (Closes: #1118187)

composer (2.8.8-1+deb13u1) trixie; urgency=medium
 .
   * Backport fix from composer 2.9.3:
     Fixed ANSI sequence injection [CVE-2025-67746]
   * Track debian/trixie

containerd (1.7.24~ds1-6+deb13u1) trixie-security; urgency=medium
 .
   * Fix overly broad directory permissions, Fixes: CVE-2024-25621
   * Fix bug in the CRI Attach implementation, Fixes: CVE-2025-64329
     Closes: #1120343

cups-filters (1.28.17-6+deb13u1) trixie; urgency=medium
 .
   * CVE-2025-64503
     fix an out of bounds write vulnerability when processing crafted
     PDF files containing a large 'Mediabox' value.
     (Closes: #1120698)
 .
   * CVE-2025-57812
     fix an out of bounds read/write vulnerability in the processing
     of TIFF image files.
     (Closes: #1120704)
 .
   * CVE-2025-64524
     fix infinite loop with crafted input raster file, that resuls
     into a heap buffer overflow

debian-installer (20250803+deb13u3) trixie; urgency=medium
 .
   * Bump Linux kernel ABI to 6.12.63+deb13.
   * Adjust linux-image build-deps accordingly.

debian-installer-netboot-images (20250803+deb13u3) trixie; urgency=medium
 .
   * Update to 20250803+deb13u3, from trixie-proposed-updates.

debian-security-support (1:13+2026.01.04) trixie; urgency=medium
 .
   [ Holger Levsen ]
   * deb13: mark wpewebkit as unsupported. Closes: #1118273.
 .
   [ Jochen Sprickerhof ]
   * deb13+12+11: mark hdf5 as limited supported. Closes: 1117607.
 .
   [ Moritz Muehlenhoff ]
   * deb13+12: mark zabbix as limited support. Closes: #1124558.

debos (1.1.5-1+deb13u1) trixie-proposed-updates; urgency=medium
 .
   * d/control: add systemd-resolved to Depends (Closes: #1115880)

dgit (12.16) trixie; urgency=medium
 .
   git-debrebase bugfix:
   * Merge resolution: Fix erroneous use of real git tree as
     if it were a private working area.  Closes: #1116933.
   * Merge resolution: Fix conflation of different temporary directories.
   * Clean out all of the temporary playground area on every invocation.

dhcpcd (1:10.1.0-11+deb13u2) trixie; urgency=medium
 .
   * [patches]
     + Uncomment 'ntp_servers' in dhcpcd.conf (Closes: #1123962).

diffoscope (297+deb13u1) trixie; urgency=medium
 .
   * Fix a test after the upload of systemd-ukify 258~rc3 (vs 258~rc2).
     (Closes: #1120867)

distribution-gpg-keys (1.115+ds-1~deb13u1) trixie; urgency=medium
 .
   * Merge tag 'debian/1.115+ds-1' into debian/trixie
 .
 distribution-gpg-keys (1.115+ds-1) unstable; urgency=medium
 .
   * Update upstream source from tag 'upstream/1.115+ds'
 .
 distribution-gpg-keys (1.114+ds-1) unstable; urgency=medium
 .
   * Update upstream source from tag 'upstream/1.114+ds'
distribution-gpg-keys (1.114+ds-1) unstable; urgency=medium
 .
   * Update upstream source from tag 'upstream/1.114+ds'

dpdk (24.11.4-0+deb13u1) trixie; urgency=medium
 .
   [ Christian Ehrhardt ]
   * d/p/disable_arm64_autopkgtest_fails.patch: disable tests that are
     flaky in debci (Closes: #1114911)
 .
   [ Luca Boccassi ]
   * New upstream release 24.11.4. For a full list of changes in 24.11.4 see:
     https://doc.dpdk.org/guides/rel_notes/release_24_11.html
dpdk (24.11.3-2) unstable; urgency=medium
 .
   [ Christian Ehrhardt ]
   * d/control: librte-net-ntnic25 is x86_64 only
   * d/control: librte-net-zxdh25 is x86_64 and arm64 only
   * d/p/disable_arm64_autopkgtest_fails.patch: disable tests that are
     flaky in debci (Closes: #1114911)
dpdk (24.11.3-1) unstable; urgency=medium
 .
   * New upstream release 24.11.3. For a full list of changes in 24.11.3 see:
     https://doc.dpdk.org/guides/rel_notes/release_24_11.html

dropbear (2025.89-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream security and bugfix release (closes: #1123069).
     + Fix CVE-2025-14282: Privilege escalation via unix stream forwarding in
       Dropbear server. Other programs on a system may authenticate unix
       sockets via SO_PEERCRED, which would be root user for Dropbear forwarded
       connections, allowing root privilege escalation.
     + The server now drops privileges of the dropbear process after
       authentication.
     + Remote server TCP socket forwarding will now use OS privileged port
       restrictions rather than having a fixed "allow >=1024 for non-root"
       rule.
     + Unix stream sockets are now disallowed when a forced command is used,
       either with authorized_key restrictions or "dropbear -c command".
   * DEP-8: Add "Depends: e2fsprogs" to remote-unlocking test.

edk2 (2025.02-8+deb13u1) trixie; urgency=medium
 .
   * Cherry-pick openssl fix for timing side-channel in ECDSA signature
     computation, CVE-2024-13176.
     - d/p/0001-Fix-timing-side-channel-in-ECDSA-signature-computati.patch
   * Fix out-of-bounds memory access in NetworkPkg/IScsiDxe, CVE-2024-38805.
     - d/p/0001-NetworkPkg-IScsiDxe-Fix-for-out-of-bound-memory-acce.patch
   * Safe handling of IDT register on SMM entry, CVE-2025-3770.
     - d/p/0001-UefiCpuPkg-PiSmmCpuDxeSmm-Safe-handling-of-IDT-regis.patch

exfatprogs (1.2.9-1+deb13u1) trixie; urgency=medium
 .
   * Add trixie branch information to gbp.conf and Vcs-Git.
   * Add debian/patches/windows-compat-use-512-sector-size.patch
     for Windows compatibility. Windows fails to access devices
     with a 4KB sector size which use a 512Byte sector emulation.
     Cherry-Pick the revert from exfatprogs 1.3.0 to use a 512Byte
     sector size for those devices, despite the performance penalty.
     If a user would like to omit the Windows compatability
     "mkfs.exfat -s 4096" can still be used to override the sector size.
     (Closes: #1120932)

extrepo-data (1.0.6~deb13u1) trixie; urgency=medium
 .
   * Reupload to stable.
     - This also includes a fix for the "build on trixie now fails" issue,
     which Closes: #1078614.
extrepo-data (1.0.5) unstable; urgency=medium
 .
   [ Robin Schneider ]
   * switch vector repo to apt.vector.dev after old repo was shutdown
   * fix bug in validate-repo that prevented validation of Release file
 .
   [ Merlin Lüdicke ]
   * switch nvidia-docker to unified debian repo
   * add pgpainless-cli requirement to readme
   * add bookworm amd64 to virtualbox repo
 .
   [ Oscar A. Jara ]
   * Add Brave keys
 .
   [ Robin Schneider ]
   * Provide `vector` repo which will point to latest major release
 .
   [ Sergey Ponomarev ]
   * waydroid.yaml: add trixie and sid suites
   * README.md: add a command to install dependencies and example of validation
 .
   [ Holger Weiss ]
   * eturnal repository: Add trixie and sid suites
 .
   [ Nicolas Peugnet ]
   * Update element.io PGP key
   * Check for GOODSIG instead of VALIDSIG in validate-repo
   * Better log messages for validate-repo
   * Add Zotero-deb repo
 .
   [ Colin Watson ]
   * Add pyxian
 .
   [ mirabilos ]
   * Update wtf/wtf-lts
 .
   [ Oliver Smith ]
   * Osmocom: update gpg-key
 .
   [ Juri Grabowski ]
   * Add new repositories from Ondřej Surý
   * Rewrite elastic repositories #12
   * add openmediavault repositories
   * add mysql-lts repository
   * add angie repository
   * add unifi repository
   * add opentofu repository
   * add helm repository
   * add azure-cli repository
   * add ceph repositories
   * add gopasspw repository
   * add trixie to winehq
   * add mozilla repository
   * add n.wtf nginx repository
   * add arctica-project repositories
   * add linux-libre repository
   * update gitlab key
   * Update elbe key
   * Update all possible repositories to bookworm
   * Close #1065421
 .
   [ Jonathan Wiltshire ]
   * New signing key for Spotify
   * Update google-chrome signing key
 .
   [ Thomas Goirand ]
   * OpenStack debian.net backport repo: Add the OpenStack Caracal release.
   * Add ceph_reef repository
 .
   [ Wouter Verhelst ]
   * Add trivy repository
   * Add beidconnect repository
   * Consol repository don't support i386 architecture anymore

ffmpeg (7:7.1.3-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 7.1.3
ffmpeg (7:7.1.2-1) unstable; urgency=medium
 .
   * New upstream version 7.1.2
     - Fixes CVE-2025-1594

flatpak (1.16.2-1~deb13u1) trixie; urgency=medium
 .
   * d/control, d/gbp.conf: Use debian/trixie packaging branch
   * Summary of changes since trixie:
     - New upstream stable release, see 1.16.2-1 changelog
       (Closes: #1114484)
     - Fix FTBFS with DEB_BUILD_OPTIONS=nocheck
       (Closes: #1116737)
     - d/copyright: Point to GNU web address instead of old FSF postal
       address
     - d/copyright: Clarify possible interpretations of LGPL-2
   * Revert changes that are not appropriate for a stable update:
     - Revert "Prefer the OpenSSL flavour of libcurl"
     - Revert "d/control: Only require gtk-doc-tools, etc. if we are
       building documentation"
     - Revert "Stop build-depending on libgirepository1.0-dev"
     - Revert "d/control: Remove Rules-Requires-Root"
     - Revert "Normalize formatting with debputy"
 .
 flatpak (1.16.2-1) unstable; urgency=medium
 .
   * New upstream stable release
     - Fix a memory leak in flatpak-session-helper when invoking host
       commands (flatpak-spawn --host) from privileged apps
       (Closes: #1114484)
     - Treat either the xe or i915 kernel module as indicating an Intel GPU,
       not just i915, and install the appropriate VA-API extensions
     - If using GLib 2.86.1 (specifically that version due to a regression
       that was later fixed), avoid exposing $HOME to apps if an XDG special
       directory such as Music is requested by the app but has been disabled
       locally
     - In flatpak-kill(1), make killing processes more robust, and avoid race
       conditions that could lead to the whole process group being killed
     - Allow `flatpak run` or `flatpak install --user` while under
       `sudo -u otheruser` or `sudo -g`, as long as the other user is not root,
       relaxing a check that was only intended to avoid accidents involving
       running as root
     - Provide an empty /run/host/font-dirs.xml during flatpak-build(1),
       avoiding spurious warnings for processes that use fontconfig during
       build-time tests
     - Fix a crash in `flatpak install --include-sdk` if the app is installed
       on a per-user basis but the corresponding SDK is already installed
       system-wide
     - Take the --reinstall option into account when installing a bundle
     - Add a missing argument to fcntl F_DUPFD_CLOEXEC during Flatpak's own
       build-time tests, fixing a test regression with newer glibc on Ubuntu
     - Fix flatpak-pin(1)/flatpak-mask(1) with multiple arguments, by
       reloading configuration when needed
     - Fix an assertion failure in flatpak-build-import-bundle(1)
     - When using the library API, allow http downloads with libcurl to be
       cancelled
     - If an OCI registry only has one image, allow the tag to be omitted
     - Fix a memory leak when using an OCI registry
     - Fix an uninitialized variable
     - Documentation improvements
     - Translation updates: pl
   * d/libflatpak-doc.install:
     Install single-file HTML documentation for the library.
     This was built by Autotools in 1.14.x and disappeared during the switch
     to Meson, but is now built again as a result of upstream fixes.
 .
 flatpak (1.16.1-3) unstable; urgency=medium
 .
   * Fix <!nocheck> builds (Closes: #1116737)
     - d/control: Remove <!nocheck> annotation from fuse3.
       This is required unconditionally (even if not running tests)
       since 1.15.7 upstream, so that the build system can autodetect
       the distro's appropriate path to fusermount3 or fusermount.
     - d/control, d/rules: Tighten up handling of nocheck and noinsttest.
       The upstream build system checks for some programs that are required
       during testing whenever the tests are compiled. If we are under both
       the nocheck and noinsttest build profiles, don't compile the tests,
       so that pkcheck and socat won't be needed in that configuration;
       and otherwise, we need them in Build-Depends.
   * d/control: Remove Rules-Requires-Root, no longer needed since trixie
   * Normalize formatting with debputy
 .
 flatpak (1.16.1-2) unstable; urgency=medium
 .
   * d/copyright: Point to GNU web address instead of old FSF postal address
   * d/copyright: Clarify possible interpretations of LGPL-2
   * Stop build-depending on libgirepository1.0-dev.
     Build-depend on gobject-introspection (>= 1.80) instead.
     libgirepository1.0-dev is not multiarch-compatible and should be removed
     during the forky cycle.
   * d/control: Only require gtk-doc-tools, etc. if we are building documentation
   * Prefer the OpenSSL flavour of libcurl.
     This is the one that upstream is going to be testing with in practice.
flatpak (1.16.1-3) unstable; urgency=medium
 .
   * Fix <!nocheck> builds (Closes: #1116737)
     - d/control: Remove <!nocheck> annotation from fuse3.
       This is required unconditionally (even if not running tests)
       since 1.15.7 upstream, so that the build system can autodetect
       the distro's appropriate path to fusermount3 or fusermount.
     - d/control, d/rules: Tighten up handling of nocheck and noinsttest.
       The upstream build system checks for some programs that are required
       during testing whenever the tests are compiled. If we are under both
       the nocheck and noinsttest build profiles, don't compile the tests,
       so that pkcheck and socat won't be needed in that configuration;
       and otherwise, we need them in Build-Depends.
   * d/control: Remove Rules-Requires-Root, no longer needed since trixie
   * Normalize formatting with debputy
flatpak (1.16.1-2) unstable; urgency=medium
 .
   * d/copyright: Point to GNU web address instead of old FSF postal address
   * d/copyright: Clarify possible interpretations of LGPL-2
   * Stop build-depending on libgirepository1.0-dev.
     Build-depend on gobject-introspection (>= 1.80) instead.
     libgirepository1.0-dev is not multiarch-compatible and should be removed
     during the forky cycle.
   * d/control: Only require gtk-doc-tools, etc. if we are building documentation
   * Prefer the OpenSSL flavour of libcurl.
     This is the one that upstream is going to be testing with in practice.

fpdf2 (2.8.3-1+deb13u1) trixie; urgency=medium
 .
   * Stop wrongly removing fvar table, allowing again the use of fpdf2 with
     variable fonts. (Closes: 1110990)

freedombox (25.9.3+deb13u1) trixie; urgency=medium
 .
   [ Sunil Mohan Adapa ]
   * distupgrade: Handle comments in sources.list file
   * distupgrade: Update Trixie's release date as announced
   * backups: Set proper permissions for backups-data directory (CVE-2025-68462)
 .
   [ James Valleroy ]
   * doc: Fetch latest manual

freeradius (3.2.7+dfsg-1+deb13u2) trixie; urgency=medium
 .
   [ Didier Raboud ]
   * Backport patch to fix segfaults on TLS connections with more than one
     intermediate certificate (Closes: #1120927)
 .
   [ Bernhard Schmidt ]
   * Add d/gbp.conf for Trixie branch

glib2.0 (2.84.4-3~deb13u2) trixie; urgency=medium
 .
   * d/patches: Add patches from 2.86.3 upstream to avoid integer overflows
     - d/p/gconvert-Error-out-if-g_escape_uri_string-would-overflow.patch,
       d/p/fuzzing-Add-fuzz-tests-for-g_filename_-to-from-_uri.patch:
       Fix an integer overflow when interpolating hundreds of megabytes of
       unescaped text into a URI, and add test coverage
       (CVE-2025-13601, glib#3827 upstream, Closes: #1121488)
     - d/p/gvariant-parser-Fix-potential-integer-overflow-parsing-by.patch:
       Fix an integer overflow when parsing very large strings in GVariant
       text format (CVE-2025-14087, glib#3834 upstream, Closes: #1122347)
     - d/p/gvariant-parser-Use-size_t-to-count-numbers-of-child-elem.patch,
       d/p/gvariant-parser-Convert-error-handling-code-to-use-size_t.patch:
       Fix other potential integer overflows parsing very large container
       types in GVariant text format, related to CVE-2025-14087
     - d/p/gfileattribute-Fix-integer-overflow-calculating-escaping-.patch:
       Fix an integer overflow when escaping invalid characters in very
       large file attributes
       (CVE-2025-14512, glib#3845 upstream, Closes: #1122346)

glibc (2.41-12+deb13u1) trixie; urgency=medium
 .
   * debian/patches/git-updates.diff: update from upstream stable branch:
     - Fix a double lock init issue after fork()
     - Fix _dl_find_object when ld.so has LOAD segment gaps, causing wrong
       backtrace unwinding. This affects at least arm64.
     - Fix SYSCALL_CANCEL for return values larger than INT_MAX (closes:
       #1115729).
     - Fix crash in ifunc functions on arm64 when hardening with
       -ftrivial-auto-var-init=zero.
     - Optimize inverse trig functions on arm64.
     - Optimize arm64 SVE exp, hyperbolic, and log1p functions.
     - Optimize arm64 SVE expf and log1p helpers.

gnome-shell (48.7-0+deb13u1) trixie; urgency=medium
 .
   * Team upload
   * New upstream release 48.5
     - Avoid a crash when using the Draw-On-Gnome extension, fixing a
       regression in 48.3
       (gnome-shell#8602 upstream)
     - Close the captive-portal authentication dialog when full network
       connectivity is detected
       (gnome-shell#7790 upstream)
     - Fix connecting to WPA Enterprise or WPA2 Enterprise networks from the
       quick settings menu
       (gnome-shell#8590 upstream)
     - Disable unneeded extensions before enabling new extensions, ensuring
       that there is never a time when two conflicting extensions are active
       (gnome-shell!3835 upstream)
     - Fix position of IBus candidate panel when using a scaled display
       (gnome-shell#8424 upstream)
     - During authentication, don't reset the authentication prompt on
       every tap/click, only when the prompt should change from hidden to
       visible
       (gnome-shell!3852 upstream)
     - Incorporate previously Debian-specific patches fixing X11 tray icon
       handling
       (gnome-shell!3818 upstream)
     - Avoid a possible source of lockups in keyboard focus handling
       (gnome-shell!3220 upstream)
     - Fix a memory leak with custom themes
       (gnome-shell#8509 upstream, LP: #2121786)
     - During authentication, don't discard typeahead when changing
       entry visibility
       (gnome-shell!3850 upstream)
     - Fix a crash when using a CSS-only Shell extension
       (gnome-shell#7339 upstream, previously fixed differently by a
       Debian-specific patch)
     - Improve debuggability of the actor tree (gnome-shell!3863 upstream)
     - Improve display of overview application search results in
       right-to-left locales (Arabic/Hebrew)
       (gnome-shell!3851 upstream)
     - Fix a crash during searches
       (gnome-shell#8651 upstream, LP: #2104113)
     - Fix a race condition causing intermittent stuck notifications
       (gnome-shell#6006 upstream)
     - Better forward-compatibility with post-trixie GLib versions
       (gnome-shell!3846, gnome-shell!3855 upstream)
     - Better forward-compatibility with post-trixie mutter versions
       (gnome-shell#4253 upstream)
     - Documentation/comment fixes
     - Translation updates: de, fi, th, zh_TW
   * New upstream release 48.6
     - During authentication, move keyboard focus to the currently-visible
       widget, not always the text entry box
       (gnome-shell!3849 upstream)
     - Ensure that workspace selector reappears promptly when cancelling
       a search in the overview (gnome-shell#7985 upstream)
     - Warn instead of crashing if an unsupported accent colour is set,
       for example when swapping between Ubuntu's patched gnome-shell and
       an upstream gnome-shell (gnome-shell!3892 upstream)
     - Always send a valid value for the reason a notification was closed
       (gnome-shell!3907 upstream)
     - In the UI for screenshots, if a button doesn't have any other label,
       use its tooltip as the label for accessibility purposes
       (gnome-shell!3908 upstream)
     - When a notification instance is reused, don't send its activation
       event multiple times (gnome-shell!3904 upstream)
     - Don't emit spurious dotted circles when using the on-screen keyboard
       in the Hindi (Bolnagri) layout (gnome-shell#8719 upstream)
     - Remove unused argument to PopupMenu constructor
       (gnome-shell!3894 upstream)
     - Translation updates: ug
   * New upstream release 48.7
     - Revert some changes in 48.6 that could cause regressions
       (not shown in the above summary)
     - Ensure network icon is updated on connectivity changes
       (gnome-shell#7357, gnome-shell#8549 upstream)
     - In gdm, sort the available sessions by their localized name,
       as displayed, and not by their internal IDs
       (gnome-shell!3920 upstream)
     - Add on-screen keyboard layouts for German (extended) and
       German (Austria, extended)
       (gnome-shell!3923 upstream)
     - Avoid zombie networkmanager-openvpn-auth processes when a VPN connection
       is stopped
       (gnome-shell#7083 upstream)
     - Avoid a warning on drag-and-drop when animations are disabled
       (gnome-shell!3922 upstream)
     - When logout, reboot or shutdown is prevented by a systemd inhibitor,
       don't log the cancellation with a stack trace as though it was an
       internal error
       (gnome-shell#8749 upstream)
     - Fix a crash when a window is closed immediately after losing on-screen
       keyboard focus
       (gnome-shell#8752 upstream)
     - Fix handling of multiple gdm greeter instances
       (gnome-shell!3942 upstream)
     - Fix warnings and potential use-after-free when the Shell exits in
       certain states
       (gnome-shell!3943 upstream)
     - Improve code clarity by using symbolic constants for SOURCE_CONTINUE,
       SOURCE_REMOVE
       (gnome-shell!3950 upstream)
     - Always return a result from "later" handlers
       (gnome-shell!3950 upstream)
     - Align search results' provider name better
       (gnome-shell!3951 upstream)
     - Always register the session with GDM on startup, even if no monitor is
       connected
       (gnome-shell!3708 upstream)
     - Fix misplaced separator in dash after unpinning running app
       (gnome-shell#3966, #3799 upstream)
     - Fix swipe gestures behaving incorrectly in RTL locales
       (gnome-shell!3967 upstream)
     - Fix some typos in documentation/comments
     - Translation updates: ro
   * Interface change: the misleadingly-named org.gnome.Shell.PortalHelper.Done
     signal has been renamed to org.gnome.Shell.PortalHelper.StatusChanged.
     In practice no other Debian package appears to subscribe to this signal,
     so this shouldn't have any effect.
 .
   [ Jeremy Bícha ]
   * Remove tray-icons patches: applied in 48.5
   * Remove st-theme-node patch: alternative fix applied in 48.5
 .
   [ Marco Trevisan (Treviño) ]
   * d/p/build-Define-test-dependencies.patch,
     d/p/extensions-app-Add-test-dependency-on-generated-desktop-f.patch:
     Add patches to fix tests' compilation dependencies
   * debian/tests: Add autopkgtests for GNOME Shell.
     We can just recompile gnome-shell and run the tests provided
     by upstream.
   * debian/tests: Run tests on the installed gnome-shell.
     Run the autopkgtests running the upstream-provided test scripts using
     the gnome-shell in the archive installed as it is. When in Ubuntu,
     we are also using the Ubuntu profile.
   * debian/salsa-ci: Enable i386 autopkgtests.
     i386 is kinda special in desktop, so better to track potential
     breakages.
 .
   [ Simon McVittie ]
   * Document upstream changes in detail
   * Rebase patch series
     - Drop one of Marco's new test-related build system patches (see
       above), applied in 48.5
   * Slightly improve patch metadata
gnome-shell (48.5-3) unstable; urgency=medium
 .
   * Team upload
   * Revert "Generate a versioned dependency for the GLib 2.86 transition"
   * Bump glib2.0 dependency to 2.86 unconditionally (part of #1115340)
gnome-shell (48.5-2) unstable; urgency=medium
 .
   * Team upload
   * Generate a versioned dependency for the GLib 2.86 transition.
     GNOME Shell will need to be rebuilt after GLib 2.86 is uploaded to
     unstable, so that its typelibs declare a dependency on GioUnix,
     which they do not when built against older GLib. Generate a
     versioned dependency so that this can be done via either a binNMU
     or a sourceful upload.
   * d/rules: Use a more robust xvfb-run command-line (Mitigates: #981201)
gnome-shell (48.5-1) unstable; urgency=medium
 .
   * New upstream release
   * debian/gnome-shell.gsettings-override: update Yelp to org.gnome.Yelp
   * Remove tray-icons patches applied in new release
   * Remove st-theme-node patch: alternative fix applied in new release
gnome-shell (48.4-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream stable release
     - network: If a network has no ID, don't treat it as available,
       avoiding breaking the network menu
       (gnome-shell!3785 upstream)
     - Improve URL recognition heuristic for notifications so that non-URLs do
       not become a link
       (gnome-shell#8517 upstream)
     - In gdm, improve efficiency of user list
       (gnome-shell!3799 upstream)
     - Fix signal order when taking a screenshot interactively is triggered
       via D-Bus, for example from xdg-desktop-portal
       (gnome-shell#8499 upstream)
     - Improve cursor scaling on systems with different-DPI monitors when using
       the Magnifier accessibility tool
       (gnome-shell!475 upstream)
     - In sliders like volume and brightness, avoid drawing part of the bar
       over the handle in RTL locales
       (gnome-shell!3817 upstream)
     - Improve robustness of signal connections in the Thunderbolt and
       smart-card code
       (gnome-shell!3796 upstream)
     - Code cleanups in extensions management service
       (part of gnome-shell!3750 upstream)
     - Translation updates
   * d/control: Bump gjs version to 1.81.2 as per meson.build.
     No practical effect, 1.82.x is already in trixie.
   * d/gbp.conf: Use debian/forky branch for uploads targeting forky.
     We'll stick to 48.x in testing/unstable for now, to get better testing
     for future 48.x updates in trixie. Preliminary 49.x packaging for
     experimental is already using the debian/latest branch.

gnome-shell-extension-gsconnect (62-1+deb13u1) trixie-security; urgency=medium
 .
   * Cherrypick 3223595bb648ad09afd150ec56dadfe1f33bd641

gnupg2 (2.4.7-21+deb13u1) trixie; urgency=high
 .
   * Avoid potential downgrade to SHA1 in 3rd party key signatures.
     https://gpg.fail/sha1 #12
     Patch from STABLE-BRANCH-2-4
   * gpg: Error out on unverified output for non-detached signatures.
     https://gpg.fail/detached #1
     Patch from STABLE-BRANCH-2-4
   * gpg: Fix possible memory corruption in the armor parser (CVE-2025-68973)
     https://gpg.fail/memcpy #5
     Patch from STABLE-BRANCH-2-4 (Closes: #1124221)
   * gpg: Do not use a default when asking for another output filename.
     https://gpg.fail/filename #2
     Unfuzzed patch from GIT master

gnutls28 (3.8.9-3+deb13u1) trixie; urgency=medium
 .
   * Add patch for CVE-2025-9820 / GNUTLS-SA-2025-11-18 from 3.8.11.
     Closes: #1121146

imagemagick (8:7.1.1.43+dfsg1-1+deb13u4) trixie; urgency=high
 .
   * Fix CVE-2025-62594 (Closes: #1119296)
     Imagemagick is vulnerable to denial-of-service due to unsigned integer
     underflow and division-by-zero in the CLAHEImage function. When tile
     width or height is zero, unsigned underflow occurs in pointer
     arithmetic, leading to out-of-bounds memory access, and
     division-by-zero causes immediate crashes.
   * Fix CVE-2025-65955 (Closes: #1122827)
     There is a vulnerability in ImageMagick’s Magick++ layer that
     manifests when Options::fontFamily is invoked with an empty
     string. Clearing a font family calls RelinquishMagickMemory on
     _drawInfo->font, freeing the font string but leaving _drawInfo->font
     pointing to freed memory while _drawInfo->family is set to that
     (now-invalid) pointer. Any later cleanup or reuse of _drawInfo->font
     re-frees or dereferences dangling memory. DestroyDrawInfo and other
     setters (Options::font, Image::font) assume _drawInfo->font remains
     valid, so destruction or subsequent updates trigger crashes or heap
     corruption.
   * Fix CVE-2025-66628 (Closes: #1122584)
     The TIM (PSX TIM) image parser contains a critical integer overflow
     vulnerability in its ReadTIMImage function (coders/tim.c). The code
     reads width and height (16-bit values) from the file header and
     calculates image_size = 2 * width * height without checking for
     overflow. On 32-bit systems (or where size_t is 32-bit), this
     calculation can overflow if width and height are large (e.g., 65535),
     wrapping around to a small value.
   * Fix CVE-2025-68618:
     Magick's failure to limit the depth of SVG file reads caused
     a DoS attack.
   * Do not allow vid for vector graphics
   * Fix CVE-2025-68950:
     Magick's failure to limit MVG mutual references forming a loop
   * Fix CVE-2025-69204:
     Converting a malicious MVG file to SVG caused an integer overflow.

incus (6.0.4-2+deb13u3) trixie; urgency=medium
 .
   * Backport fix for running nested docker in containers (Closes: #1121011)
incus (6.0.4-2+deb13u2) trixie-security; urgency=high
 .
   * Backport upstream fix for GHSA-56mx-8g9f-5crf
incus (6.0.4-2+deb13u2~bpo12+1) bookworm-backports; urgency=medium
 .
   * Rebuild for bookworm-backports.
     - Drop dependency on virtiofsd, as it isn't available for bookworm
     - Drop apparmor 4.x patch
     - Relax dependency on lxcfs, since runit scripts aren't expected for
       bookworm
     - Add patch to remove dependency on go-criu
     - Add patch to build with older version of openfga-go-sdk
     - Add patch backporting RemoveAll from newer sftp

intel-microcode (3.20251111.1~deb13u1) trixie; urgency=medium
 .
   * Upload to stable: no changes
intel-microcode (3.20251111.1~deb12u1) bookworm; urgency=medium
 .
   * Backport to bookworm
   * debian/rules: revert use of /usr/lib/firmware for deb12
intel-microcode (3.20250812.1) unstable; urgency=medium
 .
   [ Henrique de Moraes Holschuh ]
   * New upstream microcode datafile 20250812 (closes: #1110983, #1112168)
     - Mitgations for INTEL-SA-01249 (processor Stream Cache):
       CVE-2025-20109: Improper Isolation or Compartmentalization in the
       stream cache mechanism for some Intel Processors may allow an
       authenticated user to potentially enable escalation of privilege via
       local access.  Intel also disclosed that several processors models
       had already received this mitigation on the previous microcode
       release, 20250512.
     - Mitigations for INTEL-SA-01308:
       CVE-2025-22840: Sequence of processor instructions leads to
       unexpected behavior for some Intel Xeon 6 Scalable processors may
       allow an authenticated user to potentially enable escalation of
       privilege via local access.
     - Mitigations for INTEL-SA-01310 (OOBM services module):
       CVE-2025-22839: Insufficient granularity of access control in the
       OOB-MSM for some Intel Xeon 6 Scalable processors may allow a
       privileged user to potentially enable escalation of privilege via
       adjacent access.
     - Mitigations for INTEL-SA-01311 (Intel TDX):
       CVE-2025-22889: Improper handling of overlap between protected
       memory ranges for some Intel Xeon 6 processors with Intel TDX may
       allow a privileged user to potentially enable escalation of
       privilege via local access.
     - Mitigations for INTEL-SA-01313:
       CVE-2025-20053: Improper buffer restrictions for some Intel Xeon
       Processor firmware with SGX enabled may allow a privileged user to
       potentially enable escalation of privilege via local access.
       CVE-2025-21090: Missing reference to active allocated resource for
       some Intel Xeon processors may allow an authenticated user to
       potentially enable denial of service via local access.
       CVE-2025-24305: Insufficient control flow management in the Alias
       Checking Trusted Module (ACTM) firmware for some Intel Xeon
       processors may allow a privileged user to potentially enable
       escalation of privilege via local access.
     - Mitigations for INTEL-SA-01367 (Intel SGX, TDX):
       CVE-2025-26403: Out-of-bounds write in the memory subsystem for some
       Intel Xeon 6 processors when using Intel SGX or Intel TDX may allow
       a privileged user to potentially enable escalation of privilege via
       local access.
       CVE-2025-32086: Improperly implemented security check for standard
       in the DDRIO configuration for some Intel Xeon 6 Processors when
       using Intel SGX or Intel TDX may allow a privileged user to
       potentially enable escalation of privilege via local access.
     - Fixes for unspecified functional issues on several Intel Core and
       Intel Xeon processor models.
   * Updated microcodes:
     sig 0x000606a6, pf_mask 0x87, 2025-03-11, rev 0xd000410, size 309248
     sig 0x000606c1, pf_mask 0x10, 2025-03-06, rev 0x10002e0, size 301056
     sig 0x000806f8, pf_mask 0x87, 2025-04-04, rev 0x2b000643, size 592896
     sig 0x000806f7, pf_mask 0x87, 2025-04-04, rev 0x2b000643
     sig 0x000806f6, pf_mask 0x87, 2025-04-04, rev 0x2b000643
     sig 0x000806f5, pf_mask 0x87, 2025-04-04, rev 0x2b000643
     sig 0x000806f4, pf_mask 0x87, 2025-04-04, rev 0x2b000643
     sig 0x000806f8, pf_mask 0x10, 2025-04-08, rev 0x2c000401, size 625664
     sig 0x000806f6, pf_mask 0x10, 2025-04-08, rev 0x2c000401
     sig 0x000806f5, pf_mask 0x10, 2025-04-08, rev 0x2c000401
     sig 0x000806f4, pf_mask 0x10, 2025-04-08, rev 0x2c000401
     sig 0x000a06a4, pf_mask 0xe6, 2025-03-19, rev 0x0025, size 140288
     sig 0x000a06d1, pf_mask 0x95, 2025-05-15, rev 0x10003d0, size 1667072
     sig 0x000a06d1, pf_mask 0x20, 2025-05-15, rev 0xa000100, size 1638400
     sig 0x000a06f3, pf_mask 0x01, 2025-05-03, rev 0x3000362, size 1530880
     sig 0x000b06a2, pf_mask 0xe0, 2025-02-24, rev 0x4129, size 224256
     sig 0x000b06a3, pf_mask 0xe0, 2025-02-24, rev 0x4129
     sig 0x000b06a8, pf_mask 0xe0, 2025-02-24, rev 0x4129
     sig 0x000b06d1, pf_mask 0x80, 2025-05-21, rev 0x0123, size 80896
     sig 0x000c0662, pf_mask 0x82, 2025-05-14, rev 0x0119, size 90112
     sig 0x000c06a2, pf_mask 0x82, 2025-05-14, rev 0x0119
     sig 0x000c0652, pf_mask 0x82, 2025-05-14, rev 0x0119
     sig 0x000c0664, pf_mask 0x82, 2025-05-14, rev 0x0119
     sig 0x000c06f2, pf_mask 0x87, 2025-04-15, rev 0x210002b3, size 564224
     sig 0x000c06f1, pf_mask 0x87, 2025-04-15, rev 0x210002b3
   * update entry for 3.20250512.1 with new information
   * source: update symlinks to reflect id of the latest release, 20250812
 .
   [ Ben Hutchings ]
   * debian/tests/initramfs: Update to work with forky's initramfs-tools.
     In version 0.149 of initramfs-tools, unmkinitramfs was changed to no
     longer create early/ and main/ subdirectories.  Update the microcode
     file check to work with both old and new behaviours.

iperf3 (3.18-2+deb13u2) trixie; urgency=medium
 .
   * Fix FTBS in trixie with openssl >= 3.5.3 (Closes: #1120866)

kdeconnect (25.04.2-1+deb13u1) trixie-security; urgency=medium
 .
   * Cherrypick 1d757349d0f517ef12c119565ffb1f79503fbcdf

keystone (2:27.0.0-3+deb13u1) trixie-security; urgency=high
 .
   * OSSA-2025-002: kay reported a vulnerability in Keystone’s ec2tokens and
     s3tokens APIs. By sending those endpoints a valid AWS Signature (e.g., from
     a presigned S3 URL), an unauthenticated attacker may obtain Keystone
     authorization (ec2tokens can yield a fully scoped token; s3tokens can
     reveal scope accepted by some services), resulting in unauthorized access
     and privilege escalation. Deployments where /v3/ec2tokens or /v3/s3tokens
     are reachable by unauthenticated clients (e.g., exposed on a public API)
     are affected.
     Applied upstream patch (Closes: #1120053):
     - keystone-bug-2119646-stable-2025.1.patch

kleopatra (4:24.12.3-1+deb13u1) trixie; urgency=medium
 .
   [ Sandro Knauß ]
   * Fix "Fails to start with a file argument on GNOME" by import upstream
     patches. (Closes: #1120106)

krita (1:5.2.9+dfsg-1+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2025-59820

lasso (2.8.2-9+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * tests: test that inserted comment do not change node value and still
     validate signature
   * xml: prevent assignment of attribute value inside any attribute
     (CVE-2025-47151)
   * misc: check xmlSecGetNodeNsHref for possible NULL result (CVE-2025-46404)
   * xml: do not terminate on an unknown XML node type (CVE-2025-46705)

libcoap3 (4.3.4-1.1+deb13u2) trixie; urgency=medium
 .
   * CVE-2025-59391 (Closes: #1122290)
     fix OSCORE configuration file parsing issue
   * CVE-2025-65493 (Closes: 1121415)
     fix NULL pointer dereference
   * CVE-2025-65494
     fix NULL pointer dereference
   * CVE-2025-65495
     fix integer signedness
   * CVE-2025-65496
     fix NULL pointer dereference
   * CVE-2025-65497
     fix NULL pointer dereference
   * CVE-2025-65498
     fix NULL pointer dereference
   * CVE-2025-65499
     fix array index error
   * CVE-2025-65500
     fix NULL pointer dereference
   * CVE-2025-65501
     fix NULL pointer dereference

libcupsfilters (2.0.0-3+deb13u1) trixie; urgency=medium
 .
   * CVE-2025-64503
     fix an out of bounds write vulnerability when processing crafted
     PDF files containing a large 'Mediabox' value.
     (Closes: #1120697)
 .
   * CVE-2025-57812
     fix an out of bounds read/write vulnerability in the processing
     of TIFF image files.
     (Closes: #1120703)

libphp-adodb (5.22.9-0.1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Fix CVE-2025-54119: SQL injection in sqlite3 driver (Closes: #1110464)

libpng1.6 (1.6.48-1+deb13u1) trixie-security; urgency=high
 .
   * Security upload targeting trixie.
   * Backport fixes for:
     - CVE-2025-64505 - Heap buffer over-read (Closes: #1121219)
     - CVE-2025-64506 - Heap buffer over-read (Closes: #1121218)
     - CVE-2025-64720 - Heap buffer overflow (Closes: #1121217)
     - CVE-2025-65018 - Heap buffer overflow (Closes: #1121216)
     - CVE-2025-66293 - Out-of-bounds read (Closes: #1121877)
   * Set gbp.conf for trixie and enable salsa CI

libreoffice (4:25.2.3-2+deb13u3) trixie; urgency=medium
 .
    * debian/patches/add-EUR-for-Bulgaria-Lew.diff: fix typo: s/BLN/BGN/, thanks
      Xisco Fauli
    * debian/patches/default-to-EUR-for-Bulgaria.diff: as name says

libvirt (11.3.0-3+deb13u2) trixie; urgency=medium
 .
   * [c5ef2ce] patches: Add backports
     - backport/conf-Add-virDomainDefIDsParseString[...]
     - backport/bhyve-Check-ACLs-before-parsing-[...]
     - backport/libxl-Check-ACLs-before-parsing-[...]
     - backport/lxc-Check-ACLs-before-parsing-[...]
     - backport/vz-Check-ACLs-before-parsing-[...]
     - backport/ch-Check-ACLs-before-parsing-[...]
     - backport/qemu-Check-ACLs-before-parsing-[...]
       - Perform ACL checks earlier, preventing malicious users
         from potentially being able to crash the daemon
       - CVE-2025-12748
       - Closes: #1120584
   * [9c44722] patches: Add backports
     - backport/qemu-snapshot-Set-umask-for-qemu-img-[...]
       - Ensure that newly-created snapshots are not world-readable
       - CVE-2025-13193
       - Closes: #1120119
   * [74ba3ed] patches: Add backports
     - backport/qemuxmlconftest-Improve-coverage-of-disk-[...]
     - backport/qemu[...]-Setup-detect_zeroes-[...]
       - Apply the detect_zeroes settings across all layers of the
         backing chain instead of just the topmost one
       - Closes: #1121280

linux (6.12.63-1) trixie; urgency=medium
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.58
     - NFSD: Fix crash in nfsd4_read_release()
     - net: usb: asix_devices: Check return value of usbnet_get_endpoints
     - fbcon: Set fb_display[i]->mode to NULL when the mode is released
     - fbdev: atyfb: Check if pll_ops->init_pll failed
     - ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
     - ACPI: button: Call input_free_device() on failing input device
       registration
     - virtio-net: drop the multi-buffer XDP packet in zerocopy
     - fbdev: bitblit: bound-check glyph index in bit_putcs*
     - Bluetooth: rfcomm: fix modem control handling
     - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP
       Mode
     - mptcp: drop bogus optimization in __mptcp_check_push()
     - mptcp: restore window probe
     - [arm64] ASoC: qdsp6: q6asm: do not sleep while atomic
     - [s390x] pci: Restore IRQ unconditionally for the zPCI device
     - smb: client: fix potential cfid UAF in smb2_query_info_compound
     - [amd64] x86/fpu: Ensure XFD state on signal delivery
     - wifi: ath10k: Fix memory leak on unsupported WMI command
     - wifi: ath11k: Add missing platform IDs for quirk table
     - wifi: ath12k: free skb during idr cleanup callback
     - wifi: ath11k: add support for MU EDCA
     - wifi: ath11k: avoid bit operation on key flags
     - [arm64] drm/msm/a6xx: Fix GMU firmware parser
     - ALSA: usb-audio: fix control pipe direction
     - wifi: mac80211: don't mark keys for inactive links as uploaded
     - wifi: mac80211: fix key tailroom accounting leak
     - bpf: Sync pending IRQ work before freeing ring buffer
     - scsi: ufs: core: Initialize value of an attribute returned by uic cmd
     - bpf: Find eligible subprogs for private stack support
     - bpf, x86: Avoid repeated usage of bpf_prog->aux->stack_depth
     - bpf: Do not audit capability check in do_jit()
     - [amd64] ASoC: Intel: avs: Unprepare a stream when XRUN occurs
     - [amd64] ASoC: Intel: avs: Disable periods-elapsed work when closing PCM
     - [arm64,armhf] ASoC: fsl_sai: fix bit order for DSD format
     - libbpf: Fix powerpc's stack register definition in bpf_tracing.h
     - usbnet: Prevents free active kevent
     - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
     - Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave
     - Bluetooth: ISO: Fix BIS connection dst_type handling
     - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset
     - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00
     - Bluetooth: ISO: Fix another instance of dst_type handling
     - Bluetooth: hci_core: Fix tracking of periodic advertisement
     - [arm64,armhf] drm/etnaviv: fix flush sequence logic
     - [arm64] net: hns3: return error code when function fails
     - sfc: fix potential memory leak in efx_mae_process_mport()
     - dpll: spec: add missing module-name and clock-id to pin-get reply
     - [arm64,armhf] ASoC: fsl_sai: Fix sync error in consumer mode
     - drm/radeon: Do not kfree() devres managed rdev
     - drm/radeon: Remove calls to drm_put_dev()
     - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table()
     - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji
     - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland
     - ACPI: fan: Use ACPI handle when retrieving _FST
     - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL
     - block: make REQ_OP_ZONE_OPEN a write operation
     - regmap: slimbus: fix bus_context pointer in regmap init calls
     - [s390x] mm: Fix memory leak in add_marker() when kvrealloc() fails
     - drm/xe: Do not wake device during a GT reset
     - drm/sysfb: Do not dereference NULL pointer in plane reset
     - drm/sched: avoid killing parent entity on child SIGKILL
     - drm/nouveau: Fix race in nouveau_sched_fini()
     - [arm64] drm/mediatek: Fix device use-after-free on unbind
     - drm/amd: Check that VPE has reached DPM0 in idle handler
     - drm/amd/display: Fix incorrect return of vblank enable on unconfigured
       crtc (Closes: #1000966)
     - ACPI: fan: Add fan speed reporting for fans with only _FST
     - ACPI: fan: Use platform device for devres-related actions
     - sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU
     - cpuidle: governors: menu: Rearrange main loop in menu_select()
     - cpuidle: governors: menu: Select polling state in some more cases
     - [amd64] mfd: kempld: Switch back to earlier ->init() behavior
     - [amd64] x86/CPU/AMD: Add RDSEED fix for Zen5
     - usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
     - drm/sched: Optimise drm_sched_entity_push_job
     - drm/sched: Re-group and rename the entity run-queue lock
     - drm/sched: Fix race in drm_sched_entity_select_rq()
     - [s390x] pci: Avoid deadlock between PCI error recovery and mlx5 crdump
     - [s390x] Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP
     - [armhf] soc: aspeed: socinfo: Add AST27xx silicon IDs
     - [arm64] firmware: qcom: scm: preserve assign_mem() error return value
     - [arm64] soc: qcom: smem: Fix endian-unaware access of num_entries
     - [arm64] soc: ti: pruss: don't use %pK through printk
     - bpf: Don't use %pK through printk
     - pinctrl: single: fix bias pull up/down handling in pin_config_set
     - [arm64] mmc: host: renesas_sdhi: Fix the actual clock
     - memstick: Add timeout to prevent indefinite waiting
     - [arm64,armhf] cpufreq: ti: Add support for AM62D2
     - bpf: Use tnums for JEQ/JNE is_branch_taken logic
     - firewire: ohci: move self_id_complete tracepoint after validating register
     - [riscv64] irqchip/sifive-plic: Respect mask state when setting affinity
     - io_uring/zctx: check chained notif contexts
     - ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object
     - ACPI: video: force native for Lenovo 82K8
     - libbpf: Fix USDT SIB argument handling causing unrecognized register error
     - cpufreq/longhaul: handle NULL policy in longhaul_exit
     - [arm64,armhf] irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
     - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
     - ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU
     - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
     - thermal: gov_step_wise: Allow cooling level to be reduced earlier
     - power: supply: qcom_battmgr: add OOI chemistry
     - [amd64] hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based
       models
     - [amd64] hwmon: (k10temp) Add device ID for Strix Halo
     - power: supply: sbs-charger: Support multiple devices
     - cpufreq: ondemand: Update the efficient idle check for Intel extended
       Families
     - [arm64,armhf] soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
     - [arm64] firmware: qcom: tzmem: disable sc7180 platform
     - [arm64] mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
     - pwm: pca9685: Use bulk write to atomicially update registers
     - ACPICA: dispatcher: Use acpi_ds_clear_operands() in
       acpi_ds_call_control_method()
     - [amd64,arm64] tee: allow a driver to allocate a tee_device without a pool
     - nvmet-fc: avoid scheduling association deletion twice
     - nvme-fc: use lock accessing port_state and rport state
     - bpf: Do not limit bpf_cgroup_from_id to current's namespace
     - i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C
     - video: backlight: lp855x_bl: Set correct EPROM start for LP8556
     - tools/cpupower: fix error return value in cpupower_write_sysfs()
     - power: supply: qcom_battmgr: handle charging state change notifications
     - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21
     - cpuidle: Fail cpuidle device registration if there is one already
     - futex: Don't leak robust_list pointer on exec race
     - ACPI: SPCR: Support Precise Baud Rate field
     - blk-cgroup: fix possible deadlock while configuring policy
     - [riscv64] bpf: Fix uninitialized symbol 'retval_off'
     - bpf: Clear pfmemalloc flag when freeing all fragments
     - nvme: Use non zero KATO for persistent discovery connections
     - uprobe: Do not emulate/sstep original instruction when ip is changed
     - [amd64] hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex
     - [amd64] hwmon: (dell-smm) Remove Dell Precision 490 custom config data
     - tools/cpupower: Fix incorrect size in cpuidle_state_disable()
     - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
     - tools/power x86_energy_perf_policy: Enhance HWP enable
     - tools/power x86_energy_perf_policy: Prefer driver HWP limits
     - [armhf] mfd: stmpe: Remove IRQ domain upon removal
     - [armhf] mfd: stmpe-i2c: Add missing MODULE_LICENSE
     - [riscv64] mfd: da9063: Split chip variant reading in two bus transactions
     - mfd: core: Increment of_node's refcount before linking it to the platform
       device
     - [amd64] mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs
     - drm/amd/display: fix condition for setting timing_adjust_pending
     - drm/amd/display: ensure committing streams is seamless
     - drm/amdgpu: add range check for RAS bad page address
     - drm/amdgpu: Check vcn sram load return value
     - drm/amd/display: Move setup_stream_attribute
     - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration
     - drm/xe/guc: Add more GuC load error status codes
     - drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.
     - drm/amdgpu: Avoid rma causes GPU duplicate reset
     - drm/amd/amdgpu: Release xcp drm memory after unplug
     - drm/amdgpu: Skip poison aca bank from UE channel
     - drm/amd/display: add more cyan skillfish devices
     - drm/amd/display: update dpp/disp clock from smu clock table
     - drm/amd/pm: Use cached metrics data on aldebaran
     - drm/amd/pm: Use cached metrics data on arcturus
     - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
     - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
     - [arm64] ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks
     - drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off
     - drm/amd/display: Wait until OTG enable state is cleared
     - PCI: Disable MSI on RDC PCI to PCIe bridges
     - wifi: rtw89: print just once for unknown C2H events
     - wifi: rtw88: sdio: use indirect IO for device registers before power-on
     - drm/amdkfd: return -ENOTTY for unsupported IOCTLs
     - media: pci: ivtv: Don't create fake v4l2_fh
     - [arm64] drm/tidss: Use the crtc_* timings when programming the HW
     - [arm64] drm/tidss: Set crtc modesetting parameters with adjusted mode
     - PCI/ERR: Update device error_state already after reset
     - [amd64] x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
     - net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
     - ice: Don't use %pK through printk or tracepoints
     - thunderbolt: Use is_pciehp instead of is_hotplug_bridge
     - tty: serial: ip22zilog: Use platform device for probing
     - [powerpc*] eeh: Use result of error_detected() in uevent
     - [s390x] pci: Use pci_uevent_ers() in PCI recovery
     - bridge: Redirect to backup port when port is administratively down
     - net: ipv6: fix field-spanning memcpy warning in AH output
     - media: imon: make send_packet() more robust
     - [arm64] drm/panthor: Serialize GPU cache flush operations
     - HID: pidff: Use direction fix only for conditional effects
     - HID: pidff: PERMISSIVE_CONTROL quirk autodetection
     - [arm64,armhf] drm/bridge: display-connector: don't set OP_DETECT for
       DisplayPorts
     - drm/amdgpu: fix nullptr err of vm_handle_moved
     - drm/amdkfd: Handle lack of READ permissions in SVM mapping
     - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before
       setting register
     - iio: adc: imx93_adc: load calibrated values even calibration failed
     - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
     - wifi: rtw89: wow: remove notify during WoWLAN net-detect
     - wifi: rtw89: fix BSSID comparison for non-transmitted BSSID
     - dm error: mark as DM_TARGET_PASSES_INTEGRITY
     - char: misc: Make misc_register() reentry for miscdevice who wants dynamic
       minor
     - char: misc: Does not request module for miscdevice with dynamic minor
     - net: When removing nexthops, don't call synchronize_net if it is not
       necessary
     - net: stmmac: Correctly handle Rx checksum offload errors
     - net: Call trace_sock_exceed_buf_limit() for memcg failure with
       SK_MEM_RECV.
     - f2fs: fix to detect potential corrupted nid in free_nid_list
     - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
     - bnxt_en: Add Hyper-V VF ID
     - tty: serial: Modify the use of dev_err_probe()
     - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
     - [amd64,arm64] idpf: do not linearize big TSO packets
     - rds: Fix endianness annotation for RDS_MPATH_HASH
     - media: ipu6: isys: Set embedded data type correctly for metadata formats
     - rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table
     - net: ipv4: allow directed broadcast routes to use dst hint
     - scsi: mpi3mr: Fix I/O failures during controller reset
     - scsi: mpi3mr: Fix controller init failure on fault during queue creation
     - scsi: pm80xx: Fix race condition caused by static variables
     - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper
     - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device
     - fuse: zero initialize inode private data
     - drm/amdgpu: Correct the counts of nr_banks and nr_errors
     - drm/amdkfd: fix vram allocation failure for a special case
     - drm/amd/display: Support HW cursor 180 rot for any number of pipe splits
     - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
     - [amd64] platform/x86/intel-uncore-freq: Fix warning in partitioned system
     - media: fix uninitialized symbol warnings
     - media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS
     - [amd64] ASoC: SOF: ipc4-pcm: Add fixup for channels
     - drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting
     - drm/amd/display: incorrect conditions for failing dto calculations
     - drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest
     - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2)
     - inet_diag: annotate data-races in inet_diag_bc_sk()
     - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()
     - [amd64] crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof()
     - scsi: pm8001: Use int instead of u32 to store error codes
     - [arm64] scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset
       on suspend
     - ptp: Limit time setting of PTP clocks
     - dmaengine: sh: setup_xref error handling
     - [arm64,armhf] dmaengine: mv_xor: match alloc_wc and free_wc
     - [arm64] drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL
     - [arm64] drm/msm/dsi/phy_7nm: Fix missing initial VCO rate
     - drm/amdgpu: Allow kfd CRIU with no buffer objects
     - drm/xe/guc: Increase GuC crash dump buffer size
     - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
     - [arm64] drm/panthor: check bo offset alignment in vm bind
     - drm: panel-backlight-quirks: Make EDID match optional
     - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
     - media: adv7180: Add missing lock in suspend callback
     - media: adv7180: Do not write format to device in set_fmt
     - media: adv7180: Only validate format in querystd
     - [arm64,armhf] media: verisilicon: Explicitly disable selection api ioctls
       for decoders
     - wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower
       bands
     - ALSA: usb-audio: apply quirk for MOONDROP Quark2
     - [arm64,armhf] PCI: imx6: Enable the Vaux supply if available
     - drm/xe/guc: Set upper limit of H2G retries over CTB
     - net: call cond_resched() less often in __release_sock()
     - smsc911x: add second read of EEPROM mac when possible corruption seen
     - [amd64] iommu/amd: Skip enabling command/event buffers for kdump
     - [amd64] crypto: ccp: Skip SEV and SNP INIT for kdump boot
     - drm/amd: add more cyan skillfish PCI ids
     - drm/amdgpu: don't enable SMU on cyan skillfish
     - drm/amdgpu: add support for cyan skillfish gpu_info
     - drm/amd/display: Fix pbn_div Calculation Error
     - [arm64] net: dsa: felix: support phy-mode = "10g-qxgmii"
     - usb: gadget: f_hid: Fix zero length packet transfer
     - usb: cdns3: gadget: Use-after-free during failed initialization and exit
       of cdnsp gadget
     - tty/vt: Add missing return value for VT_RESIZE in vt_ioctl()
     - [arm64] drm/msm: make sure to not queue up recovery more than once
     - char: Use list_del_init() in misc_deregister() to reinitialize list
       pointer
     - PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs
     - wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list
     - [amd64] media: ov08x40: Fix the horizontal flip control
     - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer
     - f2fs: fix wrong layout information on 16KB page
     - net: phy: marvell: Fix 88e1510 downshift counter errata
     - ntfs3: pretend $Extend records as regular files
     - wifi: mac80211: Fix HE capabilities element check
     - [arm64] phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf
       register 0
     - [arm64] drm/msm/registers: Generate _HI/LO builders for reg64
     - net: sh_eth: Disable WoL if system can not suspend
     - netfilter: nf_reject: don't reply to icmp error messages
     - [amd64] x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective
       of PV_UNHALT
     - net: devmem: expose tcp_recvmsg_locked errors
     - udp_tunnel: use netdev_warn() instead of netdev_WARN()
     - HID: asus: add Z13 folio to generic group for multitouch to work
     - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger
     - [arm64] crypto: sun8i-ce - remove channel timeout field
     - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify()
     - [amd64] crypto: ccp - Fix incorrect payload size calculation in
       psp_poulate_hsti()
     - [arm64,armhf] crypto: caam - double the entropy delay interval for retry
     - net/cls_cgroup: Fix task_get_classid() during qdisc run
     - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device
     - wifi: mt76: mt7996: Temporarily disable EPCS
     - wifi: mt76: mt76_eeprom_override to int
     - ALSA: serial-generic: remove shared static buffer
     - wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error
     - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl
     - drm/amd/display: Set up pixel encoding for YCBCR422
     - drm/amd/display: fix dml ms order of operations
     - drm/amd: Avoid evicting resources at S5
     - drm/amd/display: Fix DVI-D/HDMI adapters
     - drm/amd/display: Disable VRR on DCE 6
     - drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with
       DC_FP_START
     - page_pool: always add GFP_NOWARN for ATOMIC allocations
     - ethernet: Extend device_get_mac_address() to use NVMEM
     - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4
     - drm/xe/guc: Return an error code if the GuC load fails
     - drm/amdgpu: reject gang submissions under SRIOV
     - scsi: ufs: core: Disable timestamp functionality if not supported
     - scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail
     - scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted
     - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during
       TGT_RESET
     - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in
       lpfc_cleanup
     - scsi: lpfc: Define size of debugfs entry for xri rebalancing
     - scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point
       topology
     - allow finish_no_open(file, ERR_PTR(-E...))
     - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
     - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
     - f2fs: fix infinite loop in __insert_extent_tree()
     - wifi: rtw89: obtain RX path from ppdu status IE00
     - wifi: rtw89: renew a completion for each H2C command waiting C2H event
     - usb: xhci-pci: add support for hosts with zero USB3 ports
     - ipv6: np->rxpmtu race annotation
     - RDMA/irdma: Update Kconfig
     - IB/ipoib: Ignore L3 master device
     - jfs: Verify inode mode when loading from disk
     - jfs: fix uninitialized waitqueue in transaction manager
     - drm/amdgpu/atom: Check kcalloc() for WS buffer in
       amdgpu_atom_execute_table_locked()
     - [arm64] ASoC: qcom: sc8280xp: explicitly set S16LE format in
       sc8280xp_be_hw_params_fixup()
     - net: phy: clear link parameters on admin link down
     - bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state
     - [amd64] iommu/vt-d: Replace snprintf with scnprintf in
       dmar_latency_snapshot()
     - wifi: ath10k: Fix connection after GTK rekeying
     - wifi: mac80211: Track NAN interface start/stop
     - net: intel: fm10k: Fix parameter idx set but not used
     - r8169: set EEE speed down ratio to 1
     - vfio: return -ENOTTY for unsupported device feature
     - PCI/PM: Skip resuming to D0 if device is disconnected
     - remoteproc: qcom: q6v5: Avoid handling handover twice
     - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256
     - [armhf] net: dsa: microchip: Set SPI as bus interface during reset for
       KSZ8463
     - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream
     - drm/amd/display: Init dispclk from bootup clock for DCN314
     - drm/amd/display: Fix for test crash due to power gating
     - drm/amd/display: change dc stream color settings only in atomic commit
     - NFSv4: handle ERR_GRACE on delegation recalls
     - NFSv4.1: fix mount hang after CREATE_SESSION failure
     - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode
       dereferencing
     - net: bridge: Install FDB for bridge MAC on VLAN 0
     - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill()
     - [amd64] accel/habanalabs/gaudi2: fix BMON disable configuration
     - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate
     - [amd64] accel/habanalabs: return ENOMEM if less than requested pages were
       pinned
     - [amd64] accel/habanalabs/gaudi2: read preboot status after recovering from
       dirty state
     - [amd64] accel/habanalabs: support mapping cb with vmalloc-backed coherent
       memory
     - fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock
     - ext4: increase IO priority of fastcommit
     - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw
     - [armhf] ASoC: stm32: sai: manage context in set_sysclk callback
     - [armhf] ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007
     - ACPI: scan: Update honor list for RPMI System MSI
     - vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices
     - net/mlx5e: Don't query FEC statistics when FEC is disabled
     - net: macb: avoid dealing with endianness in macb_set_hwaddr()
     - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames
     - Bluetooth: SCO: Fix UAF on sco_conn_free
     - Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922
     - Bluetooth: bcsp: receive data only if registered
     - ALSA: usb-audio: add mono main switch to Presonus S1824c
     - net: stmmac: est: Drop frames causing HLBS error
     - exfat: limit log print for IO error
     - exfat: validate cluster allocation bits of the allocation bitmap
     - 6pack: drop redundant locking and refcounting
     - page_pool: Clamp pool size to max 16K pages
     - orangefs: fix xattr related buffer overflow...
     - ftrace: Fix softlockup in ftrace_module_enable
     - ksmbd: use sock_create_kern interface to create kernel socket
     - smb: client: transport: avoid reconnects triggered by pending task work
     - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr
     - usb: xhci-pci: Fix USB2-only root hub registration
     - char: misc: restrict the dynamic range to exclude reserved minors
     - drm/amd/display: Add fallback path for YCBCR422
     - ACPICA: Update dsmethod.c to get rid of unused variable warning
     - RDMA/irdma: Fix SD index calculation
     - RDMA/irdma: Remove unused struct irdma_cq fields
     - RDMA/irdma: Set irdma_cq cq_num field during CQ create
     - [arm64] RDMA/hns: Fix recv CQ and QP cache affinity
     - [arm64] RDMA/hns: Fix the modification of max_send_sge
     - [arm64] RDMA/hns: Fix wrong WQE data when QP wraps around
     - btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation
     - btrfs: mark dirty extent range for out of bound prealloc extents
     - fs/hpfs: Fix error code for new_inode() failure in
       mkdir/create/mknod/symlink
     - clk: sunxi-ng: sun6i-rtc: Add A523 specifics
     - [arm64] rtc: pcf2127: clear minute/second interrupt
     - 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN
     - [armhf] clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled
     - [arm64] clk: scmi: Add duty cycle ops only when duty cycle is supported
     - 9p: fix /sys/fs/9p/caches overwriting itself
     - 9p: sysfs_init: don't hardcode error to ENOMEM
     - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS
     - ACPI: property: Return present device nodes only on fwnode interface
     - tools bitmap: Add missing asm-generic/bitsperlong.h include
     - tools: lib: thermal: don't preserve owner in install
     - tools: lib: thermal: use pkg-config to locate libnl3
     - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
     - [arm64] rtc: pcf2127: fix watchdog interrupt mask on pcf2131
     - net: wwan: t7xx: add support for HP DRMR-H01
     - kbuild: uapi: Strip comments before size type check
     - [arm64,armhf] ASoC: meson: aiu-encoder-i2s: fix bit clock polarity
     - drm/amdkfd: Fix mmap write lock not release
     - ceph: add checking of wait_for_completion_killable() return value
     - ceph: fix potential race condition in ceph_ioctl_lazyio()
     - ceph: refactor wake_up_bit() pattern of calling
     - ceph: fix multifs mds auth caps issue
     - [amd64] x86: use cmov for user address masking
     - [amd64] x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro
     - [amd64] x86: uaccess: don't use runtime-const rewriting in modules
     - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again
     - btrfs: ensure no dirty metadata is written back for an fs with errors
     - media: uvcvideo: Use heuristic to find stream entity
     - media: videobuf2: forbid remove_bufs when legacy fileio is active
     - [arm64] drm/mediatek: Disable AFBC support on Mediatek DRM driver
     - Revert "wifi: ath10k: avoid unnecessary wait for service ready message"
       (Closes: #1120680)
     - ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader
       catches up
     - [riscv64] ptdump: use seq_puts() in pt_dump_seq_puts() macro
     - Bluetooth: hci_event: validate skb length for unknown CC opcode
     - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2()
     - [armhf] net: dsa: tag_brcm: legacy: reorganize functions
     - [armhf] net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for
       bcm63xx
     - net: vlan: sync VLAN features with lower device
     - gpio: swnode: don't use the swnode's name as the key for GPIO lookup
     - gpiolib: fix invalid pointer access in debugfs
     - [armhf] net: dsa: b53: fix resetting speed and pause on forced link
     - [armhf] net: dsa: b53: fix bcm63xx RGMII port link adjustment
     - [armhf] net: dsa: b53: fix enabling ip multicast
     - [armhf] net: dsa: b53: stop reading ARL entries if search is done
     - sctp: Hold RCU read lock while iterating over address list
     - sctp: Prevent TOCTOU out-of-bounds write
     - sctp: Hold sock lock while iterating over address list
     - net: ionic: add dma_wmb() before ringing TX doorbell
     - net: ionic: map SKB after pseudo-header checksum prep
     - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
     - bnxt_en: Fix a possible memory leak in bnxt_ptp_init
     - bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type
     - bnxt_en: Refactor bnxt_free_ctx_mem()
     - bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem()
     - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup
     - net/mlx5e: Fix return value in case of module EEPROM read error
     - [arm64] net: ti: icssg-prueth: Fix fdb hash size configuration
     - net/mlx5e: SHAMPO, Fix skb size check for 64K pages
     - [armhf] net: dsa: microchip: Fix reserved multicast address table
       programming
     - net: bridge: fix use-after-free due to MST port state bypass
     - net: bridge: fix MST static key usage
     - tracing: Fix memory leaks in create_field_var()
     - drm/amd/display: Enable mst when it's detected but yet to be initialized
     - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb
     - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()
     - [arm64] rtc: rx8025: fix incorrect register reference
     - [amd64] x86/microcode/AMD: Add more known models to entry sign checking
     - smb: client: validate change notify buffer before copy
     - smb: client: fix potential UAF in smb2_close_cached_fid()
     - drm/amdgpu/smu: Handle S0ix for vangogh
     - drm/amd/display: Fix NULL deref in debugfs odm_combine_segments
     - virtio-net: fix received length check in big packets
     - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC
     - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers
     - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel
       ADL
     - scsi: ufs: core: Add a quirk to suppress link_startup_again
     - drm/amd/display: update color on atomic commit time
     - ACPI: SPCR: Check for table version when using precise baudrate
     - drm/amdgpu: Fix unintended error log in VCN5_0_0
     - drm/amdgpu: Fix function header names in amdgpu_connectors.c
     - drm/amd/display: Fix black screen with HDMI outputs
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.59
     - [arm64] drm/mediatek: Add pm_runtime support for GCE power control
     - [amd64] drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD
     - [amd64] drm/i915: Fix conversion between clock ticks and nanoseconds
     - smb: client: fix refcount leak in smb2_set_path_attr
     - drm/amd: Fix suspend failure with secure display TA
     - drm/xe/guc: Synchronize Dead CT worker with unbind
     - drm/xe: Move declarations under conditional branch
     - drm/xe: Do clean shutdown also when using flr
     - [arm64] kprobes: check the return value of set_memory_rox()
     - [riscv64] clear hot-unplugged cores from all task mm_cpumasks to avoid
       rfence errors
     - [riscv64] acpi: avoid errors caused by probing DT devices when ACPI is
       used
     - drm/amdgpu: remove two invalid BUG_ON()s
     - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks
     - drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM
     - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices
     - NFS4: Fix state renewals missing after boot
     - NFS4: Apply delay_retrans to async operations
     - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
     - HID: nintendo: Wait longer for initial probe
     - NFS: check if suid/sgid was cleared after a write as needed
     - HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel
     - exfat: fix improper check of dentry.stream.valid_size
     - smb/server: fix possible memory leak in smb2_read()
     - smb/server: fix possible refcount leak in smb2_sess_setup()
     - HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL
     - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
     - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp()
     - erofs: avoid infinite loop due to incomplete zstd-compressed data
     - [arm64,armhf] net: fec: correct rx_bytes statistic for the case SHIFT16 is
       set
     - net: phy: micrel: Introduce lanphy_modify_page_reg
     - net: phy: micrel: Replace hardcoded pages with defines
     - net: phy: micrel: lan8814 fix reset of the QSGMII interface
     - NFSD: Skip close replay processing if XDR encoding fails
     - Bluetooth: MGMT: cancel mesh send timer when hdev removed
     - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
     - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
     - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
     - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
     - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
     - net/smc: fix mismatch between CLC header and proposal
     - net/handshake: Fix memory leak in tls_handshake_accept()
     - tipc: Fix use-after-free in tipc_mon_reinit_self().
     - net: mdio: fix resource leak in mdiobus_register_device()
     - wifi: mac80211: skip rate verification for not captured PSDUs
     - af_unix: Initialise scc_index in unix_add_edge().
     - net_sched: act_connmark: use RCU in tcf_connmark_dump()
     - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak
     - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
     - net/mlx5e: Fix maxrate wraparound in threshold between units
     - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
     - net/mlx5e: Fix potentially misleading debug message
     - net_sched: limit try_bulk_dequeue_skb() batches
     - virtio-net: fix incorrect flags recording in big mode
     - hsr: Fix supervision frame sending on HSRv0
     - [amd64] ACPI: CPPC: Detect preferred core availability on online CPUs
     - [amd64] ACPI: CPPC: Check _CPC validity for only the online CPUs
     - [amd64] ACPI: CPPC: Perform fast check switch only for online CPUs
     - [amd64] ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs
     - Bluetooth: L2CAP: export l2cap_chan_hold for modules
     - acpi,srat: Fix incorrect device handle check for Generic Initiator
     - regulator: fixed: fix GPIO descriptor leak on register failure
     - [arm64] ASoC: codecs: va-macro: fix resource leak in probe error path
     - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
     - ASoC: tas2781: fix getting the wrong device number
     - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect()
     - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS
     - simplify nfs_atomic_open_v23()
     - NFSv2/v3: Fix error handling in nfs_atomic_open_v23()
     - NFS: sysfs: fix leak when nfs_client kobject add fails
     - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync()
     - NFS: Fix LTP test failures when timestamps are delegated
     - ALSA: usb-audio: Fix NULL pointer dereference in
       snd_usb_mixer_controls_badd
     - acpi/hmat: Fix lockdep warning for hmem_register_resource()
     - bpf: Add bpf_prog_run_data_pointers()
     - bpf: account for current allocated stack depth in
       widen_imprecise_scalars()
     - [riscv64] irqchip/riscv-intc: Add missing free() callback in
       riscv_intc_domain_ops
     - wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in
       error path
     - proc: fix the issue of proc_mem_open returning NULL
     - ext4: introduce ITAIL helper
     - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()
       (CVE-2025-22121)
     - Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)
     - f2fs: fix to avoid overflow while left shift operation (CVE-2025-40077)
     - hostfs: Fix only passing host root in boot stage with new mount
     - virtio-fs: fix incorrect check for fsvq->kobj
     - fs/namespace: correctly handle errors returned by grab_requested_mnt_ns
     - sched_ext: Fix unsafe locking in the scx_dump_state()
     - Revert "netfilter: nf_tables: Reintroduce shortened deletion
       notifications"
     - netfilter: nf_tables: reject duplicate device on updates (CVE-2025-38678)
     - [arm64] dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1
     - [arm64] dts: rockchip: Make RK3588 GPU OPP table naming less generic
     - [armhf] dts: imx51-zii-rdu1: Fix audmux node names
     - HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
     - HID: playstation: Fix memory leak in dualshock4_get_calibration_data()
     - HID: uclogic: Fix potential memory leak in error path
     - [amd64] KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated
     - nfsd: fix refcount leak in nfsd_set_fh_dentry() (CVE-2025-40212)
     - nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes
     - NFSD: free copynotify stateid in nfs4_free_ol_stateid()
     - ksmbd: close accepted socket when per-IP limit rejects connection
     - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
     - strparser: Fix signed/unsigned mismatch bug
     - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent
     - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
     - nilfs2: avoid having an active sc_timer before freeing sci
     - wifi: mac80211: reject address change while connecting
     - fs/proc: fix uaf in proc_readdir_de()
     - mm/mm_init: fix hash table order logging in alloc_large_system_hash()
     - mm/shmem: fix THP allocation and fallback loop
     - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4
     - mmc: dw_mmc-rockchip: Fix wrong internal phase calculate
     - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer
     - cifs: client: fix memory leak in smb3_fs_context_parse_param
     - codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for
       slabobj_ext
     - crash: fix crashkernel resource shrink
     - smb: client: fix cifs_pick_channel when channel needs reconnect
     - spi: Try to get ACPI GPIO IRQ earlier
     - [amd64] x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev
     - ftrace: Fix BPF fexit with livepatch
     - PM: hibernate: Emit an error when image writing fails
     - PM: hibernate: Use atomic64_t for compressed_size variable
     - btrfs: zoned: fix conventional zone capacity calculation
     - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe()
     - btrfs: do not update last_log_commit when logging inode due to a new name
     - btrfs: release root after error in data_reloc_print_warning_inode()
     - drm/amdkfd: relax checks for over allocation of save area
     - drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces
     - [arm64] pmdomain: arm: scmi: Fix genpd leak on provider registration
       failure
     - [armhf] pmdomain: imx: Fix reference count leak in imx_gpc_remove
     - [arm64,armhf] pmdomain: samsung: plug potential memleak during probe
     - mptcp: fix MSG_PEEK stream corruption
     - wifi: cfg80211: add an hrtimer based delayed work item
     - wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work
     - mm, percpu: do not consider sleepable allocations atomic
     - [amd64] KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn()
     - [amd64] KVM: guest_memfd: Remove RCU-protected attribute from
       slot->gmem.file
     - [amd64] KVM: guest_memfd: Remove bindings on memslot deletion when gmem is
       dying
     - net: netpoll: Individualize the skb pool
     - net: netpoll: flush skb pool during cleanup
     - net: netpoll: fix incorrect refcount handling causing incorrect cleanup
     - [amd64] KVM: VMX: Split out guts of EPT violation to common/exposed
       function
     - [amd64] KVM: VMX: Fix check for valid GVA on an EPT violation
     - ALSA: hda: Fix missing pointer check in hda_component_manager_init
       function (CVE-2025-40097)
     - io_uring/napi: fix io_napi_entry RCU accesses
     - uio_hv_generic: Set event for all channels on the device
       (Closes: #1120602)
     - mm/memory: do not populate page table entries beyond i_size
     - mm/truncate: unmap large folio on split failure
     - mm/secretmem: fix use-after-free race in fault handler
     - mm/huge_memory: do not change split_huge_page*() target order silently
     - mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to >0 order
     - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
     - net: phy: micrel: Fix lan8814_config_init
     - net: netpoll: ensure skb_pool list is always initialized
     - proc: proc_maps_open allow proc_mem_open to return NULL
     - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete
       (CVE-2025-40213)
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.60
     - [arm64] KVM: arm64: Check the untrusted offset in FF-A memory share
     - timers: Fix NULL function pointer race in timer_shutdown_sync()
     - HID: amd_sfh: Stop sensor before starting
     - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155
       (Closes: #1114557)
     - [arm64] dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5
     - mtdchar: fix integer overflow in read/write ioctls
     - isofs: check the return value of sb_min_blocksize() in isofs_fill_super
     - shmem: fix tmpfs reconfiguration (remount) when noswap is set
     - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector
     - mptcp: Disallow MPTCP subflows from sockmap
     - mptcp: Fix proto fallback detection with BPF
     - ata: libata-scsi: Fix system suspend for a security locked drive
     - smb: client: introduce close_cached_dir_locked()
     - ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan()
     - be2net: pass wrb_params in case of OS2BMC
     - [armhf] net: dsa: microchip: lan937x: Fix RGMII delay tuning
     - [arm64,armhf] Revert "drm/tegra: dsi: Clear enable register if powered by
       bootloader"
     - Input: cros_ec_keyb - fix an invalid memory access
     - Input: goodix - add support for ACPI ID GDIX1003
     - Input: pegasus-notetaker - fix potential out-of-bounds access
     - mm/mempool: fix poisoning order>0 pages with HIGHMEM
     - nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot
     - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl()
     - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
     - scsi: sg: Do not sleep in atomic context
     - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
     - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups
     - mptcp: fix race condition in mptcp_schedule_work()
     - mptcp: fix ack generation for fallback msk
     - mptcp: fix duplicate reset on fastclose
     - mptcp: fix premature close in case of fallback
     - mptcp: avoid unneeded subflow-level drops
     - mptcp: decouple mptcp fastclose from tcp close
     - mptcp: do not fallback when OoO is present
     - [arm64,armhf] drm/tegra: dc: Fix reference leak in tegra_dc_couple()
     - drm/radeon: delete radeon_fence_process in is_signaled, no deadlock
     - drm/amd: Skip power ungate during suspend for VPE
     - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled
     - drm/amd/display: Increase DPCD read retries
     - drm/amd/display: Move sleep into each retry for retrieve_link_cap()
     - drm/amd/display: Fix pbn to kbps Conversion
     - drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5
     - xfrm: drop SA reference in xfrm_state_update if dir doesn't match
     - xfrm: set err and extack on failure to create pcpu SA
     - xfrm: Determine inner GSO type from packet inner protocol
     - xfrm: Prevent locally generated packets from direct output in tunnel mode
     - [amd64] pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe()
     - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()
     - [arm64,armhf] drm/tegra: Add call to put_pid()
     - net: mlxsw: linecards: fix missing error check in
       mlxsw_linecard_devlink_info_get()
     - net: openvswitch: remove never-working support for setting nsh fields
     - nvme-multipath: fix lockdep WARN due to partition scan work
     - [s390x] ctcm: Fix double-kfree
     - [amd64] platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes
       to errnos
     - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and
       qede_tpa_end()
     - [amd64,arm64] idpf: fix possible vport_config NULL pointer deref in remove
     - ice: fix PTP cleanup on driver removal in error path
     - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
     - net/mlx5: Clean up only new IRQ glue on request_irq() failure
     - af_unix: Cache state->msg in unix_stream_read_generic().
     - af_unix: Read sk_peek_offset() again after sleeping in
       unix_stream_read_generic().
     - cifs: fix memory leak in smb3_fs_context_parse_param error path
     - vsock: Ignore signal/timeout on connect() if already established
     - bcma: don't register devices disabled in OF
     - cifs: fix typo in enable_gcm_256 module parameter
     - scsi: core: Fix a regression triggered by scsi_host_busy()
     - [amd64] x86/microcode/AMD: Limit Entrysign signature checking to known
       generations
     - net: tls: Change async resync helpers argument
     - blk-crypto: use BLK_STS_INVAL for alignment errors
     - net: tls: Cancel RX async resync request on rcd_delta overflow
     - ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check
     - [arm64] KVM: arm64: Make all 32bit ID registers fully writable
     - drm/xe: Prevent BIT() overflow when handling invalid prefetch region
     - [s390x] mm: Fix __ptep_rdp() inline assembly
     - ALSA: usb-audio: fix uac2 clock source at terminal parser
     - tracing/tools: Fix incorrcet short option in usage text for --threads
     - drm/amdgpu: fix gpu page fault after hibernation on PF passthrough
     - smb: client: fix incomplete backport in cfids_invalidation_worker()
     - tty/vt: fix up incorrect backport to stable releases
     - maple_tree: fix tracepoint string pointers
     - [amd64] drm/i915/dp_mst: Disable Panel Replay
     - mptcp: fix a race in mptcp_pm_del_add_timer()
     - xfs: Replace strncpy with memcpy
     - xfs: fix out of bounds memory read error in symlink repair
     - drm/amd/display: avoid reset DTBCLK at clock init
     - drm/amd/display: disable DPP RCG before DPP CLK enable
     - drm/amd/display: Insert dccg log for easy debug
     - drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched
     - Revert "gpio: swnode: don't use the swnode's name as the key for GPIO
       lookup"
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.61
     - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers
     - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted
       URBs
     - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before
       accessing header
     - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before
       accessing data
     - Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso
       interface
     - Bluetooth: hci_core: Fix triggering cmd_timer for HCI_OP_NOP
     - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind
     - Bluetooth: SMP: Fix not generating mackey and ltk when repairing
     - net: sched: generalize check for no-queue qdisc on TX queue
     - veth: apply qdisc backpressure on full ptr_ring to reduce TX drops
     - veth: prevent NULL pointer dereference in veth_xdp_rcv
     - veth: more robust handing of race to avoid txq getting stuck
     - veth: reduce XDP no_direct return section to fix race
     - [amd64] platform/x86: intel: punit_ipc: fix memory corruption
     - net: aquantia: Add missing descriptor cache invalidation on ATL2
     - net: lan966x: Fix the initialization of taprio
     - drm/xe: Fix conversion from clock ticks to milliseconds
     - net/mlx5e: Fix validation logic in rate limiting
     - team: Move team device type change at the end of team_port_add
     - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling
     - net: wwan: mhi: Keep modem name match with Foxconn T99W640
     - net: atlantic: fix fragment overflow handling in RX path
     - [arm64,armhf] net: fec: cancel perout_timer when PEROUT is disabled
     - [arm64,armhf] net: fec: do not update PEROUT if it is enabled
     - [arm64,armhf] net: fec: do not allow enabling PPS and PEROUT
       simultaneously
     - [arm64,armhf] net: fec: do not register PPS event for PEROUT
     - iio: st_lsm6dsx: Fixed calibrated timestamp calculation
     - [arm64] mailbox: mtk-cmdq: Refine DMA address handling for the command
       buffer
     - mailbox: pcc: Refactor error handling in irq handler into separate
       function
     - mailbox: pcc: don't zero error register
     - fs/namespace: fix reference leak in grab_requested_mnt_ns
     - spi: spi-mem: Allow specifying the byte order in Octal DTR mode
     - spi: spi-mem: Extend spi-mem operations with a per-operation maximum
       frequency
     - spi: spi-mem: Add a new controller capability
     - [arm64] spi: nxp-fspi: Support per spi-mem operation frequency switches
     - [arm64] spi: spi-nxp-fspi: remove the goto in probe
     - [arm64] spi: spi-nxp-fspi: Add OCT-DTR mode support
     - [arm64] spi: nxp-fspi: Propagate fwnode in ACPI case as well
     - Revert "drm/amd/display: Move setup_stream_attribute"
     - [amd64] Revert "perf/x86: Always store regs->ip in
       perf_callchain_kernel()"
     - iio: buffer-dma: support getting the DMA channel
     - iio: buffer-dmaengine: enable .get_dma_dev()
     - iio: buffer: support getting dma channel from the buffer
     - iio: accel: bmc150: Fix irq assumption regression (Closes: #1106411)
     - tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs
     - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230
     - [arm64] dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity
     - Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref
     - can: sja1000: fix max irq loop handling
     - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling
     - ceph: fix crash in process_v2_sparse_read() for encrypted directories
     - dm-verity: fix unreliable memory allocation
     - drivers/usb/dwc3: fix PCI parent check
     - smb: client: fix memory leak in cifs_construct_tcon()
     - [amd64] thunderbolt: Add support for Intel Wildcat Lake
     - [arm64] slimbus: ngd: Fix reference count leak in
       qcom_slim_ngd_notify_slaves
     - nvmem: layouts: fix nvmem_layout_bus_uevent
     - firmware: stratix10-svc: fix bug in saving controller data
     - mm/memfd: fix information leak in hugetlb folios
     - mmc: sdhci-of-dwcmshc: Promote the th1520 reset handling to ip level
     - mptcp: clear scheduled subflows on retransmit
     - mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in
       mptcp_do_fastclose().
     - [arm*] serial: amba-pl011: prefer dma_mapping_error() over explicit
       address checking
     - usb: cdns3: Fix double resource release in cdns3_pci_probe
     - usb: gadget: f_eem: Fix memory leak in eem_unwrap
     - usb: storage: Fix memory leak in USB bulk transport
     - USB: storage: Remove subclass and protocol overrides from Novatek quirk
     - usb: storage: sddr55: Reject out-of-bound new_pba
     - usb: uas: fix urb unmapping issue when the uas device is remove during
       ongoing data transfer
     - [amd64,arm64] usb: dwc3: pci: add support for the Intel Nova Lake -S
     - [amd64,arm64] usb: dwc3: pci: Sort out the Intel device IDs
     - [amd64,arm64] usb: dwc3: Fix race condition between concurrent
       dwc3_remove_requests() call paths
     - xhci: fix stale flag preventig URBs after link state error is cleared
     - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host
     - xhci: dbgtty: fix device unregister
     - USB: serial: ftdi_sio: add support for u-blox EVK-M101
     - USB: serial: option: add support for Rolling RW101R-GL
     - drm: sti: fix device leaks at component probe
     - drm/amd/amdgpu: reserve vm invalidation engine for uni_mes
     - drm/amd/display: Check NULL before accessing
     - drm/amd/display: Don't change brightness for disabled connectors
     - [armhf] net: dsa: microchip: common: Fix checks on irq_find_mapping()
     - [armhf] net: dsa: microchip: ptp: Fix checks on irq_find_mapping()
     - [armhf] net: dsa: microchip: Don't free uninitialized ksz_irq
     - libceph: fix potential use-after-free in have_mon_and_osd_map()
     - libceph: prevent potential out-of-bounds writes in
       handle_auth_session_key()
     - libceph: replace BUG_ON with bounds check for map->max_osd
     - staging: rtl8712: Remove driver using deprecated API wext
     - nfsd: Replace clamp_t in nfsd4_get_drc_mem()
     - usb: typec: ucsi: psy: Set max current to zero when disconnected
     - usb: udc: Add trace event for usb_gadget_set_state
     - usb: gadget: udc: fix use-after-free in usb_gadget_state_work
     - mm/huge_memory: fix NULL pointer deference when splitting folio
     - [amd64] KVM: SVM: Introduce svm_recalc_lbr_msr_intercepts()
     - [amd64] KVM: nSVM: Always recalculate LBR MSR intercepts in
       svm_update_lbrv()
     - [amd64] KVM: nSVM: Fix and simplify LBR virtualization handling with
       nested
     - [amd64] KVM: SVM: Fix redundant updates of LBR MSR intercepts
     - drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup
     - [armhf] net: dsa: microchip: Do not execute PTP driver code for
       unsupported switches
     - [armhf] net: dsa: microchip: Free previously initialized ports on init
       failures
     - wifi: ath12k: correctly handle mcast packets for clients
     - Revert "ACPI: Suppress misleading SPCR console message when SPCR table is
       absent"
     - [amd64] drm/i915/dp: Initialize the source OUI write timestamp always
     - [arm64] spi: spi-nxp-fspi: Check return value of devm_mutex_init()
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.62
     - xfrm: delete x->tunnel as we delete x
     - Revert "xfrm: destroy xfrm_state synchronously on net exit path"
     - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that
       were never added
     - xfrm: flush all states in xfrm_state_fini
     - Documentation: process: Also mention Sasha Levin as stable tree maintainer
     - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system
       corrupted
     - ext4: refresh inline data size before write operations
     - ksmbd: ipc: fix use-after-free in ipc_msg_send_request
     - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()
     - [amd64] KVM: SVM: Don't skip unrelated instruction if INT3/INTO is
       replaced
     - USB: serial: option: add Foxconn T99W760
     - USB: serial: option: add Telit Cinterion FE910C04 new compositions
     - USB: serial: option: move Telit 0x10c7 composition in the right place
     - USB: serial: ftdi_sio: match on interface number for jtag
     - serial: add support of CPCI cards
     - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC
     - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC
     - ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct()
     - [arm64,armhf] ipi: imx: keep dma request disabled before dma transfer
       setup
     - drm/vmwgfx: Use kref in vmw_bo_dirty
     - Bluetooth: btrtl: Avoid loading the config file on security chips
     - smb: fix invalid username check in smb3_fs_context_parse_param()
     - drm/amdkfd: Fix GPU mappings for APU after prefetch
     - ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series
     - bfs: Reconstruct file type when loading from disk
     - HID: hid-input: Extend Elan ignore battery quirk to USB
     - nvme: fix admin request_queue lifetime
     - [arm64] pinctrl: qcom: msm: Fix deadlock in pinmux configuration
     - [amd64] platform/x86: acer-wmi: Ignore backlight event
     - HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list
     - [amd64] platform/x86: huawei-wmi: add keys for HONOR models
     - [amd64] platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list
     - [amd64] platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally
     - HID: elecom: Add support for ELECOM M-XT3URBK (018F)
     - wifi: rtl8xxxu: Add USB ID 2001:3328 for D-Link AN3U rev. A1
     - wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1
     - [amd64] comedi: check device's attached status in compat ioctls
     - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
     - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
     - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing
     - bus: mhi: host: pci_generic: Add Telit FN920C04 modem support
     - bus: mhi: host: pci_generic: Add Telit FN990B40 modem support
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.63
     - [arm64,armhf] gpu: host1x: Fix race in syncpt alloc/free
     - [amd64] accel/ivpu: Prevent runtime suspend during context abort work
     - [amd64] accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume
       fail
     - [amd64] accel/ivpu: Make function parameter names consistent
     - [amd64] accel/ivpu: Fix DCT active percent format
     - drm/vgem-fence: Fix potential deadlock on release
     - USB: Fix descriptor count when handling invalid MBIM extended descriptor
     - [arm64] pinctrl: renesas: rzg2l: Fix PMC restore
     - [arm64] clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle
       callback
     - [arm64] clk: renesas: Use str_on_off() helper
     - [arm64] clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register
     - [arm64] clk: renesas: cpg-mssr: Read back reset registers to assure values
       latched
     - HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync()
     - objtool: Fix standalone --hacks=jump_label
     - objtool: Fix weak symbol detection
     - wifi: ath10k: Avoid vdev delete timeout when firmware is already down
     - wifi: ath10k: Add missing include of export.h
     - wifi: ath10k: move recovery check logic into a new work
     - wifi: ath11k: restore register window after global reset
     - sched/fair: Forfeit vruntime on yield
     - [arm*] irqchip/irq-brcmstb-l2: Fix section mismatch
     - [arm64,armhf] irqchip/imx-mu-msi: Fix section mismatch
     - [arm64] irqchip/renesas-rzg2l: Fix section mismatch
     - [riscv64] irqchip/starfive-jh8100: Fix section mismatch
     - [arm64] irqchip/qcom-irq-combiner: Fix section mismatch
     - crypto: authenc - Correctly pass EINPROGRESS back up to the caller
     - ntfs3: fix uninit memory after failed mi_read in mi_format_new
     - ntfs3: Fix uninit buffer allocated by __getname()
     - dt-bindings: clock: qcom,x1e80100-gcc: Add missing video resets
     - dt-bindings: clock: qcom,x1e80100-gcc: Add missing USB4 clocks/resets
     - clk: qcom: gcc-x1e80100: Add missing USB4 clocks/resets
     - rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu()
     - inet: Avoid ehash lookup race in inet_ehash_insert()
     - inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule()
     - firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc
     - block/mq-deadline: Introduce dd_start_request()
     - block/mq-deadline: Switch back to a single dispatch list
     - [arm64] dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1
       props
     - [arm64] dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl
     - [arm64] dts: imx8mp-venice-gw702x: remove off-board uart
     - [arm64] dts: imx8mp-venice-gw702x: remove off-board sdhc1
     - perf annotate: Check return value of evsel__get_arch() properly
     - [arm64] dts: exynos: gs101: fix sysreg_apm reg property
     - uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe
     - soc: Switch back to struct platform_driver::remove()
     - [arm64] soc: qcom: gsbi: fix double disable caused by devm
     - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
     - wifi: ath11k: fix VHT MCS assignment
     - wifi: ath11k: fix peer HE MCS assignment
     - [s390x] smp: Fix fallback CPU detection
     - [s390x] ap: Don't leak debug feature files if AP instructions are not
       available
     - [arm64] dts: ti: k3-am62p: Fix memory ranges for GPU
     - firmware: imx: scu-irq: fix OF node leak in
     - [arm64] dts: qcom: x1e80100: Fix compile warnings for USB HS controller
     - [arm64] dts: qcom: x1e80100: Add missing quirk for HS only USB controller
     - [arm64] dts: qcom: sdm845-oneplus: Correct gpio used for slider
     - [arm64] dts: qcom: sm8650: set ufs as dma coherent
     - [arm64] dts: qcom: qcm6490-shift-otter: Add missing reserved-memory
     - phy: mscc: Fix PTP for VSC8574 and VSC8572
     - sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock().
     - RDMA/rxe: Fix null deref on srq->rq.queue after resize failure
     - Revert "mtd: rawnand: marvell: fix layouts"
     - [arm64,armhf] mtd: nand: relax ECC parameter validation check
     - perf: Remove get_perf_callchain() init_nr argument
     - bpf: Refactor stack map trace depth calculation into helper function
     - bpf: Fix stackmap overflow check in __bpf_get_stackid()
     - [amd64] perf/x86/intel/cstate: Remove PC3 support from LunarLake
     - task_work: Fix NMI race condition
     - [amd64] x86/dumpstack: Prevent KASAN false positive warnings in
       __show_regs()
     - tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set
     - [arm64] soc: qcom: smem: fix hwspinlock resource leak in probe error paths
     - [armhf] pinctrl: stm32: fix hwspinlock resource leak in probe function
     - i3c: fix refcount inconsistency in i3c_master_register
     - i3c: master: svc: Prevent incomplete IBI transaction
     - wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload()
     - [arm64] interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS
     - [arm64] dts: qcom: msm8996: add interconnect paths to USB2 controller
     - interconnect: debugfs: Fix incorrect error handling for NULL path
     - drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource()
     - perf lock contention: Load kernel map before lookup
     - perf record: skip synthesize event when open evsel failed
     - power: supply: rt5033_charger: Fix device node reference leaks
     - power: supply: cw2015: Check devm_delayed_work_autocancel() return code
     - power: supply: max17040: Check iio_read_channel_processed() return code
     - power: supply: rt9467: Return error on failure in
       rt9467_set_value_from_ranges()
     - power: supply: rt9467: Prevent using uninitialized local variable in
       rt9467_set_value_from_ranges()
     - power: supply: wm831x: Check wm831x_set_bits() return value
     - power: supply: apm_power: only unset own apm_get_power_status
     - scsi: target: Do not write NUL characters into ASCII configfs output
     - fs/9p: Don't open remote file with APPEND mode when writeback cache is
       used
     - [arm64] drm/panthor: Handle errors returned by drm_sched_entity_init()
     - [arm64] drm/panthor: Fix group_free_queue() for partially initialized
       queues
     - [arm64] drm/panthor: Fix UAF race between device unplug and FW event
       processing
     - [arm64] drm/panthor: Fix race with suspend during unplug
     - [arm64] drm/panthor: Fix UAF on kernel BO VA nodes
     - libbpf: Fix parsing of multi-split BTF
     - [armhf] dts: am335x-netcom-plus-2xx: add missing GPIO labels
     - [armhf] dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible
     - [armhf] dts: omap3: n900: Correct obsolete TWL4030 power compatible
     - [amd64] x86/boot: Fix page table access in 5-level to 4-level paging
       transition
     - efi/libstub: Fix page table access in 5-level to 4-level paging transition
     - ext4: correct the checking of quota files before moving extents
     - [amd64] perf/x86/intel: Correct large PEBS flag check
     - regulator: core: disable supply if enabling main regulator fails
     - md: fix rcu protection in md_wakeup_thread
     - nbd: defer config put in recv_work
     - scsi: stex: Fix reboot_notifier leak in probe error path
     - scsi: smartpqi: Fix device resources accessed after device removal
     - dt-bindings: PCI: amlogic: Fix the register name of the DBI region
     - RDMA/rtrs: server: Fix error handling in get_or_create_srv
     - ntfs3: init run lock for extend inode
     - [arm64] drm/panthor: Fix potential memleak of vma structure
     - scsi: ufs: core: fix incorrect buffer duplication in
       ufshcd_read_string_desc()
     - [amd64] cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs
     - [powerpc*] kdump: Fix size calculation for hot-removed memory ranges
     - [powerpc*] 32: Fix unpaired stwcx. on interrupt exit
     - wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper()
     - nbd: defer config unlock in nbd_genl_connect
     - coresight: Change device mode to atomic type
     - [arm64] coresight: etm4x: Correct polling IDLE bit
     - [arm64] coresight: etm4x: Extract the trace unit controlling
     - [arm64] coresight: etm4x: Add context synchronization before enabling
       trace
     - lib/vsprintf: Check pointer before dereferencing in time_and_date()
     - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()
     - ACPI: property: Fix fwnode refcount leak in
       acpi_fwnode_graph_parse_endpoint()
     - scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls
     - leds: netxbig: Fix GPIO descriptor leak in error paths
     - bpf: Free special fields when update [lru_,]percpu_hash maps
     - PCI: keystone: Exit ks_pcie_probe() for invalid mode
     - [arm64] dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A
     - [arm64] dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A
     - [arm64] dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C
     - [amd64] crypto: iaa - Fix incorrect return value in save_iaa_wq()
     - [arm64] drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype
     - ps3disk: use memcpy_{from,to}_bvec index
     - bpf: Handle return value of ftrace_set_filter_ip in register_fentry
     - bpf: Check skb->transport_header is set in bpf_skb_check_mtu
     - watchdog: wdat_wdt: Fix ACPI table leak in probe function
     - watchdog: starfive: Fix resource leak in probe error path
     - tracefs: fix a leak in eventfs_create_events_dir()
     - NFSD/blocklayout: Fix minlength check in proc_layoutget
     - block/blk-throttle: Fix throttle slice time for SSDs
     - [arm64] drm/msm/a2xx: stop over-complaining about the legacy firmware
     - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
     - bpf: Fix invalid prog->stats access when update_effective_progs fails
     - [powerpc*] 64s/hash: Restrict stress_hpt_struct memblock region to within
       RMA limit
     - [powerpc*] 64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE
       format
     - fs/ntfs3: out1 also needs to put mi
     - fs/ntfs3: Prevent memory leaks in add sub record
     - [arm64] drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue
     - [arm64] drm/msm/a6xx: Flush LRZ cache before PT switch
     - [arm64] drm/msm/a6xx: Fix the gemnoc workaround
     - [arm64] drm/msm/a6xx: Improve MX rail fallback in RPMH vote init
     - ipv6: clear RA flags when adding a static route (Closes: #1117959)
     - pwm: bcm2835: Make sure the channel is enabled after pwm_request()
     - scsi: qla2xxx: Fix improper freeing of purex item
     - [amd64] iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb
     - wifi: mac80211: fix CMAC functions not handling errors
     - [arm64] mfd: mt6397-irq: Fix missing irq_domain_remove() in error path
     - [arm64] mfd: mt6358-irq: Fix missing irq_domain_remove() in error path
     - leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM
     - [arm64] phy: renesas: rcar-gen3-usb2: Fix an error handling path in
       rcar_gen3_phy_usb2_probe()
     - [arm64] phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth
     - [arm64] phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from
       exceeding the limits
     - net: phy: adin1100: Fix software power-down ready condition
     - cpuset: Treat cpusets in attaching as populated
     - wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
     - RAS: Report all ARM processor CPER information to userspace
     - ima: Handle error code returned by ima_filter_rule_match()
     - usb: chaoskey: fix locking for O_NONBLOCK
     - usb: dwc2: disable platform lowlevel hw resources during shutdown
     - usb: dwc2: fix hang during shutdown if set as peripheral
     - usb: dwc2: fix hang during suspend if set as peripheral
     - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE
     - [riscv64] KVM: Fix guest page fault within HLV* instructions
     - erofs: limit the level of fs stacking for file-backed mounts
     - RDMA/bnxt_re: Fix the inline size for GenP7 devices
     - RDMA/bnxt_re: Pass correct flag for dma mr creation
     - ASoC: tas2781: correct the wrong period
     - mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()
     - firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc
     - staging: fbtft: core: fix potential memory leak in fbtft_probe_common()
     - [arm64] iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables
     - btrfs: fix leaf leak in an error path in btrfs_del_items()
     - PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition
     - drm/nouveau: restrict the flush page to a 32-bit address
     - iomap: factor out a iomap_dio_done helper
     - iomap: always run error completions in user context
     - wifi: ieee80211: correct FILS status codes
     - backlight: led-bl: Add devlink to supplier LEDs
     - backlight: lp855x: Fix lp855x.h kernel-doc warnings
     - [arm64] iommu/arm-smmu-qcom: Enable use of all SMR groups when running
       bare-metal
     - RDMA/irdma: Fix data race in irdma_sc_ccq_arm
     - RDMA/irdma: Fix data race in irdma_free_pble
     - RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY
     - [arm64] drm/panthor: Avoid adding of kernel BOs to extobj list
     - gfs2: Prevent recursive memory reclaim
     - firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER
     - drm/amd/display: Fix logical vs bitwise bug in
       get_embedded_panel_info_v2_1()
     - hwmon: sy7636a: Fix regulator_enable resource leak on error path
     - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4
     - ublk: prevent invalid access with DEBUG
     - ext4: improve integrity checking in __mb_check_buddy by enhancing order-0
       validation
     - of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node
     - virtio_vdpa: fix misleading return in void function
     - virtio: fix typo in virtio_device_ready() comment
     - virtio: fix whitespace in virtio_config_ops
     - virtio: fix grammar in virtio_queue_info docs
     - virtio: fix virtqueue_set_affinity() docs
     - vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues
     - vhost: Fix kthread worker cgroup failure handling
     - vdpa/pds: use %pe for ERR_PTR() in event handler registration
     - [amd64] ASoC: Intel: catpt: Fix error path in hw_params()
     - [armhf] dts: samsung: universal_c210: turn off SDIO WLAN chip during
       system suspend
     - [armhf] dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during
       system suspend
     - [armhf] dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during
       system suspend
     - [armhf] dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during
       system suspend
     - regulator: core: Protect regulator_supply_alias_list with
       regulator_list_mutex
     - resource: replace open coded resource_intersection()
     - resource: introduce is_type_match() helper and use it
     - Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()"
     - netfilter: flowtable: check for maximum number of encapsulations in bridge
       vlan
     - netfilter: nf_conncount: rework API to use sk_buff directly
     - netfilter: nft_connlimit: update the count if add was skipped
     - net: stmmac: fix rx limit check in stmmac_rx_zc()
     - vfio/pci: Use RCU for error/request triggers to avoid circular locking
     - net: phy: aquantia: check for NVMEM deferral
     - mtd: lpddr_cmds: fix signed shifts in lpddr_cmds
     - [arm64] remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs
     - md/raid5: fix IO hang when array is broken with IO inflight
     - net: hsr: remove one synchronize_rcu() from hsr_del_port()
     - net: hsr: remove synchronize_rcu() from hsr_add_port()
     - net: hsr: Create and export hsr_get_port_ndev()
     - net: hsr: create an API to get hsr port type
     - net: dsa: xrs700x: reject unsupported HSR configurations
     - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop
       (CVE-2025-68325)
     - perf tools: Mark split kallsyms DSOs as loaded
     - perf tools: Fix split kallsyms DSO counting
     - perf hist: In init, ensure mem_info is put on error paths
     - [arm64,armhf] pinctrl: single: Fix incorrect type for error return
       variable
     - fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe()
     - 9p: fix cache/debug options printing in v9fs_show_options
     - sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the
       last task migrates out
     - [amd64] platform/x86:intel/pmc: Update Arrow Lake telemetry GUID
     - f2fs: keep POSIX_FADV_NOREUSE ranges
     - f2fs: add a sysfs entry to reclaim POSIX_FADV_NOREUSE pages
     - f2fs: fix to avoid running out of free segments
     - f2fs: add carve_out sysfs node
     - f2fs: sysfs: add encoding_flags entry
     - f2fs: introduce reserved_pin_section sysfs entry
     - f2fs: add gc_boost_gc_multiple sysfs node
     - f2fs: add gc_boost_gc_greedy sysfs node
     - f2fs: maintain one time GC mode is enabled during whole zoned GC cycle
     - NFS: Avoid changing nlink when file removes and attribute updates race
     - fs/nls: Fix utf16 to utf8 conversion
     - NFS: Initialise verifiers for visible dentries in readdir and lookup
     - NFS: Initialise verifiers for visible dentries in nfs_atomic_open()
     - nfs/vfs: discard d_exact_alias()
     - NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state
     - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid
     - Revert "nfs: ignore SB_RDONLY when remounting nfs"
     - Revert "nfs: clear SB_RDONLY before getting superblock"
     - Revert "nfs: ignore SB_RDONLY when mounting nfs"
     - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
     - Expand the type of nfs_fattr->valid
     - NFS: Fix inheritance of the block sizes when automounting
     - fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8()
     - [amd64] platform/x86: asus-wmi: use brightness_set_blocking() for kbd led
     - blk-mq: Abort suspend when wakeup events are pending
     - block: fix comment for op_is_zone_mgmt() to include RESET_ALL
     - block: fix memory leak in __blkdev_issue_zero_pages
     - nvme-auth: use kvfree() for memory allocated with kvcalloc()
     - drm/plane: Fix IS_ERR() vs NULL check in
       drm_plane_create_hotspot_properties()
     - regulator: fixed: Rely on the core freeing the enable GPIO
     - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events
     - drm/nouveau: refactor deprecated strcpy
     - cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2
     - docs: hwmon: fix link to g762 devicetree binding
     - dma/pool: eliminate alloc_pages warning in atomic_pool_expand
     - ALSA: uapi: Fix typo in asound.h comment
     - drm/amdkfd: Use huge page size to check split svm range alignment
     - rtc: gamecube: Check the return value of ioremap()
     - ALSA: firewire-motu: add bounds check in put_user loop for DSP events
     - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of
       set->tag_list_lock
     - block: return unsigned int from queue_dma_alignment
     - dm-raid: fix possible NULL dereference with undefined raid type
     - dm log-writes: Add missing set_freezable() for freezable kthread
     - efi/cper: Add a new helper function to print bitmasks
     - efi/cper: Adjust infopfx size to accept an extra space
     - efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs
     - scsi: imm: Fix use-after-free bug caused by unfinished delayed work
       (CVE-2025-68324)
     - irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()
     - ocfs2: fix memory leak in ocfs2_merge_rec_left()
     - net: lan743x: Allocate rings outside ZONE_DMA
     - net: dst: introduce dst->dev_rcu
     - tcp_metrics: use dst_dev_net_rcu() (CVE-2025-40075)
     - usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt
     - usb: phy: Initialize struct usb_phy list_head
     - usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required
     - ALSA: dice: fix buffer overflow in detect_stream_formats()
     - ALSA: wavefront: Fix integer overflow in sample size validation
 .
   [ Uwe Kleine-König ]
   * [armhf] Enable LEDS_TURRIS_OMNIA as a module for Turris Omnia LED
     support.
 .
   [ Maxwell Pevner ]
   * drivers/hid: Enable HID_UNIVERSAL_PIDFF as module (Closes: #1122144)

linux-signed-amd64 (6.12.63+1) trixie; urgency=medium
 .
   * Sign kernel from linux 6.12.63-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.58
     - NFSD: Fix crash in nfsd4_read_release()
     - net: usb: asix_devices: Check return value of usbnet_get_endpoints
     - fbcon: Set fb_display[i]->mode to NULL when the mode is released
     - fbdev: atyfb: Check if pll_ops->init_pll failed
     - ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
     - ACPI: button: Call input_free_device() on failing input device
       registration
     - virtio-net: drop the multi-buffer XDP packet in zerocopy
     - fbdev: bitblit: bound-check glyph index in bit_putcs*
     - Bluetooth: rfcomm: fix modem control handling
     - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP
       Mode
     - mptcp: drop bogus optimization in __mptcp_check_push()
     - mptcp: restore window probe
     - [arm64] ASoC: qdsp6: q6asm: do not sleep while atomic
     - [s390x] pci: Restore IRQ unconditionally for the zPCI device
     - smb: client: fix potential cfid UAF in smb2_query_info_compound
     - [amd64] x86/fpu: Ensure XFD state on signal delivery
     - wifi: ath10k: Fix memory leak on unsupported WMI command
     - wifi: ath11k: Add missing platform IDs for quirk table
     - wifi: ath12k: free skb during idr cleanup callback
     - wifi: ath11k: add support for MU EDCA
     - wifi: ath11k: avoid bit operation on key flags
     - [arm64] drm/msm/a6xx: Fix GMU firmware parser
     - ALSA: usb-audio: fix control pipe direction
     - wifi: mac80211: don't mark keys for inactive links as uploaded
     - wifi: mac80211: fix key tailroom accounting leak
     - bpf: Sync pending IRQ work before freeing ring buffer
     - scsi: ufs: core: Initialize value of an attribute returned by uic cmd
     - bpf: Find eligible subprogs for private stack support
     - bpf, x86: Avoid repeated usage of bpf_prog->aux->stack_depth
     - bpf: Do not audit capability check in do_jit()
     - [amd64] ASoC: Intel: avs: Unprepare a stream when XRUN occurs
     - [amd64] ASoC: Intel: avs: Disable periods-elapsed work when closing PCM
     - [arm64,armhf] ASoC: fsl_sai: fix bit order for DSD format
     - libbpf: Fix powerpc's stack register definition in bpf_tracing.h
     - usbnet: Prevents free active kevent
     - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
     - Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave
     - Bluetooth: ISO: Fix BIS connection dst_type handling
     - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset
     - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00
     - Bluetooth: ISO: Fix another instance of dst_type handling
     - Bluetooth: hci_core: Fix tracking of periodic advertisement
     - [arm64,armhf] drm/etnaviv: fix flush sequence logic
     - [arm64] net: hns3: return error code when function fails
     - sfc: fix potential memory leak in efx_mae_process_mport()
     - dpll: spec: add missing module-name and clock-id to pin-get reply
     - [arm64,armhf] ASoC: fsl_sai: Fix sync error in consumer mode
     - drm/radeon: Do not kfree() devres managed rdev
     - drm/radeon: Remove calls to drm_put_dev()
     - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table()
     - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji
     - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland
     - ACPI: fan: Use ACPI handle when retrieving _FST
     - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL
     - block: make REQ_OP_ZONE_OPEN a write operation
     - regmap: slimbus: fix bus_context pointer in regmap init calls
     - [s390x] mm: Fix memory leak in add_marker() when kvrealloc() fails
     - drm/xe: Do not wake device during a GT reset
     - drm/sysfb: Do not dereference NULL pointer in plane reset
     - drm/sched: avoid killing parent entity on child SIGKILL
     - drm/nouveau: Fix race in nouveau_sched_fini()
     - [arm64] drm/mediatek: Fix device use-after-free on unbind
     - drm/amd: Check that VPE has reached DPM0 in idle handler
     - drm/amd/display: Fix incorrect return of vblank enable on unconfigured
       crtc (Closes: #1000966)
     - ACPI: fan: Add fan speed reporting for fans with only _FST
     - ACPI: fan: Use platform device for devres-related actions
     - sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU
     - cpuidle: governors: menu: Rearrange main loop in menu_select()
     - cpuidle: governors: menu: Select polling state in some more cases
     - [amd64] mfd: kempld: Switch back to earlier ->init() behavior
     - [amd64] x86/CPU/AMD: Add RDSEED fix for Zen5
     - usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
     - drm/sched: Optimise drm_sched_entity_push_job
     - drm/sched: Re-group and rename the entity run-queue lock
     - drm/sched: Fix race in drm_sched_entity_select_rq()
     - [s390x] pci: Avoid deadlock between PCI error recovery and mlx5 crdump
     - [s390x] Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP
     - [armhf] soc: aspeed: socinfo: Add AST27xx silicon IDs
     - [arm64] firmware: qcom: scm: preserve assign_mem() error return value
     - [arm64] soc: qcom: smem: Fix endian-unaware access of num_entries
     - [arm64] soc: ti: pruss: don't use %pK through printk
     - bpf: Don't use %pK through printk
     - pinctrl: single: fix bias pull up/down handling in pin_config_set
     - [arm64] mmc: host: renesas_sdhi: Fix the actual clock
     - memstick: Add timeout to prevent indefinite waiting
     - [arm64,armhf] cpufreq: ti: Add support for AM62D2
     - bpf: Use tnums for JEQ/JNE is_branch_taken logic
     - firewire: ohci: move self_id_complete tracepoint after validating register
     - [riscv64] irqchip/sifive-plic: Respect mask state when setting affinity
     - io_uring/zctx: check chained notif contexts
     - ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object
     - ACPI: video: force native for Lenovo 82K8
     - libbpf: Fix USDT SIB argument handling causing unrecognized register error
     - cpufreq/longhaul: handle NULL policy in longhaul_exit
     - [arm64,armhf] irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
     - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
     - ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU
     - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
     - thermal: gov_step_wise: Allow cooling level to be reduced earlier
     - power: supply: qcom_battmgr: add OOI chemistry
     - [amd64] hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based
       models
     - [amd64] hwmon: (k10temp) Add device ID for Strix Halo
     - power: supply: sbs-charger: Support multiple devices
     - cpufreq: ondemand: Update the efficient idle check for Intel extended
       Families
     - [arm64,armhf] soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
     - [arm64] firmware: qcom: tzmem: disable sc7180 platform
     - [arm64] mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
     - pwm: pca9685: Use bulk write to atomicially update registers
     - ACPICA: dispatcher: Use acpi_ds_clear_operands() in
       acpi_ds_call_control_method()
     - [amd64,arm64] tee: allow a driver to allocate a tee_device without a pool
     - nvmet-fc: avoid scheduling association deletion twice
     - nvme-fc: use lock accessing port_state and rport state
     - bpf: Do not limit bpf_cgroup_from_id to current's namespace
     - i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C
     - video: backlight: lp855x_bl: Set correct EPROM start for LP8556
     - tools/cpupower: fix error return value in cpupower_write_sysfs()
     - power: supply: qcom_battmgr: handle charging state change notifications
     - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21
     - cpuidle: Fail cpuidle device registration if there is one already
     - futex: Don't leak robust_list pointer on exec race
     - ACPI: SPCR: Support Precise Baud Rate field
     - blk-cgroup: fix possible deadlock while configuring policy
     - [riscv64] bpf: Fix uninitialized symbol 'retval_off'
     - bpf: Clear pfmemalloc flag when freeing all fragments
     - nvme: Use non zero KATO for persistent discovery connections
     - uprobe: Do not emulate/sstep original instruction when ip is changed
     - [amd64] hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex
     - [amd64] hwmon: (dell-smm) Remove Dell Precision 490 custom config data
     - tools/cpupower: Fix incorrect size in cpuidle_state_disable()
     - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
     - tools/power x86_energy_perf_policy: Enhance HWP enable
     - tools/power x86_energy_perf_policy: Prefer driver HWP limits
     - [armhf] mfd: stmpe: Remove IRQ domain upon removal
     - [armhf] mfd: stmpe-i2c: Add missing MODULE_LICENSE
     - [riscv64] mfd: da9063: Split chip variant reading in two bus transactions
     - mfd: core: Increment of_node's refcount before linking it to the platform
       device
     - [amd64] mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs
     - drm/amd/display: fix condition for setting timing_adjust_pending
     - drm/amd/display: ensure committing streams is seamless
     - drm/amdgpu: add range check for RAS bad page address
     - drm/amdgpu: Check vcn sram load return value
     - drm/amd/display: Move setup_stream_attribute
     - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration
     - drm/xe/guc: Add more GuC load error status codes
     - drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.
     - drm/amdgpu: Avoid rma causes GPU duplicate reset
     - drm/amd/amdgpu: Release xcp drm memory after unplug
     - drm/amdgpu: Skip poison aca bank from UE channel
     - drm/amd/display: add more cyan skillfish devices
     - drm/amd/display: update dpp/disp clock from smu clock table
     - drm/amd/pm: Use cached metrics data on aldebaran
     - drm/amd/pm: Use cached metrics data on arcturus
     - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
     - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
     - [arm64] ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks
     - drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off
     - drm/amd/display: Wait until OTG enable state is cleared
     - PCI: Disable MSI on RDC PCI to PCIe bridges
     - wifi: rtw89: print just once for unknown C2H events
     - wifi: rtw88: sdio: use indirect IO for device registers before power-on
     - drm/amdkfd: return -ENOTTY for unsupported IOCTLs
     - media: pci: ivtv: Don't create fake v4l2_fh
     - [arm64] drm/tidss: Use the crtc_* timings when programming the HW
     - [arm64] drm/tidss: Set crtc modesetting parameters with adjusted mode
     - PCI/ERR: Update device error_state already after reset
     - [amd64] x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
     - net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
     - ice: Don't use %pK through printk or tracepoints
     - thunderbolt: Use is_pciehp instead of is_hotplug_bridge
     - tty: serial: ip22zilog: Use platform device for probing
     - [powerpc*] eeh: Use result of error_detected() in uevent
     - [s390x] pci: Use pci_uevent_ers() in PCI recovery
     - bridge: Redirect to backup port when port is administratively down
     - net: ipv6: fix field-spanning memcpy warning in AH output
     - media: imon: make send_packet() more robust
     - [arm64] drm/panthor: Serialize GPU cache flush operations
     - HID: pidff: Use direction fix only for conditional effects
     - HID: pidff: PERMISSIVE_CONTROL quirk autodetection
     - [arm64,armhf] drm/bridge: display-connector: don't set OP_DETECT for
       DisplayPorts
     - drm/amdgpu: fix nullptr err of vm_handle_moved
     - drm/amdkfd: Handle lack of READ permissions in SVM mapping
     - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before
       setting register
     - iio: adc: imx93_adc: load calibrated values even calibration failed
     - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
     - wifi: rtw89: wow: remove notify during WoWLAN net-detect
     - wifi: rtw89: fix BSSID comparison for non-transmitted BSSID
     - dm error: mark as DM_TARGET_PASSES_INTEGRITY
     - char: misc: Make misc_register() reentry for miscdevice who wants dynamic
       minor
     - char: misc: Does not request module for miscdevice with dynamic minor
     - net: When removing nexthops, don't call synchronize_net if it is not
       necessary
     - net: stmmac: Correctly handle Rx checksum offload errors
     - net: Call trace_sock_exceed_buf_limit() for memcg failure with
       SK_MEM_RECV.
     - f2fs: fix to detect potential corrupted nid in free_nid_list
     - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
     - bnxt_en: Add Hyper-V VF ID
     - tty: serial: Modify the use of dev_err_probe()
     - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
     - [amd64,arm64] idpf: do not linearize big TSO packets
     - rds: Fix endianness annotation for RDS_MPATH_HASH
     - media: ipu6: isys: Set embedded data type correctly for metadata formats
     - rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table
     - net: ipv4: allow directed broadcast routes to use dst hint
     - scsi: mpi3mr: Fix I/O failures during controller reset
     - scsi: mpi3mr: Fix controller init failure on fault during queue creation
     - scsi: pm80xx: Fix race condition caused by static variables
     - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper
     - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device
     - fuse: zero initialize inode private data
     - drm/amdgpu: Correct the counts of nr_banks and nr_errors
     - drm/amdkfd: fix vram allocation failure for a special case
     - drm/amd/display: Support HW cursor 180 rot for any number of pipe splits
     - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
     - [amd64] platform/x86/intel-uncore-freq: Fix warning in partitioned system
     - media: fix uninitialized symbol warnings
     - media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS
     - [amd64] ASoC: SOF: ipc4-pcm: Add fixup for channels
     - drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting
     - drm/amd/display: incorrect conditions for failing dto calculations
     - drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest
     - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2)
     - inet_diag: annotate data-races in inet_diag_bc_sk()
     - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()
     - [amd64] crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof()
     - scsi: pm8001: Use int instead of u32 to store error codes
     - [arm64] scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset
       on suspend
     - ptp: Limit time setting of PTP clocks
     - dmaengine: sh: setup_xref error handling
     - [arm64,armhf] dmaengine: mv_xor: match alloc_wc and free_wc
     - [arm64] drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL
     - [arm64] drm/msm/dsi/phy_7nm: Fix missing initial VCO rate
     - drm/amdgpu: Allow kfd CRIU with no buffer objects
     - drm/xe/guc: Increase GuC crash dump buffer size
     - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
     - [arm64] drm/panthor: check bo offset alignment in vm bind
     - drm: panel-backlight-quirks: Make EDID match optional
     - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
     - media: adv7180: Add missing lock in suspend callback
     - media: adv7180: Do not write format to device in set_fmt
     - media: adv7180: Only validate format in querystd
     - [arm64,armhf] media: verisilicon: Explicitly disable selection api ioctls
       for decoders
     - wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower
       bands
     - ALSA: usb-audio: apply quirk for MOONDROP Quark2
     - [arm64,armhf] PCI: imx6: Enable the Vaux supply if available
     - drm/xe/guc: Set upper limit of H2G retries over CTB
     - net: call cond_resched() less often in __release_sock()
     - smsc911x: add second read of EEPROM mac when possible corruption seen
     - [amd64] iommu/amd: Skip enabling command/event buffers for kdump
     - [amd64] crypto: ccp: Skip SEV and SNP INIT for kdump boot
     - drm/amd: add more cyan skillfish PCI ids
     - drm/amdgpu: don't enable SMU on cyan skillfish
     - drm/amdgpu: add support for cyan skillfish gpu_info
     - drm/amd/display: Fix pbn_div Calculation Error
     - [arm64] net: dsa: felix: support phy-mode = "10g-qxgmii"
     - usb: gadget: f_hid: Fix zero length packet transfer
     - usb: cdns3: gadget: Use-after-free during failed initialization and exit
       of cdnsp gadget
     - tty/vt: Add missing return value for VT_RESIZE in vt_ioctl()
     - [arm64] drm/msm: make sure to not queue up recovery more than once
     - char: Use list_del_init() in misc_deregister() to reinitialize list
       pointer
     - PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs
     - wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list
     - [amd64] media: ov08x40: Fix the horizontal flip control
     - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer
     - f2fs: fix wrong layout information on 16KB page
     - net: phy: marvell: Fix 88e1510 downshift counter errata
     - ntfs3: pretend $Extend records as regular files
     - wifi: mac80211: Fix HE capabilities element check
     - [arm64] phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf
       register 0
     - [arm64] drm/msm/registers: Generate _HI/LO builders for reg64
     - net: sh_eth: Disable WoL if system can not suspend
     - netfilter: nf_reject: don't reply to icmp error messages
     - [amd64] x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective
       of PV_UNHALT
     - net: devmem: expose tcp_recvmsg_locked errors
     - udp_tunnel: use netdev_warn() instead of netdev_WARN()
     - HID: asus: add Z13 folio to generic group for multitouch to work
     - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger
     - [arm64] crypto: sun8i-ce - remove channel timeout field
     - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify()
     - [amd64] crypto: ccp - Fix incorrect payload size calculation in
       psp_poulate_hsti()
     - [arm64,armhf] crypto: caam - double the entropy delay interval for retry
     - net/cls_cgroup: Fix task_get_classid() during qdisc run
     - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device
     - wifi: mt76: mt7996: Temporarily disable EPCS
     - wifi: mt76: mt76_eeprom_override to int
     - ALSA: serial-generic: remove shared static buffer
     - wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error
     - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl
     - drm/amd/display: Set up pixel encoding for YCBCR422
     - drm/amd/display: fix dml ms order of operations
     - drm/amd: Avoid evicting resources at S5
     - drm/amd/display: Fix DVI-D/HDMI adapters
     - drm/amd/display: Disable VRR on DCE 6
     - drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with
       DC_FP_START
     - page_pool: always add GFP_NOWARN for ATOMIC allocations
     - ethernet: Extend device_get_mac_address() to use NVMEM
     - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4
     - drm/xe/guc: Return an error code if the GuC load fails
     - drm/amdgpu: reject gang submissions under SRIOV
     - scsi: ufs: core: Disable timestamp functionality if not supported
     - scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail
     - scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted
     - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during
       TGT_RESET
     - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in
       lpfc_cleanup
     - scsi: lpfc: Define size of debugfs entry for xri rebalancing
     - scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point
       topology
     - allow finish_no_open(file, ERR_PTR(-E...))
     - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
     - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
     - f2fs: fix infinite loop in __insert_extent_tree()
     - wifi: rtw89: obtain RX path from ppdu status IE00
     - wifi: rtw89: renew a completion for each H2C command waiting C2H event
     - usb: xhci-pci: add support for hosts with zero USB3 ports
     - ipv6: np->rxpmtu race annotation
     - RDMA/irdma: Update Kconfig
     - IB/ipoib: Ignore L3 master device
     - jfs: Verify inode mode when loading from disk
     - jfs: fix uninitialized waitqueue in transaction manager
     - drm/amdgpu/atom: Check kcalloc() for WS buffer in
       amdgpu_atom_execute_table_locked()
     - [arm64] ASoC: qcom: sc8280xp: explicitly set S16LE format in
       sc8280xp_be_hw_params_fixup()
     - net: phy: clear link parameters on admin link down
     - bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state
     - [amd64] iommu/vt-d: Replace snprintf with scnprintf in
       dmar_latency_snapshot()
     - wifi: ath10k: Fix connection after GTK rekeying
     - wifi: mac80211: Track NAN interface start/stop
     - net: intel: fm10k: Fix parameter idx set but not used
     - r8169: set EEE speed down ratio to 1
     - vfio: return -ENOTTY for unsupported device feature
     - PCI/PM: Skip resuming to D0 if device is disconnected
     - remoteproc: qcom: q6v5: Avoid handling handover twice
     - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256
     - [armhf] net: dsa: microchip: Set SPI as bus interface during reset for
       KSZ8463
     - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream
     - drm/amd/display: Init dispclk from bootup clock for DCN314
     - drm/amd/display: Fix for test crash due to power gating
     - drm/amd/display: change dc stream color settings only in atomic commit
     - NFSv4: handle ERR_GRACE on delegation recalls
     - NFSv4.1: fix mount hang after CREATE_SESSION failure
     - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode
       dereferencing
     - net: bridge: Install FDB for bridge MAC on VLAN 0
     - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill()
     - [amd64] accel/habanalabs/gaudi2: fix BMON disable configuration
     - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate
     - [amd64] accel/habanalabs: return ENOMEM if less than requested pages were
       pinned
     - [amd64] accel/habanalabs/gaudi2: read preboot status after recovering from
       dirty state
     - [amd64] accel/habanalabs: support mapping cb with vmalloc-backed coherent
       memory
     - fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock
     - ext4: increase IO priority of fastcommit
     - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw
     - [armhf] ASoC: stm32: sai: manage context in set_sysclk callback
     - [armhf] ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007
     - ACPI: scan: Update honor list for RPMI System MSI
     - vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices
     - net/mlx5e: Don't query FEC statistics when FEC is disabled
     - net: macb: avoid dealing with endianness in macb_set_hwaddr()
     - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames
     - Bluetooth: SCO: Fix UAF on sco_conn_free
     - Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922
     - Bluetooth: bcsp: receive data only if registered
     - ALSA: usb-audio: add mono main switch to Presonus S1824c
     - net: stmmac: est: Drop frames causing HLBS error
     - exfat: limit log print for IO error
     - exfat: validate cluster allocation bits of the allocation bitmap
     - 6pack: drop redundant locking and refcounting
     - page_pool: Clamp pool size to max 16K pages
     - orangefs: fix xattr related buffer overflow...
     - ftrace: Fix softlockup in ftrace_module_enable
     - ksmbd: use sock_create_kern interface to create kernel socket
     - smb: client: transport: avoid reconnects triggered by pending task work
     - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr
     - usb: xhci-pci: Fix USB2-only root hub registration
     - char: misc: restrict the dynamic range to exclude reserved minors
     - drm/amd/display: Add fallback path for YCBCR422
     - ACPICA: Update dsmethod.c to get rid of unused variable warning
     - RDMA/irdma: Fix SD index calculation
     - RDMA/irdma: Remove unused struct irdma_cq fields
     - RDMA/irdma: Set irdma_cq cq_num field during CQ create
     - [arm64] RDMA/hns: Fix recv CQ and QP cache affinity
     - [arm64] RDMA/hns: Fix the modification of max_send_sge
     - [arm64] RDMA/hns: Fix wrong WQE data when QP wraps around
     - btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation
     - btrfs: mark dirty extent range for out of bound prealloc extents
     - fs/hpfs: Fix error code for new_inode() failure in
       mkdir/create/mknod/symlink
     - clk: sunxi-ng: sun6i-rtc: Add A523 specifics
     - [arm64] rtc: pcf2127: clear minute/second interrupt
     - 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN
     - [armhf] clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled
     - [arm64] clk: scmi: Add duty cycle ops only when duty cycle is supported
     - 9p: fix /sys/fs/9p/caches overwriting itself
     - 9p: sysfs_init: don't hardcode error to ENOMEM
     - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS
     - ACPI: property: Return present device nodes only on fwnode interface
     - tools bitmap: Add missing asm-generic/bitsperlong.h include
     - tools: lib: thermal: don't preserve owner in install
     - tools: lib: thermal: use pkg-config to locate libnl3
     - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
     - [arm64] rtc: pcf2127: fix watchdog interrupt mask on pcf2131
     - net: wwan: t7xx: add support for HP DRMR-H01
     - kbuild: uapi: Strip comments before size type check
     - [arm64,armhf] ASoC: meson: aiu-encoder-i2s: fix bit clock polarity
     - drm/amdkfd: Fix mmap write lock not release
     - ceph: add checking of wait_for_completion_killable() return value
     - ceph: fix potential race condition in ceph_ioctl_lazyio()
     - ceph: refactor wake_up_bit() pattern of calling
     - ceph: fix multifs mds auth caps issue
     - [amd64] x86: use cmov for user address masking
     - [amd64] x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro
     - [amd64] x86: uaccess: don't use runtime-const rewriting in modules
     - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again
     - btrfs: ensure no dirty metadata is written back for an fs with errors
     - media: uvcvideo: Use heuristic to find stream entity
     - media: videobuf2: forbid remove_bufs when legacy fileio is active
     - [arm64] drm/mediatek: Disable AFBC support on Mediatek DRM driver
     - Revert "wifi: ath10k: avoid unnecessary wait for service ready message"
       (Closes: #1120680)
     - ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader
       catches up
     - [riscv64] ptdump: use seq_puts() in pt_dump_seq_puts() macro
     - Bluetooth: hci_event: validate skb length for unknown CC opcode
     - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2()
     - [armhf] net: dsa: tag_brcm: legacy: reorganize functions
     - [armhf] net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for
       bcm63xx
     - net: vlan: sync VLAN features with lower device
     - gpio: swnode: don't use the swnode's name as the key for GPIO lookup
     - gpiolib: fix invalid pointer access in debugfs
     - [armhf] net: dsa: b53: fix resetting speed and pause on forced link
     - [armhf] net: dsa: b53: fix bcm63xx RGMII port link adjustment
     - [armhf] net: dsa: b53: fix enabling ip multicast
     - [armhf] net: dsa: b53: stop reading ARL entries if search is done
     - sctp: Hold RCU read lock while iterating over address list
     - sctp: Prevent TOCTOU out-of-bounds write
     - sctp: Hold sock lock while iterating over address list
     - net: ionic: add dma_wmb() before ringing TX doorbell
     - net: ionic: map SKB after pseudo-header checksum prep
     - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
     - bnxt_en: Fix a possible memory leak in bnxt_ptp_init
     - bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type
     - bnxt_en: Refactor bnxt_free_ctx_mem()
     - bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem()
     - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup
     - net/mlx5e: Fix return value in case of module EEPROM read error
     - [arm64] net: ti: icssg-prueth: Fix fdb hash size configuration
     - net/mlx5e: SHAMPO, Fix skb size check for 64K pages
     - [armhf] net: dsa: microchip: Fix reserved multicast address table
       programming
     - net: bridge: fix use-after-free due to MST port state bypass
     - net: bridge: fix MST static key usage
     - tracing: Fix memory leaks in create_field_var()
     - drm/amd/display: Enable mst when it's detected but yet to be initialized
     - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb
     - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()
     - [arm64] rtc: rx8025: fix incorrect register reference
     - [amd64] x86/microcode/AMD: Add more known models to entry sign checking
     - smb: client: validate change notify buffer before copy
     - smb: client: fix potential UAF in smb2_close_cached_fid()
     - drm/amdgpu/smu: Handle S0ix for vangogh
     - drm/amd/display: Fix NULL deref in debugfs odm_combine_segments
     - virtio-net: fix received length check in big packets
     - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC
     - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers
     - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel
       ADL
     - scsi: ufs: core: Add a quirk to suppress link_startup_again
     - drm/amd/display: update color on atomic commit time
     - ACPI: SPCR: Check for table version when using precise baudrate
     - drm/amdgpu: Fix unintended error log in VCN5_0_0
     - drm/amdgpu: Fix function header names in amdgpu_connectors.c
     - drm/amd/display: Fix black screen with HDMI outputs
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.59
     - [arm64] drm/mediatek: Add pm_runtime support for GCE power control
     - [amd64] drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD
     - [amd64] drm/i915: Fix conversion between clock ticks and nanoseconds
     - smb: client: fix refcount leak in smb2_set_path_attr
     - drm/amd: Fix suspend failure with secure display TA
     - drm/xe/guc: Synchronize Dead CT worker with unbind
     - drm/xe: Move declarations under conditional branch
     - drm/xe: Do clean shutdown also when using flr
     - [arm64] kprobes: check the return value of set_memory_rox()
     - [riscv64] clear hot-unplugged cores from all task mm_cpumasks to avoid
       rfence errors
     - [riscv64] acpi: avoid errors caused by probing DT devices when ACPI is
       used
     - drm/amdgpu: remove two invalid BUG_ON()s
     - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks
     - drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM
     - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices
     - NFS4: Fix state renewals missing after boot
     - NFS4: Apply delay_retrans to async operations
     - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
     - HID: nintendo: Wait longer for initial probe
     - NFS: check if suid/sgid was cleared after a write as needed
     - HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel
     - exfat: fix improper check of dentry.stream.valid_size
     - smb/server: fix possible memory leak in smb2_read()
     - smb/server: fix possible refcount leak in smb2_sess_setup()
     - HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL
     - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
     - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp()
     - erofs: avoid infinite loop due to incomplete zstd-compressed data
     - [arm64,armhf] net: fec: correct rx_bytes statistic for the case SHIFT16 is
       set
     - net: phy: micrel: Introduce lanphy_modify_page_reg
     - net: phy: micrel: Replace hardcoded pages with defines
     - net: phy: micrel: lan8814 fix reset of the QSGMII interface
     - NFSD: Skip close replay processing if XDR encoding fails
     - Bluetooth: MGMT: cancel mesh send timer when hdev removed
     - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
     - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
     - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
     - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
     - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
     - net/smc: fix mismatch between CLC header and proposal
     - net/handshake: Fix memory leak in tls_handshake_accept()
     - tipc: Fix use-after-free in tipc_mon_reinit_self().
     - net: mdio: fix resource leak in mdiobus_register_device()
     - wifi: mac80211: skip rate verification for not captured PSDUs
     - af_unix: Initialise scc_index in unix_add_edge().
     - net_sched: act_connmark: use RCU in tcf_connmark_dump()
     - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak
     - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
     - net/mlx5e: Fix maxrate wraparound in threshold between units
     - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
     - net/mlx5e: Fix potentially misleading debug message
     - net_sched: limit try_bulk_dequeue_skb() batches
     - virtio-net: fix incorrect flags recording in big mode
     - hsr: Fix supervision frame sending on HSRv0
     - [amd64] ACPI: CPPC: Detect preferred core availability on online CPUs
     - [amd64] ACPI: CPPC: Check _CPC validity for only the online CPUs
     - [amd64] ACPI: CPPC: Perform fast check switch only for online CPUs
     - [amd64] ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs
     - Bluetooth: L2CAP: export l2cap_chan_hold for modules
     - acpi,srat: Fix incorrect device handle check for Generic Initiator
     - regulator: fixed: fix GPIO descriptor leak on register failure
     - [arm64] ASoC: codecs: va-macro: fix resource leak in probe error path
     - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
     - ASoC: tas2781: fix getting the wrong device number
     - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect()
     - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS
     - simplify nfs_atomic_open_v23()
     - NFSv2/v3: Fix error handling in nfs_atomic_open_v23()
     - NFS: sysfs: fix leak when nfs_client kobject add fails
     - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync()
     - NFS: Fix LTP test failures when timestamps are delegated
     - ALSA: usb-audio: Fix NULL pointer dereference in
       snd_usb_mixer_controls_badd
     - acpi/hmat: Fix lockdep warning for hmem_register_resource()
     - bpf: Add bpf_prog_run_data_pointers()
     - bpf: account for current allocated stack depth in
       widen_imprecise_scalars()
     - [riscv64] irqchip/riscv-intc: Add missing free() callback in
       riscv_intc_domain_ops
     - wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in
       error path
     - proc: fix the issue of proc_mem_open returning NULL
     - ext4: introduce ITAIL helper
     - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()
       (CVE-2025-22121)
     - Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)
     - f2fs: fix to avoid overflow while left shift operation (CVE-2025-40077)
     - hostfs: Fix only passing host root in boot stage with new mount
     - virtio-fs: fix incorrect check for fsvq->kobj
     - fs/namespace: correctly handle errors returned by grab_requested_mnt_ns
     - sched_ext: Fix unsafe locking in the scx_dump_state()
     - Revert "netfilter: nf_tables: Reintroduce shortened deletion
       notifications"
     - netfilter: nf_tables: reject duplicate device on updates (CVE-2025-38678)
     - [arm64] dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1
     - [arm64] dts: rockchip: Make RK3588 GPU OPP table naming less generic
     - [armhf] dts: imx51-zii-rdu1: Fix audmux node names
     - HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
     - HID: playstation: Fix memory leak in dualshock4_get_calibration_data()
     - HID: uclogic: Fix potential memory leak in error path
     - [amd64] KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated
     - nfsd: fix refcount leak in nfsd_set_fh_dentry() (CVE-2025-40212)
     - nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes
     - NFSD: free copynotify stateid in nfs4_free_ol_stateid()
     - ksmbd: close accepted socket when per-IP limit rejects connection
     - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
     - strparser: Fix signed/unsigned mismatch bug
     - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent
     - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
     - nilfs2: avoid having an active sc_timer before freeing sci
     - wifi: mac80211: reject address change while connecting
     - fs/proc: fix uaf in proc_readdir_de()
     - mm/mm_init: fix hash table order logging in alloc_large_system_hash()
     - mm/shmem: fix THP allocation and fallback loop
     - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4
     - mmc: dw_mmc-rockchip: Fix wrong internal phase calculate
     - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer
     - cifs: client: fix memory leak in smb3_fs_context_parse_param
     - codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for
       slabobj_ext
     - crash: fix crashkernel resource shrink
     - smb: client: fix cifs_pick_channel when channel needs reconnect
     - spi: Try to get ACPI GPIO IRQ earlier
     - [amd64] x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev
     - ftrace: Fix BPF fexit with livepatch
     - PM: hibernate: Emit an error when image writing fails
     - PM: hibernate: Use atomic64_t for compressed_size variable
     - btrfs: zoned: fix conventional zone capacity calculation
     - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe()
     - btrfs: do not update last_log_commit when logging inode due to a new name
     - btrfs: release root after error in data_reloc_print_warning_inode()
     - drm/amdkfd: relax checks for over allocation of save area
     - drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces
     - [arm64] pmdomain: arm: scmi: Fix genpd leak on provider registration
       failure
     - [armhf] pmdomain: imx: Fix reference count leak in imx_gpc_remove
     - [arm64,armhf] pmdomain: samsung: plug potential memleak during probe
     - mptcp: fix MSG_PEEK stream corruption
     - wifi: cfg80211: add an hrtimer based delayed work item
     - wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work
     - mm, percpu: do not consider sleepable allocations atomic
     - [amd64] KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn()
     - [amd64] KVM: guest_memfd: Remove RCU-protected attribute from
       slot->gmem.file
     - [amd64] KVM: guest_memfd: Remove bindings on memslot deletion when gmem is
       dying
     - net: netpoll: Individualize the skb pool
     - net: netpoll: flush skb pool during cleanup
     - net: netpoll: fix incorrect refcount handling causing incorrect cleanup
     - [amd64] KVM: VMX: Split out guts of EPT violation to common/exposed
       function
     - [amd64] KVM: VMX: Fix check for valid GVA on an EPT violation
     - ALSA: hda: Fix missing pointer check in hda_component_manager_init
       function (CVE-2025-40097)
     - io_uring/napi: fix io_napi_entry RCU accesses
     - uio_hv_generic: Set event for all channels on the device
       (Closes: #1120602)
     - mm/memory: do not populate page table entries beyond i_size
     - mm/truncate: unmap large folio on split failure
     - mm/secretmem: fix use-after-free race in fault handler
     - mm/huge_memory: do not change split_huge_page*() target order silently
     - mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to >0 order
     - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
     - net: phy: micrel: Fix lan8814_config_init
     - net: netpoll: ensure skb_pool list is always initialized
     - proc: proc_maps_open allow proc_mem_open to return NULL
     - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete
       (CVE-2025-40213)
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.60
     - [arm64] KVM: arm64: Check the untrusted offset in FF-A memory share
     - timers: Fix NULL function pointer race in timer_shutdown_sync()
     - HID: amd_sfh: Stop sensor before starting
     - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155
       (Closes: #1114557)
     - [arm64] dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5
     - mtdchar: fix integer overflow in read/write ioctls
     - isofs: check the return value of sb_min_blocksize() in isofs_fill_super
     - shmem: fix tmpfs reconfiguration (remount) when noswap is set
     - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector
     - mptcp: Disallow MPTCP subflows from sockmap
     - mptcp: Fix proto fallback detection with BPF
     - ata: libata-scsi: Fix system suspend for a security locked drive
     - smb: client: introduce close_cached_dir_locked()
     - ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan()
     - be2net: pass wrb_params in case of OS2BMC
     - [armhf] net: dsa: microchip: lan937x: Fix RGMII delay tuning
     - [arm64,armhf] Revert "drm/tegra: dsi: Clear enable register if powered by
       bootloader"
     - Input: cros_ec_keyb - fix an invalid memory access
     - Input: goodix - add support for ACPI ID GDIX1003
     - Input: pegasus-notetaker - fix potential out-of-bounds access
     - mm/mempool: fix poisoning order>0 pages with HIGHMEM
     - nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot
     - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl()
     - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
     - scsi: sg: Do not sleep in atomic context
     - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
     - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups
     - mptcp: fix race condition in mptcp_schedule_work()
     - mptcp: fix ack generation for fallback msk
     - mptcp: fix duplicate reset on fastclose
     - mptcp: fix premature close in case of fallback
     - mptcp: avoid unneeded subflow-level drops
     - mptcp: decouple mptcp fastclose from tcp close
     - mptcp: do not fallback when OoO is present
     - [arm64,armhf] drm/tegra: dc: Fix reference leak in tegra_dc_couple()
     - drm/radeon: delete radeon_fence_process in is_signaled, no deadlock
     - drm/amd: Skip power ungate during suspend for VPE
     - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled
     - drm/amd/display: Increase DPCD read retries
     - drm/amd/display: Move sleep into each retry for retrieve_link_cap()
     - drm/amd/display: Fix pbn to kbps Conversion
     - drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5
     - xfrm: drop SA reference in xfrm_state_update if dir doesn't match
     - xfrm: set err and extack on failure to create pcpu SA
     - xfrm: Determine inner GSO type from packet inner protocol
     - xfrm: Prevent locally generated packets from direct output in tunnel mode
     - [amd64] pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe()
     - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()
     - [arm64,armhf] drm/tegra: Add call to put_pid()
     - net: mlxsw: linecards: fix missing error check in
       mlxsw_linecard_devlink_info_get()
     - net: openvswitch: remove never-working support for setting nsh fields
     - nvme-multipath: fix lockdep WARN due to partition scan work
     - [s390x] ctcm: Fix double-kfree
     - [amd64] platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes
       to errnos
     - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and
       qede_tpa_end()
     - [amd64,arm64] idpf: fix possible vport_config NULL pointer deref in remove
     - ice: fix PTP cleanup on driver removal in error path
     - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
     - net/mlx5: Clean up only new IRQ glue on request_irq() failure
     - af_unix: Cache state->msg in unix_stream_read_generic().
     - af_unix: Read sk_peek_offset() again after sleeping in
       unix_stream_read_generic().
     - cifs: fix memory leak in smb3_fs_context_parse_param error path
     - vsock: Ignore signal/timeout on connect() if already established
     - bcma: don't register devices disabled in OF
     - cifs: fix typo in enable_gcm_256 module parameter
     - scsi: core: Fix a regression triggered by scsi_host_busy()
     - [amd64] x86/microcode/AMD: Limit Entrysign signature checking to known
       generations
     - net: tls: Change async resync helpers argument
     - blk-crypto: use BLK_STS_INVAL for alignment errors
     - net: tls: Cancel RX async resync request on rcd_delta overflow
     - ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check
     - [arm64] KVM: arm64: Make all 32bit ID registers fully writable
     - drm/xe: Prevent BIT() overflow when handling invalid prefetch region
     - [s390x] mm: Fix __ptep_rdp() inline assembly
     - ALSA: usb-audio: fix uac2 clock source at terminal parser
     - tracing/tools: Fix incorrcet short option in usage text for --threads
     - drm/amdgpu: fix gpu page fault after hibernation on PF passthrough
     - smb: client: fix incomplete backport in cfids_invalidation_worker()
     - tty/vt: fix up incorrect backport to stable releases
     - maple_tree: fix tracepoint string pointers
     - [amd64] drm/i915/dp_mst: Disable Panel Replay
     - mptcp: fix a race in mptcp_pm_del_add_timer()
     - xfs: Replace strncpy with memcpy
     - xfs: fix out of bounds memory read error in symlink repair
     - drm/amd/display: avoid reset DTBCLK at clock init
     - drm/amd/display: disable DPP RCG before DPP CLK enable
     - drm/amd/display: Insert dccg log for easy debug
     - drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched
     - Revert "gpio: swnode: don't use the swnode's name as the key for GPIO
       lookup"
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.61
     - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers
     - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted
       URBs
     - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before
       accessing header
     - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before
       accessing data
     - Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso
       interface
     - Bluetooth: hci_core: Fix triggering cmd_timer for HCI_OP_NOP
     - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind
     - Bluetooth: SMP: Fix not generating mackey and ltk when repairing
     - net: sched: generalize check for no-queue qdisc on TX queue
     - veth: apply qdisc backpressure on full ptr_ring to reduce TX drops
     - veth: prevent NULL pointer dereference in veth_xdp_rcv
     - veth: more robust handing of race to avoid txq getting stuck
     - veth: reduce XDP no_direct return section to fix race
     - [amd64] platform/x86: intel: punit_ipc: fix memory corruption
     - net: aquantia: Add missing descriptor cache invalidation on ATL2
     - net: lan966x: Fix the initialization of taprio
     - drm/xe: Fix conversion from clock ticks to milliseconds
     - net/mlx5e: Fix validation logic in rate limiting
     - team: Move team device type change at the end of team_port_add
     - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling
     - net: wwan: mhi: Keep modem name match with Foxconn T99W640
     - net: atlantic: fix fragment overflow handling in RX path
     - [arm64,armhf] net: fec: cancel perout_timer when PEROUT is disabled
     - [arm64,armhf] net: fec: do not update PEROUT if it is enabled
     - [arm64,armhf] net: fec: do not allow enabling PPS and PEROUT
       simultaneously
     - [arm64,armhf] net: fec: do not register PPS event for PEROUT
     - iio: st_lsm6dsx: Fixed calibrated timestamp calculation
     - [arm64] mailbox: mtk-cmdq: Refine DMA address handling for the command
       buffer
     - mailbox: pcc: Refactor error handling in irq handler into separate
       function
     - mailbox: pcc: don't zero error register
     - fs/namespace: fix reference leak in grab_requested_mnt_ns
     - spi: spi-mem: Allow specifying the byte order in Octal DTR mode
     - spi: spi-mem: Extend spi-mem operations with a per-operation maximum
       frequency
     - spi: spi-mem: Add a new controller capability
     - [arm64] spi: nxp-fspi: Support per spi-mem operation frequency switches
     - [arm64] spi: spi-nxp-fspi: remove the goto in probe
     - [arm64] spi: spi-nxp-fspi: Add OCT-DTR mode support
     - [arm64] spi: nxp-fspi: Propagate fwnode in ACPI case as well
     - Revert "drm/amd/display: Move setup_stream_attribute"
     - [amd64] Revert "perf/x86: Always store regs->ip in
       perf_callchain_kernel()"
     - iio: buffer-dma: support getting the DMA channel
     - iio: buffer-dmaengine: enable .get_dma_dev()
     - iio: buffer: support getting dma channel from the buffer
     - iio: accel: bmc150: Fix irq assumption regression (Closes: #1106411)
     - tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs
     - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230
     - [arm64] dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity
     - Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref
     - can: sja1000: fix max irq loop handling
     - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling
     - ceph: fix crash in process_v2_sparse_read() for encrypted directories
     - dm-verity: fix unreliable memory allocation
     - drivers/usb/dwc3: fix PCI parent check
     - smb: client: fix memory leak in cifs_construct_tcon()
     - [amd64] thunderbolt: Add support for Intel Wildcat Lake
     - [arm64] slimbus: ngd: Fix reference count leak in
       qcom_slim_ngd_notify_slaves
     - nvmem: layouts: fix nvmem_layout_bus_uevent
     - firmware: stratix10-svc: fix bug in saving controller data
     - mm/memfd: fix information leak in hugetlb folios
     - mmc: sdhci-of-dwcmshc: Promote the th1520 reset handling to ip level
     - mptcp: clear scheduled subflows on retransmit
     - mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in
       mptcp_do_fastclose().
     - [arm*] serial: amba-pl011: prefer dma_mapping_error() over explicit
       address checking
     - usb: cdns3: Fix double resource release in cdns3_pci_probe
     - usb: gadget: f_eem: Fix memory leak in eem_unwrap
     - usb: storage: Fix memory leak in USB bulk transport
     - USB: storage: Remove subclass and protocol overrides from Novatek quirk
     - usb: storage: sddr55: Reject out-of-bound new_pba
     - usb: uas: fix urb unmapping issue when the uas device is remove during
       ongoing data transfer
     - [amd64,arm64] usb: dwc3: pci: add support for the Intel Nova Lake -S
     - [amd64,arm64] usb: dwc3: pci: Sort out the Intel device IDs
     - [amd64,arm64] usb: dwc3: Fix race condition between concurrent
       dwc3_remove_requests() call paths
     - xhci: fix stale flag preventig URBs after link state error is cleared
     - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host
     - xhci: dbgtty: fix device unregister
     - USB: serial: ftdi_sio: add support for u-blox EVK-M101
     - USB: serial: option: add support for Rolling RW101R-GL
     - drm: sti: fix device leaks at component probe
     - drm/amd/amdgpu: reserve vm invalidation engine for uni_mes
     - drm/amd/display: Check NULL before accessing
     - drm/amd/display: Don't change brightness for disabled connectors
     - [armhf] net: dsa: microchip: common: Fix checks on irq_find_mapping()
     - [armhf] net: dsa: microchip: ptp: Fix checks on irq_find_mapping()
     - [armhf] net: dsa: microchip: Don't free uninitialized ksz_irq
     - libceph: fix potential use-after-free in have_mon_and_osd_map()
     - libceph: prevent potential out-of-bounds writes in
       handle_auth_session_key()
     - libceph: replace BUG_ON with bounds check for map->max_osd
     - staging: rtl8712: Remove driver using deprecated API wext
     - nfsd: Replace clamp_t in nfsd4_get_drc_mem()
     - usb: typec: ucsi: psy: Set max current to zero when disconnected
     - usb: udc: Add trace event for usb_gadget_set_state
     - usb: gadget: udc: fix use-after-free in usb_gadget_state_work
     - mm/huge_memory: fix NULL pointer deference when splitting folio
     - [amd64] KVM: SVM: Introduce svm_recalc_lbr_msr_intercepts()
     - [amd64] KVM: nSVM: Always recalculate LBR MSR intercepts in
       svm_update_lbrv()
     - [amd64] KVM: nSVM: Fix and simplify LBR virtualization handling with
       nested
     - [amd64] KVM: SVM: Fix redundant updates of LBR MSR intercepts
     - drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup
     - [armhf] net: dsa: microchip: Do not execute PTP driver code for
       unsupported switches
     - [armhf] net: dsa: microchip: Free previously initialized ports on init
       failures
     - wifi: ath12k: correctly handle mcast packets for clients
     - Revert "ACPI: Suppress misleading SPCR console message when SPCR table is
       absent"
     - [amd64] drm/i915/dp: Initialize the source OUI write timestamp always
     - [arm64] spi: spi-nxp-fspi: Check return value of devm_mutex_init()
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.62
     - xfrm: delete x->tunnel as we delete x
     - Revert "xfrm: destroy xfrm_state synchronously on net exit path"
     - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that
       were never added
     - xfrm: flush all states in xfrm_state_fini
     - Documentation: process: Also mention Sasha Levin as stable tree maintainer
     - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system
       corrupted
     - ext4: refresh inline data size before write operations
     - ksmbd: ipc: fix use-after-free in ipc_msg_send_request
     - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()
     - [amd64] KVM: SVM: Don't skip unrelated instruction if INT3/INTO is
       replaced
     - USB: serial: option: add Foxconn T99W760
     - USB: serial: option: add Telit Cinterion FE910C04 new compositions
     - USB: serial: option: move Telit 0x10c7 composition in the right place
     - USB: serial: ftdi_sio: match on interface number for jtag
     - serial: add support of CPCI cards
     - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC
     - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC
     - ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct()
     - [arm64,armhf] ipi: imx: keep dma request disabled before dma transfer
       setup
     - drm/vmwgfx: Use kref in vmw_bo_dirty
     - Bluetooth: btrtl: Avoid loading the config file on security chips
     - smb: fix invalid username check in smb3_fs_context_parse_param()
     - drm/amdkfd: Fix GPU mappings for APU after prefetch
     - ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series
     - bfs: Reconstruct file type when loading from disk
     - HID: hid-input: Extend Elan ignore battery quirk to USB
     - nvme: fix admin request_queue lifetime
     - [arm64] pinctrl: qcom: msm: Fix deadlock in pinmux configuration
     - [amd64] platform/x86: acer-wmi: Ignore backlight event
     - HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list
     - [amd64] platform/x86: huawei-wmi: add keys for HONOR models
     - [amd64] platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list
     - [amd64] platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally
     - HID: elecom: Add support for ELECOM M-XT3URBK (018F)
     - wifi: rtl8xxxu: Add USB ID 2001:3328 for D-Link AN3U rev. A1
     - wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1
     - [amd64] comedi: check device's attached status in compat ioctls
     - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
     - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
     - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing
     - bus: mhi: host: pci_generic: Add Telit FN920C04 modem support
     - bus: mhi: host: pci_generic: Add Telit FN990B40 modem support
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.63
     - [arm64,armhf] gpu: host1x: Fix race in syncpt alloc/free
     - [amd64] accel/ivpu: Prevent runtime suspend during context abort work
     - [amd64] accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume
       fail
     - [amd64] accel/ivpu: Make function parameter names consistent
     - [amd64] accel/ivpu: Fix DCT active percent format
     - drm/vgem-fence: Fix potential deadlock on release
     - USB: Fix descriptor count when handling invalid MBIM extended descriptor
     - [arm64] pinctrl: renesas: rzg2l: Fix PMC restore
     - [arm64] clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle
       callback
     - [arm64] clk: renesas: Use str_on_off() helper
     - [arm64] clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register
     - [arm64] clk: renesas: cpg-mssr: Read back reset registers to assure values
       latched
     - HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync()
     - objtool: Fix standalone --hacks=jump_label
     - objtool: Fix weak symbol detection
     - wifi: ath10k: Avoid vdev delete timeout when firmware is already down
     - wifi: ath10k: Add missing include of export.h
     - wifi: ath10k: move recovery check logic into a new work
     - wifi: ath11k: restore register window after global reset
     - sched/fair: Forfeit vruntime on yield
     - [arm*] irqchip/irq-brcmstb-l2: Fix section mismatch
     - [arm64,armhf] irqchip/imx-mu-msi: Fix section mismatch
     - [arm64] irqchip/renesas-rzg2l: Fix section mismatch
     - [riscv64] irqchip/starfive-jh8100: Fix section mismatch
     - [arm64] irqchip/qcom-irq-combiner: Fix section mismatch
     - crypto: authenc - Correctly pass EINPROGRESS back up to the caller
     - ntfs3: fix uninit memory after failed mi_read in mi_format_new
     - ntfs3: Fix uninit buffer allocated by __getname()
     - dt-bindings: clock: qcom,x1e80100-gcc: Add missing video resets
     - dt-bindings: clock: qcom,x1e80100-gcc: Add missing USB4 clocks/resets
     - clk: qcom: gcc-x1e80100: Add missing USB4 clocks/resets
     - rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu()
     - inet: Avoid ehash lookup race in inet_ehash_insert()
     - inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule()
     - firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc
     - block/mq-deadline: Introduce dd_start_request()
     - block/mq-deadline: Switch back to a single dispatch list
     - [arm64] dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1
       props
     - [arm64] dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl
     - [arm64] dts: imx8mp-venice-gw702x: remove off-board uart
     - [arm64] dts: imx8mp-venice-gw702x: remove off-board sdhc1
     - perf annotate: Check return value of evsel__get_arch() properly
     - [arm64] dts: exynos: gs101: fix sysreg_apm reg property
     - uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe
     - soc: Switch back to struct platform_driver::remove()
     - [arm64] soc: qcom: gsbi: fix double disable caused by devm
     - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
     - wifi: ath11k: fix VHT MCS assignment
     - wifi: ath11k: fix peer HE MCS assignment
     - [s390x] smp: Fix fallback CPU detection
     - [s390x] ap: Don't leak debug feature files if AP instructions are not
       available
     - [arm64] dts: ti: k3-am62p: Fix memory ranges for GPU
     - firmware: imx: scu-irq: fix OF node leak in
     - [arm64] dts: qcom: x1e80100: Fix compile warnings for USB HS controller
     - [arm64] dts: qcom: x1e80100: Add missing quirk for HS only USB controller
     - [arm64] dts: qcom: sdm845-oneplus: Correct gpio used for slider
     - [arm64] dts: qcom: sm8650: set ufs as dma coherent
     - [arm64] dts: qcom: qcm6490-shift-otter: Add missing reserved-memory
     - phy: mscc: Fix PTP for VSC8574 and VSC8572
     - sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock().
     - RDMA/rxe: Fix null deref on srq->rq.queue after resize failure
     - Revert "mtd: rawnand: marvell: fix layouts"
     - [arm64,armhf] mtd: nand: relax ECC parameter validation check
     - perf: Remove get_perf_callchain() init_nr argument
     - bpf: Refactor stack map trace depth calculation into helper function
     - bpf: Fix stackmap overflow check in __bpf_get_stackid()
     - [amd64] perf/x86/intel/cstate: Remove PC3 support from LunarLake
     - task_work: Fix NMI race condition
     - [amd64] x86/dumpstack: Prevent KASAN false positive warnings in
       __show_regs()
     - tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set
     - [arm64] soc: qcom: smem: fix hwspinlock resource leak in probe error paths
     - [armhf] pinctrl: stm32: fix hwspinlock resource leak in probe function
     - i3c: fix refcount inconsistency in i3c_master_register
     - i3c: master: svc: Prevent incomplete IBI transaction
     - wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload()
     - [arm64] interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS
     - [arm64] dts: qcom: msm8996: add interconnect paths to USB2 controller
     - interconnect: debugfs: Fix incorrect error handling for NULL path
     - drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource()
     - perf lock contention: Load kernel map before lookup
     - perf record: skip synthesize event when open evsel failed
     - power: supply: rt5033_charger: Fix device node reference leaks
     - power: supply: cw2015: Check devm_delayed_work_autocancel() return code
     - power: supply: max17040: Check iio_read_channel_processed() return code
     - power: supply: rt9467: Return error on failure in
       rt9467_set_value_from_ranges()
     - power: supply: rt9467: Prevent using uninitialized local variable in
       rt9467_set_value_from_ranges()
     - power: supply: wm831x: Check wm831x_set_bits() return value
     - power: supply: apm_power: only unset own apm_get_power_status
     - scsi: target: Do not write NUL characters into ASCII configfs output
     - fs/9p: Don't open remote file with APPEND mode when writeback cache is
       used
     - [arm64] drm/panthor: Handle errors returned by drm_sched_entity_init()
     - [arm64] drm/panthor: Fix group_free_queue() for partially initialized
       queues
     - [arm64] drm/panthor: Fix UAF race between device unplug and FW event
       processing
     - [arm64] drm/panthor: Fix race with suspend during unplug
     - [arm64] drm/panthor: Fix UAF on kernel BO VA nodes
     - libbpf: Fix parsing of multi-split BTF
     - [armhf] dts: am335x-netcom-plus-2xx: add missing GPIO labels
     - [armhf] dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible
     - [armhf] dts: omap3: n900: Correct obsolete TWL4030 power compatible
     - [amd64] x86/boot: Fix page table access in 5-level to 4-level paging
       transition
     - efi/libstub: Fix page table access in 5-level to 4-level paging transition
     - ext4: correct the checking of quota files before moving extents
     - [amd64] perf/x86/intel: Correct large PEBS flag check
     - regulator: core: disable supply if enabling main regulator fails
     - md: fix rcu protection in md_wakeup_thread
     - nbd: defer config put in recv_work
     - scsi: stex: Fix reboot_notifier leak in probe error path
     - scsi: smartpqi: Fix device resources accessed after device removal
     - dt-bindings: PCI: amlogic: Fix the register name of the DBI region
     - RDMA/rtrs: server: Fix error handling in get_or_create_srv
     - ntfs3: init run lock for extend inode
     - [arm64] drm/panthor: Fix potential memleak of vma structure
     - scsi: ufs: core: fix incorrect buffer duplication in
       ufshcd_read_string_desc()
     - [amd64] cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs
     - [powerpc*] kdump: Fix size calculation for hot-removed memory ranges
     - [powerpc*] 32: Fix unpaired stwcx. on interrupt exit
     - wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper()
     - nbd: defer config unlock in nbd_genl_connect
     - coresight: Change device mode to atomic type
     - [arm64] coresight: etm4x: Correct polling IDLE bit
     - [arm64] coresight: etm4x: Extract the trace unit controlling
     - [arm64] coresight: etm4x: Add context synchronization before enabling
       trace
     - lib/vsprintf: Check pointer before dereferencing in time_and_date()
     - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()
     - ACPI: property: Fix fwnode refcount leak in
       acpi_fwnode_graph_parse_endpoint()
     - scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls
     - leds: netxbig: Fix GPIO descriptor leak in error paths
     - bpf: Free special fields when update [lru_,]percpu_hash maps
     - PCI: keystone: Exit ks_pcie_probe() for invalid mode
     - [arm64] dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A
     - [arm64] dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A
     - [arm64] dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C
     - [amd64] crypto: iaa - Fix incorrect return value in save_iaa_wq()
     - [arm64] drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype
     - ps3disk: use memcpy_{from,to}_bvec index
     - bpf: Handle return value of ftrace_set_filter_ip in register_fentry
     - bpf: Check skb->transport_header is set in bpf_skb_check_mtu
     - watchdog: wdat_wdt: Fix ACPI table leak in probe function
     - watchdog: starfive: Fix resource leak in probe error path
     - tracefs: fix a leak in eventfs_create_events_dir()
     - NFSD/blocklayout: Fix minlength check in proc_layoutget
     - block/blk-throttle: Fix throttle slice time for SSDs
     - [arm64] drm/msm/a2xx: stop over-complaining about the legacy firmware
     - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
     - bpf: Fix invalid prog->stats access when update_effective_progs fails
     - [powerpc*] 64s/hash: Restrict stress_hpt_struct memblock region to within
       RMA limit
     - [powerpc*] 64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE
       format
     - fs/ntfs3: out1 also needs to put mi
     - fs/ntfs3: Prevent memory leaks in add sub record
     - [arm64] drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue
     - [arm64] drm/msm/a6xx: Flush LRZ cache before PT switch
     - [arm64] drm/msm/a6xx: Fix the gemnoc workaround
     - [arm64] drm/msm/a6xx: Improve MX rail fallback in RPMH vote init
     - ipv6: clear RA flags when adding a static route (Closes: #1117959)
     - pwm: bcm2835: Make sure the channel is enabled after pwm_request()
     - scsi: qla2xxx: Fix improper freeing of purex item
     - [amd64] iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb
     - wifi: mac80211: fix CMAC functions not handling errors
     - [arm64] mfd: mt6397-irq: Fix missing irq_domain_remove() in error path
     - [arm64] mfd: mt6358-irq: Fix missing irq_domain_remove() in error path
     - leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM
     - [arm64] phy: renesas: rcar-gen3-usb2: Fix an error handling path in
       rcar_gen3_phy_usb2_probe()
     - [arm64] phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth
     - [arm64] phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from
       exceeding the limits
     - net: phy: adin1100: Fix software power-down ready condition
     - cpuset: Treat cpusets in attaching as populated
     - wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
     - RAS: Report all ARM processor CPER information to userspace
     - ima: Handle error code returned by ima_filter_rule_match()
     - usb: chaoskey: fix locking for O_NONBLOCK
     - usb: dwc2: disable platform lowlevel hw resources during shutdown
     - usb: dwc2: fix hang during shutdown if set as peripheral
     - usb: dwc2: fix hang during suspend if set as peripheral
     - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE
     - [riscv64] KVM: Fix guest page fault within HLV* instructions
     - erofs: limit the level of fs stacking for file-backed mounts
     - RDMA/bnxt_re: Fix the inline size for GenP7 devices
     - RDMA/bnxt_re: Pass correct flag for dma mr creation
     - ASoC: tas2781: correct the wrong period
     - mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()
     - firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc
     - staging: fbtft: core: fix potential memory leak in fbtft_probe_common()
     - [arm64] iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables
     - btrfs: fix leaf leak in an error path in btrfs_del_items()
     - PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition
     - drm/nouveau: restrict the flush page to a 32-bit address
     - iomap: factor out a iomap_dio_done helper
     - iomap: always run error completions in user context
     - wifi: ieee80211: correct FILS status codes
     - backlight: led-bl: Add devlink to supplier LEDs
     - backlight: lp855x: Fix lp855x.h kernel-doc warnings
     - [arm64] iommu/arm-smmu-qcom: Enable use of all SMR groups when running
       bare-metal
     - RDMA/irdma: Fix data race in irdma_sc_ccq_arm
     - RDMA/irdma: Fix data race in irdma_free_pble
     - RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY
     - [arm64] drm/panthor: Avoid adding of kernel BOs to extobj list
     - gfs2: Prevent recursive memory reclaim
     - firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER
     - drm/amd/display: Fix logical vs bitwise bug in
       get_embedded_panel_info_v2_1()
     - hwmon: sy7636a: Fix regulator_enable resource leak on error path
     - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4
     - ublk: prevent invalid access with DEBUG
     - ext4: improve integrity checking in __mb_check_buddy by enhancing order-0
       validation
     - of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node
     - virtio_vdpa: fix misleading return in void function
     - virtio: fix typo in virtio_device_ready() comment
     - virtio: fix whitespace in virtio_config_ops
     - virtio: fix grammar in virtio_queue_info docs
     - virtio: fix virtqueue_set_affinity() docs
     - vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues
     - vhost: Fix kthread worker cgroup failure handling
     - vdpa/pds: use %pe for ERR_PTR() in event handler registration
     - [amd64] ASoC: Intel: catpt: Fix error path in hw_params()
     - [armhf] dts: samsung: universal_c210: turn off SDIO WLAN chip during
       system suspend
     - [armhf] dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during
       system suspend
     - [armhf] dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during
       system suspend
     - [armhf] dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during
       system suspend
     - regulator: core: Protect regulator_supply_alias_list with
       regulator_list_mutex
     - resource: replace open coded resource_intersection()
     - resource: introduce is_type_match() helper and use it
     - Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()"
     - netfilter: flowtable: check for maximum number of encapsulations in bridge
       vlan
     - netfilter: nf_conncount: rework API to use sk_buff directly
     - netfilter: nft_connlimit: update the count if add was skipped
     - net: stmmac: fix rx limit check in stmmac_rx_zc()
     - vfio/pci: Use RCU for error/request triggers to avoid circular locking
     - net: phy: aquantia: check for NVMEM deferral
     - mtd: lpddr_cmds: fix signed shifts in lpddr_cmds
     - [arm64] remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs
     - md/raid5: fix IO hang when array is broken with IO inflight
     - net: hsr: remove one synchronize_rcu() from hsr_del_port()
     - net: hsr: remove synchronize_rcu() from hsr_add_port()
     - net: hsr: Create and export hsr_get_port_ndev()
     - net: hsr: create an API to get hsr port type
     - net: dsa: xrs700x: reject unsupported HSR configurations
     - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop
       (CVE-2025-68325)
     - perf tools: Mark split kallsyms DSOs as loaded
     - perf tools: Fix split kallsyms DSO counting
     - perf hist: In init, ensure mem_info is put on error paths
     - [arm64,armhf] pinctrl: single: Fix incorrect type for error return
       variable
     - fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe()
     - 9p: fix cache/debug options printing in v9fs_show_options
     - sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the
       last task migrates out
     - [amd64] platform/x86:intel/pmc: Update Arrow Lake telemetry GUID
     - f2fs: keep POSIX_FADV_NOREUSE ranges
     - f2fs: add a sysfs entry to reclaim POSIX_FADV_NOREUSE pages
     - f2fs: fix to avoid running out of free segments
     - f2fs: add carve_out sysfs node
     - f2fs: sysfs: add encoding_flags entry
     - f2fs: introduce reserved_pin_section sysfs entry
     - f2fs: add gc_boost_gc_multiple sysfs node
     - f2fs: add gc_boost_gc_greedy sysfs node
     - f2fs: maintain one time GC mode is enabled during whole zoned GC cycle
     - NFS: Avoid changing nlink when file removes and attribute updates race
     - fs/nls: Fix utf16 to utf8 conversion
     - NFS: Initialise verifiers for visible dentries in readdir and lookup
     - NFS: Initialise verifiers for visible dentries in nfs_atomic_open()
     - nfs/vfs: discard d_exact_alias()
     - NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state
     - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid
     - Revert "nfs: ignore SB_RDONLY when remounting nfs"
     - Revert "nfs: clear SB_RDONLY before getting superblock"
     - Revert "nfs: ignore SB_RDONLY when mounting nfs"
     - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
     - Expand the type of nfs_fattr->valid
     - NFS: Fix inheritance of the block sizes when automounting
     - fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8()
     - [amd64] platform/x86: asus-wmi: use brightness_set_blocking() for kbd led
     - blk-mq: Abort suspend when wakeup events are pending
     - block: fix comment for op_is_zone_mgmt() to include RESET_ALL
     - block: fix memory leak in __blkdev_issue_zero_pages
     - nvme-auth: use kvfree() for memory allocated with kvcalloc()
     - drm/plane: Fix IS_ERR() vs NULL check in
       drm_plane_create_hotspot_properties()
     - regulator: fixed: Rely on the core freeing the enable GPIO
     - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events
     - drm/nouveau: refactor deprecated strcpy
     - cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2
     - docs: hwmon: fix link to g762 devicetree binding
     - dma/pool: eliminate alloc_pages warning in atomic_pool_expand
     - ALSA: uapi: Fix typo in asound.h comment
     - drm/amdkfd: Use huge page size to check split svm range alignment
     - rtc: gamecube: Check the return value of ioremap()
     - ALSA: firewire-motu: add bounds check in put_user loop for DSP events
     - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of
       set->tag_list_lock
     - block: return unsigned int from queue_dma_alignment
     - dm-raid: fix possible NULL dereference with undefined raid type
     - dm log-writes: Add missing set_freezable() for freezable kthread
     - efi/cper: Add a new helper function to print bitmasks
     - efi/cper: Adjust infopfx size to accept an extra space
     - efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs
     - scsi: imm: Fix use-after-free bug caused by unfinished delayed work
       (CVE-2025-68324)
     - irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()
     - ocfs2: fix memory leak in ocfs2_merge_rec_left()
     - net: lan743x: Allocate rings outside ZONE_DMA
     - net: dst: introduce dst->dev_rcu
     - tcp_metrics: use dst_dev_net_rcu() (CVE-2025-40075)
     - usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt
     - usb: phy: Initialize struct usb_phy list_head
     - usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required
     - ALSA: dice: fix buffer overflow in detect_stream_formats()
     - ALSA: wavefront: Fix integer overflow in sample size validation
 .
   [ Uwe Kleine-König ]
   * [armhf] Enable LEDS_TURRIS_OMNIA as a module for Turris Omnia LED
     support.
 .
   [ Maxwell Pevner ]
   * drivers/hid: Enable HID_UNIVERSAL_PIDFF as module (Closes: #1122144)

linux-signed-arm64 (6.12.63+1) trixie; urgency=medium
 .
   * Sign kernel from linux 6.12.63-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.58
     - NFSD: Fix crash in nfsd4_read_release()
     - net: usb: asix_devices: Check return value of usbnet_get_endpoints
     - fbcon: Set fb_display[i]->mode to NULL when the mode is released
     - fbdev: atyfb: Check if pll_ops->init_pll failed
     - ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
     - ACPI: button: Call input_free_device() on failing input device
       registration
     - virtio-net: drop the multi-buffer XDP packet in zerocopy
     - fbdev: bitblit: bound-check glyph index in bit_putcs*
     - Bluetooth: rfcomm: fix modem control handling
     - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP
       Mode
     - mptcp: drop bogus optimization in __mptcp_check_push()
     - mptcp: restore window probe
     - [arm64] ASoC: qdsp6: q6asm: do not sleep while atomic
     - [s390x] pci: Restore IRQ unconditionally for the zPCI device
     - smb: client: fix potential cfid UAF in smb2_query_info_compound
     - [amd64] x86/fpu: Ensure XFD state on signal delivery
     - wifi: ath10k: Fix memory leak on unsupported WMI command
     - wifi: ath11k: Add missing platform IDs for quirk table
     - wifi: ath12k: free skb during idr cleanup callback
     - wifi: ath11k: add support for MU EDCA
     - wifi: ath11k: avoid bit operation on key flags
     - [arm64] drm/msm/a6xx: Fix GMU firmware parser
     - ALSA: usb-audio: fix control pipe direction
     - wifi: mac80211: don't mark keys for inactive links as uploaded
     - wifi: mac80211: fix key tailroom accounting leak
     - bpf: Sync pending IRQ work before freeing ring buffer
     - scsi: ufs: core: Initialize value of an attribute returned by uic cmd
     - bpf: Find eligible subprogs for private stack support
     - bpf, x86: Avoid repeated usage of bpf_prog->aux->stack_depth
     - bpf: Do not audit capability check in do_jit()
     - [amd64] ASoC: Intel: avs: Unprepare a stream when XRUN occurs
     - [amd64] ASoC: Intel: avs: Disable periods-elapsed work when closing PCM
     - [arm64,armhf] ASoC: fsl_sai: fix bit order for DSD format
     - libbpf: Fix powerpc's stack register definition in bpf_tracing.h
     - usbnet: Prevents free active kevent
     - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
     - Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave
     - Bluetooth: ISO: Fix BIS connection dst_type handling
     - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset
     - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00
     - Bluetooth: ISO: Fix another instance of dst_type handling
     - Bluetooth: hci_core: Fix tracking of periodic advertisement
     - [arm64,armhf] drm/etnaviv: fix flush sequence logic
     - [arm64] net: hns3: return error code when function fails
     - sfc: fix potential memory leak in efx_mae_process_mport()
     - dpll: spec: add missing module-name and clock-id to pin-get reply
     - [arm64,armhf] ASoC: fsl_sai: Fix sync error in consumer mode
     - drm/radeon: Do not kfree() devres managed rdev
     - drm/radeon: Remove calls to drm_put_dev()
     - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table()
     - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji
     - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland
     - ACPI: fan: Use ACPI handle when retrieving _FST
     - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL
     - block: make REQ_OP_ZONE_OPEN a write operation
     - regmap: slimbus: fix bus_context pointer in regmap init calls
     - [s390x] mm: Fix memory leak in add_marker() when kvrealloc() fails
     - drm/xe: Do not wake device during a GT reset
     - drm/sysfb: Do not dereference NULL pointer in plane reset
     - drm/sched: avoid killing parent entity on child SIGKILL
     - drm/nouveau: Fix race in nouveau_sched_fini()
     - [arm64] drm/mediatek: Fix device use-after-free on unbind
     - drm/amd: Check that VPE has reached DPM0 in idle handler
     - drm/amd/display: Fix incorrect return of vblank enable on unconfigured
       crtc (Closes: #1000966)
     - ACPI: fan: Add fan speed reporting for fans with only _FST
     - ACPI: fan: Use platform device for devres-related actions
     - sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU
     - cpuidle: governors: menu: Rearrange main loop in menu_select()
     - cpuidle: governors: menu: Select polling state in some more cases
     - [amd64] mfd: kempld: Switch back to earlier ->init() behavior
     - [amd64] x86/CPU/AMD: Add RDSEED fix for Zen5
     - usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
     - drm/sched: Optimise drm_sched_entity_push_job
     - drm/sched: Re-group and rename the entity run-queue lock
     - drm/sched: Fix race in drm_sched_entity_select_rq()
     - [s390x] pci: Avoid deadlock between PCI error recovery and mlx5 crdump
     - [s390x] Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP
     - [armhf] soc: aspeed: socinfo: Add AST27xx silicon IDs
     - [arm64] firmware: qcom: scm: preserve assign_mem() error return value
     - [arm64] soc: qcom: smem: Fix endian-unaware access of num_entries
     - [arm64] soc: ti: pruss: don't use %pK through printk
     - bpf: Don't use %pK through printk
     - pinctrl: single: fix bias pull up/down handling in pin_config_set
     - [arm64] mmc: host: renesas_sdhi: Fix the actual clock
     - memstick: Add timeout to prevent indefinite waiting
     - [arm64,armhf] cpufreq: ti: Add support for AM62D2
     - bpf: Use tnums for JEQ/JNE is_branch_taken logic
     - firewire: ohci: move self_id_complete tracepoint after validating register
     - [riscv64] irqchip/sifive-plic: Respect mask state when setting affinity
     - io_uring/zctx: check chained notif contexts
     - ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object
     - ACPI: video: force native for Lenovo 82K8
     - libbpf: Fix USDT SIB argument handling causing unrecognized register error
     - cpufreq/longhaul: handle NULL policy in longhaul_exit
     - [arm64,armhf] irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
     - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
     - ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU
     - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
     - thermal: gov_step_wise: Allow cooling level to be reduced earlier
     - power: supply: qcom_battmgr: add OOI chemistry
     - [amd64] hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based
       models
     - [amd64] hwmon: (k10temp) Add device ID for Strix Halo
     - power: supply: sbs-charger: Support multiple devices
     - cpufreq: ondemand: Update the efficient idle check for Intel extended
       Families
     - [arm64,armhf] soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
     - [arm64] firmware: qcom: tzmem: disable sc7180 platform
     - [arm64] mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
     - pwm: pca9685: Use bulk write to atomicially update registers
     - ACPICA: dispatcher: Use acpi_ds_clear_operands() in
       acpi_ds_call_control_method()
     - [amd64,arm64] tee: allow a driver to allocate a tee_device without a pool
     - nvmet-fc: avoid scheduling association deletion twice
     - nvme-fc: use lock accessing port_state and rport state
     - bpf: Do not limit bpf_cgroup_from_id to current's namespace
     - i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C
     - video: backlight: lp855x_bl: Set correct EPROM start for LP8556
     - tools/cpupower: fix error return value in cpupower_write_sysfs()
     - power: supply: qcom_battmgr: handle charging state change notifications
     - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21
     - cpuidle: Fail cpuidle device registration if there is one already
     - futex: Don't leak robust_list pointer on exec race
     - ACPI: SPCR: Support Precise Baud Rate field
     - blk-cgroup: fix possible deadlock while configuring policy
     - [riscv64] bpf: Fix uninitialized symbol 'retval_off'
     - bpf: Clear pfmemalloc flag when freeing all fragments
     - nvme: Use non zero KATO for persistent discovery connections
     - uprobe: Do not emulate/sstep original instruction when ip is changed
     - [amd64] hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex
     - [amd64] hwmon: (dell-smm) Remove Dell Precision 490 custom config data
     - tools/cpupower: Fix incorrect size in cpuidle_state_disable()
     - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
     - tools/power x86_energy_perf_policy: Enhance HWP enable
     - tools/power x86_energy_perf_policy: Prefer driver HWP limits
     - [armhf] mfd: stmpe: Remove IRQ domain upon removal
     - [armhf] mfd: stmpe-i2c: Add missing MODULE_LICENSE
     - [riscv64] mfd: da9063: Split chip variant reading in two bus transactions
     - mfd: core: Increment of_node's refcount before linking it to the platform
       device
     - [amd64] mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs
     - drm/amd/display: fix condition for setting timing_adjust_pending
     - drm/amd/display: ensure committing streams is seamless
     - drm/amdgpu: add range check for RAS bad page address
     - drm/amdgpu: Check vcn sram load return value
     - drm/amd/display: Move setup_stream_attribute
     - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration
     - drm/xe/guc: Add more GuC load error status codes
     - drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.
     - drm/amdgpu: Avoid rma causes GPU duplicate reset
     - drm/amd/amdgpu: Release xcp drm memory after unplug
     - drm/amdgpu: Skip poison aca bank from UE channel
     - drm/amd/display: add more cyan skillfish devices
     - drm/amd/display: update dpp/disp clock from smu clock table
     - drm/amd/pm: Use cached metrics data on aldebaran
     - drm/amd/pm: Use cached metrics data on arcturus
     - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
     - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
     - [arm64] ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks
     - drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off
     - drm/amd/display: Wait until OTG enable state is cleared
     - PCI: Disable MSI on RDC PCI to PCIe bridges
     - wifi: rtw89: print just once for unknown C2H events
     - wifi: rtw88: sdio: use indirect IO for device registers before power-on
     - drm/amdkfd: return -ENOTTY for unsupported IOCTLs
     - media: pci: ivtv: Don't create fake v4l2_fh
     - [arm64] drm/tidss: Use the crtc_* timings when programming the HW
     - [arm64] drm/tidss: Set crtc modesetting parameters with adjusted mode
     - PCI/ERR: Update device error_state already after reset
     - [amd64] x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
     - net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
     - ice: Don't use %pK through printk or tracepoints
     - thunderbolt: Use is_pciehp instead of is_hotplug_bridge
     - tty: serial: ip22zilog: Use platform device for probing
     - [powerpc*] eeh: Use result of error_detected() in uevent
     - [s390x] pci: Use pci_uevent_ers() in PCI recovery
     - bridge: Redirect to backup port when port is administratively down
     - net: ipv6: fix field-spanning memcpy warning in AH output
     - media: imon: make send_packet() more robust
     - [arm64] drm/panthor: Serialize GPU cache flush operations
     - HID: pidff: Use direction fix only for conditional effects
     - HID: pidff: PERMISSIVE_CONTROL quirk autodetection
     - [arm64,armhf] drm/bridge: display-connector: don't set OP_DETECT for
       DisplayPorts
     - drm/amdgpu: fix nullptr err of vm_handle_moved
     - drm/amdkfd: Handle lack of READ permissions in SVM mapping
     - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before
       setting register
     - iio: adc: imx93_adc: load calibrated values even calibration failed
     - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
     - wifi: rtw89: wow: remove notify during WoWLAN net-detect
     - wifi: rtw89: fix BSSID comparison for non-transmitted BSSID
     - dm error: mark as DM_TARGET_PASSES_INTEGRITY
     - char: misc: Make misc_register() reentry for miscdevice who wants dynamic
       minor
     - char: misc: Does not request module for miscdevice with dynamic minor
     - net: When removing nexthops, don't call synchronize_net if it is not
       necessary
     - net: stmmac: Correctly handle Rx checksum offload errors
     - net: Call trace_sock_exceed_buf_limit() for memcg failure with
       SK_MEM_RECV.
     - f2fs: fix to detect potential corrupted nid in free_nid_list
     - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
     - bnxt_en: Add Hyper-V VF ID
     - tty: serial: Modify the use of dev_err_probe()
     - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
     - [amd64,arm64] idpf: do not linearize big TSO packets
     - rds: Fix endianness annotation for RDS_MPATH_HASH
     - media: ipu6: isys: Set embedded data type correctly for metadata formats
     - rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table
     - net: ipv4: allow directed broadcast routes to use dst hint
     - scsi: mpi3mr: Fix I/O failures during controller reset
     - scsi: mpi3mr: Fix controller init failure on fault during queue creation
     - scsi: pm80xx: Fix race condition caused by static variables
     - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper
     - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device
     - fuse: zero initialize inode private data
     - drm/amdgpu: Correct the counts of nr_banks and nr_errors
     - drm/amdkfd: fix vram allocation failure for a special case
     - drm/amd/display: Support HW cursor 180 rot for any number of pipe splits
     - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
     - [amd64] platform/x86/intel-uncore-freq: Fix warning in partitioned system
     - media: fix uninitialized symbol warnings
     - media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS
     - [amd64] ASoC: SOF: ipc4-pcm: Add fixup for channels
     - drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting
     - drm/amd/display: incorrect conditions for failing dto calculations
     - drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest
     - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2)
     - inet_diag: annotate data-races in inet_diag_bc_sk()
     - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()
     - [amd64] crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof()
     - scsi: pm8001: Use int instead of u32 to store error codes
     - [arm64] scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset
       on suspend
     - ptp: Limit time setting of PTP clocks
     - dmaengine: sh: setup_xref error handling
     - [arm64,armhf] dmaengine: mv_xor: match alloc_wc and free_wc
     - [arm64] drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL
     - [arm64] drm/msm/dsi/phy_7nm: Fix missing initial VCO rate
     - drm/amdgpu: Allow kfd CRIU with no buffer objects
     - drm/xe/guc: Increase GuC crash dump buffer size
     - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
     - [arm64] drm/panthor: check bo offset alignment in vm bind
     - drm: panel-backlight-quirks: Make EDID match optional
     - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
     - media: adv7180: Add missing lock in suspend callback
     - media: adv7180: Do not write format to device in set_fmt
     - media: adv7180: Only validate format in querystd
     - [arm64,armhf] media: verisilicon: Explicitly disable selection api ioctls
       for decoders
     - wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower
       bands
     - ALSA: usb-audio: apply quirk for MOONDROP Quark2
     - [arm64,armhf] PCI: imx6: Enable the Vaux supply if available
     - drm/xe/guc: Set upper limit of H2G retries over CTB
     - net: call cond_resched() less often in __release_sock()
     - smsc911x: add second read of EEPROM mac when possible corruption seen
     - [amd64] iommu/amd: Skip enabling command/event buffers for kdump
     - [amd64] crypto: ccp: Skip SEV and SNP INIT for kdump boot
     - drm/amd: add more cyan skillfish PCI ids
     - drm/amdgpu: don't enable SMU on cyan skillfish
     - drm/amdgpu: add support for cyan skillfish gpu_info
     - drm/amd/display: Fix pbn_div Calculation Error
     - [arm64] net: dsa: felix: support phy-mode = "10g-qxgmii"
     - usb: gadget: f_hid: Fix zero length packet transfer
     - usb: cdns3: gadget: Use-after-free during failed initialization and exit
       of cdnsp gadget
     - tty/vt: Add missing return value for VT_RESIZE in vt_ioctl()
     - [arm64] drm/msm: make sure to not queue up recovery more than once
     - char: Use list_del_init() in misc_deregister() to reinitialize list
       pointer
     - PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs
     - wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list
     - [amd64] media: ov08x40: Fix the horizontal flip control
     - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer
     - f2fs: fix wrong layout information on 16KB page
     - net: phy: marvell: Fix 88e1510 downshift counter errata
     - ntfs3: pretend $Extend records as regular files
     - wifi: mac80211: Fix HE capabilities element check
     - [arm64] phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf
       register 0
     - [arm64] drm/msm/registers: Generate _HI/LO builders for reg64
     - net: sh_eth: Disable WoL if system can not suspend
     - netfilter: nf_reject: don't reply to icmp error messages
     - [amd64] x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective
       of PV_UNHALT
     - net: devmem: expose tcp_recvmsg_locked errors
     - udp_tunnel: use netdev_warn() instead of netdev_WARN()
     - HID: asus: add Z13 folio to generic group for multitouch to work
     - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger
     - [arm64] crypto: sun8i-ce - remove channel timeout field
     - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify()
     - [amd64] crypto: ccp - Fix incorrect payload size calculation in
       psp_poulate_hsti()
     - [arm64,armhf] crypto: caam - double the entropy delay interval for retry
     - net/cls_cgroup: Fix task_get_classid() during qdisc run
     - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device
     - wifi: mt76: mt7996: Temporarily disable EPCS
     - wifi: mt76: mt76_eeprom_override to int
     - ALSA: serial-generic: remove shared static buffer
     - wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error
     - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl
     - drm/amd/display: Set up pixel encoding for YCBCR422
     - drm/amd/display: fix dml ms order of operations
     - drm/amd: Avoid evicting resources at S5
     - drm/amd/display: Fix DVI-D/HDMI adapters
     - drm/amd/display: Disable VRR on DCE 6
     - drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with
       DC_FP_START
     - page_pool: always add GFP_NOWARN for ATOMIC allocations
     - ethernet: Extend device_get_mac_address() to use NVMEM
     - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4
     - drm/xe/guc: Return an error code if the GuC load fails
     - drm/amdgpu: reject gang submissions under SRIOV
     - scsi: ufs: core: Disable timestamp functionality if not supported
     - scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail
     - scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted
     - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during
       TGT_RESET
     - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in
       lpfc_cleanup
     - scsi: lpfc: Define size of debugfs entry for xri rebalancing
     - scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point
       topology
     - allow finish_no_open(file, ERR_PTR(-E...))
     - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
     - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
     - f2fs: fix infinite loop in __insert_extent_tree()
     - wifi: rtw89: obtain RX path from ppdu status IE00
     - wifi: rtw89: renew a completion for each H2C command waiting C2H event
     - usb: xhci-pci: add support for hosts with zero USB3 ports
     - ipv6: np->rxpmtu race annotation
     - RDMA/irdma: Update Kconfig
     - IB/ipoib: Ignore L3 master device
     - jfs: Verify inode mode when loading from disk
     - jfs: fix uninitialized waitqueue in transaction manager
     - drm/amdgpu/atom: Check kcalloc() for WS buffer in
       amdgpu_atom_execute_table_locked()
     - [arm64] ASoC: qcom: sc8280xp: explicitly set S16LE format in
       sc8280xp_be_hw_params_fixup()
     - net: phy: clear link parameters on admin link down
     - bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state
     - [amd64] iommu/vt-d: Replace snprintf with scnprintf in
       dmar_latency_snapshot()
     - wifi: ath10k: Fix connection after GTK rekeying
     - wifi: mac80211: Track NAN interface start/stop
     - net: intel: fm10k: Fix parameter idx set but not used
     - r8169: set EEE speed down ratio to 1
     - vfio: return -ENOTTY for unsupported device feature
     - PCI/PM: Skip resuming to D0 if device is disconnected
     - remoteproc: qcom: q6v5: Avoid handling handover twice
     - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256
     - [armhf] net: dsa: microchip: Set SPI as bus interface during reset for
       KSZ8463
     - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream
     - drm/amd/display: Init dispclk from bootup clock for DCN314
     - drm/amd/display: Fix for test crash due to power gating
     - drm/amd/display: change dc stream color settings only in atomic commit
     - NFSv4: handle ERR_GRACE on delegation recalls
     - NFSv4.1: fix mount hang after CREATE_SESSION failure
     - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode
       dereferencing
     - net: bridge: Install FDB for bridge MAC on VLAN 0
     - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill()
     - [amd64] accel/habanalabs/gaudi2: fix BMON disable configuration
     - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate
     - [amd64] accel/habanalabs: return ENOMEM if less than requested pages were
       pinned
     - [amd64] accel/habanalabs/gaudi2: read preboot status after recovering from
       dirty state
     - [amd64] accel/habanalabs: support mapping cb with vmalloc-backed coherent
       memory
     - fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock
     - ext4: increase IO priority of fastcommit
     - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw
     - [armhf] ASoC: stm32: sai: manage context in set_sysclk callback
     - [armhf] ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007
     - ACPI: scan: Update honor list for RPMI System MSI
     - vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices
     - net/mlx5e: Don't query FEC statistics when FEC is disabled
     - net: macb: avoid dealing with endianness in macb_set_hwaddr()
     - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames
     - Bluetooth: SCO: Fix UAF on sco_conn_free
     - Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922
     - Bluetooth: bcsp: receive data only if registered
     - ALSA: usb-audio: add mono main switch to Presonus S1824c
     - net: stmmac: est: Drop frames causing HLBS error
     - exfat: limit log print for IO error
     - exfat: validate cluster allocation bits of the allocation bitmap
     - 6pack: drop redundant locking and refcounting
     - page_pool: Clamp pool size to max 16K pages
     - orangefs: fix xattr related buffer overflow...
     - ftrace: Fix softlockup in ftrace_module_enable
     - ksmbd: use sock_create_kern interface to create kernel socket
     - smb: client: transport: avoid reconnects triggered by pending task work
     - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr
     - usb: xhci-pci: Fix USB2-only root hub registration
     - char: misc: restrict the dynamic range to exclude reserved minors
     - drm/amd/display: Add fallback path for YCBCR422
     - ACPICA: Update dsmethod.c to get rid of unused variable warning
     - RDMA/irdma: Fix SD index calculation
     - RDMA/irdma: Remove unused struct irdma_cq fields
     - RDMA/irdma: Set irdma_cq cq_num field during CQ create
     - [arm64] RDMA/hns: Fix recv CQ and QP cache affinity
     - [arm64] RDMA/hns: Fix the modification of max_send_sge
     - [arm64] RDMA/hns: Fix wrong WQE data when QP wraps around
     - btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation
     - btrfs: mark dirty extent range for out of bound prealloc extents
     - fs/hpfs: Fix error code for new_inode() failure in
       mkdir/create/mknod/symlink
     - clk: sunxi-ng: sun6i-rtc: Add A523 specifics
     - [arm64] rtc: pcf2127: clear minute/second interrupt
     - 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN
     - [armhf] clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled
     - [arm64] clk: scmi: Add duty cycle ops only when duty cycle is supported
     - 9p: fix /sys/fs/9p/caches overwriting itself
     - 9p: sysfs_init: don't hardcode error to ENOMEM
     - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS
     - ACPI: property: Return present device nodes only on fwnode interface
     - tools bitmap: Add missing asm-generic/bitsperlong.h include
     - tools: lib: thermal: don't preserve owner in install
     - tools: lib: thermal: use pkg-config to locate libnl3
     - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
     - [arm64] rtc: pcf2127: fix watchdog interrupt mask on pcf2131
     - net: wwan: t7xx: add support for HP DRMR-H01
     - kbuild: uapi: Strip comments before size type check
     - [arm64,armhf] ASoC: meson: aiu-encoder-i2s: fix bit clock polarity
     - drm/amdkfd: Fix mmap write lock not release
     - ceph: add checking of wait_for_completion_killable() return value
     - ceph: fix potential race condition in ceph_ioctl_lazyio()
     - ceph: refactor wake_up_bit() pattern of calling
     - ceph: fix multifs mds auth caps issue
     - [amd64] x86: use cmov for user address masking
     - [amd64] x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro
     - [amd64] x86: uaccess: don't use runtime-const rewriting in modules
     - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again
     - btrfs: ensure no dirty metadata is written back for an fs with errors
     - media: uvcvideo: Use heuristic to find stream entity
     - media: videobuf2: forbid remove_bufs when legacy fileio is active
     - [arm64] drm/mediatek: Disable AFBC support on Mediatek DRM driver
     - Revert "wifi: ath10k: avoid unnecessary wait for service ready message"
       (Closes: #1120680)
     - ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader
       catches up
     - [riscv64] ptdump: use seq_puts() in pt_dump_seq_puts() macro
     - Bluetooth: hci_event: validate skb length for unknown CC opcode
     - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2()
     - [armhf] net: dsa: tag_brcm: legacy: reorganize functions
     - [armhf] net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for
       bcm63xx
     - net: vlan: sync VLAN features with lower device
     - gpio: swnode: don't use the swnode's name as the key for GPIO lookup
     - gpiolib: fix invalid pointer access in debugfs
     - [armhf] net: dsa: b53: fix resetting speed and pause on forced link
     - [armhf] net: dsa: b53: fix bcm63xx RGMII port link adjustment
     - [armhf] net: dsa: b53: fix enabling ip multicast
     - [armhf] net: dsa: b53: stop reading ARL entries if search is done
     - sctp: Hold RCU read lock while iterating over address list
     - sctp: Prevent TOCTOU out-of-bounds write
     - sctp: Hold sock lock while iterating over address list
     - net: ionic: add dma_wmb() before ringing TX doorbell
     - net: ionic: map SKB after pseudo-header checksum prep
     - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
     - bnxt_en: Fix a possible memory leak in bnxt_ptp_init
     - bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type
     - bnxt_en: Refactor bnxt_free_ctx_mem()
     - bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem()
     - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup
     - net/mlx5e: Fix return value in case of module EEPROM read error
     - [arm64] net: ti: icssg-prueth: Fix fdb hash size configuration
     - net/mlx5e: SHAMPO, Fix skb size check for 64K pages
     - [armhf] net: dsa: microchip: Fix reserved multicast address table
       programming
     - net: bridge: fix use-after-free due to MST port state bypass
     - net: bridge: fix MST static key usage
     - tracing: Fix memory leaks in create_field_var()
     - drm/amd/display: Enable mst when it's detected but yet to be initialized
     - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb
     - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()
     - [arm64] rtc: rx8025: fix incorrect register reference
     - [amd64] x86/microcode/AMD: Add more known models to entry sign checking
     - smb: client: validate change notify buffer before copy
     - smb: client: fix potential UAF in smb2_close_cached_fid()
     - drm/amdgpu/smu: Handle S0ix for vangogh
     - drm/amd/display: Fix NULL deref in debugfs odm_combine_segments
     - virtio-net: fix received length check in big packets
     - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC
     - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers
     - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel
       ADL
     - scsi: ufs: core: Add a quirk to suppress link_startup_again
     - drm/amd/display: update color on atomic commit time
     - ACPI: SPCR: Check for table version when using precise baudrate
     - drm/amdgpu: Fix unintended error log in VCN5_0_0
     - drm/amdgpu: Fix function header names in amdgpu_connectors.c
     - drm/amd/display: Fix black screen with HDMI outputs
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.59
     - [arm64] drm/mediatek: Add pm_runtime support for GCE power control
     - [amd64] drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD
     - [amd64] drm/i915: Fix conversion between clock ticks and nanoseconds
     - smb: client: fix refcount leak in smb2_set_path_attr
     - drm/amd: Fix suspend failure with secure display TA
     - drm/xe/guc: Synchronize Dead CT worker with unbind
     - drm/xe: Move declarations under conditional branch
     - drm/xe: Do clean shutdown also when using flr
     - [arm64] kprobes: check the return value of set_memory_rox()
     - [riscv64] clear hot-unplugged cores from all task mm_cpumasks to avoid
       rfence errors
     - [riscv64] acpi: avoid errors caused by probing DT devices when ACPI is
       used
     - drm/amdgpu: remove two invalid BUG_ON()s
     - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks
     - drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM
     - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices
     - NFS4: Fix state renewals missing after boot
     - NFS4: Apply delay_retrans to async operations
     - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
     - HID: nintendo: Wait longer for initial probe
     - NFS: check if suid/sgid was cleared after a write as needed
     - HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel
     - exfat: fix improper check of dentry.stream.valid_size
     - smb/server: fix possible memory leak in smb2_read()
     - smb/server: fix possible refcount leak in smb2_sess_setup()
     - HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL
     - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
     - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp()
     - erofs: avoid infinite loop due to incomplete zstd-compressed data
     - [arm64,armhf] net: fec: correct rx_bytes statistic for the case SHIFT16 is
       set
     - net: phy: micrel: Introduce lanphy_modify_page_reg
     - net: phy: micrel: Replace hardcoded pages with defines
     - net: phy: micrel: lan8814 fix reset of the QSGMII interface
     - NFSD: Skip close replay processing if XDR encoding fails
     - Bluetooth: MGMT: cancel mesh send timer when hdev removed
     - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
     - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
     - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
     - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
     - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
     - net/smc: fix mismatch between CLC header and proposal
     - net/handshake: Fix memory leak in tls_handshake_accept()
     - tipc: Fix use-after-free in tipc_mon_reinit_self().
     - net: mdio: fix resource leak in mdiobus_register_device()
     - wifi: mac80211: skip rate verification for not captured PSDUs
     - af_unix: Initialise scc_index in unix_add_edge().
     - net_sched: act_connmark: use RCU in tcf_connmark_dump()
     - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak
     - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
     - net/mlx5e: Fix maxrate wraparound in threshold between units
     - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
     - net/mlx5e: Fix potentially misleading debug message
     - net_sched: limit try_bulk_dequeue_skb() batches
     - virtio-net: fix incorrect flags recording in big mode
     - hsr: Fix supervision frame sending on HSRv0
     - [amd64] ACPI: CPPC: Detect preferred core availability on online CPUs
     - [amd64] ACPI: CPPC: Check _CPC validity for only the online CPUs
     - [amd64] ACPI: CPPC: Perform fast check switch only for online CPUs
     - [amd64] ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs
     - Bluetooth: L2CAP: export l2cap_chan_hold for modules
     - acpi,srat: Fix incorrect device handle check for Generic Initiator
     - regulator: fixed: fix GPIO descriptor leak on register failure
     - [arm64] ASoC: codecs: va-macro: fix resource leak in probe error path
     - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
     - ASoC: tas2781: fix getting the wrong device number
     - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect()
     - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS
     - simplify nfs_atomic_open_v23()
     - NFSv2/v3: Fix error handling in nfs_atomic_open_v23()
     - NFS: sysfs: fix leak when nfs_client kobject add fails
     - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync()
     - NFS: Fix LTP test failures when timestamps are delegated
     - ALSA: usb-audio: Fix NULL pointer dereference in
       snd_usb_mixer_controls_badd
     - acpi/hmat: Fix lockdep warning for hmem_register_resource()
     - bpf: Add bpf_prog_run_data_pointers()
     - bpf: account for current allocated stack depth in
       widen_imprecise_scalars()
     - [riscv64] irqchip/riscv-intc: Add missing free() callback in
       riscv_intc_domain_ops
     - wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in
       error path
     - proc: fix the issue of proc_mem_open returning NULL
     - ext4: introduce ITAIL helper
     - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()
       (CVE-2025-22121)
     - Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)
     - f2fs: fix to avoid overflow while left shift operation (CVE-2025-40077)
     - hostfs: Fix only passing host root in boot stage with new mount
     - virtio-fs: fix incorrect check for fsvq->kobj
     - fs/namespace: correctly handle errors returned by grab_requested_mnt_ns
     - sched_ext: Fix unsafe locking in the scx_dump_state()
     - Revert "netfilter: nf_tables: Reintroduce shortened deletion
       notifications"
     - netfilter: nf_tables: reject duplicate device on updates (CVE-2025-38678)
     - [arm64] dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1
     - [arm64] dts: rockchip: Make RK3588 GPU OPP table naming less generic
     - [armhf] dts: imx51-zii-rdu1: Fix audmux node names
     - HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
     - HID: playstation: Fix memory leak in dualshock4_get_calibration_data()
     - HID: uclogic: Fix potential memory leak in error path
     - [amd64] KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated
     - nfsd: fix refcount leak in nfsd_set_fh_dentry() (CVE-2025-40212)
     - nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes
     - NFSD: free copynotify stateid in nfs4_free_ol_stateid()
     - ksmbd: close accepted socket when per-IP limit rejects connection
     - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
     - strparser: Fix signed/unsigned mismatch bug
     - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent
     - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
     - nilfs2: avoid having an active sc_timer before freeing sci
     - wifi: mac80211: reject address change while connecting
     - fs/proc: fix uaf in proc_readdir_de()
     - mm/mm_init: fix hash table order logging in alloc_large_system_hash()
     - mm/shmem: fix THP allocation and fallback loop
     - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4
     - mmc: dw_mmc-rockchip: Fix wrong internal phase calculate
     - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer
     - cifs: client: fix memory leak in smb3_fs_context_parse_param
     - codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for
       slabobj_ext
     - crash: fix crashkernel resource shrink
     - smb: client: fix cifs_pick_channel when channel needs reconnect
     - spi: Try to get ACPI GPIO IRQ earlier
     - [amd64] x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev
     - ftrace: Fix BPF fexit with livepatch
     - PM: hibernate: Emit an error when image writing fails
     - PM: hibernate: Use atomic64_t for compressed_size variable
     - btrfs: zoned: fix conventional zone capacity calculation
     - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe()
     - btrfs: do not update last_log_commit when logging inode due to a new name
     - btrfs: release root after error in data_reloc_print_warning_inode()
     - drm/amdkfd: relax checks for over allocation of save area
     - drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces
     - [arm64] pmdomain: arm: scmi: Fix genpd leak on provider registration
       failure
     - [armhf] pmdomain: imx: Fix reference count leak in imx_gpc_remove
     - [arm64,armhf] pmdomain: samsung: plug potential memleak during probe
     - mptcp: fix MSG_PEEK stream corruption
     - wifi: cfg80211: add an hrtimer based delayed work item
     - wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work
     - mm, percpu: do not consider sleepable allocations atomic
     - [amd64] KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn()
     - [amd64] KVM: guest_memfd: Remove RCU-protected attribute from
       slot->gmem.file
     - [amd64] KVM: guest_memfd: Remove bindings on memslot deletion when gmem is
       dying
     - net: netpoll: Individualize the skb pool
     - net: netpoll: flush skb pool during cleanup
     - net: netpoll: fix incorrect refcount handling causing incorrect cleanup
     - [amd64] KVM: VMX: Split out guts of EPT violation to common/exposed
       function
     - [amd64] KVM: VMX: Fix check for valid GVA on an EPT violation
     - ALSA: hda: Fix missing pointer check in hda_component_manager_init
       function (CVE-2025-40097)
     - io_uring/napi: fix io_napi_entry RCU accesses
     - uio_hv_generic: Set event for all channels on the device
       (Closes: #1120602)
     - mm/memory: do not populate page table entries beyond i_size
     - mm/truncate: unmap large folio on split failure
     - mm/secretmem: fix use-after-free race in fault handler
     - mm/huge_memory: do not change split_huge_page*() target order silently
     - mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to >0 order
     - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
     - net: phy: micrel: Fix lan8814_config_init
     - net: netpoll: ensure skb_pool list is always initialized
     - proc: proc_maps_open allow proc_mem_open to return NULL
     - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete
       (CVE-2025-40213)
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.60
     - [arm64] KVM: arm64: Check the untrusted offset in FF-A memory share
     - timers: Fix NULL function pointer race in timer_shutdown_sync()
     - HID: amd_sfh: Stop sensor before starting
     - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155
       (Closes: #1114557)
     - [arm64] dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5
     - mtdchar: fix integer overflow in read/write ioctls
     - isofs: check the return value of sb_min_blocksize() in isofs_fill_super
     - shmem: fix tmpfs reconfiguration (remount) when noswap is set
     - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector
     - mptcp: Disallow MPTCP subflows from sockmap
     - mptcp: Fix proto fallback detection with BPF
     - ata: libata-scsi: Fix system suspend for a security locked drive
     - smb: client: introduce close_cached_dir_locked()
     - ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan()
     - be2net: pass wrb_params in case of OS2BMC
     - [armhf] net: dsa: microchip: lan937x: Fix RGMII delay tuning
     - [arm64,armhf] Revert "drm/tegra: dsi: Clear enable register if powered by
       bootloader"
     - Input: cros_ec_keyb - fix an invalid memory access
     - Input: goodix - add support for ACPI ID GDIX1003
     - Input: pegasus-notetaker - fix potential out-of-bounds access
     - mm/mempool: fix poisoning order>0 pages with HIGHMEM
     - nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot
     - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl()
     - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
     - scsi: sg: Do not sleep in atomic context
     - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
     - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups
     - mptcp: fix race condition in mptcp_schedule_work()
     - mptcp: fix ack generation for fallback msk
     - mptcp: fix duplicate reset on fastclose
     - mptcp: fix premature close in case of fallback
     - mptcp: avoid unneeded subflow-level drops
     - mptcp: decouple mptcp fastclose from tcp close
     - mptcp: do not fallback when OoO is present
     - [arm64,armhf] drm/tegra: dc: Fix reference leak in tegra_dc_couple()
     - drm/radeon: delete radeon_fence_process in is_signaled, no deadlock
     - drm/amd: Skip power ungate during suspend for VPE
     - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled
     - drm/amd/display: Increase DPCD read retries
     - drm/amd/display: Move sleep into each retry for retrieve_link_cap()
     - drm/amd/display: Fix pbn to kbps Conversion
     - drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5
     - xfrm: drop SA reference in xfrm_state_update if dir doesn't match
     - xfrm: set err and extack on failure to create pcpu SA
     - xfrm: Determine inner GSO type from packet inner protocol
     - xfrm: Prevent locally generated packets from direct output in tunnel mode
     - [amd64] pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe()
     - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()
     - [arm64,armhf] drm/tegra: Add call to put_pid()
     - net: mlxsw: linecards: fix missing error check in
       mlxsw_linecard_devlink_info_get()
     - net: openvswitch: remove never-working support for setting nsh fields
     - nvme-multipath: fix lockdep WARN due to partition scan work
     - [s390x] ctcm: Fix double-kfree
     - [amd64] platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes
       to errnos
     - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and
       qede_tpa_end()
     - [amd64,arm64] idpf: fix possible vport_config NULL pointer deref in remove
     - ice: fix PTP cleanup on driver removal in error path
     - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
     - net/mlx5: Clean up only new IRQ glue on request_irq() failure
     - af_unix: Cache state->msg in unix_stream_read_generic().
     - af_unix: Read sk_peek_offset() again after sleeping in
       unix_stream_read_generic().
     - cifs: fix memory leak in smb3_fs_context_parse_param error path
     - vsock: Ignore signal/timeout on connect() if already established
     - bcma: don't register devices disabled in OF
     - cifs: fix typo in enable_gcm_256 module parameter
     - scsi: core: Fix a regression triggered by scsi_host_busy()
     - [amd64] x86/microcode/AMD: Limit Entrysign signature checking to known
       generations
     - net: tls: Change async resync helpers argument
     - blk-crypto: use BLK_STS_INVAL for alignment errors
     - net: tls: Cancel RX async resync request on rcd_delta overflow
     - ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check
     - [arm64] KVM: arm64: Make all 32bit ID registers fully writable
     - drm/xe: Prevent BIT() overflow when handling invalid prefetch region
     - [s390x] mm: Fix __ptep_rdp() inline assembly
     - ALSA: usb-audio: fix uac2 clock source at terminal parser
     - tracing/tools: Fix incorrcet short option in usage text for --threads
     - drm/amdgpu: fix gpu page fault after hibernation on PF passthrough
     - smb: client: fix incomplete backport in cfids_invalidation_worker()
     - tty/vt: fix up incorrect backport to stable releases
     - maple_tree: fix tracepoint string pointers
     - [amd64] drm/i915/dp_mst: Disable Panel Replay
     - mptcp: fix a race in mptcp_pm_del_add_timer()
     - xfs: Replace strncpy with memcpy
     - xfs: fix out of bounds memory read error in symlink repair
     - drm/amd/display: avoid reset DTBCLK at clock init
     - drm/amd/display: disable DPP RCG before DPP CLK enable
     - drm/amd/display: Insert dccg log for easy debug
     - drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched
     - Revert "gpio: swnode: don't use the swnode's name as the key for GPIO
       lookup"
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.61
     - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers
     - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted
       URBs
     - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before
       accessing header
     - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before
       accessing data
     - Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso
       interface
     - Bluetooth: hci_core: Fix triggering cmd_timer for HCI_OP_NOP
     - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind
     - Bluetooth: SMP: Fix not generating mackey and ltk when repairing
     - net: sched: generalize check for no-queue qdisc on TX queue
     - veth: apply qdisc backpressure on full ptr_ring to reduce TX drops
     - veth: prevent NULL pointer dereference in veth_xdp_rcv
     - veth: more robust handing of race to avoid txq getting stuck
     - veth: reduce XDP no_direct return section to fix race
     - [amd64] platform/x86: intel: punit_ipc: fix memory corruption
     - net: aquantia: Add missing descriptor cache invalidation on ATL2
     - net: lan966x: Fix the initialization of taprio
     - drm/xe: Fix conversion from clock ticks to milliseconds
     - net/mlx5e: Fix validation logic in rate limiting
     - team: Move team device type change at the end of team_port_add
     - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling
     - net: wwan: mhi: Keep modem name match with Foxconn T99W640
     - net: atlantic: fix fragment overflow handling in RX path
     - [arm64,armhf] net: fec: cancel perout_timer when PEROUT is disabled
     - [arm64,armhf] net: fec: do not update PEROUT if it is enabled
     - [arm64,armhf] net: fec: do not allow enabling PPS and PEROUT
       simultaneously
     - [arm64,armhf] net: fec: do not register PPS event for PEROUT
     - iio: st_lsm6dsx: Fixed calibrated timestamp calculation
     - [arm64] mailbox: mtk-cmdq: Refine DMA address handling for the command
       buffer
     - mailbox: pcc: Refactor error handling in irq handler into separate
       function
     - mailbox: pcc: don't zero error register
     - fs/namespace: fix reference leak in grab_requested_mnt_ns
     - spi: spi-mem: Allow specifying the byte order in Octal DTR mode
     - spi: spi-mem: Extend spi-mem operations with a per-operation maximum
       frequency
     - spi: spi-mem: Add a new controller capability
     - [arm64] spi: nxp-fspi: Support per spi-mem operation frequency switches
     - [arm64] spi: spi-nxp-fspi: remove the goto in probe
     - [arm64] spi: spi-nxp-fspi: Add OCT-DTR mode support
     - [arm64] spi: nxp-fspi: Propagate fwnode in ACPI case as well
     - Revert "drm/amd/display: Move setup_stream_attribute"
     - [amd64] Revert "perf/x86: Always store regs->ip in
       perf_callchain_kernel()"
     - iio: buffer-dma: support getting the DMA channel
     - iio: buffer-dmaengine: enable .get_dma_dev()
     - iio: buffer: support getting dma channel from the buffer
     - iio: accel: bmc150: Fix irq assumption regression (Closes: #1106411)
     - tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs
     - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230
     - [arm64] dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity
     - Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref
     - can: sja1000: fix max irq loop handling
     - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling
     - ceph: fix crash in process_v2_sparse_read() for encrypted directories
     - dm-verity: fix unreliable memory allocation
     - drivers/usb/dwc3: fix PCI parent check
     - smb: client: fix memory leak in cifs_construct_tcon()
     - [amd64] thunderbolt: Add support for Intel Wildcat Lake
     - [arm64] slimbus: ngd: Fix reference count leak in
       qcom_slim_ngd_notify_slaves
     - nvmem: layouts: fix nvmem_layout_bus_uevent
     - firmware: stratix10-svc: fix bug in saving controller data
     - mm/memfd: fix information leak in hugetlb folios
     - mmc: sdhci-of-dwcmshc: Promote the th1520 reset handling to ip level
     - mptcp: clear scheduled subflows on retransmit
     - mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in
       mptcp_do_fastclose().
     - [arm*] serial: amba-pl011: prefer dma_mapping_error() over explicit
       address checking
     - usb: cdns3: Fix double resource release in cdns3_pci_probe
     - usb: gadget: f_eem: Fix memory leak in eem_unwrap
     - usb: storage: Fix memory leak in USB bulk transport
     - USB: storage: Remove subclass and protocol overrides from Novatek quirk
     - usb: storage: sddr55: Reject out-of-bound new_pba
     - usb: uas: fix urb unmapping issue when the uas device is remove during
       ongoing data transfer
     - [amd64,arm64] usb: dwc3: pci: add support for the Intel Nova Lake -S
     - [amd64,arm64] usb: dwc3: pci: Sort out the Intel device IDs
     - [amd64,arm64] usb: dwc3: Fix race condition between concurrent
       dwc3_remove_requests() call paths
     - xhci: fix stale flag preventig URBs after link state error is cleared
     - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host
     - xhci: dbgtty: fix device unregister
     - USB: serial: ftdi_sio: add support for u-blox EVK-M101
     - USB: serial: option: add support for Rolling RW101R-GL
     - drm: sti: fix device leaks at component probe
     - drm/amd/amdgpu: reserve vm invalidation engine for uni_mes
     - drm/amd/display: Check NULL before accessing
     - drm/amd/display: Don't change brightness for disabled connectors
     - [armhf] net: dsa: microchip: common: Fix checks on irq_find_mapping()
     - [armhf] net: dsa: microchip: ptp: Fix checks on irq_find_mapping()
     - [armhf] net: dsa: microchip: Don't free uninitialized ksz_irq
     - libceph: fix potential use-after-free in have_mon_and_osd_map()
     - libceph: prevent potential out-of-bounds writes in
       handle_auth_session_key()
     - libceph: replace BUG_ON with bounds check for map->max_osd
     - staging: rtl8712: Remove driver using deprecated API wext
     - nfsd: Replace clamp_t in nfsd4_get_drc_mem()
     - usb: typec: ucsi: psy: Set max current to zero when disconnected
     - usb: udc: Add trace event for usb_gadget_set_state
     - usb: gadget: udc: fix use-after-free in usb_gadget_state_work
     - mm/huge_memory: fix NULL pointer deference when splitting folio
     - [amd64] KVM: SVM: Introduce svm_recalc_lbr_msr_intercepts()
     - [amd64] KVM: nSVM: Always recalculate LBR MSR intercepts in
       svm_update_lbrv()
     - [amd64] KVM: nSVM: Fix and simplify LBR virtualization handling with
       nested
     - [amd64] KVM: SVM: Fix redundant updates of LBR MSR intercepts
     - drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup
     - [armhf] net: dsa: microchip: Do not execute PTP driver code for
       unsupported switches
     - [armhf] net: dsa: microchip: Free previously initialized ports on init
       failures
     - wifi: ath12k: correctly handle mcast packets for clients
     - Revert "ACPI: Suppress misleading SPCR console message when SPCR table is
       absent"
     - [amd64] drm/i915/dp: Initialize the source OUI write timestamp always
     - [arm64] spi: spi-nxp-fspi: Check return value of devm_mutex_init()
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.62
     - xfrm: delete x->tunnel as we delete x
     - Revert "xfrm: destroy xfrm_state synchronously on net exit path"
     - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that
       were never added
     - xfrm: flush all states in xfrm_state_fini
     - Documentation: process: Also mention Sasha Levin as stable tree maintainer
     - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system
       corrupted
     - ext4: refresh inline data size before write operations
     - ksmbd: ipc: fix use-after-free in ipc_msg_send_request
     - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()
     - [amd64] KVM: SVM: Don't skip unrelated instruction if INT3/INTO is
       replaced
     - USB: serial: option: add Foxconn T99W760
     - USB: serial: option: add Telit Cinterion FE910C04 new compositions
     - USB: serial: option: move Telit 0x10c7 composition in the right place
     - USB: serial: ftdi_sio: match on interface number for jtag
     - serial: add support of CPCI cards
     - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC
     - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC
     - ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct()
     - [arm64,armhf] ipi: imx: keep dma request disabled before dma transfer
       setup
     - drm/vmwgfx: Use kref in vmw_bo_dirty
     - Bluetooth: btrtl: Avoid loading the config file on security chips
     - smb: fix invalid username check in smb3_fs_context_parse_param()
     - drm/amdkfd: Fix GPU mappings for APU after prefetch
     - ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series
     - bfs: Reconstruct file type when loading from disk
     - HID: hid-input: Extend Elan ignore battery quirk to USB
     - nvme: fix admin request_queue lifetime
     - [arm64] pinctrl: qcom: msm: Fix deadlock in pinmux configuration
     - [amd64] platform/x86: acer-wmi: Ignore backlight event
     - HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list
     - [amd64] platform/x86: huawei-wmi: add keys for HONOR models
     - [amd64] platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list
     - [amd64] platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally
     - HID: elecom: Add support for ELECOM M-XT3URBK (018F)
     - wifi: rtl8xxxu: Add USB ID 2001:3328 for D-Link AN3U rev. A1
     - wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1
     - [amd64] comedi: check device's attached status in compat ioctls
     - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
     - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
     - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing
     - bus: mhi: host: pci_generic: Add Telit FN920C04 modem support
     - bus: mhi: host: pci_generic: Add Telit FN990B40 modem support
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.63
     - [arm64,armhf] gpu: host1x: Fix race in syncpt alloc/free
     - [amd64] accel/ivpu: Prevent runtime suspend during context abort work
     - [amd64] accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume
       fail
     - [amd64] accel/ivpu: Make function parameter names consistent
     - [amd64] accel/ivpu: Fix DCT active percent format
     - drm/vgem-fence: Fix potential deadlock on release
     - USB: Fix descriptor count when handling invalid MBIM extended descriptor
     - [arm64] pinctrl: renesas: rzg2l: Fix PMC restore
     - [arm64] clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle
       callback
     - [arm64] clk: renesas: Use str_on_off() helper
     - [arm64] clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register
     - [arm64] clk: renesas: cpg-mssr: Read back reset registers to assure values
       latched
     - HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync()
     - objtool: Fix standalone --hacks=jump_label
     - objtool: Fix weak symbol detection
     - wifi: ath10k: Avoid vdev delete timeout when firmware is already down
     - wifi: ath10k: Add missing include of export.h
     - wifi: ath10k: move recovery check logic into a new work
     - wifi: ath11k: restore register window after global reset
     - sched/fair: Forfeit vruntime on yield
     - [arm*] irqchip/irq-brcmstb-l2: Fix section mismatch
     - [arm64,armhf] irqchip/imx-mu-msi: Fix section mismatch
     - [arm64] irqchip/renesas-rzg2l: Fix section mismatch
     - [riscv64] irqchip/starfive-jh8100: Fix section mismatch
     - [arm64] irqchip/qcom-irq-combiner: Fix section mismatch
     - crypto: authenc - Correctly pass EINPROGRESS back up to the caller
     - ntfs3: fix uninit memory after failed mi_read in mi_format_new
     - ntfs3: Fix uninit buffer allocated by __getname()
     - dt-bindings: clock: qcom,x1e80100-gcc: Add missing video resets
     - dt-bindings: clock: qcom,x1e80100-gcc: Add missing USB4 clocks/resets
     - clk: qcom: gcc-x1e80100: Add missing USB4 clocks/resets
     - rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu()
     - inet: Avoid ehash lookup race in inet_ehash_insert()
     - inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule()
     - firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc
     - block/mq-deadline: Introduce dd_start_request()
     - block/mq-deadline: Switch back to a single dispatch list
     - [arm64] dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1
       props
     - [arm64] dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl
     - [arm64] dts: imx8mp-venice-gw702x: remove off-board uart
     - [arm64] dts: imx8mp-venice-gw702x: remove off-board sdhc1
     - perf annotate: Check return value of evsel__get_arch() properly
     - [arm64] dts: exynos: gs101: fix sysreg_apm reg property
     - uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe
     - soc: Switch back to struct platform_driver::remove()
     - [arm64] soc: qcom: gsbi: fix double disable caused by devm
     - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
     - wifi: ath11k: fix VHT MCS assignment
     - wifi: ath11k: fix peer HE MCS assignment
     - [s390x] smp: Fix fallback CPU detection
     - [s390x] ap: Don't leak debug feature files if AP instructions are not
       available
     - [arm64] dts: ti: k3-am62p: Fix memory ranges for GPU
     - firmware: imx: scu-irq: fix OF node leak in
     - [arm64] dts: qcom: x1e80100: Fix compile warnings for USB HS controller
     - [arm64] dts: qcom: x1e80100: Add missing quirk for HS only USB controller
     - [arm64] dts: qcom: sdm845-oneplus: Correct gpio used for slider
     - [arm64] dts: qcom: sm8650: set ufs as dma coherent
     - [arm64] dts: qcom: qcm6490-shift-otter: Add missing reserved-memory
     - phy: mscc: Fix PTP for VSC8574 and VSC8572
     - sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock().
     - RDMA/rxe: Fix null deref on srq->rq.queue after resize failure
     - Revert "mtd: rawnand: marvell: fix layouts"
     - [arm64,armhf] mtd: nand: relax ECC parameter validation check
     - perf: Remove get_perf_callchain() init_nr argument
     - bpf: Refactor stack map trace depth calculation into helper function
     - bpf: Fix stackmap overflow check in __bpf_get_stackid()
     - [amd64] perf/x86/intel/cstate: Remove PC3 support from LunarLake
     - task_work: Fix NMI race condition
     - [amd64] x86/dumpstack: Prevent KASAN false positive warnings in
       __show_regs()
     - tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set
     - [arm64] soc: qcom: smem: fix hwspinlock resource leak in probe error paths
     - [armhf] pinctrl: stm32: fix hwspinlock resource leak in probe function
     - i3c: fix refcount inconsistency in i3c_master_register
     - i3c: master: svc: Prevent incomplete IBI transaction
     - wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload()
     - [arm64] interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS
     - [arm64] dts: qcom: msm8996: add interconnect paths to USB2 controller
     - interconnect: debugfs: Fix incorrect error handling for NULL path
     - drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource()
     - perf lock contention: Load kernel map before lookup
     - perf record: skip synthesize event when open evsel failed
     - power: supply: rt5033_charger: Fix device node reference leaks
     - power: supply: cw2015: Check devm_delayed_work_autocancel() return code
     - power: supply: max17040: Check iio_read_channel_processed() return code
     - power: supply: rt9467: Return error on failure in
       rt9467_set_value_from_ranges()
     - power: supply: rt9467: Prevent using uninitialized local variable in
       rt9467_set_value_from_ranges()
     - power: supply: wm831x: Check wm831x_set_bits() return value
     - power: supply: apm_power: only unset own apm_get_power_status
     - scsi: target: Do not write NUL characters into ASCII configfs output
     - fs/9p: Don't open remote file with APPEND mode when writeback cache is
       used
     - [arm64] drm/panthor: Handle errors returned by drm_sched_entity_init()
     - [arm64] drm/panthor: Fix group_free_queue() for partially initialized
       queues
     - [arm64] drm/panthor: Fix UAF race between device unplug and FW event
       processing
     - [arm64] drm/panthor: Fix race with suspend during unplug
     - [arm64] drm/panthor: Fix UAF on kernel BO VA nodes
     - libbpf: Fix parsing of multi-split BTF
     - [armhf] dts: am335x-netcom-plus-2xx: add missing GPIO labels
     - [armhf] dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible
     - [armhf] dts: omap3: n900: Correct obsolete TWL4030 power compatible
     - [amd64] x86/boot: Fix page table access in 5-level to 4-level paging
       transition
     - efi/libstub: Fix page table access in 5-level to 4-level paging transition
     - ext4: correct the checking of quota files before moving extents
     - [amd64] perf/x86/intel: Correct large PEBS flag check
     - regulator: core: disable supply if enabling main regulator fails
     - md: fix rcu protection in md_wakeup_thread
     - nbd: defer config put in recv_work
     - scsi: stex: Fix reboot_notifier leak in probe error path
     - scsi: smartpqi: Fix device resources accessed after device removal
     - dt-bindings: PCI: amlogic: Fix the register name of the DBI region
     - RDMA/rtrs: server: Fix error handling in get_or_create_srv
     - ntfs3: init run lock for extend inode
     - [arm64] drm/panthor: Fix potential memleak of vma structure
     - scsi: ufs: core: fix incorrect buffer duplication in
       ufshcd_read_string_desc()
     - [amd64] cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs
     - [powerpc*] kdump: Fix size calculation for hot-removed memory ranges
     - [powerpc*] 32: Fix unpaired stwcx. on interrupt exit
     - wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper()
     - nbd: defer config unlock in nbd_genl_connect
     - coresight: Change device mode to atomic type
     - [arm64] coresight: etm4x: Correct polling IDLE bit
     - [arm64] coresight: etm4x: Extract the trace unit controlling
     - [arm64] coresight: etm4x: Add context synchronization before enabling
       trace
     - lib/vsprintf: Check pointer before dereferencing in time_and_date()
     - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()
     - ACPI: property: Fix fwnode refcount leak in
       acpi_fwnode_graph_parse_endpoint()
     - scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls
     - leds: netxbig: Fix GPIO descriptor leak in error paths
     - bpf: Free special fields when update [lru_,]percpu_hash maps
     - PCI: keystone: Exit ks_pcie_probe() for invalid mode
     - [arm64] dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A
     - [arm64] dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A
     - [arm64] dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C
     - [amd64] crypto: iaa - Fix incorrect return value in save_iaa_wq()
     - [arm64] drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype
     - ps3disk: use memcpy_{from,to}_bvec index
     - bpf: Handle return value of ftrace_set_filter_ip in register_fentry
     - bpf: Check skb->transport_header is set in bpf_skb_check_mtu
     - watchdog: wdat_wdt: Fix ACPI table leak in probe function
     - watchdog: starfive: Fix resource leak in probe error path
     - tracefs: fix a leak in eventfs_create_events_dir()
     - NFSD/blocklayout: Fix minlength check in proc_layoutget
     - block/blk-throttle: Fix throttle slice time for SSDs
     - [arm64] drm/msm/a2xx: stop over-complaining about the legacy firmware
     - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
     - bpf: Fix invalid prog->stats access when update_effective_progs fails
     - [powerpc*] 64s/hash: Restrict stress_hpt_struct memblock region to within
       RMA limit
     - [powerpc*] 64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE
       format
     - fs/ntfs3: out1 also needs to put mi
     - fs/ntfs3: Prevent memory leaks in add sub record
     - [arm64] drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue
     - [arm64] drm/msm/a6xx: Flush LRZ cache before PT switch
     - [arm64] drm/msm/a6xx: Fix the gemnoc workaround
     - [arm64] drm/msm/a6xx: Improve MX rail fallback in RPMH vote init
     - ipv6: clear RA flags when adding a static route (Closes: #1117959)
     - pwm: bcm2835: Make sure the channel is enabled after pwm_request()
     - scsi: qla2xxx: Fix improper freeing of purex item
     - [amd64] iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb
     - wifi: mac80211: fix CMAC functions not handling errors
     - [arm64] mfd: mt6397-irq: Fix missing irq_domain_remove() in error path
     - [arm64] mfd: mt6358-irq: Fix missing irq_domain_remove() in error path
     - leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM
     - [arm64] phy: renesas: rcar-gen3-usb2: Fix an error handling path in
       rcar_gen3_phy_usb2_probe()
     - [arm64] phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth
     - [arm64] phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from
       exceeding the limits
     - net: phy: adin1100: Fix software power-down ready condition
     - cpuset: Treat cpusets in attaching as populated
     - wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
     - RAS: Report all ARM processor CPER information to userspace
     - ima: Handle error code returned by ima_filter_rule_match()
     - usb: chaoskey: fix locking for O_NONBLOCK
     - usb: dwc2: disable platform lowlevel hw resources during shutdown
     - usb: dwc2: fix hang during shutdown if set as peripheral
     - usb: dwc2: fix hang during suspend if set as peripheral
     - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE
     - [riscv64] KVM: Fix guest page fault within HLV* instructions
     - erofs: limit the level of fs stacking for file-backed mounts
     - RDMA/bnxt_re: Fix the inline size for GenP7 devices
     - RDMA/bnxt_re: Pass correct flag for dma mr creation
     - ASoC: tas2781: correct the wrong period
     - mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()
     - firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc
     - staging: fbtft: core: fix potential memory leak in fbtft_probe_common()
     - [arm64] iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables
     - btrfs: fix leaf leak in an error path in btrfs_del_items()
     - PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition
     - drm/nouveau: restrict the flush page to a 32-bit address
     - iomap: factor out a iomap_dio_done helper
     - iomap: always run error completions in user context
     - wifi: ieee80211: correct FILS status codes
     - backlight: led-bl: Add devlink to supplier LEDs
     - backlight: lp855x: Fix lp855x.h kernel-doc warnings
     - [arm64] iommu/arm-smmu-qcom: Enable use of all SMR groups when running
       bare-metal
     - RDMA/irdma: Fix data race in irdma_sc_ccq_arm
     - RDMA/irdma: Fix data race in irdma_free_pble
     - RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY
     - [arm64] drm/panthor: Avoid adding of kernel BOs to extobj list
     - gfs2: Prevent recursive memory reclaim
     - firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER
     - drm/amd/display: Fix logical vs bitwise bug in
       get_embedded_panel_info_v2_1()
     - hwmon: sy7636a: Fix regulator_enable resource leak on error path
     - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4
     - ublk: prevent invalid access with DEBUG
     - ext4: improve integrity checking in __mb_check_buddy by enhancing order-0
       validation
     - of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node
     - virtio_vdpa: fix misleading return in void function
     - virtio: fix typo in virtio_device_ready() comment
     - virtio: fix whitespace in virtio_config_ops
     - virtio: fix grammar in virtio_queue_info docs
     - virtio: fix virtqueue_set_affinity() docs
     - vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues
     - vhost: Fix kthread worker cgroup failure handling
     - vdpa/pds: use %pe for ERR_PTR() in event handler registration
     - [amd64] ASoC: Intel: catpt: Fix error path in hw_params()
     - [armhf] dts: samsung: universal_c210: turn off SDIO WLAN chip during
       system suspend
     - [armhf] dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during
       system suspend
     - [armhf] dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during
       system suspend
     - [armhf] dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during
       system suspend
     - regulator: core: Protect regulator_supply_alias_list with
       regulator_list_mutex
     - resource: replace open coded resource_intersection()
     - resource: introduce is_type_match() helper and use it
     - Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()"
     - netfilter: flowtable: check for maximum number of encapsulations in bridge
       vlan
     - netfilter: nf_conncount: rework API to use sk_buff directly
     - netfilter: nft_connlimit: update the count if add was skipped
     - net: stmmac: fix rx limit check in stmmac_rx_zc()
     - vfio/pci: Use RCU for error/request triggers to avoid circular locking
     - net: phy: aquantia: check for NVMEM deferral
     - mtd: lpddr_cmds: fix signed shifts in lpddr_cmds
     - [arm64] remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs
     - md/raid5: fix IO hang when array is broken with IO inflight
     - net: hsr: remove one synchronize_rcu() from hsr_del_port()
     - net: hsr: remove synchronize_rcu() from hsr_add_port()
     - net: hsr: Create and export hsr_get_port_ndev()
     - net: hsr: create an API to get hsr port type
     - net: dsa: xrs700x: reject unsupported HSR configurations
     - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop
       (CVE-2025-68325)
     - perf tools: Mark split kallsyms DSOs as loaded
     - perf tools: Fix split kallsyms DSO counting
     - perf hist: In init, ensure mem_info is put on error paths
     - [arm64,armhf] pinctrl: single: Fix incorrect type for error return
       variable
     - fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe()
     - 9p: fix cache/debug options printing in v9fs_show_options
     - sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the
       last task migrates out
     - [amd64] platform/x86:intel/pmc: Update Arrow Lake telemetry GUID
     - f2fs: keep POSIX_FADV_NOREUSE ranges
     - f2fs: add a sysfs entry to reclaim POSIX_FADV_NOREUSE pages
     - f2fs: fix to avoid running out of free segments
     - f2fs: add carve_out sysfs node
     - f2fs: sysfs: add encoding_flags entry
     - f2fs: introduce reserved_pin_section sysfs entry
     - f2fs: add gc_boost_gc_multiple sysfs node
     - f2fs: add gc_boost_gc_greedy sysfs node
     - f2fs: maintain one time GC mode is enabled during whole zoned GC cycle
     - NFS: Avoid changing nlink when file removes and attribute updates race
     - fs/nls: Fix utf16 to utf8 conversion
     - NFS: Initialise verifiers for visible dentries in readdir and lookup
     - NFS: Initialise verifiers for visible dentries in nfs_atomic_open()
     - nfs/vfs: discard d_exact_alias()
     - NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state
     - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid
     - Revert "nfs: ignore SB_RDONLY when remounting nfs"
     - Revert "nfs: clear SB_RDONLY before getting superblock"
     - Revert "nfs: ignore SB_RDONLY when mounting nfs"
     - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
     - Expand the type of nfs_fattr->valid
     - NFS: Fix inheritance of the block sizes when automounting
     - fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8()
     - [amd64] platform/x86: asus-wmi: use brightness_set_blocking() for kbd led
     - blk-mq: Abort suspend when wakeup events are pending
     - block: fix comment for op_is_zone_mgmt() to include RESET_ALL
     - block: fix memory leak in __blkdev_issue_zero_pages
     - nvme-auth: use kvfree() for memory allocated with kvcalloc()
     - drm/plane: Fix IS_ERR() vs NULL check in
       drm_plane_create_hotspot_properties()
     - regulator: fixed: Rely on the core freeing the enable GPIO
     - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events
     - drm/nouveau: refactor deprecated strcpy
     - cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2
     - docs: hwmon: fix link to g762 devicetree binding
     - dma/pool: eliminate alloc_pages warning in atomic_pool_expand
     - ALSA: uapi: Fix typo in asound.h comment
     - drm/amdkfd: Use huge page size to check split svm range alignment
     - rtc: gamecube: Check the return value of ioremap()
     - ALSA: firewire-motu: add bounds check in put_user loop for DSP events
     - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of
       set->tag_list_lock
     - block: return unsigned int from queue_dma_alignment
     - dm-raid: fix possible NULL dereference with undefined raid type
     - dm log-writes: Add missing set_freezable() for freezable kthread
     - efi/cper: Add a new helper function to print bitmasks
     - efi/cper: Adjust infopfx size to accept an extra space
     - efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs
     - scsi: imm: Fix use-after-free bug caused by unfinished delayed work
       (CVE-2025-68324)
     - irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()
     - ocfs2: fix memory leak in ocfs2_merge_rec_left()
     - net: lan743x: Allocate rings outside ZONE_DMA
     - net: dst: introduce dst->dev_rcu
     - tcp_metrics: use dst_dev_net_rcu() (CVE-2025-40075)
     - usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt
     - usb: phy: Initialize struct usb_phy list_head
     - usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required
     - ALSA: dice: fix buffer overflow in detect_stream_formats()
     - ALSA: wavefront: Fix integer overflow in sample size validation
 .
   [ Uwe Kleine-König ]
   * [armhf] Enable LEDS_TURRIS_OMNIA as a module for Turris Omnia LED
     support.
 .
   [ Maxwell Pevner ]
   * drivers/hid: Enable HID_UNIVERSAL_PIDFF as module (Closes: #1122144)

lua-wsapi (1.6.1-3+deb13u1) trixie; urgency=medium
 .
   * Fix Homepage.
   * Recover common module for lua5.1. (Closes: #1123592)

lxc (1:6.0.4-4+deb13u1) trixie; urgency=medium
 .
   [ Frost ]
   * Add lxc-net dependency to sysvinit script (Closes: #1122149)
 .
   [ Mathias Gibbens ]
   * Cherry-pick upstream fix to stop printing misleading errors in
     enter_net_ns() (Closes: #1118024)
   * Cherry-pick upstream fix for generating
     apparmor.d/abstractions/lxc/container-base (partially addresses: #1111087)
   * Cherry-pick upstream fix for restarting unprivileged containers
     (Closes: #1123979)

lxd (5.0.2+git20231211.1364ae4-9+deb13u2) trixie; urgency=medium
 .
   * Cherry-pick upstream fix for broken idmapping with kernel 6.9+
   * Cherry-pick upstream fix for CVE-2025-64507 / GHSA-56mx-8g9f-5crf

matlab-support (0.1.1+deb13u1) trixie; urgency=medium
 .
   * No longer rename libvulkan.so.1 and libfreetype.so.6 in postinst
     (Closes: #1120681)

mbedtls (3.6.5-0.1~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie.
 .
 mbedtls (3.6.5-0.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * New upstream release.
     - CVE-2025-54764: Side channel in RSA key generation and operations
       (Closes: #1118750)
     - CVE-2025-59438: Padding oracle through timing of cipher error reporting
       (Closes: #1118752)

mediawiki (1:1.43.6+dfsg-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security.
mediawiki (1:1.43.5+dfsg-1) unstable; urgency=medium
 .
   * New upstream version 1.43.5, fixing CVE-2025-11173, CVE-2025-61634,
     CVE-2025-61635, CVE-2025-61636, CVE-2025-61637, CVE-2025-61638,
     CVE-2025-61639, CVE-2025-61640, CVE-2025-61641, CVE-2025-61642,
     CVE-2025-61643, CVE-2025-61646, CVE-2025-61652, CVE-2025-61653,
     CVE-2025-61654, CVE-2025-61655, CVE-2025-61656, CVE-2025-61657. This
     version is not affected by CVE-2025-61645.
     * Drop patches merged upstream.
   * Include the font required to render the two-factor authentication enabling
     interface.

mirrorbits (0.6.1-1~deb13u1) trixie; urgency=medium
 .
   * New upstream version [0.6.1]
   * Fix "Internal Server Error" regressions. Mirrorbits must redirect users to
     the fallback mirror(s) if ever the database is unreachable. This was
     broken in version 0.6, and fixed in 0.6.1.
   * Normalize URL for fallback mirror(s), as it's done for all the other
     mirrors. Fix bogus redirections if ever the fallback URL doesn't end with
     a trailing slash.

mongo-c-driver (1.30.4-1+deb13u1) trixie; urgency=medium
 .
   * Fix CVE-2025-12119: mongoc_bulk_operation_t may read invalid memory if
     large options are passed.

mutter (48.7-0+deb13u1) trixie; urgency=medium
 .
   * Team upload
   * New upstream stable release 48.6
     - Fix drag-and-drop actions not working reliably in some X11 clients
       (mutter#4288 upstream)
     - Fix delayed frame presentation with the commit-timing-v1 Wayland
       extension (mutter#4258 upstream)
     - Avoid a crash if a GNOME Shell extension tries to delete the same
       window more than once (mutter#4319 upstream)
     - Avoid a crash in the Wayland session if a non-GNOME desktop
       environment previously set the cursor size in GSettings to zero;
       recover by resetting it to the default, 24px (mutter#3933 upstream)
     - Fix crashes if a GNOME Shell extension uses certain Cogl pipeline
       APIs (mutter#4352 upstream)
     - Save the intended size for tiled windows when saving session state
       (mutter!4697 upstream)
     - Avoid potential crashes when saving the state of a window with no
       valid toplevel state (mutter!4697 upstream)
     - Remove dead code detected by static analysis (mutter!4697 upstream)
   * New upstream stable release 48.7
     - For fullscreen Wayland windows, if the window has a size limit
       smaller than the screen, add black borders around the limited size
       and log a warning
       (mutter!4587 upstream)
     - Avoid a crash when activating a notification that has no app info
       (mutter!4705 upstream)
     - Avoid a potential crash when checking whether a client owns a window
       that is disappearing
       (mutter!4643 upstream)
     - Test suite enhancements
 .
   [ Simon McVittie ]
   * d/libmutter-test-16.symbols:
     Update for new ABI added by the test suite enhancements
     (nothing in Debian outside the mutter source package is likely to
     use this, except possibly a future version of gnome-shell)
   * Revert "d/gbp/conf, d/control: Switch packaging branch for forky"
   * Add a mention of #1121170 to the previous changelog entry
mutter (48.5-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream stable release
     - Fix X11 drag-and-drop with a graphics tablet stylus, which would
       previously freeze the application
       (mutter#3914 upstream)
     - Fix a file descriptor leak that would cause a crash after a long
       screencast
       (mutter#4251 upstream)
     - Fix crash with an assertion failure when screencasting from an
       Apple aarch64 system
       (mutter#4224 upstream)
     - Fix detection of the "Privacy Screen" feature on hardware that
       supports it
       (mutter#4259 upstream)
     - Update the EIS viewport used for input capture when a virtual monitor
       stream is resized
       (mutter!4622 upstream)
     - Fix a crash when combining the screen time limit's greyscale effect,
       the screen magnifier and the screenshot tool
       (mutter#8634 upstream)
     - Fix a crash when unplugging a docking station with two monitors
       (mutter#4262 upstream)
     - Translation update: th
   * d/gbp/conf, d/control: Switch packaging branch for forky

node-nodemailer (6.10.0+~6.4.17-1+deb13u1) trixie; urgency=medium
 .
   * Fix  addressparser handling of quoted nested email addresses
     (Closes: CVE-2025-13033)

openconnect (9.12-3+deb13u2) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * use the unsigned printf qualifier for size_t : fixes MinGW{32,64} build
   * Use RFC9266 'tls-exporter' channel bindings for Cisco STRAP with TLSv1.3
     (Closes: #1099497)
openconnect (9.12-3+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   [ Luca Boccassi ]
   * d/copyright: update Upstream-Contact to mailing list
 .
   [ Lee Garrett ]
   * Patch: Respect path in AnyConnect/OpenConnect XML form handling (Closes: #1119239)
   * Update debian/gbp.conf to match debian/trixie branch

openvpn (2.6.14-1+deb13u1) trixie-security; urgency=medium
 .
   * Cherry-pick patches for CVE-2025-13086
     - check-message-id.patch: Check message id/acked ids too when doing
       sessionid cookie checks - bugfix for floating client problem, code
       prequesite for the CVE patch to apply
     - CVE-2025-13086.patch: Fix memcmp check for the hmac verification in the
       3way handshake being inverted (Closes: #1121086)
   * fix-ftbfs-kernel-6.16.patch: Fix compilation against 6.16+ kernel
     headers (Closes: #1114249)
   * d/gbp.conf: set debian-branch for trixie

pdfminer (20221105+dfsg-1.1~deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Rebuild for trixie-security
pdfminer (20221105+dfsg-1.1~deb12u1) bookworm-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Rebuild for bookworm-security

pdns-recursor (5.2.7-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 5.2.7, fixing CVE-2025-59030.

pgbouncer (1.24.1-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload by the Debian LTS Security Team.
   * CVE-2025-12819: execute arbitrary SQL during authentication.
     Untrusted search path in auth_query connection handler in PgBouncer
     before 1.25.1 allows an unauthenticated attacker to execute arbitrary
     SQL during authentication via a malicious search_path parameter in the
     StartupMessage.

postgresql-17 (17.7-0+deb13u1) trixie; urgency=medium
 .
   * New upstream version 17.7.
 .
     + Check for CREATE privileges on the schema in CREATE STATISTICS
       (Jelte Fennema-Nio)
 .
       This omission allowed table owners to create statistics in any schema,
       potentially leading to unexpected naming conflicts.
 .
       The PostgreSQL Project thanks Jelte Fennema-Nio for reporting this
       problem. (CVE-2025-12817)
 .
     + Avoid integer overflow in allocation-size calculations within libpq
       (Jacob Champion)
 .
       Several places in libpq were not sufficiently careful about computing
       the required size of a memory allocation.  Sufficiently large inputs
       could cause integer overflow, resulting in an undersized buffer, which
       would then lead to writing past the end of the buffer.
 .
       The PostgreSQL Project thanks Aleksey Solovev of Positive Technologies
       for reporting this problem. (CVE-2025-12818)
postgresql-17 (17.6-1) unstable; urgency=medium
 .
   * New upstream version 17.6.
 .
     + Tighten security checks in planner estimation functions (Dean Rasheed)
 .
       The fix for CVE-2017-7484, plus followup fixes, intended to prevent
       leaky functions from being applied to statistics data for columns that
       the calling user does not have permission to read.  Two gaps in that
       protection have been found.  One gap applies to partitioning and
       inheritance hierarchies where RLS policies on the tables should restrict
       access to statistics data, but did not.
 .
       The other gap applies to cases where the query accesses a table via a
       view, and the view owner has permissions to read the underlying table
       but the calling user does not have permissions on the view. The view
       owner's permissions satisfied the security checks, and the leaky
       function would get applied to the underlying table's statistics before
       we check the calling user's permissions on the view.  This has been
       fixed by making security checks on views occur at the start of planning.
       That might cause permissions failures to occur earlier than before.
 .
       The PostgreSQL Project thanks Dean Rasheed for reporting this problem.
       (CVE-2025-8713)
 .
     + Prevent pg_dump scripts from being used to attack the user running the
       restore (Nathan Bossart)
 .
       Since dump/restore operations typically involve running SQL commands as
       superuser, the target database installation must trust the source
       server.  However, it does not follow that the operating system user who
       executes psql to perform the restore should have to trust the source
       server.  The risk here is that an attacker who has gained
       superuser-level control over the source server might be able to cause it
       to emit text that would be interpreted as psql meta-commands. That would
       provide shell-level access to the restoring user's own account,
       independently of access to the target database.
 .
       To provide a positive guarantee that this can't happen, extend psql with
       a \restrict command that prevents execution of further meta-commands,
       and teach pg_dump to issue that before any data coming from the source
       server.
 .
       The PostgreSQL Project thanks Martin Rakhmanov, Matthieu Denais, and
       RyotaK for reporting this problem. (CVE-2025-8714)
 .
     + Convert newlines to spaces in names included in comments in pg_dump
       output (Noah Misch)
 .
       Object names containing newlines offered the ability to inject arbitrary
       SQL commands into the output script.  (Without the preceding fix,
       injection of psql meta-commands would also be possible this way.)
       CVE-2012-0868 fixed this class of problem at the time, but later work
       reintroduced several cases.
 .
       The PostgreSQL Project thanks Noah Misch for reporting this problem.
       (CVE-2025-8715)
 .
   * Add Turkish debconf translation by Atila KOÇ, thanks! (Closes: #1107984)
   * Drop hurd-iovec patch, implemented upstream.
   * Drop obsolete patches: focal-arm64-outline-atomics, jit-s390x.

pylint-django (2.0.13-5+deb13u1) trixie; urgency=medium
 .
   * Add salsa-ci.yml.
   * Add smoke autopkgtest.
   * Delete unused broken unit-tests-p3 autopkgtest.
   * Fix scoped_nodes import (Closes: #1121404).

qemu (1:10.0.7+ds-0+deb13u1) trixie; urgency=medium
 .
   * 10.0.7 upstream stable/bugfix release:
    - Update version for 10.0.7 release
    - kvm: Fix kvm_vm_ioctl() and kvm_device_ioctl() return value
    - docs/devel: Update URL for make-pullreq script
    - target/arm: Fix assert on BRA.
    - hw/aspeed/{xdma, rtc, sdhci}: Fix endianness to DEVICE_LITTLE_ENDIAN
    - hw/core/machine: Provide a description for aux-ram-share property
    - hw/pci: Make msix_init take a uint32_t for nentries
    - block/io_uring: avoid potentially getting stuck after resubmit
      at the end of ioq_submit()
    - block-backend: Fix race when resuming queued requests
    - ui/vnc: Fix qemu abort when query vnc info
    - chardev/char-pty: Do not ignore chr_write() failures
    - hw/display/exynos4210_fimd: Account for zero length
      in fimd_update_memory_section()
    - hw/arm/armv7m: Disable reentrancy guard for v7m_sysreg_ns_ops MRs
    - hw/arm/aspeed: Fix missing SPI IRQ connection causing
      DMA interrupt failure
    - migration: Fix transition to COLO state from precopy
    - qmp: Fix a typo for a USO feature
    - MAINTAINERS: Add functional tests that are not covered yet
    - tests/functional: Remove unnecessary import statements
    - tests/functional: Remove semicolons at the end of lines
    - Remove the remainders of the Avocado tests
    - docs/devel/testing: Dissolve the ci-definitions.rst.inc file
    - gitlab-ci: Update QEMU_JOB_AVOCADO and QEMU_CI_AVOCADO_TESTING
    - tests/functional: Convert the SMMU test to the functional framework
    - tests/functional: Use the tuxrun kernel for the aarch64 replay test
    - tests/functional: Use the tuxrun kernel for the x86 replay test
    - tests/avocado: Remove the boot_linux.py tests
    - tests/functional: Convert the 64-bit big endian Wheezy mips test
    - tests/functional: Convert the 64-bit little endian Wheezy mips test
    - tests/functional: Convert the 32-bit little endian Wheezy mips test
    - tests/functional: Convert the 32-bit big endian Wheezy mips test
    - tests/avocado: Remove the LinuxKernelTest class
    - tests/functional: Convert the i386 replay avocado test
    - tests/functional: Convert reverse_debugging tests to the
      functional framework
    - tests/functional: Move the check for the parameters from avocado
      to functional
    - gitlab-ci: Remove the avocado tests from the CI pipelines
    - tests/functional/test_vnc: skip test if no crypto backend available
    - target/i386: fix stack size when delivering real mode interrupts
    - target/i386: svm: fix sign extension of exit code
    - target/i386/tcg: validate segment registers
    - target/i386: Mark VPERMILPS as not valid with prefix 0
    - hw/southbridge/lasi: Correct LasiState parent
    - hw/dma/zynq-devcfg: Fix register memory
    - tests/functional: handle URLError when fetching assets
    - tests/functional: fix formatting of exception args
    - block/io: Take reqs_lock for tracked_requests
    - nvme: Fix coroutine waking
    - nvme: Kick and check completions in BDS context
    - curl: Fix coroutine waking
    - nfs: Run co BH CB in the coroutine’s AioContext
    - rbd: Run co BH CB in the coroutine’s AioContext
    - tests: move test_virt_gpu to share.linaro.org
    - tests: move test_kvm_xen to share.linaro.org
    - tests: move test_netdev_ethtool to share.linaro.org
    - tests: move test_virt assets to share.linaro.org
    - tests: move test_xen assets to share.linaro.org
    - block: add test non-active commit with zeroed data
    - block: allow commit to unmap zero blocks
    - block: refactor error handling of commit_iteration
    - block: move commit_run loop to separate function
    - block: get type of block allocation in commit_run
    - hw/misc/npcm_clk: Don't divide by zero when calculating frequency
    - hw/display/xlnx_dp: Don't abort for unsupported graphics formats
    - hw/display/xlnx_dp.c: Don't abort on AUX FIFO overrun/underrun
    - net: pad packets to minimum length in qemu_receive_packet()
      Closes: #1119917, CVE-2025-12464 (buffer overflow in e1000_receive_iov)
    - hw/net/e1000e_core: Adjust
      e1000e_write_payload_frag_to_rx_buffers() assert
    - hw/net/e1000e_core: Correct rx oversize packet checks
    - hw/net/e1000e_core: Don't advance desc_offset for NULL buffer
      RX descriptors
    - qio: Protect NetListener callback with mutex
    - qio: Remember context of qio_net_listener_set_client_func_full
    - qio: Unwatch before notify in QIONetListener
    - qio: Add trace points to net_listener
    - tests/qemu-iotest: fix iotest 024 with qed images
    - qemu-img rebase: don't exceed IO_BUF_SIZE in one operation
    - qemu-img: Fix amend option parse error handling
    - tests/qtest/bios-tables-test: Update DSDT blobs after GPEX _DSM change
    - hw/pci-host/gpex-acpi: Fix _DSM function 0 support return value
    - tests/qtest/bios-tables-test: Prepare for _DSM change in the DSDT table
    - vhost-user: fix shared object lookup handler logic
    - target/x86: Correctly handle invalid 0x0f 0xc7 0xxx insns
    - hostmem/shm: Allow shm memory backend serve as shared memory for coco-VMs
    - tests/tcg/s390x: Test SET CLOCK COMPARATOR
    - target/s390x: Use address generation for register branch targets
    - target/s390x: Fix missing clock-comparator interrupts after reset
    - target/s390x: Fix missing interrupts for small CKC values
    - target/microblaze: Handle signed division overflows
    - target/microblaze: div: Break out raise_divzero()
    - target/microblaze: Remove unused arg from check_divz()
    - gdbstub: Fix %s formatting
    - block/curl.c: Fix CURLOPT_VERBOSE parameter type
    - block: fix luks 'amend' when run in coroutine
    - block: remove 'detached-header' option from opts after use
    - i386/kvm/cpu: Init SMM cpu address space for hotplugged CPUs
    - hw/i386/pc: Avoid overlap between CXL window and PCI 64bit BARs
      in QEMU 10.0.x
    - target/i386: clear CPU_INTERRUPT_SIPI for all accelerators
    - linux-user: permit sendto() with NULL buf and 0 len
    - linux-user: Use correct type for FIBMAP and FIGETBSZ emulation
    - qtest/am53c974-test: add additional test for cmdfifo overflow
    - esp.c: fix esp_cdb_ready() FIFO wraparound limit calculation
    - hw/hppa: Fix interrupt of LASI parallel port
    - nw/nvram/ds1225y: Fix nvram MemoryRegion owner
    - target/hppa: Set FPCR exception flag bits for non-trapped exceptions
    - hw/scsi: avoid deadlock upon TMF request cancelling with VirtIO
    - crypto: stop requiring "key encipherment" usage in x509 certs
    - io: fix use after free in websocket handshake code
      Closes: #1117153, CVE-2025-11234 (UAF in websocket handshake code)
    - io: move websock resource release to close method
    - io: release active GSource in TLS channel finalizer
    - target/riscv: fix riscv_cpu_sirq_pending() mask
    - target/riscv/kvm: fix env->priv setting in reset_regs_csr()
    - target/riscv/kvm: add scounteren CSR
    - target/riscv/kvm: read/write KVM regs via env size
    - target/riscv/kvm: add senvcfg CSR
    - aplic: fix mask for smsiaddrcfgh
    - hw/riscv: Correct mmu-type property of sifive_u harts in device tree
    - target/arm: Fix reads of CNTFRQ_EL0 in linux-user mode
    - hw/ppc/e500: Check for compatible CPU type instead of
      aborting ungracefully
    - ui/gtk-gl-area: Remove extra draw call in refresh
    - tests/tcg/multiarch/linux/linux-test: Don't try to test atime update
   * linux-user-use-correct-type-for-FIBMAP-and-FIGETBSZ.patch:
     remove, applied upstream
   * d/control: qemu-system-xen: add the forgotten ipxe-qemu dependency
     qemu-system binaries require pxe boot roms for the network adaptors.
     When splitting qemu-system-xen into its own package, this dependency
     has been forgotten initally, but has been enabled for bookworm (#1035676).
     However, this change were lost when uploading the next version of qemu
     aimed for trixie.  So trixie has this issue too, despite it's been fixed
     in bookworm already.  (Closes: #1035676, #1120146)

qiv (3.0.1-2+deb13u1) trixie; urgency=medium
 .
   * debian/patches/putenv-x11.diff: Closes: #1103712.

r-bioc-beachmat (2.22.0+ds-3~deb13u1) trixie; urgency=medium
 .
   * Team upload.
 .
   [ Michael R. Crusoe ]
   * Patch up part of a test that depends on the "beachmat.hdf5" R
     package, which is not yet in Debian. Closes: #1111758

r-cran-gh (1.4.1-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload by the Debian LTS team.
   * d/patches/CVE-2025-54956.patch: Add patch to fix CVE-2025-54956.
     - The HTTP response is delivered in a data structure that
       includes the Authorization header from the corresponding HTTP
       request (closes: #1110481).

rails (2:7.2.2.2+dfsg-2~deb13u1) trixie-security; urgency=medium
 .
   * Team upload
   * New upstream release
   * Fix CVE-2025-24293 (Closes: #1111106)
     Active Record connects classes to relational database tables.
     The ID passed to find or similar methods may be logged without
     escaping. If this is directly to the terminal it may include
     unescaped ANSI sequences.
   * Fix CVE-2025-55193.
     Active Storage attempts to prevent the use of potentially unsafe image
     transformation methods and parameters by default.
     The default allowed list contains three methods allowing
     for the circumvention of the safe defaults which enables potential
     command injection vulnerabilities in cases where arbitrary
     user supplied input is accepted as valid transformation methods
     or parameters.
   * Target trixie in salsaCI
rails (2:7.2.2.2+dfsg-1) unstable; urgency=medium
 .
   * Team upload.
 .
   [ Soren Stoutner ]
   * New upstream release (fixes CVE-2025-24293 and CVE-2025-55193).
   * debian/control:  Remove "Breaks: ruby-actionpack-action-caching (<< 1.2.2)"
     (see https://lists.debian.org/debian-ruby/2025/08/msg00017.html).
   * debian/copyright:
     - Add Soren Stoutner to the debian/* stanza.
     - Add Lucas Nussbaum to the debian/* stanza.
     - Remove the unused GPL license.
 .
   [ Lucas Nussbaum ]
   * Remove unnecessary debian/.gitattributes.
   * debian/gbp.conf:  Make compliant with DEP-14 defaults.
   * debian/salsa-ci.yml:  Change to use the team-specific include.

reform-tools (1.71-2+deb13u1) trixie; urgency=medium
 .
   * add patch to allow building lpc for linux 6.17 from trixie-backports

rlottie (0.1+dfsg-4.2+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload by the LTS Team.
   * CVE-2025-0634 (Closes: #1109341)
     CVE-2025-53074
     CVE-2025-53075
     Most patches to fix these issues are already part of:
       Fix-crash-on-invalid-data.patch
     The remaining boundary check is left in:
       CVE-2025-0634-CVE-2025-53074-CVE-2025-53075.patch
     For the sake of completeness, the whole upstream patch
     for these CVEs is added in:
       CVE-2025-0634-CVE-2025-53074-CVE-2025-53075.patch.org

roundcube (1.6.12+dfsg-0+deb13u1) trixie-security; urgency=high
 .
   * New upstream security and bugfix release (closes: #1122899).
     + Fix CVE-2025-68461: Cross-Site-Scripting vulnerability via SVG's animate
       tag.
     + Fix CVE-2025-68460: Information Disclosure vulnerability in the HTML
       style sanitizer.
   * Refresh d/patches.
   * d/gbp.conf: Set debian-branch=debian/trixie.
   * Salsa CI: Set RELEASE=trixie, disable reprotest and lintian jobs.

rsync (3.4.1+ds1-5+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * d/p/CVE-2025-10158.patch: Import upstream patch to fix CVE-2025-10158
 .
     A malicious client acting as the receiver of an rsync file transfer
     can trigger an out of bounds read of a heap based buffer,
     via a negative array index.

rust-sequoia-openpgp (2.0.0-2+deb13u1) trixie; urgency=medium
 .
   * Add upstream commit b59886e5 (via debian/patches, edited to apply cleanly)
     to fix an underflow in aes_key_unwrap / CVE-2025-67897 to prevent DOS
     (crash) via special crafted encrypted messages. Closes: #1122582.

rust-sudo-rs (0.2.5-5+deb13u1) trixie-security; urgency=high
 .
   * Team upload
   * Ensure (partially) input passwords are not printed if killed during
     password prompt (Fixes:: GHSA-q428-6v73-fc4q)
   * Ensure `Defaults targetpw` and `Defaults rootpw` are taken into account for
     timestamp files (Fixes: GHSA-c978-wq47-pvvw)

sbuild (0.89.3+deb13u4) trixie; urgency=medium
 .
   * Revert "Actually use UNSHARE_MMDEBSTRAP_ENV_CMD"
 .
 sbuild (0.89.3+deb13u3) trixie; urgency=medium
 .
   * Actually use UNSHARE_MMDEBSTRAP_ENV_CMD
   * lib/Sbuild/Build.pm: preserve TMPDIR for piuparts
   * Obey $TMPDIR for autopkgtest dsc mkdtemp
   * Fix tempdir for autopkgtest
   * Initialize variable
 .
 sbuild (0.89.3+deb13u2) trixie; urgency=medium
 .
   [ Jochen Sprickerhof ]
   * Explicitly select the sbuild-build-depends-main-dummy package arch
     (Closes: #1119344)
 .
   [ Johannes Schauer Marin Rodrigues ]
   * lib/Sbuild/Build.pm: preserve TMPDIR when running autopkgtest
     (Closes: #1121503)
   * lib/Sbuild/Build.pm: perltidy
sbuild (0.89.3+deb13u3) trixie; urgency=medium
 .
   * Actually use UNSHARE_MMDEBSTRAP_ENV_CMD
   * lib/Sbuild/Build.pm: preserve TMPDIR for piuparts
   * Obey $TMPDIR for autopkgtest dsc mkdtemp
   * Fix tempdir for autopkgtest
   * Initialize variable
 .
 sbuild (0.89.3+deb13u2) trixie; urgency=medium
 .
   [ Jochen Sprickerhof ]
   * Explicitly select the sbuild-build-depends-main-dummy package arch
     (Closes: #1119344)
 .
   [ Johannes Schauer Marin Rodrigues ]
   * lib/Sbuild/Build.pm: preserve TMPDIR when running autopkgtest
     (Closes: #1121503)
   * lib/Sbuild/Build.pm: perltidy
sbuild (0.89.3+deb13u2) trixie; urgency=medium
 .
   [ Jochen Sprickerhof ]
   * Explicitly select the sbuild-build-depends-main-dummy package arch
     (Closes: #1119344)
 .
   [ Johannes Schauer Marin Rodrigues ]
   * lib/Sbuild/Build.pm: preserve TMPDIR when running autopkgtest
     (Closes: #1121503)
   * lib/Sbuild/Build.pm: perltidy

smb4k (4.0.0-1+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Fix two security issues in the KAuth mounthelper:
     - CVE-2025-66002: local users can perform arbitrary unmounts via
       smb4kmounthelper due to lack of input validation
     - CVE-2025-66003: local users can perform a local root exploit via smb4k
       mounthelper if they can access and control the contents of a Samba share
     (Closes: #1122381)
   * Merge Smb4KHardwareInterface class from master so that the merged security
     fixes can be compiled

sogo (5.12.1-3+deb13u1) trixie; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * CVE-2025-63498 - Cross Site Scripting (XSS)
   * CVE-2025-63499 - Cross Site Scripting (XSS) (Closes: #1121952)

strongswan (6.0.1-6+deb13u2) trixie-security; urgency=medium
 .
   * d/patches: add fix for buffer overflow in EAP-MSCHAPv2 (CVE-2025-62291)

suricata (1:7.0.10-1+deb13u2) trixie; urgency=medium
 .
   * Fix CVE-2025-64344 in 7.0.10.
     Cherry-Picked from upstream a7ff4c9ba53009680c7cd128b16c28d0aeda9886.
   * Fix CVE-2025-64333 in 7.0.10.
     Cherry-Picked from upstream 4b1d284bb57219b6677a8bda5cdc14a24a6aa22d.
   * Fix CVE-2025-64332 in 7.0.10.
     Cherry-Picked from upstream f67d72702a2601d0a86ac1450686e70d7176f629.
   * Fix CVE-2025-64331 in 7.0.10.
     Cherry-Picked from upstream 5abf9b81e78476f49ab074f3a74b5840747cd069.
     Added missing function declaration and refreshed patch by quilt.
   * Fix CVE-2025-64330 in 7.0.10.
     Cherry-Picked from upstream 5d6c24cc2ce6a390c0956b7ecb2c5efc47e72abc.

survex (1.4.17-1+deb13u1) trixie; urgency=medium
 .
   * New patch fix-find-stations-search-box-width.patch backported from
     1.4.18.  This fixes the width of the "find stations" search box to
     make it actually usable again.  Closes: #1109835

swift (2.35.1-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream point release:
     This new point release adds the feature to allow the use of aws-chunked
     transfer encoding. This is important because most S3 clients are using the
     boto library that has dropped support for any other protocol. This
     upstream point release contains only that change, which is minimal and
     will not affect any deployment other than accepting aws-chunked transfer.
   * Blacklist 2 unit tests that require isal lib to be installed:
     - test_sig_v4_strm_unsgnd_pyld_trl_checksum_hdr_unsupported
     - test_get_checksum_hasher
   * OSSA-2025-002: kay reported a vulnerability in Keystone’s ec2tokens and
     s3tokens APIs. By sending those endpoints a valid AWS Signature (e.g., from
     a presigned S3 URL), an unauthenticated attacker may obtain Keystone
     authorization (ec2tokens can yield a fully scoped token; s3tokens can
     reveal scope accepted by some services), resulting in unauthorized access
     and privilege escalation. Deployments where /v3/ec2tokens or /v3/s3tokens
     are reachable by unauthenticated clients (e.g., exposed on a public API)
     are affected.
     Swift needs to be modified to accept the fix for Keystone, otherwise S3
     authentication will stop working.
     Deployers are advised to update Swift first, as the patched swift will work
     with unpatched keystone, while the opposite isn't true.
     Applied upstream patch (Closes: #1120057):
     Add bug-2119646-swift.patch, which offers swift side compatibility with the
     keystone fix.

swupdate (2024.12.1+dfsg-3+deb13u1) trixie; urgency=medium
 .
   * Backport: suricatta/wfx: Fix rebooting (Closes: #1118485)

symfony (6.4.21+dfsg-2+deb13u1) trixie; urgency=medium
 .
   * Backport security fix from Symfony 6.4.29:
     - [HttpFoundation] Fix parsing pathinfo with no leading slash
       [CVE-2025-64500]
   * Use debian/trixie branch
   * [Finder] Drop data from testsuite

thunderbird (1:140.6.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security
thunderbird (1:140.6.0esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * Rebuild for bookworm-security
thunderbird (1:140.5.0esr-1) unstable; urgency=medium
 .
   [ Paul Gevers ]
   * [e457726] tests: help.sh is really a very superficial test, so let's mark
     it as such (Closes: #1120427)
 .
   [ Christoph Goehre ]
   * [4908c1a] New upstream version 140.5.0esr
     Fixed CVE issues in upstream version 140.5 (MFSA 2025-91):
     CVE-2025-13012: Race condition in the Graphics component
     CVE-2025-13016: Incorrect boundary conditions in the JavaScript:
                     WebAssembly component
     CVE-2025-13017: Same-origin policy bypass in the DOM: Notifications
                     component
     CVE-2025-13018: Mitigation bypass in the DOM: Security component
     CVE-2025-13019: Same-origin policy bypass in the DOM: Workers component
     CVE-2025-13013: Mitigation bypass in the DOM: Core & HTML component
     CVE-2025-13020: Use-after-free in the WebRTC: Audio/Video component
     CVE-2025-13014: Use-after-free in the Audio/Video component
     CVE-2025-13015: Spoofing issue in Thunderbird
thunderbird (1:140.5.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security
thunderbird (1:140.5.0esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * Rebuild for bookworm-security
thunderbird (1:140.4.0esr-1) unstable; urgency=medium
 .
   * [d34f599] New upstream version 140.4.0esr
     Fixed CVE issues in upstream version 140.4 (MFSA 2025-85):
     CVE-2025-11708: Use-after-free in MediaTrackGraphImpl::GetInstance()
     CVE-2025-11709: Out of bounds read/write in a privileged process triggered
                     by WebGL textures
     CVE-2025-11710: Cross-process information leaked due to malicious IPC
                     messages
     CVE-2025-11711: Some non-writable Object properties could be modified
     CVE-2025-11712: An OBJECT tag type attribute overrode browser behavior on
                     web resources without a content-type
     CVE-2025-11713: Potential user-assisted code execution in “Copy as cURL”
                     command
     CVE-2025-11714: Memory safety bugs fixed in Firefox ESR 115.29, Firefox
                     ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and
                     Thunderbird 144
     CVE-2025-11715: Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
                     ESR 140.4, Firefox 144 and Thunderbird 144

tryton-sao (7.0.28+ds1-1+deb13u2) trixie-security; urgency=high
 .
   * Add 02_escape_completion_content.patch.
     Patch for security issue:
     https://foss.heptapod.net/tryton/tryton/-/issues/14363
     Stored XSS Vulnerability Found in Party Field Leading to Arbitrary
     JavaScript Execution
     S.a. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1121233

tryton-server (7.0.30-1+deb13u1) trixie-security; urgency=high
 .
   * Add 03_traceback_in_RPC.patch,
     04_enforce_access_check_html_editor.patch,
     05_enforce_access_check_export_data.patch
 .
     Fixes for security issues:
 .
      Enforce access check in HTML editor route
      https://bugs.debian.org/1121241 (s.a. #1121241)
      -> https://foss.heptapod.net/tryton/tryton/-/issues/14364
 .
      Include the traceback only in RPC responses in development mode
      https://bugs.debian.org/1121242 (s.a. #1121242)
      -> https://foss.heptapod.net/tryton/tryton/-/issues/14354
 .
      Enforce access check in export_data
      https://bugs.debian.org/1121243 (s.a. #1121243)
      -> https://foss.heptapod.net/tryton/tryton/-/issues/14366

tzsetup (1:0.132+deb13u1) trixie; urgency=medium
 .
   [ Holger Wansing ]
   * Fix timezone for Argentina. Closes: #1111332.
   * Fix timezone for Ukraine as well (from MR4).

unbound (1.22.0-2+deb13u1) trixie-security; urgency=high
 .
   [ Guilhem Moulin ]
   * Fix CVE-2025-11411: Cache poisoning vulnerability via NS RRSet injection
   * debian/salsa-ci.yml: Disable reprotest and lintian jobs, set RELEASE=trixie
 .
   [ Michael Tokarev ]
   * CVE-2025-11411-additional-nodata.patch -- additional fixes
     for CVE-2025-11411 (Closes: #1121446, CVE-2025-11411)
   * d/gbp.conf: set default branch to debian/trixie

vlc (3.0.22-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 3.0.22
   * debian/gbp.conf: Work in trixie branch
   * debian/patches: Remove patches from upstream
vlc (3.0.22-0+deb12u1) bookworm-security; urgency=medium
 .
   * New upstream version 3.0.22
   * debian/: Re-enable VAAPI support (Closes: #1021601, #1013898)
vlc (3.0.22~rc2-1) unstable; urgency=medium
 .
   [ John Paul Adrian Glaubitz ]
   * Fix FTBFS on powerpc (Closes: #1115385)
 .
   [ Sebastian Ramacher ]
   * New upstream version 3.0.22~rc2
     - Fix installation of Assamese translation (Closes: #1085961)
vlc (3.0.22~rc1-1) unstable; urgency=medium
 .
   * New upstream version 3.0.22~rc1
   * debian/control:
     - Fix version constraints on suggested plugins
     - Drop alternative libmodplug-dev BD
     - Remove dpkg-dev dependency satisfied in stable
   * debian/:
     - Remove zsh completion to make the package reproducible
     - Switch to lua 5.4 (Closes: #1099742)
       Check the NEWS entry of vlc-plugin-base on potential issues.
     - Update lintian overrides for new format
   * debian/watch: Migrate to version 5
   * debian/rules:
     - debhelper now skips override_dh_auto_test if nocheck is specified
     - Remove handling of libtar as it got dropped upstream
   * debian/patches: Remove upstream patches included in 3.0.22~rc1
   * debian/copyright:
     - Remove old FSF address
     - Update copyright years
vlc (3.0.21-11) unstable; urgency=medium
 .
   * debian/rules: Disable postproc plugin since libpostproc is removed from
     ffmpeg 8.0
   * debian/control:
     - Bump Standards-Version
     - Remove unused BD on libvcdinfo-dev

webkit2gtk (2.50.4-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security.
   * Re-enable libmanette in i386.
   * Enable the transitional packages.
   * Don't override the clang compiler on armhf since trixie already uses
     clang-19 by default.
webkit2gtk (2.50.4-1~deb12u1) bookworm-security; urgency=medium
 .
   * Rebuild for bookworm-security.
   * Disable sysprof profiling integration to avoid new dependencies:
     - debian/control.in: Don't depend on libsysprof-capture-4-dev.
     - debian/rules: Build with -DUSE_SYSPROF_CAPTURE=OFF.
   * Disable JPEG XL to avoid adding new dependencies.
     - debian/control.in: Remove build dependency on libjxl-dev.
     - debian/rules: Build with -DUSE_JPEGXL=OFF.
   * debian/rules:
     - Enable ENABLE_SOUP2 and USE_OLD_PKG_NAMES to keep using the old
       package names.
     - Re-enable libmanette in i386.
   * debian/control-common.in:
     - Make the -dev packages depend on the gir packages.
   * debian/control.in:
     - Build depend on ccache.
   * Use clang-16 instead of clang.
   * debian/patches/fix-minibrowser.patch:
     - Fix the MiniBrowser with clang-16.
webkit2gtk (2.50.3-1) unstable; urgency=medium
 .
   [ Alberto Garcia ]
   * New upstream release.
   * Use the default gcc (gcc-15) again in mips64el now that #1116217 has
     been fixed.
   * Drop fix-crash.patch and fix-link-error.patch.
 .
   [ Jeremy Bicha ]
   * debian/control.in:
     - Stop suggesting devhelp, it's going to be removed from Debian.
webkit2gtk (2.50.3-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security.
   * Re-enable libmanette in i386.
   * Enable the transitional packages.
   * Don't override the clang compiler on armhf since trixie already uses
     clang-19 by default.
webkit2gtk (2.50.3-1~deb12u1) bookworm-security; urgency=medium
 .
   * Rebuild for bookworm-security.
   * Disable sysprof profiling integration to avoid new dependencies:
     - debian/control.in: Don't depend on libsysprof-capture-4-dev.
     - debian/rules: Build with -DUSE_SYSPROF_CAPTURE=OFF.
   * Disable JPEG XL to avoid adding new dependencies.
     - debian/control.in: Remove build dependency on libjxl-dev.
     - debian/rules: Build with -DUSE_JPEGXL=OFF.
   * debian/rules:
     - Enable ENABLE_SOUP2 and USE_OLD_PKG_NAMES to keep using the old
       package names.
     - Re-enable libmanette in i386.
   * debian/control-common.in:
     - Make the -dev packages depend on the gir packages.
   * debian/control.in:
     - Build depend on ccache.
   * Use clang-16 instead of clang.
   * debian/patches/fix-minibrowser.patch:
     - Fix the MiniBrowser with clang-16.
webkit2gtk (2.50.2-1) unstable; urgency=medium
 .
   * New upstream release.
   * debian/patches/fix-link-error.patch:
     - Cherry pick build fix for 2.50.2.
   * debian/patches/fix-crash.patch:
     - Cherry pick crash fix.
   * As of 2.50.0, WebKitGTK no longer depends on GstTranscoder (WebKit bug
     #295985).
     - debian/control.in: Remove build dependency on
       libgstreamer-plugins-bad1.0-dev.
     - debian/rules: Don't use -DUSE_GSTREAMER_TRANSCODER=OFF in Ubuntu.
   * debian/control.in:
     - Drop build dependency on libgirepository1.0-dev (Closes: #1118932).
     - Remove Rules-Requires-Root: no, as this is the default value since
       dpkg 1.22.13 (fixes redundant-rules-requires-root-no-field).
   * Use clang-19 on armhf since the build fails with versions 20 and 21
     (WebKit bug #290167).
webkit2gtk (2.50.2-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security.
   * Re-enable libmanette in i386.
   * Enable the transitional packages.
   * Don't override the gcc compiler on mips64el since trixie already uses
     gcc-14 by default.
   * Don't override the clang compiler on armhf since trixie already uses
     clang-19 by default.
webkit2gtk (2.50.2-1~deb12u1) bookworm-security; urgency=medium
 .
   * Rebuild for bookworm-security.
   * Disable sysprof profiling integration to avoid new dependencies:
     - debian/control.in: Don't depend on libsysprof-capture-4-dev.
     - debian/rules: Build with -DUSE_SYSPROF_CAPTURE=OFF.
   * Disable JPEG XL to avoid adding new dependencies.
     - debian/control.in: Remove build dependency on libjxl-dev.
     - debian/rules: Build with -DUSE_JPEGXL=OFF.
   * debian/rules:
     - Enable ENABLE_SOUP2 and USE_OLD_PKG_NAMES to keep using the old
       package names.
     - Re-enable libmanette in i386.
   * debian/control-common.in:
     - Make the -dev packages depend on the gir packages.
   * debian/control.in:
     - Build depend on ccache.
   * Use clang-16 instead of clang.
   * Don't override the gcc compiler on mips64el since bookworm uses gcc 12
     and not gcc 15 (#1116217).
   * debian/patches/fix-minibrowser.patch:
     - Fix the MiniBrowser with clang-16.
webkit2gtk (2.50.1-1) unstable; urgency=medium
 .
   * New upstream release.
   * debian/control.in:
     - Enable the bubblewrap sandbox in loong64.
     - Remove Gustavo from the list of uploaders, he hasn't been active
       in over a decade. Obrigado, amigo!
   * debian/rules:
     - Enable Skia in loong64, it builds fine with GCC 15.2.0 (but not with
       clang 19: "neon.h: error: _Float16 is not supported on this target")
     - Stop using -DDEBUG_FISSION=OFF, this is already disabled by
       default if developer mode is not enabled (WebKit bug #252679).
     - Use DEB_HOST_ARCH_BITS instead of DEB_BUILD_ARCH_BITS to detect if
       we're making a 32-bit build. This won't make a difference in
       practice but it's the correct way to do it.
   * Drop fix-ftbfs-i386.patch and fix-ftbfs-s390x.patch.

wordpress (6.8.3+dfsg1-0+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload.
   * New upstream version 6.8.3+dfsg1.
     (Fixes: CVE-2025-58674, CVE-2025-58246)

xen (4.20.2+7-g1badcf5035-0+deb13u1) trixie-security; urgency=medium
 .
   Significant changes:
   * Update to new upstream version 4.20.2+7-g1badcf5035, which also contains
     security fixes for the following issues:
     (Closes: #1105193) (Closes: #1120075)
     - x86: Indirect Target Selection
       XSA-469 CVE-2024-28956
     - x86: Incorrect stubs exception handling for flags recovery
       XSA-470 CVE-2025-27465
     - x86: Transitive Scheduler Attacks
       XSA-471 CVE-2024-36350 CVE-2024-36357
     - Multiple vulnerabilities in the Viridian interface
       XSA-472 CVE-2025-27466 CVE-2025-58142 CVE-2025-58143
     - Arm issues with page refcounting
       XSA-473 CVE-2025-58144 CVE-2025-58145
     - x86: Incorrect input sanitisation in Viridian hypercalls
       XSA-475 CVE-2025-58147 CVE-2025-58148
     - Incorrect removal of permissions on PCI device unplug
       XSA-476 CVE-2025-58149
   * Note that the following XSA are not listed, because...
     - XSA-468 applies to Windows PV drivers
     - XSA-474 applies to XAPI which is not included in Debian
 .
   Packaging minor fixes and improvements:
   * debian/salsa-ci.yml: adjust for trixie and new salsa-ci pipeline

yorick-gy (0.0.6-1~deb13u1) trixie; urgency=medium
 .
   * Rebuild for trixie
=======================================
Sat, 15 Nov 2025 - Debian 13.2 released
=======================================
=========================================================================
[Date: Sat, 15 Nov 2025 09:44:31 -0000] [ftpmaster: Archive Administrator]
Removed the following packages from stable:

librust-profiling-procmacros-dev |   1.0.16-1 | amd64, arm64, armel, armhf, i386, ppc64el, riscv64, s390x
rust-profiling-procmacros |   1.0.16-1 | source
Closed bugs: 1115989

------------------- Reason -------------------
RoM; unused
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 15 Nov 2025 09:59:05 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

btrfs-modules-6.12.38+deb13-s390x-di |  6.12.38-1 | s390x
btrfs-modules-6.12.48+deb13-s390x-di |  6.12.48-1 | s390x
cdrom-core-modules-6.12.38+deb13-s390x-di |  6.12.38-1 | s390x
cdrom-core-modules-6.12.48+deb13-s390x-di |  6.12.48-1 | s390x
crypto-dm-modules-6.12.38+deb13-s390x-di |  6.12.38-1 | s390x
crypto-dm-modules-6.12.48+deb13-s390x-di |  6.12.48-1 | s390x
crypto-modules-6.12.38+deb13-s390x-di |  6.12.38-1 | s390x
crypto-modules-6.12.48+deb13-s390x-di |  6.12.48-1 | s390x
dasd-extra-modules-6.12.38+deb13-s390x-di |  6.12.38-1 | s390x
dasd-extra-modules-6.12.48+deb13-s390x-di |  6.12.48-1 | s390x
dasd-modules-6.12.38+deb13-s390x-di |  6.12.38-1 | s390x
dasd-modules-6.12.48+deb13-s390x-di |  6.12.48-1 | s390x
ext4-modules-6.12.38+deb13-s390x-di |  6.12.38-1 | s390x
ext4-modules-6.12.48+deb13-s390x-di |  6.12.48-1 | s390x
f2fs-modules-6.12.38+deb13-s390x-di |  6.12.38-1 | s390x
f2fs-modules-6.12.48+deb13-s390x-di |  6.12.48-1 | s390x
fat-modules-6.12.38+deb13-s390x-di |  6.12.38-1 | s390x
fat-modules-6.12.48+deb13-s390x-di |  6.12.48-1 | s390x
isofs-modules-6.12.38+deb13-s390x-di |  6.12.38-1 | s390x
isofs-modules-6.12.48+deb13-s390x-di |  6.12.48-1 | s390x
kernel-image-6.12.38+deb13-s390x-di |  6.12.38-1 | s390x
kernel-image-6.12.48+deb13-s390x-di |  6.12.48-1 | s390x
linux-headers-6.12.38+deb13-s390x |  6.12.38-1 | s390x
linux-headers-6.12.48+deb13-s390x |  6.12.48-1 | s390x
linux-image-6.12.38+deb13-s390x |  6.12.38-1 | s390x
linux-image-6.12.38+deb13-s390x-dbg |  6.12.38-1 | s390x
linux-image-6.12.48+deb13-s390x |  6.12.48-1 | s390x
linux-image-6.12.48+deb13-s390x-dbg |  6.12.48-1 | s390x
loop-modules-6.12.38+deb13-s390x-di |  6.12.38-1 | s390x
loop-modules-6.12.48+deb13-s390x-di |  6.12.48-1 | s390x
md-modules-6.12.38+deb13-s390x-di |  6.12.38-1 | s390x
md-modules-6.12.48+deb13-s390x-di |  6.12.48-1 | s390x
mtd-core-modules-6.12.38+deb13-s390x-di |  6.12.38-1 | s390x
mtd-core-modules-6.12.48+deb13-s390x-di |  6.12.48-1 | s390x
multipath-modules-6.12.38+deb13-s390x-di |  6.12.38-1 | s390x
multipath-modules-6.12.48+deb13-s390x-di |  6.12.48-1 | s390x
nbd-modules-6.12.38+deb13-s390x-di |  6.12.38-1 | s390x
nbd-modules-6.12.48+deb13-s390x-di |  6.12.48-1 | s390x
nic-modules-6.12.38+deb13-s390x-di |  6.12.38-1 | s390x
nic-modules-6.12.48+deb13-s390x-di |  6.12.48-1 | s390x
scsi-core-modules-6.12.38+deb13-s390x-di |  6.12.38-1 | s390x
scsi-core-modules-6.12.48+deb13-s390x-di |  6.12.48-1 | s390x
scsi-modules-6.12.38+deb13-s390x-di |  6.12.38-1 | s390x
scsi-modules-6.12.48+deb13-s390x-di |  6.12.48-1 | s390x
udf-modules-6.12.38+deb13-s390x-di |  6.12.38-1 | s390x
udf-modules-6.12.48+deb13-s390x-di |  6.12.48-1 | s390x
xfs-modules-6.12.38+deb13-s390x-di |  6.12.38-1 | s390x
xfs-modules-6.12.48+deb13-s390x-di |  6.12.48-1 | s390x

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 15 Nov 2025 09:59:18 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

ata-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
ata-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
btrfs-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
btrfs-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
cdrom-core-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
cdrom-core-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
crypto-dm-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
crypto-dm-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
crypto-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
crypto-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
drm-core-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
drm-core-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
ext4-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
ext4-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
f2fs-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
f2fs-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
fat-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
fat-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
fb-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
fb-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
input-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
input-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
isofs-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
isofs-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
jfs-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
jfs-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
kernel-image-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
kernel-image-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
linux-headers-6.12.38+deb13-riscv64 |  6.12.38-1 | riscv64
linux-headers-6.12.48+deb13-riscv64 |  6.12.48-1 | riscv64
linux-image-6.12.38+deb13-riscv64 |  6.12.38-1 | riscv64
linux-image-6.12.38+deb13-riscv64-dbg |  6.12.38-1 | riscv64
linux-image-6.12.48+deb13-riscv64 |  6.12.48-1 | riscv64
linux-image-6.12.48+deb13-riscv64-dbg |  6.12.48-1 | riscv64
loop-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
loop-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
md-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
md-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
mmc-core-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
mmc-core-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
mmc-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
mmc-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
mtd-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
mtd-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
multipath-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
multipath-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
nbd-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
nbd-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
nic-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
nic-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
nic-shared-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
nic-shared-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
nic-usb-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
nic-usb-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
nic-wireless-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
nic-wireless-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
pata-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
pata-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
ppp-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
ppp-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
sata-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
sata-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
scsi-core-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
scsi-core-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
scsi-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
scsi-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
scsi-nic-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
scsi-nic-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
squashfs-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
squashfs-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
udf-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
udf-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
usb-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
usb-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
usb-serial-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
usb-serial-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
usb-storage-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
usb-storage-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64
xfs-modules-6.12.38+deb13-riscv64-di |  6.12.38-1 | riscv64
xfs-modules-6.12.48+deb13-riscv64-di |  6.12.48-1 | riscv64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 15 Nov 2025 09:59:37 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

linux-headers-6.12.38+deb13-amd64 |  6.12.38-1 | amd64
linux-headers-6.12.38+deb13-cloud-amd64 |  6.12.38-1 | amd64
linux-headers-6.12.38+deb13-rt-amd64 |  6.12.38-1 | amd64
linux-headers-6.12.48+deb13-amd64 |  6.12.48-1 | amd64
linux-headers-6.12.48+deb13-cloud-amd64 |  6.12.48-1 | amd64
linux-headers-6.12.48+deb13-rt-amd64 |  6.12.48-1 | amd64
linux-image-6.12.38+deb13-amd64-dbg |  6.12.38-1 | amd64
linux-image-6.12.38+deb13-amd64-unsigned |  6.12.38-1 | amd64
linux-image-6.12.38+deb13-cloud-amd64-dbg |  6.12.38-1 | amd64
linux-image-6.12.38+deb13-cloud-amd64-unsigned |  6.12.38-1 | amd64
linux-image-6.12.38+deb13-rt-amd64-dbg |  6.12.38-1 | amd64
linux-image-6.12.38+deb13-rt-amd64-unsigned |  6.12.38-1 | amd64
linux-image-6.12.48+deb13-amd64-dbg |  6.12.48-1 | amd64
linux-image-6.12.48+deb13-amd64-unsigned |  6.12.48-1 | amd64
linux-image-6.12.48+deb13-cloud-amd64-dbg |  6.12.48-1 | amd64
linux-image-6.12.48+deb13-cloud-amd64-unsigned |  6.12.48-1 | amd64
linux-image-6.12.48+deb13-rt-amd64-dbg |  6.12.48-1 | amd64
linux-image-6.12.48+deb13-rt-amd64-unsigned |  6.12.48-1 | amd64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 15 Nov 2025 10:00:04 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

linux-kbuild-6.12.38+deb13 |  6.12.38-1 | amd64, arm64, armel, armhf, i386, ppc64el, riscv64, s390x
linux-kbuild-6.12.48+deb13 |  6.12.48-1 | amd64, arm64, armel, armhf, i386, ppc64el, riscv64, s390x

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 15 Nov 2025 10:00:19 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

linux-headers-6.12.38+deb13-arm64 |  6.12.38-1 | arm64
linux-headers-6.12.38+deb13-arm64-16k |  6.12.38-1 | arm64
linux-headers-6.12.38+deb13-cloud-arm64 |  6.12.38-1 | arm64
linux-headers-6.12.38+deb13-rt-arm64 |  6.12.38-1 | arm64
linux-headers-6.12.48+deb13-arm64 |  6.12.48-1 | arm64
linux-headers-6.12.48+deb13-arm64-16k |  6.12.48-1 | arm64
linux-headers-6.12.48+deb13-cloud-arm64 |  6.12.48-1 | arm64
linux-headers-6.12.48+deb13-rt-arm64 |  6.12.48-1 | arm64
linux-image-6.12.38+deb13-arm64-16k-dbg |  6.12.38-1 | arm64
linux-image-6.12.38+deb13-arm64-16k-unsigned |  6.12.38-1 | arm64
linux-image-6.12.38+deb13-arm64-dbg |  6.12.38-1 | arm64
linux-image-6.12.38+deb13-arm64-unsigned |  6.12.38-1 | arm64
linux-image-6.12.38+deb13-cloud-arm64-dbg |  6.12.38-1 | arm64
linux-image-6.12.38+deb13-cloud-arm64-unsigned |  6.12.38-1 | arm64
linux-image-6.12.38+deb13-rt-arm64-dbg |  6.12.38-1 | arm64
linux-image-6.12.38+deb13-rt-arm64-unsigned |  6.12.38-1 | arm64
linux-image-6.12.48+deb13-arm64-16k-dbg |  6.12.48-1 | arm64
linux-image-6.12.48+deb13-arm64-16k-unsigned |  6.12.48-1 | arm64
linux-image-6.12.48+deb13-arm64-dbg |  6.12.48-1 | arm64
linux-image-6.12.48+deb13-arm64-unsigned |  6.12.48-1 | arm64
linux-image-6.12.48+deb13-cloud-arm64-dbg |  6.12.48-1 | arm64
linux-image-6.12.48+deb13-cloud-arm64-unsigned |  6.12.48-1 | arm64
linux-image-6.12.48+deb13-rt-arm64-dbg |  6.12.48-1 | arm64
linux-image-6.12.48+deb13-rt-arm64-unsigned |  6.12.48-1 | arm64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 15 Nov 2025 10:00:40 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

linux-headers-6.12.38+deb13-rpi |  6.12.38-1 | armel
linux-headers-6.12.48+deb13-rpi |  6.12.48-1 | armel
linux-image-6.12.38+deb13-rpi |  6.12.38-1 | armel
linux-image-6.12.38+deb13-rpi-dbg |  6.12.38-1 | armel
linux-image-6.12.48+deb13-rpi |  6.12.48-1 | armel
linux-image-6.12.48+deb13-rpi-dbg |  6.12.48-1 | armel

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 15 Nov 2025 10:00:52 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

ata-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
ata-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
btrfs-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
btrfs-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
cdrom-core-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
cdrom-core-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
crypto-dm-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
crypto-dm-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
crypto-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
crypto-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
drm-core-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
drm-core-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
ext4-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
ext4-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
f2fs-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
f2fs-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
fat-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
fat-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
fb-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
fb-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
input-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
input-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
isofs-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
isofs-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
jfs-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
jfs-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
kernel-image-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
kernel-image-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
linux-headers-6.12.38+deb13-armmp |  6.12.38-1 | armhf
linux-headers-6.12.38+deb13-armmp-lpae |  6.12.38-1 | armhf
linux-headers-6.12.38+deb13-rt-armmp |  6.12.38-1 | armhf
linux-headers-6.12.48+deb13-armmp |  6.12.48-1 | armhf
linux-headers-6.12.48+deb13-armmp-lpae |  6.12.48-1 | armhf
linux-headers-6.12.48+deb13-rt-armmp |  6.12.48-1 | armhf
linux-image-6.12.38+deb13-armmp |  6.12.38-1 | armhf
linux-image-6.12.38+deb13-armmp-dbg |  6.12.38-1 | armhf
linux-image-6.12.38+deb13-armmp-lpae |  6.12.38-1 | armhf
linux-image-6.12.38+deb13-armmp-lpae-dbg |  6.12.38-1 | armhf
linux-image-6.12.38+deb13-rt-armmp |  6.12.38-1 | armhf
linux-image-6.12.38+deb13-rt-armmp-dbg |  6.12.38-1 | armhf
linux-image-6.12.48+deb13-armmp |  6.12.48-1 | armhf
linux-image-6.12.48+deb13-armmp-dbg |  6.12.48-1 | armhf
linux-image-6.12.48+deb13-armmp-lpae |  6.12.48-1 | armhf
linux-image-6.12.48+deb13-armmp-lpae-dbg |  6.12.48-1 | armhf
linux-image-6.12.48+deb13-rt-armmp |  6.12.48-1 | armhf
linux-image-6.12.48+deb13-rt-armmp-dbg |  6.12.48-1 | armhf
loop-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
loop-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
md-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
md-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
mmc-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
mmc-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
mtd-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
mtd-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
multipath-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
multipath-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
nbd-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
nbd-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
nic-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
nic-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
nic-shared-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
nic-shared-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
nic-usb-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
nic-usb-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
nic-wireless-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
nic-wireless-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
pata-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
pata-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
ppp-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
ppp-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
sata-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
sata-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
scsi-core-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
scsi-core-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
scsi-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
scsi-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
scsi-nic-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
scsi-nic-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
sound-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
sound-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
speakup-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
speakup-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
squashfs-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
squashfs-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
udf-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
udf-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
uinput-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
uinput-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
usb-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
usb-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
usb-serial-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
usb-serial-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf
usb-storage-modules-6.12.38+deb13-armmp-di |  6.12.38-1 | armhf
usb-storage-modules-6.12.48+deb13-armmp-di |  6.12.48-1 | armhf

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 15 Nov 2025 10:01:07 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

ata-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
ata-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
btrfs-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
btrfs-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
cdrom-core-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
cdrom-core-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
crypto-dm-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
crypto-dm-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
crypto-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
crypto-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
drm-core-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
drm-core-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
ext4-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
ext4-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
f2fs-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
f2fs-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
fat-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
fat-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
fb-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
fb-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
firewire-core-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
firewire-core-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
hypervisor-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
hypervisor-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
input-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
input-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
isofs-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
isofs-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
jfs-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
jfs-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
kernel-image-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
kernel-image-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
linux-headers-6.12.38+deb13-powerpc64le |  6.12.38-1 | ppc64el
linux-headers-6.12.38+deb13-powerpc64le-64k |  6.12.38-1 | ppc64el
linux-headers-6.12.48+deb13-powerpc64le |  6.12.48-1 | ppc64el
linux-headers-6.12.48+deb13-powerpc64le-64k |  6.12.48-1 | ppc64el
linux-image-6.12.38+deb13-powerpc64le |  6.12.38-1 | ppc64el
linux-image-6.12.38+deb13-powerpc64le-64k |  6.12.38-1 | ppc64el
linux-image-6.12.38+deb13-powerpc64le-64k-dbg |  6.12.38-1 | ppc64el
linux-image-6.12.38+deb13-powerpc64le-dbg |  6.12.38-1 | ppc64el
linux-image-6.12.48+deb13-powerpc64le |  6.12.48-1 | ppc64el
linux-image-6.12.48+deb13-powerpc64le-64k |  6.12.48-1 | ppc64el
linux-image-6.12.48+deb13-powerpc64le-64k-dbg |  6.12.48-1 | ppc64el
linux-image-6.12.48+deb13-powerpc64le-dbg |  6.12.48-1 | ppc64el
loop-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
loop-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
md-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
md-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
mtd-core-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
mtd-core-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
multipath-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
multipath-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
nbd-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
nbd-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
nic-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
nic-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
nic-shared-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
nic-shared-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
nic-usb-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
nic-usb-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
nic-wireless-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
nic-wireless-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
ppp-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
ppp-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
sata-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
sata-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
scsi-core-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
scsi-core-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
scsi-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
scsi-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
scsi-nic-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
scsi-nic-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
serial-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
serial-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
squashfs-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
squashfs-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
udf-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
udf-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
uinput-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
uinput-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
usb-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
usb-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
usb-serial-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
usb-serial-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
usb-storage-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
usb-storage-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el
xfs-modules-6.12.38+deb13-powerpc64le-di |  6.12.38-1 | ppc64el
xfs-modules-6.12.48+deb13-powerpc64le-di |  6.12.48-1 | ppc64el

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 15 Nov 2025 10:01:19 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

ata-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
ata-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
btrfs-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
btrfs-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
cdrom-core-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
cdrom-core-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
crypto-dm-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
crypto-dm-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
crypto-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
crypto-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
drm-core-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
drm-core-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
ext4-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
ext4-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
f2fs-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
f2fs-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
fat-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
fat-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
fb-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
fb-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
firewire-core-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
firewire-core-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
input-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
input-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
isofs-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
isofs-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
jfs-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
jfs-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
kernel-image-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
kernel-image-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
linux-image-6.12.38+deb13-amd64 |  6.12.38-1 | amd64
linux-image-6.12.38+deb13-cloud-amd64 |  6.12.38-1 | amd64
linux-image-6.12.38+deb13-rt-amd64 |  6.12.38-1 | amd64
linux-image-6.12.48+deb13-amd64 |  6.12.48-1 | amd64
linux-image-6.12.48+deb13-cloud-amd64 |  6.12.48-1 | amd64
linux-image-6.12.48+deb13-rt-amd64 |  6.12.48-1 | amd64
loop-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
loop-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
md-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
md-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
mmc-core-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
mmc-core-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
mmc-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
mmc-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
mtd-core-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
mtd-core-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
multipath-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
multipath-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
nbd-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
nbd-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
nic-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
nic-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
nic-pcmcia-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
nic-pcmcia-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
nic-shared-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
nic-shared-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
nic-usb-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
nic-usb-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
nic-wireless-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
nic-wireless-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
pata-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
pata-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
pcmcia-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
pcmcia-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
pcmcia-storage-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
pcmcia-storage-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
ppp-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
ppp-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
rfkill-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
rfkill-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
sata-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
sata-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
scsi-core-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
scsi-core-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
scsi-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
scsi-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
scsi-nic-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
scsi-nic-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
serial-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
serial-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
sound-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
sound-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
speakup-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
speakup-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
squashfs-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
squashfs-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
udf-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
udf-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
uinput-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
uinput-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
usb-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
usb-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
usb-serial-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
usb-serial-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
usb-storage-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
usb-storage-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64
xfs-modules-6.12.38+deb13-amd64-di |  6.12.38-1 | amd64
xfs-modules-6.12.48+deb13-amd64-di |  6.12.48-1 | amd64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux-signed-amd64)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 15 Nov 2025 10:01:31 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

ata-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
ata-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
btrfs-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
btrfs-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
cdrom-core-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
cdrom-core-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
crypto-dm-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
crypto-dm-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
crypto-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
crypto-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
ext4-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
ext4-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
f2fs-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
f2fs-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
fat-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
fat-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
fb-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
fb-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
input-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
input-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
isofs-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
isofs-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
jfs-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
jfs-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
kernel-image-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
kernel-image-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
linux-image-6.12.38+deb13-arm64 |  6.12.38-1 | arm64
linux-image-6.12.38+deb13-arm64-16k |  6.12.38-1 | arm64
linux-image-6.12.38+deb13-cloud-arm64 |  6.12.38-1 | arm64
linux-image-6.12.38+deb13-rt-arm64 |  6.12.38-1 | arm64
linux-image-6.12.48+deb13-arm64 |  6.12.48-1 | arm64
linux-image-6.12.48+deb13-arm64-16k |  6.12.48-1 | arm64
linux-image-6.12.48+deb13-cloud-arm64 |  6.12.48-1 | arm64
linux-image-6.12.48+deb13-rt-arm64 |  6.12.48-1 | arm64
loop-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
loop-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
md-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
md-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
mmc-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
mmc-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
multipath-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
multipath-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
nbd-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
nbd-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
nic-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
nic-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
nic-shared-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
nic-shared-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
nic-usb-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
nic-usb-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
nic-wireless-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
nic-wireless-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
ppp-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
ppp-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
sata-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
sata-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
scsi-core-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
scsi-core-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
scsi-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
scsi-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
scsi-nic-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
scsi-nic-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
sound-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
sound-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
speakup-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
speakup-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
squashfs-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
squashfs-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
udf-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
udf-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
uinput-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
uinput-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
usb-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
usb-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
usb-serial-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
usb-serial-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
usb-storage-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
usb-storage-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64
xfs-modules-6.12.38+deb13-arm64-di |  6.12.38-1 | arm64
xfs-modules-6.12.48+deb13-arm64-di |  6.12.48-1 | arm64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux-signed-arm64)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 15 Nov 2025 10:01:57 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

linux-headers-6.12.38+deb13-common |  6.12.38-1 | all
linux-headers-6.12.38+deb13-common-rt |  6.12.38-1 | all
linux-headers-6.12.48+deb13-common |  6.12.48-1 | all
linux-headers-6.12.48+deb13-common-rt |  6.12.48-1 | all
linux-support-6.12.38+deb13 |  6.12.38-1 | all
linux-support-6.12.48+deb13 |  6.12.48-1 | all

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux - based on source metadata)
----------------------------------------------
=========================================================================

7zip (25.01+dfsg-1~deb13u1) trixie; urgency=medium
 .
   * New upstream version 25.01+dfsg
   * Fix CVE-2025-55188, CVE-2025-11002, CVE-2025-11001
7zip (25.00+dfsg-1) unstable; urgency=medium
 .
   * New upstream version 25.00+dfsg
   * Rediff patches
   * Drop unused macro while building SFX stub
   * Disable CI for upstream codes branch
   * Enable cross build test in CI

7zip-rar (25.00+ds-1+deb13u1) trixie; urgency=medium
 .
   * Add missing CRC table constructor (Closes: #1118733)

aide (0.19.1-2+deb13u2) trixie; urgency=medium
 .
   * fix issue with 31_aide_lvm: bin/buildcache was a non-functional script
     in the original trixie release. This version now runs properly in the
     non-root daily job: bin/buildcache is now run from a root timer
   * new rules:
     * 31_aide_cryptsetup
     * 31_aide_grub-pc
     * 31_aide_ksmtuned
     * 31_aide_radvd
     * 31_aide_run_systemd_dynamic-uid
     * 31_aide_systemd_tmpfiles
     * 31_aide_valkey
     * 31_aide_xfsprogs
   * update and improve rules:
     *  10_aide_bits
     * 10_aide_dateformats
     * 10_aide_days
     * 11_aide_dateformats_cury
     * 10_aide_hardware
     * 31_aide_apt-cacher-ng
     * 31_aide_bind9
     * 31_aide_console-setup
     * 31_aide_cups
     * 31_aide_dehydrated
     * 31_aide_dev
     * 31_aide_dokuwiki
     * 31_aide_fwupd
     * 31_aide_gnupg
     * 31_aide_icinga2
     * 31_aide_lighttpd
     * 31_aide_man
     * 31_aide_mariadb
     * 31_aide_run_systemd_netif
     * 31_aide_samba
     * 31_aide_schroot
     * 31_aide_spamassassin
     * 31_aide_ssh-server
     * 31_aide_sudo
     * 31_aide_systemd
     * 31_aide_systemd_sessions
     * 31_aide_torrus
     * 31_aide_udev
   * re-work postgreql rules

allow-html-temp (10.0.8-1~deb13u1) trixie; urgency=medium
 .
   * Prepared for uploading to trixie proposed update
     after update of thunderbird in trixie (stable)
allow-html-temp (10.0.8-1~deb12u1) bookworm; urgency=medium
 .
   [ Mechtilde ]
   * [d894bae] Rebased to new upstream version 10.0.8
   * [385a188] Added d/dpb.conf to use debian-package-scripts

alsa-ucm-conf-asahi (8-2+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * d/install: install the aop_audio ucm configs (Closes: #1112531)

ansible (12.0.0~b5+dfsg-0+deb13u1) trixie; urgency=medium
 .
   * New upstream version 12.0.0~b5+dfsg
   * Update debian/gbp.conf to track trixie branches
   * Change gbp upstream tag as long as upstream version in trixie and sid match
   * Update debian/watch to also catch beta releases
   * Drop community hashi-vault patches (applied upstream)
   * Add 12 previously failing collection CI tests to autopkgtest
ansible (12.0.0~b3+dfsg-1) unstable; urgency=medium
 .
   * New upstream version 12.0.0~b3+dfsg
ansible (12.0.0~b2+dfsg-1) unstable; urgency=medium
 .
   * New upstream version 12.0.0~b2+dfsg
ansible (12.0.0~b1+dfsg-1) unstable; urgency=medium
 .
   * New upstream version 12.0.0~b1+dfsg
     - many collections have been updated to not emit deprecation warnings when
       used with ansible-core 2.19.0.
   * Drop community hashi-vault patches (applied upstream)
   * Add 12 previously failing collection CI tests to autopkgtest
   * Update debian/watch to also catch beta releases.

ansible-core (2.19.4-0+deb13u1) trixie; urgency=medium
 .
   [ Lee Garrett ]
   * New upstream bugfix release 2.19.4
     - Fix regression from 2.18 regarding handlers and play tags (Closes:
       #1114932)
   * d/t/ansible-test-integration.py: Match conditional with log verbosity
   * autopkgtest: Always emit output when testbed-setup.sh is run
 .
   [ Colin Watson ]
   * Move apt sources lists aside more comprehensively in tests
   * testbed-setup: Only remove autopkgtest's global pinning
ansible-core (2.19.3-2) unstable; urgency=medium
 .
   * Team upload.
   * Move apt sources lists aside more comprehensively in tests.
   * testbed-setup: Only remove autopkgtest's global pinning, not more
     specific pins such as those created by "autopkgtest --pin-packages".
ansible-core (2.19.3-1) unstable; urgency=medium
 .
   * d/watch: Don't scan for beta/rc releases for now.
   * New upstream version 2.19.3
   * Fix regression from 2.18 regarding handlers and play tags (Closes: #1114932)
ansible-core (2.19.2-1) unstable; urgency=medium
 .
   [ Stefano Rivera ]
   * Loosen resolvelib dependency (following upstream).
 .
   [ Lee Garrett ]
   * New upstream version 2.19.2
   * Add debug code to check for spurious autopkgtest failures regarding python's
     EXTERNALLY-MANAGED marker file
   * Fix logging conditional in autopkgtest
   * autopkgtest: Always emit output when testbed-setup.sh is run
ansible-core (2.19.1-1) unstable; urgency=medium
 .
   * New upstream bugfix release 2.19.1
   * Skip ansible-test-debugging integration test (requires running from source)
ansible-core (2.19.1-0+deb13u1) trixie; urgency=medium
 .
   * New upstream bugfix release 2.19.1
   * Update debian/gbp.conf to track trixie branches
   * Update watch file to follow ansible-core 2.19.x in trixie
   * Change gbp upstream tag as long as upstream version in trixie and sid match
   * Skip ansible-test-debugging integration test (requires running from source)
ansible-core (2.19.0-1) unstable; urgency=medium
 .
   * New upstream version 2.19.0
     - This version is equivalent to rc2 on the code level, and just consolidates
       the changelog of the beta/rc releases into a single 2.19.0 one.
ansible-core (2.19.0~rc2-1) unstable; urgency=medium
 .
   * New upstream version 2.19.0~rc1
     - templating - Relaxed the Jinja sandbox to allow specific bitwise
       operations which have no filter equivalent. The allowed methods are
       __and__, __lshift__, __or__, __rshift__, __xor__. (Closes: #1106362)
     - templating - Switched from the Jinja immutable sandbox to the standard
       sandbox. This restores the ability to use mutation methods such as
       list.append and dict.update.
     - Bugfix: Update automatic role argument spec validation to not use
       deprecated syntax.
     - Bugfix: ssh connection plugin - Allow only one password prompt attempt
       when utilizing SSH_ASKPASS.
   * New upstream version 2.19.0~rc2
     - Add deprecation warnings to YAML parsing, config settings, playbooks, and
       the public API.

asahi-scripts (20250130-3+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * d/patches:
     - add 0000-Backport-asahi-diagnose-Fix-macaudio-default-profile.patch
       to fix the macaudio default profile check (Closes: #1112262)
     - add 0000-Backport-asahi-diagnose-drop-tas2764-checks.patch to drop
       the tas2764 quirk checks (Closes: #1112262)
     - 0003-debian-Add-initramfs-tools-implementation-for-cpio-f.patch:
       add the apple_nvmem_spmi module to the initramfs explicitly and
       obsolete simple-mfd-spmi and nvmem_spmi_mfd (Closes: #1112264)
     - add 0000-Backport-update-m1n1-clobber-boot.bin.old-only-on-changes.patch
       to make update-m1n1 idempotent (Closes: #1112265)
     - refresh

base-files (13.8+deb13u2) trixie; urgency=medium
 .
   * Update debian_version and os-release for Debian 13.2 point release.

bind9 (1:9.20.15-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream version 9.20.15
    - [CVE-2025-8677]: DNSSEC validation fails if matching but invalid
      DNSKEY is found
    - [CVE-2025-40778]: Address various spoofing attacks.
    - [CVE-2025-40780]: Cache-poisoning due to weak pseudo-random number
      generator
bind9 (1:9.20.15-1~deb13u1~bpo12+1) bookworm-backports; urgency=medium
 .
   * Rebuild for trixie-backports.
   * d/gbp.conf: set branch for bookworm-backports

brltty (6.7-3.1+deb13u2) trixie; urgency=medium
 .
   * patches/noverbose-bluetooth: Avoid verbose bluetooth spam.
   * patches/noverbose-usbfs: Avoid verbose usbfs spam (Closes: Bug#845496)
brltty (6.7-3.1+deb13u2~bpo12+1) bookworm-backports; urgency=medium
 .
   * Backport to bookworm.

chromium (142.0.7444.134-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream security release.
     - CVE-2025-12725: Out of bounds write in WebGPU. Reported by Anonymous.
     - CVE-2025-12726: Inappropriate implementation in Views.
       Reported by Alesandro Ortiz.
     - CVE-2025-12727: Inappropriate implementation in V8.
       Reported by 303f06e3.
     - CVE-2025-12728: Inappropriate implementation in Omnibox.
       Reported by Hafiizh.
     - CVE-2025-12729: Inappropriate implementation in Omnibox.
       Reported by Khalil Zhani.
chromium (142.0.7444.134-1~deb12u1) bookworm-security; urgency=high
 .
   * New upstream security release.
     - CVE-2025-12725: Out of bounds write in WebGPU. Reported by Anonymous.
     - CVE-2025-12726: Inappropriate implementation in Views.
       Reported by Alesandro Ortiz.
     - CVE-2025-12727: Inappropriate implementation in V8.
       Reported by 303f06e3.
     - CVE-2025-12728: Inappropriate implementation in Omnibox.
       Reported by Hafiizh.
     - CVE-2025-12729: Inappropriate implementation in Omnibox.
       Reported by Khalil Zhani.
chromium (142.0.7444.59-1) unstable; urgency=high
 .
   * New upstream stable release.
     - CVE-2025-12428: Type Confusion in V8.
       Reported by Man Yue Mo of GitHub Security Lab.
     - CVE-2025-12429: Inappropriate implementation in V8.
       Reported by Aorui Zhang.
     - CVE-2025-12430: Object lifecycle issue in Media.
       Reported by round.about.
     - CVE-2025-12431: Inappropriate implementation in Extensions.
       Reported by Alesandro Ortiz.
     - CVE-2025-12432: Race in V8. Reported by Google Big Sleep.
     - CVE-2025-12433: Inappropriate implementation in V8.
       Reported by Google Big Sleep.
     - CVE-2025-12036: Inappropriate implementation in V8.
       Reported by Google Big Sleep.
     - CVE-2025-12434: Race in Storage. Reported by Lijo A.T.
     - CVE-2025-12435: Incorrect security UI in Omnibox. Reported by Hafiizh.
     - CVE-2025-12436: Policy bypass in Extensions.
       Reported by Luan Herrera (@lbherrera_).
     - CVE-2025-12437: Use after free in PageInfo. Reported by Umar Farooq.
     - CVE-2025-12438: Use after free in Ozone.
       Reported by Wei Yuan of MoyunSec VLab.
     - CVE-2025-12439: Inappropriate implementation in App-Bound Encryption.
       Reported by Ari Novick.
     - CVE-2025-12440: Inappropriate implementation in Autofill.
       Reported by Khalil Zhani.
     - CVE-2025-12441: Out of bounds read in V8. Reported by Google Big Sleep.
     - CVE-2025-12443: Out of bounds read in WebXR. Reported by Aisle Research
     - CVE-2025-12444: Incorrect security UI in Fullscreen UI.
       Reported by syrf.
     - CVE-2025-12445: Policy bypass in Extensions. Reported by Thomas Greiner
     - CVE-2025-12446: Incorrect security UI in SplitView. Reported by Hafiizh
     - CVE-2025-12447: Incorrect security UI in Omnibox.
       Reported by Khalil Zhani.
   * d/patches:
     - disable/android.patch: drop part of patch related to md5sum tool.
     - disable/catapult.patch: refresh.
     - trixie/rust-no-alloc-shim.patch: refresh.
     - bookworm/clang19.patch: also drop uninit-const-pointer and
       unnecessary-virtual-specifier warnings.
     - ungoogled/disable-privacy-sandbox.patch: sync from upstream.
     - i386/support-i386.patch: refresh.
     - trixie/rust-sanitize.patch: add a workaround for older rustc.
     - fixes/chromium-142-iwyu-field-form-data.patch: pull in build fix
       from gentoo.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0001-third-party-hwy-wrong-include.patch: Drop due to
       upstream fixes
     - ppc64le/third_party/0002-regenerate-xnn-buildgn.patch: Regenerate from
       upstream sources
     - core/add-ppc64-architecture-to-extensions.diff: Refresh for upstream
       changes
chromium (142.0.7444.59-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream stable release.
     - CVE-2025-12428: Type Confusion in V8.
       Reported by Man Yue Mo of GitHub Security Lab.
     - CVE-2025-12429: Inappropriate implementation in V8.
       Reported by Aorui Zhang.
     - CVE-2025-12430: Object lifecycle issue in Media.
       Reported by round.about.
     - CVE-2025-12431: Inappropriate implementation in Extensions.
       Reported by Alesandro Ortiz.
     - CVE-2025-12432: Race in V8. Reported by Google Big Sleep.
     - CVE-2025-12433: Inappropriate implementation in V8.
       Reported by Google Big Sleep.
     - CVE-2025-12036: Inappropriate implementation in V8.
       Reported by Google Big Sleep.
     - CVE-2025-12434: Race in Storage. Reported by Lijo A.T.
     - CVE-2025-12435: Incorrect security UI in Omnibox. Reported by Hafiizh.
     - CVE-2025-12436: Policy bypass in Extensions.
       Reported by Luan Herrera (@lbherrera_).
     - CVE-2025-12437: Use after free in PageInfo. Reported by Umar Farooq.
     - CVE-2025-12438: Use after free in Ozone.
       Reported by Wei Yuan of MoyunSec VLab.
     - CVE-2025-12439: Inappropriate implementation in App-Bound Encryption.
       Reported by Ari Novick.
     - CVE-2025-12440: Inappropriate implementation in Autofill.
       Reported by Khalil Zhani.
     - CVE-2025-12441: Out of bounds read in V8. Reported by Google Big Sleep.
     - CVE-2025-12443: Out of bounds read in WebXR. Reported by Aisle Research
     - CVE-2025-12444: Incorrect security UI in Fullscreen UI.
       Reported by syrf.
     - CVE-2025-12445: Policy bypass in Extensions. Reported by Thomas Greiner
     - CVE-2025-12446: Incorrect security UI in SplitView. Reported by Hafiizh
     - CVE-2025-12447: Incorrect security UI in Omnibox.
       Reported by Khalil Zhani.
   * d/patches:
     - disable/android.patch: drop part of patch related to md5sum tool.
     - disable/catapult.patch: refresh.
     - bookworm/clang19.patch: also drop uninit-const-pointer and
       unnecessary-virtual-specifier warnings.
     - ungoogled/disable-privacy-sandbox.patch: sync from upstream.
     - i386/support-i386.patch: refresh.
     - trixie/rust-sanitize.patch: add a workaround for older rustc.
     - fixes/chromium-142-iwyu-field-form-data.patch: pull in build fix
       from gentoo.
     - trixie/rust-no-alloc-shim.patch: add another missing symbol that's
       provided by newer versions of rust.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0001-third-party-hwy-wrong-include.patch: Drop due to
       upstream fixes
     - ppc64le/third_party/0002-regenerate-xnn-buildgn.patch: Regenerate from
       upstream sources
     - core/add-ppc64-architecture-to-extensions.diff: Refresh for upstream
       changes
chromium (142.0.7444.59-1~deb12u1) bookworm-security; urgency=high
 .
   * New upstream stable release.
     - CVE-2025-12428: Type Confusion in V8.
       Reported by Man Yue Mo of GitHub Security Lab.
     - CVE-2025-12429: Inappropriate implementation in V8.
       Reported by Aorui Zhang.
     - CVE-2025-12430: Object lifecycle issue in Media.
       Reported by round.about.
     - CVE-2025-12431: Inappropriate implementation in Extensions.
       Reported by Alesandro Ortiz.
     - CVE-2025-12432: Race in V8. Reported by Google Big Sleep.
     - CVE-2025-12433: Inappropriate implementation in V8.
       Reported by Google Big Sleep.
     - CVE-2025-12036: Inappropriate implementation in V8.
       Reported by Google Big Sleep.
     - CVE-2025-12434: Race in Storage. Reported by Lijo A.T.
     - CVE-2025-12435: Incorrect security UI in Omnibox. Reported by Hafiizh.
     - CVE-2025-12436: Policy bypass in Extensions.
       Reported by Luan Herrera (@lbherrera_).
     - CVE-2025-12437: Use after free in PageInfo. Reported by Umar Farooq.
     - CVE-2025-12438: Use after free in Ozone.
       Reported by Wei Yuan of MoyunSec VLab.
     - CVE-2025-12439: Inappropriate implementation in App-Bound Encryption.
       Reported by Ari Novick.
     - CVE-2025-12440: Inappropriate implementation in Autofill.
       Reported by Khalil Zhani.
     - CVE-2025-12441: Out of bounds read in V8. Reported by Google Big Sleep.
     - CVE-2025-12443: Out of bounds read in WebXR. Reported by Aisle Research
     - CVE-2025-12444: Incorrect security UI in Fullscreen UI.
       Reported by syrf.
     - CVE-2025-12445: Policy bypass in Extensions. Reported by Thomas Greiner
     - CVE-2025-12446: Incorrect security UI in SplitView. Reported by Hafiizh
     - CVE-2025-12447: Incorrect security UI in Omnibox.
       Reported by Khalil Zhani.
   * d/patches:
     - disable/android.patch: drop part of patch related to md5sum tool.
     - disable/catapult.patch: refresh.
     - bookworm/clang19.patch: also drop uninit-const-pointer and
       unnecessary-virtual-specifier warnings.
     - ungoogled/disable-privacy-sandbox.patch: sync from upstream.
     - i386/support-i386.patch: refresh.
     - trixie/rust-sanitize.patch: add a workaround for older rustc.
     - fixes/chromium-142-iwyu-field-form-data.patch: pull in build fix
       from gentoo.
     - trixie/rust-no-alloc-shim.patch: add another missing symbol that's
       provided by newer versions of rust.
     - bookworm/gn-path-exists2.patch: add another workaround for lack of
       path_exists() in older gn.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0001-third-party-hwy-wrong-include.patch: Drop due to
       upstream fixes
     - ppc64le/third_party/0002-regenerate-xnn-buildgn.patch: Regenerate from
       upstream sources
     - core/add-ppc64-architecture-to-extensions.diff: Refresh for upstream
       changes
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0001-third-party-hwy-wrong-include.patch: Drop due to
       upstream fixes
     - ppc64le/third_party/0002-regenerate-xnn-buildgn.patch: Regenerate from
       upstream sources
     - core/add-ppc64-architecture-to-extensions.diff: Refresh for upstream
       changes
chromium (141.0.7390.122-1) unstable; urgency=high
 .
   * New upstream security release.
     - CVE-2025-12036: Inappropriate implementation in V8.
       Reported by Google Big Sleep.
chromium (141.0.7390.122-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream security release.
     - CVE-2025-12036: Inappropriate implementation in V8.
       Reported by Google Big Sleep.
chromium (141.0.7390.122-1~deb12u1) bookworm-security; urgency=high
 .
   * New upstream security release.
     - CVE-2025-12036: Inappropriate implementation in V8.
       Reported by Google Big Sleep.
chromium (141.0.7390.107-1) unstable; urgency=high
 .
   * New upstream security release.
     - CVE-2025-11756: Use after free in Safe Browsing. Reported by asnine.
   * Suggest --disable-gpu to bug reporters and in README.Debian.
chromium (141.0.7390.107-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream security release.
     - CVE-2025-11756: Use after free in Safe Browsing. Reported by asnine.
   * Suggest --disable-gpu to bug reporters and in README.Debian.
chromium (141.0.7390.107-1~deb12u1) bookworm-security; urgency=high
 .
   * New upstream security release.
     - CVE-2025-11756: Use after free in Safe Browsing. Reported by asnine.
   * Suggest --disable-gpu to bug reporters and in README.Debian.
chromium (141.0.7390.65-1) unstable; urgency=high
 .
   * New upstream security release.
     - CVE-2025-11458: Heap buffer overflow in Sync.
       Reported by raven at KunLun lab.
     - CVE-2025-11460: Use after free in Storage. Reported by Sombra.
     - CVE-2025-11211: Out of bounds read in WebCodecs.
       Reported by Jakob Košir.
chromium (141.0.7390.65-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream security release.
     - CVE-2025-11458: Heap buffer overflow in Sync.
       Reported by raven at KunLun lab.
     - CVE-2025-11460: Use after free in Storage. Reported by Sombra.
     - CVE-2025-11211: Out of bounds read in WebCodecs.
       Reported by Jakob Košir.
chromium (141.0.7390.65-1~deb12u1) bookworm-security; urgency=high
 .
   * New upstream security release.
     - CVE-2025-11458: Heap buffer overflow in Sync.
       Reported by raven at KunLun lab.
     - CVE-2025-11460: Use after free in Storage. Reported by Sombra.
     - CVE-2025-11211: Out of bounds read in WebCodecs.
       Reported by Jakob Košir.
chromium (141.0.7390.54-1) unstable; urgency=high
 .
   * New upstream stable release.
   * d/patches:
     - fixes/rust-clanglib.patch: refresh.
     - trixie/rust-no-alloc-shim.patch: refresh.
     - ungoogled/disable-privacy-sandbox.patch: update from ungoogled.
     - fixes/gentoo-stylesheet.patch: add patch from gentoo to fix build.
     - fixes/libcpp-headers.patch: add build fix for unbundling clang.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - sandbox/0001-sandbox-Enable-seccomp_bpf-for-ppc64.patch: Refresh for
       upstream changes
     - fixes/fix-rustc.patch: Refresh for upstream changes
chromium (141.0.7390.54-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream stable release.
     - CVE-2025-11205: Heap buffer overflow in WebGPU.
       Reported by Atte Kettunen of OUSPG.
     - CVE-2025-11206: Heap buffer overflow in Video. Reported by Elias Hohl.
     - CVE-2025-11207: Side-channel information leakage in Storage.
       Reported by Alesandro Ortiz.
     - CVE-2025-11208: Inappropriate implementation in Media.
       Reported by Kevin Joensen.
     - CVE-2025-11209: Inappropriate implementation in Omnibox.
       Reported by Hafiizh.
     - CVE-2025-11210: Side-channel information leakage in Tab.
       Reported by Umar Farooq.
     - CVE-2025-11211: Out of bounds read in Media. Reported by Kosir Jakob.
     - CVE-2025-11212: Inappropriate implementation in Media.
       Reported by Ameen Basha M K.
     - CVE-2025-11213: Inappropriate implementation in Omnibox.
       Reported by Hafiizh.
     - CVE-2025-11215: Off by one error in V8. Reported by Google Big Sleep.
     - CVE-2025-11216: Inappropriate implementation in Storage.
       Reported by Farras Givari.
     - CVE-2025-11219: Use after free in V8. Reported by Google Big Sleep.
   * d/patches:
     - fixes/rust-clanglib.patch: refresh.
     - trixie/rust-no-alloc-shim.patch: refresh.
     - ungoogled/disable-privacy-sandbox.patch: update from ungoogled.
     - fixes/gentoo-stylesheet.patch: add patch from gentoo to fix build.
     - fixes/libcpp-headers.patch: add build fix for unbundling clang.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - sandbox/0001-sandbox-Enable-seccomp_bpf-for-ppc64.patch: Refresh for
       upstream changes
     - fixes/fix-rustc.patch: Refresh for upstream changes
chromium (141.0.7390.54-1~deb12u1) bookworm-security; urgency=high
 .
   * New upstream stable release.
     - CVE-2025-11205: Heap buffer overflow in WebGPU.
       Reported by Atte Kettunen of OUSPG.
     - CVE-2025-11206: Heap buffer overflow in Video. Reported by Elias Hohl.
     - CVE-2025-11207: Side-channel information leakage in Storage.
       Reported by Alesandro Ortiz.
     - CVE-2025-11208: Inappropriate implementation in Media.
       Reported by Kevin Joensen.
     - CVE-2025-11209: Inappropriate implementation in Omnibox.
       Reported by Hafiizh.
     - CVE-2025-11210: Side-channel information leakage in Tab.
       Reported by Umar Farooq.
     - CVE-2025-11211: Out of bounds read in Media. Reported by Kosir Jakob.
     - CVE-2025-11212: Inappropriate implementation in Media.
       Reported by Ameen Basha M K.
     - CVE-2025-11213: Inappropriate implementation in Omnibox.
       Reported by Hafiizh.
     - CVE-2025-11215: Off by one error in V8. Reported by Google Big Sleep.
     - CVE-2025-11216: Inappropriate implementation in Storage.
       Reported by Farras Givari.
     - CVE-2025-11219: Use after free in V8. Reported by Google Big Sleep.
   * d/patches:
     - fixes/rust-clanglib.patch: refresh.
     - trixie/rust-no-alloc-shim.patch: refresh.
     - ungoogled/disable-privacy-sandbox.patch: update from ungoogled.
     - fixes/gentoo-stylesheet.patch: add patch from gentoo to fix build.
     - fixes/libcpp-headers.patch: add build fix for unbundling clang.
   * d/rules: set rtc_video_psnr=false for bookworm's older openh264.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - sandbox/0001-sandbox-Enable-seccomp_bpf-for-ppc64.patch: Refresh for
       upstream changes
     - fixes/fix-rustc.patch: Refresh for upstream changes
chromium (140.0.7339.207-1) unstable; urgency=high
 .
   * New upstream security release.
     - CVE-2025-10890: Side-channel information leakage in V8.
       Reported by Mate Marjanović (SharpEdged).
     - CVE-2025-10891: Integer overflow in V8. Reported by Google Big Sleep.
     - CVE-2025-10892: Integer overflow in V8. Reported by Google Big Sleep.
chromium (140.0.7339.207-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream security release.
     - CVE-2025-10890: Side-channel information leakage in V8.
       Reported by Mate Marjanović (SharpEdged).
     - CVE-2025-10891: Integer overflow in V8. Reported by Google Big Sleep.
     - CVE-2025-10892: Integer overflow in V8. Reported by Google Big Sleep.
chromium (140.0.7339.207-1~deb12u1) bookworm-security; urgency=high
 .
   * New upstream security release.
     - CVE-2025-10890: Side-channel information leakage in V8.
       Reported by Mate Marjanović (SharpEdged).
     - CVE-2025-10891: Integer overflow in V8. Reported by Google Big Sleep.
     - CVE-2025-10892: Integer overflow in V8. Reported by Google Big Sleep.
chromium (140.0.7339.185-1) unstable; urgency=high
 .
   * New upstream security release.
     - CVE-2025-10585: Type Confusion in V8.
       Reported by Google Threat Analysis Group.
     - CVE-2025-10500: Use after free in Dawn.
       Reported by Giunash (Gyujeong Jin).
     - CVE-2025-10501: Use after free in WebRTC. Reported by sherkito.
     - CVE-2025-10502: Heap buffer overflow in ANGLE.
       Reported by Google Big Sleep.
chromium (140.0.7339.185-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream security release.
     - CVE-2025-10585: Type Confusion in V8.
       Reported by Google Threat Analysis Group.
     - CVE-2025-10500: Use after free in Dawn.
       Reported by Giunash (Gyujeong Jin).
     - CVE-2025-10501: Use after free in WebRTC. Reported by sherkito.
     - CVE-2025-10502: Heap buffer overflow in ANGLE.
       Reported by Google Big Sleep.
chromium (140.0.7339.185-1~deb12u1) bookworm-security; urgency=high
 .
   * New upstream security release.
     - CVE-2025-10585: Type Confusion in V8.
       Reported by Google Threat Analysis Group.
     - CVE-2025-10500: Use after free in Dawn.
       Reported by Giunash (Gyujeong Jin).
     - CVE-2025-10501: Use after free in WebRTC. Reported by sherkito.
     - CVE-2025-10502: Heap buffer overflow in ANGLE.
       Reported by Google Big Sleep.
chromium (140.0.7339.127-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2025-10200: Use after free in Serviceworker.
       Reported by Looben Yang.
     - CVE-2025-10201: Inappropriate implementation in Mojo.
       Reported by Sahan Fernando & Anon.
 .
   [ Jianfeng Liu ]
   * drop not working fixes/libsync-rk3588-panthor.patch.
   * drop fixes/strlcpy.patch, which isn't needed w/ clang-19.
chromium (140.0.7339.127-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2025-10200: Use after free in Serviceworker.
       Reported by Looben Yang.
     - CVE-2025-10201: Inappropriate implementation in Mojo.
       Reported by Sahan Fernando & Anon.
 .
   [ Jianfeng Liu ]
   * drop not working fixes/libsync-rk3588-panthor.patch.
   * drop fixes/strlcpy.patch, which isn't needed w/ clang-19.
chromium (140.0.7339.127-1~deb12u1) bookworm-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2025-10200: Use after free in Serviceworker.
       Reported by Looben Yang.
     - CVE-2025-10201: Inappropriate implementation in Mojo.
       Reported by Sahan Fernando & Anon.
 .
   [ Jianfeng Liu ]
   * drop not working fixes/libsync-rk3588-panthor.patch.
   * drop fixes/strlcpy.patch, which isn't needed w/ clang-19.
chromium (140.0.7339.80-1) unstable; urgency=medium
 .
   * New upstream stable release.
   * d/patches:
     - fixes/armhf-icf.patch: refresh.
     - disable/tests.patch: refresh.
     - disable/catapult.patch: refresh.
     - disable/widevine-cdm-cu.patch: refresh (and make it shorter).
     - bookworm/clang19.patch: refresh.
     - disable/android.patch: delete a new reference to chrome/android/.
     - disable/buildtools-libc.patch: drop due to upstream cleanups.
     - trixie/rust-no-alloc-shim.patch: add a build fix for older rustc.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0002-regenerate-xnn-buildgn.patch: Refresh for upstream
       changes
     - fixes/fix-study-crash.patch: Refresh for upstream changes
     - core/add-ppc64-architecture-to-extensions.diff: Refresh for upstream
       changes
     - fixes/fix-unknown-warning-option-messages.diff: Refresh for upstream
       changes
     - libaom/0001-Add-pregenerated-config-for-libaom-on-ppc64.patch:
       Regenerate from new upstream version
     - third_party/0003-third_party-ffmpeg-Add-ppc64-generated-config.patch:
       Regenerate from new upstream version
chromium (140.0.7339.80-1~deb13u1) trixie-security; urgency=medium
 .
   * New upstream stable release.
     - CVE-2025-9864: Use after free in V8.
       Reported by Pavel Kuzmin of Yandex Security Team.
     - CVE-2025-9865: Inappropriate implementation in Toolbar.
       Reported by Khalil Zhani.
     - CVE-2025-9866: Inappropriate implementation in Extensions.
       Reported by NDevTK.
     - CVE-2025-9867: Inappropriate implementation in Downloads.
       Reported by Farras Givari.
   * d/patches:
     - fixes/armhf-icf.patch: refresh.
     - disable/tests.patch: refresh.
     - disable/catapult.patch: refresh.
     - disable/widevine-cdm-cu.patch: refresh (and make it shorter).
     - bookworm/clang19.patch: refresh.
     - disable/android.patch: delete a new reference to chrome/android/.
     - disable/buildtools-libc.patch: drop due to upstream cleanups.
     - trixie/rust-no-alloc-shim.patch: add a build fix for older rustc.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0002-regenerate-xnn-buildgn.patch: Refresh for upstream
       changes
     - fixes/fix-study-crash.patch: Refresh for upstream changes
     - core/add-ppc64-architecture-to-extensions.diff: Refresh for upstream
       changes
     - fixes/fix-unknown-warning-option-messages.diff: Refresh for upstream
       changes
     - libaom/0001-Add-pregenerated-config-for-libaom-on-ppc64.patch:
       Regenerate from new upstream version
     - third_party/0003-third_party-ffmpeg-Add-ppc64-generated-config.patch:
       Regenerate from new upstream version
chromium (140.0.7339.80-1~deb12u1) bookworm-security; urgency=medium
 .
   * New upstream stable release.
     - CVE-2025-9864: Use after free in V8.
       Reported by Pavel Kuzmin of Yandex Security Team.
     - CVE-2025-9865: Inappropriate implementation in Toolbar.
       Reported by Khalil Zhani.
     - CVE-2025-9866: Inappropriate implementation in Extensions.
       Reported by NDevTK.
     - CVE-2025-9867: Inappropriate implementation in Downloads.
       Reported by Farras Givari.
   * d/patches:
     - fixes/armhf-icf.patch: refresh.
     - disable/tests.patch: refresh.
     - disable/catapult.patch: refresh.
     - disable/widevine-cdm-cu.patch: refresh (and make it shorter).
     - bookworm/clang19.patch: refresh.
     - disable/android.patch: delete a new reference to chrome/android/.
     - disable/buildtools-libc.patch: drop due to upstream cleanups.
     - trixie/rust-no-alloc-shim.patch: add a build fix for older rustc.
     - bookworm/rust-visibility.patch: drop, not needed w/ new rust 1.85.
     - bookworm/crabbyav1f.patch: drop, not needed w/ new rust 1.85.
     - bookworm/toktrie-utf8chunks.patch: drop, not needed w/ new rust.
     - bookworm/derivre-create.patch: drop, not needed w/ new rust.
     - bookworm/rust-split-at-checked.patch: drop, not needed w/ new rust.
     - bookworm/crabbyav1f-macro-scope.patch: drop, not needed w/ new rust.
     - bookworm/rust-box-to-vec.patch: drop, not needed w/ new rust.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0002-regenerate-xnn-buildgn.patch: Refresh for upstream
       changes
     - fixes/fix-study-crash.patch: Refresh for upstream changes
     - core/add-ppc64-architecture-to-extensions.diff: Refresh for upstream
       changes
     - fixes/fix-unknown-warning-option-messages.diff: Refresh for upstream
       changes
     - libaom/0001-Add-pregenerated-config-for-libaom-on-ppc64.patch:
       Regenerate from new upstream version
     - third_party/0003-third_party-ffmpeg-Add-ppc64-generated-config.patch:
       Regenerate from new upstream version
chromium (139.0.7258.154-1) unstable; urgency=high
 .
   * New upstream security release.
     - CVE-2025-9478: Use after free in ANGLE.
       Reported by Google Big Sleep.

cjson (1.7.18-3.1+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2025-57052 (Closes: #1114757)

console-setup (1.242~deb13u1) trixie; urgency=medium
 .
   * Backport 1.242 from forky development.
   * keyboard-configuration.templates: Fix dz(azerty-oss/deadkeys) into dz,
     which is what xkb really provides.
   * keyboard-configuration.config: Fix dz default layout.
console-setup (1.241) unstable; urgency=medium
 .
   * keyboard-configuration.templates: Use ca/multix variant instead of
     ca/multi (Closes: #1111994).
console-setup (1.240+deb13u1) trixie; urgency=medium
 .
   * keyboard-configuration.templates: Update dz(la) into dz(azerty-oss).
   * keyboard-configuration.templates: Use ca/multix variant instead of
     ca/multi (Closes: #1111994).

cups (2.4.10-3+deb13u2) trixie; urgency=high
 .
   * add 0018-cgi-Fix-checkbox-support-fixes.patch
     Thanks to Elena ``of Valhalla'' for finding the upstream commit
     and asking Simone Piccardi to confirm that it works now.
     (Closes: #1109471)
cups (2.4.10-3+deb13u1) trixie-security; urgency=high
 .
   * CVE-2025-58060
     fix authentication bypass with AuthType Negotiate
   * CVE-2025-58364
     fix remote DoS via null dereference

curl (8.14.1-2+deb13u2) trixie; urgency=medium
 .
   * d/p/wcurl-CVE-2025-11563.patch: Pull upstream changes to actually fix
     CVE-2025-11563
curl (8.14.1-2+deb13u1) trixie; urgency=medium
 .
   [ Alex ]
   * Team upload.
   * d/p/cookie-don-t-treat-the-leading-slash-as-trailing: import upstream
     patch to fix CVE-2025-9086
   * d/p/CVE-2025-10148.patch: backport upstream patch for CVE-2025-10148
 .
   [ Samuel Henrique ]
   * Import wcurl patches.
      * wcurl-CVE-2025-11563.patch: Fix CVE-2025-11563
      * wcurl-Fix-example-for-continue-at.patch: Fix example in manpage
      * wcurl-Set-CURL_OPTIONS-right-before-the-url.patch: Fix to allow
        --output to be overwritten with --curl-options

debian-edu-config (2.12.903~deb13u1) trixie; urgency=medium
 .
   * Upload to trixie.

debian-installer (20250803+deb13u2) trixie; urgency=medium
 .
   * Bump Linux kernel ABI to 6.12.57+deb13.
   * Adjust linux-image build-deps accordingly.

debian-installer-netboot-images (20250803+deb13u2) trixie; urgency=medium
 .
   * Update to 20250803+deb13u2, from trixie-proposed-updates.

dhcpcd (1:10.1.0-11+deb13u1) trixie; urgency=medium
 .
   * [patches]
     + DHCP: Fix crash when someone deletes our address (Closes: #1114964).
       Cherry-pick from upstream Git (included in Forky since 10.2.0).
   * [service]
     - Remove /etc/wpa_supplicant from ReadWritePaths (Closes: #1111467).
       Otherwise dhcpcd fails to launch if wpasupplicant is not installed.

distro-info-data (0.66+deb13u1) trixie; urgency=medium
 .
   * Update database to 0.68:
     - Update the bookworm EoL
     - Add Ubuntu 26.04 LTS "Resolute Raccoon" (LP: #2126961)

dkms (3.2.2-1~deb13u1) trixie; urgency=medium
 .
   * Rebuild for trixie.
 .
 dkms (3.2.2-1) unstable; urgency=medium
 .
   * New upstream release.
   * Stop shipping dkms.service. Not really needed and causes a dependency
     cycle with cloud-init-network.service.  (Closes: #1107232)
   * common.postinst: Emit a warning if no kernel headers were found.
     (Closes: #1114731)
   * Drop Pre-Depends: lsb-release, no longer used since 3.0.12.
   * Add Breaks against more obsolete *-dkms packages.

dns-root-data (2025080400~deb13u1) trixie; urgency=medium
 .
   * Rebuild the package for trixie to make possible to rebuild it again
     during the distribution lifetime. (See #1091496.)
     The content of the binary package is unchanged from version
     2024071801, which is the one currently in trixie.

dnsdist (1.9.10-1+deb13u1) trixie; urgency=medium
 .
   * d/{gbp.conf,.gitlab-ci.yml}: setup for trixie
   * Apply upstream fix for CVE-2025-8671, CVE-2025-30187
     (Closes: #1115643)

dolphin-emu (2503+dfsg-1+deb13u1) trixie; urgency=medium
 .
   * Remove the dfsg repack suffix from DOLPHIN_WC_DESCRIBE (closes: #1094989).
   * Look for locale files in the correct directory (closes: #1108687).
   * Switch debian-branch to trixie.

dovecot (1:2.4.1+dfsg1-6+deb13u2) trixie; urgency=medium
 .
   * [6ac2883] Clean up a few typos in default/example config (Closes: #1112667)
   * [7feb544] Ensure default lmtpd auth_username_format matches the global value
     (Closes: #1111469)
   * [216ec20] import upstream patch for improperly terminated auth_oauth2_post_setting_defines
     (Closes: #1116328)
   * [46eab61] lib-sieve/sieve-script.c: sieve_script_create_common: Correctly handle errors.
     (Closes: #1116070)
dovecot (1:2.4.1+dfsg1-6+deb13u1) trixie-security; urgency=high
 .
   * Import upstream fix for an issue with authentication cache management that
     could result in users being logged in as the wrong user in certain
     configurations. (Closes: #1115964)

eas4tbsync (4.17-1~deb13u2) trixie; urgency=medium
 .
   * Added dir api/ to d/rules
     It follows 4.17-2 in unstable
eas4tbsync (4.17-1~deb13u1) trixie; urgency=medium
 .
   * Prepared for uploading to trixie proposed update
     after update of thunderbird in trixie (stable)

emacs-libvterm (0.0.2+git20250113.056ad74-3~deb13u1) trixie; urgency=medium
 .
   * Upload to trixie
 .
 emacs-libvterm (0.0.2+git20250113.056ad74-3) unstable; urgency=medium
 .
   * Fix elpa-vterm to use "Multi-Arch: no"
     - elpa-vterm installs the files under the same path on different
       archs, so they are not co-installable.
 .
 emacs-libvterm (0.0.2+git20250113.056ad74-2) unstable; urgency=medium
 .
   * Upload to unstable
     - Change elpa-vterm to arch:any fixed the DEB_HOST_MULTIARCH
       generation. (Closes: #1115607)
 .
 emacs-libvterm (0.0.2+git20250113.056ad74-2~exp1) experimental; urgency=medium
 .
   * Make elpa-vterm arch:any
     - elpa-vterm sets the shard library path according to the host arch.
       Previously when set as arch:all, the `load-path' is set once during
       building arch:all package and won't change based on the host arch,
       resulting in wrong `load-path' in non-amd64 archs.
   * Add `Multi-Arch: same' hint to arch:any packages
emacs-libvterm (0.0.2+git20250113.056ad74-2) unstable; urgency=medium
 .
   * Upload to unstable
     - Change elpa-vterm to arch:any fixed the DEB_HOST_MULTIARCH
       generation. (Closes: #1115607)
 .
 emacs-libvterm (0.0.2+git20250113.056ad74-2~exp1) experimental; urgency=medium
 .
   * Make elpa-vterm arch:any
     - elpa-vterm sets the shard library path according to the host arch.
       Previously when set as arch:all, the `load-path' is set once during
       building arch:all package and won't change based on the host arch,
       resulting in wrong `load-path' in non-amd64 archs.
   * Add `Multi-Arch: same' hint to arch:any packages
emacs-libvterm (0.0.2+git20250113.056ad74-2~exp1) experimental; urgency=medium
 .
   * Make elpa-vterm arch:any
     - elpa-vterm sets the shard library path according to the host arch.
       Previously when set as arch:all, the `load-path' is set once during
       building arch:all package and won't change based on the host arch,
       resulting in wrong `load-path' in non-amd64 archs.
   * Add `Multi-Arch: same' hint to arch:any packages

eperl (2.2.15-1+deb13u1) trixie; urgency=medium
 .
   * Debian Team upload.
   * d/p/0003: Pass environ to PERL_SYS_INIT()/perl_parse() implicitly
               instead of explicitly to avoid the script getting
               a truncated environment on Perl 5.40 (Closes: #1114004)

epiphany-browser (48.5-0+deb13u1) trixie; urgency=medium
 .
   * New upstream bugfix release 48.4
     - Fix app ID in metainfo
     - Disconnect signal handlers correctly, fixing a use-after-free crash
       (epiphany#2653 upstream)
     - In incognito mode (private browsing), don't use saved HTTP
       authentication passwords from normal mode
       (epiphany#2651 upstream)
     - Fix inability to authenticate on authenticationtest.com by avoiding
       a spurious authentication attempt with known-wrong credentials
       (epiphany!1745 upstream)
     - Use the creation time for webapps' "Installed on" date, not the
       modification time
       (epiphany#2604 upstream)
     - Don't consider og:image (a media preview used when sharing links on
       social media) as a candidate for the icon for a webapp, since it often
       points to an image that merely appears on the referenced website
       (epiphany!1755 upstream)
     - Fix a crash on exit if the export dialog has been dismissed, and
       relatedly a memory leak
       (epiphany#2661 upstream)
     - Fix two crashes on startup if running under Pantheon
       (epiphany!1818 upstream; not relevant to Debian unless that desktop
       environment is installed from a third-party source)
     - Improve robustness of password import, avoiding some crashes
       (epiphany!1843 upstream)
     - Fix PKCS#11 login for invalid cert/priv pairs
       (epiphany!1857 upstream)
     - Translation updates
     - Upstream CI fixes not relevant to Debian
   * New upstream bugfix release 48.5
     - Upstream CI fixes not relevant to Debian

evolution (3.56.2-0+deb13u1) trixie; urgency=medium
 .
   * New upstream bugfix release, fixing these issues:
     - I#3042 - Check return value of CamelDataWrapper calculate size functions
     - I#3045 - Cannot add actions in 'Customize User Interface' dialog
     - I#3052 - Ensure "New" button action in Calendar view
     - I#3061 - Mail: Do not strip signature for Edit as New in Sent folder
     - Calendar: Cannot show/hide Tasks and Memos pane
     - (Closes: #1120149)
   * debian/control: Bump e-d-s dependencies and build-dependencies to 3.56.2
evolution (3.56.1-1+deb13u1) trixie-security; urgency=medium
 .
   * Cherry-pick patch to fix crash with webkit2gtk 2.50 (Closes: #1116301)
   * Update debian/gbp.conf for trixie

evolution-data-server (3.56.2-0+deb13u1) trixie; urgency=medium
 .
   * New upstream bugfix release
   * Cherry-pick patch to fix busy loop when using the MH format mail archive
     (Closes: #1111605)

fangfrisch (1.9.0-3+deb13u1) trixie; urgency=high
 .
   * Non-maintainer upload.
   * Update sanesecurity mirror as the old one will stop working
     this year (Closes: #1117681)

ffmpeg (7:7.1.2-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 7.1.2
     - Fixes CVE-2025-1594

firefox-esr (140.4.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2025-83, also known as:
     CVE-2025-11708, CVE-2025-11709, CVE-2025-11710, CVE-2025-11711,
     CVE-2025-11712, CVE-2025-11714, CVE-2025-11715.
 .
   * debian/watch: Refreshed. Somehow it was not refreshed for ESR.
   * debian/dh: Properly handle multiple DEB_BUILD_OPTIONS.
firefox-esr (140.4.0esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2025-83, also known as:
     CVE-2025-11708, CVE-2025-11709, CVE-2025-11710, CVE-2025-11711,
     CVE-2025-11712, CVE-2025-11714, CVE-2025-11715.
 .
   * debian/watch: Refreshed. Somehow it was not refreshed for ESR.
   * debian/dh: Properly handle multiple DEB_BUILD_OPTIONS.
firefox-esr (140.3.1esr-2) unstable; urgency=medium
 .
   * media/libyuv/libyuv/libyuv.gyp: Disable SVE parts of libyuv when the
     SVE flags are not supported. Fixes FTBFS on arm64 on bookworm.
   * config/system-headers.mozbuild: Add a system header wrapper for
     sys/platform/ppc.h.: Fixes FTBFS on pc64el on bookworm.
 .
   * debian/rules: Disable rust LTO on s390x, hoping to fix FTBFS.
firefox-esr (140.3.1esr-1) unstable; urgency=medium
 .
   * New upstream release.
firefox-esr (140.3.1esr-1~deb13u1) trixie-security; urgency=medium
 .
   * New upstream release.
 .
   * media/libyuv/libyuv/libyuv.gyp: Disable SVE parts of libyuv when the
     SVE flags are not supported. Fixes FTBFS on arm64 on bookworm.
   * config/system-headers.mozbuild: Add a system header wrapper for
     sys/platform/ppc.h.: Fixes FTBFS on pc64el on bookworm.
 .
   * debian/upstream.mk, debian/control: Stop handling testing/unstable
     as trixie, meaning embedded NSS is not built anymore.
   * debian/rules:
     - Avoid running dwz on platforms where we disable debug info.
       Closes: #1115490
     - Stop setting _LEAKTEST_FILES, it hasn't been used since version 32.0.
     - Disable rust LTO on s390x, hoping to fix FTBFS.
firefox-esr (140.3.1esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * New upstream release.
 .
   * media/libyuv/libyuv/libyuv.gyp: Disable SVE parts of libyuv when the
     SVE flags are not supported. Fixes FTBFS on arm64 on bookworm.
   * config/system-headers.mozbuild: Add a system header wrapper for
     sys/platform/ppc.h.: Fixes FTBFS on pc64el on bookworm.
 .
   * debian/upstream.mk, debian/control: Stop handling testing/unstable
     as trixie, meaning embedded NSS is not built anymore.
   * debian/rules:
     - Avoid running dwz on platforms where we disable debug info.
       Closes: #1115490
     - Stop setting _LEAKTEST_FILES, it hasn't been used since version 32.0.
     - Disable rust LTO on s390x, hoping to fix FTBFS.
firefox-esr (140.3.0esr-2) unstable; urgency=medium
 .
   * debian/upstream.mk, debian/control: Stop handling testing/unstable
     as trixie, meaning embedded NSS is not built anymore.
   * debian/rules:
     - Avoid running dwz on platforms where we disable debug info.
       Closes: #1115490
     - Stop setting _LEAKTEST_FILES, it hasn't been used since version 32.0.
firefox-esr (140.3.0esr-1) unstable; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2025-75, also known as:
     CVE-2025-10527, CVE-2025-10528, CVE-2025-10529, CVE-2025-10532,
     CVE-2025-10533, CVE-2025-10536, CVE-2025-10537.
firefox-esr (140.3.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2025-75, also known as:
     CVE-2025-10527, CVE-2025-10528, CVE-2025-10529, CVE-2025-10532,
     CVE-2025-10533, CVE-2025-10536, CVE-2025-10537.
firefox-esr (140.3.0esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2025-75, also known as:
     CVE-2025-10527, CVE-2025-10528, CVE-2025-10529, CVE-2025-10532,
     CVE-2025-10533, CVE-2025-10536, CVE-2025-10537.
firefox-esr (128.14.0esr-1) unstable; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2025-66, also known as:
     CVE-2025-9179, CVE-2025-9180, CVE-2025-9181, CVE-2025-9185.

fluidsynth (2.4.4+dfsg-1+deb13u1) trixie; urgency=medium
 .
   * Set the default samplerate to 48000 and buffer size to 512 in the
     service config file (Closes: #1075976, #1105956).

folder-account (12.1-1~deb13u1) trixie; urgency=medium
 .
   * Rebuild for trixie for thunderbird >= 140.3

fonts-noto-color-emoji (2.051-0+deb13u1) trixie; urgency=medium
 .
   * New upstream release (Closes: #1115370)
     - This major update introduces support for the Unicode 17.0 standard
       https://blog.emojipedia.org/google-debuts-emoji-17-0-support/

freeradius (3.2.7+dfsg-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Backport patch to fix compatibility with OpenSSL 3.5.2 (Closes: #1111328)

gegl (1:0.4.62-2+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2025-10921 (Closes: #1116470)

ghostscript (10.05.1~dfsg-1+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
 .
   [ Steve Robbins ]
   * Upstream fix for CVE-2025-7462. (Closes: #1109270)
 .
   [ Salvatore Bonaccorso ]
   * pdfwrite - bounds check some strings (CVE-2025-59799) (Closes: #1116443)
   * pdfwrite - avoid buffer overrun (CVE-2025-59798) (Closes: #1116444)

gimp (3.0.4-3+deb13u2) trixie-security; urgency=medium
 .
   * CVE-2025-10934 (Closes: #1119661)
gimp (3.0.4-3+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2025-10924 (Closes: #1116461)
   * CVE-2025-10923 (Closes: #1116460)
   * CVE-2025-10922 (Closes: #1116459)
   * CVE-2025-10920 (Closes: #1116458)

gnome-maps (48.7-0+deb13u1) trixie; urgency=medium
 .
   * New upstream bugfix release (Closes: #1111673)
     - Fix a regression when requesting route planning from transitous.org
       (gnome-maps#864 upstream)
     - Add address format for Austria
     - Add address format for Paraguay
     - Translation updates (Dutch, Romanian, Thai)
gnome-maps (48.6-3) unstable; urgency=medium
 .
   * Team upload
   * Build-depend on gobject-introspection instead of
     libgirepository1.0-dev
   * Standards-Version: 4.7.2 (no changes required)
gnome-maps (48.6-2) unstable; urgency=medium
 .
   * Cherry-pick fixes from gnome-48 branch (Closes: #1111673):
     - Add address format for Austria
     - Add address format for Paraguay
     - Update Dutch translation
 .
 gnome-maps (48.6-1) unstable; urgency=medium
 .
   * Team upload
   * d/gbp.conf, d/watch: Only watch for 48.x for now.
     We'll track 48.x in testing/unstable for now, to get more testing
     for possible future trixie updates.
   * New upstream stable release
     - Translation updates only
gnome-maps (48.6-1) unstable; urgency=medium
 .
   * Team upload
   * d/gbp.conf, d/watch: Only watch for 48.x for now.
     We'll track 48.x in testing/unstable for now, to get more testing
     for possible future trixie updates.
   * New upstream stable release
     - Translation updates only

gnome-session (48.0-1+deb13u1) trixie; urgency=medium
 .
   * Team upload
   * d/control, d/gbp.conf, d/watch: Set branch for trixie stable updates
   * d/gnome-mimeapps.list: Fall back from Evince to Papers where
     supported, if Evince is not installed.
     The default PDF reader for GNOME in trixie is evince, but the
     metapackage has an alternative dependency on papers and some early
     adopters are already using the newer package.
     Papers doesn't support some document formats that Evince did, like
     Postscript and DVI. Continue to prefer only Evince for those.
     (Closes: #1112257, #1115704)
   * d/gnome-mimeapps.list: Fall back from Totem to Showtime where
     supported, if Showtime is not installed.
     Similar to the PDF readers, the default video player for GNOME in
     trixie is totem, but the metapackage has an alternative dependency
     on showtime.
     showtime is only a file-based video player and isn't designed to
     play audio, playlists or DVDs, so continue to refer to only totem
     for the formats not supported by showtime.

google-recaptcha (1.3.0-2+deb13u1) trixie; urgency=medium
 .
   * Add a patch to fix PHP 8.4 deprecations

haproxy (3.0.11-1+deb13u1) trixie-security; urgency=high
 .
   * CVE-2025-11230: fix possible DoS when parsing JSON numbers.

hsqldb1.8.0 (1.8.0.10+dfsg-12.1+deb13u1) trixie-security; urgency=medium
 .
   * (re)add avoid-execution-of-spurious-command-in-script-or-log-file.diff to
     debian/patches/series, lost in 1.8.0.10+dfsg-12.1 NMU

ikvswitch (1.0.4+deb13u1) trixie; urgency=medium
 .
   * Write in /etc/sysctl.d/00-forward-internet.conf as sysctl.conf is gone in
     Trixie.
   * Use Trixie as default distro for the setup.
   * Add || true when doing "ip link set down dev" if ipmi bridge.

imagemagick (8:7.1.1.43+dfsg1-1+deb13u3) trixie; urgency=high
 .
   * Fix CVE-2025-62171 (Closes: #1118340)
     Integer Overflow in BMP Decoder (ReadBMP):
     CVE-2025-57803 claims to be patched, but the fix is incomplete
     and ineffective.
     .
     The patch added BMPOverflowCheck() but placed it
     after the overflow occurs, making it useless.
     A malicious 58-byte BMP file can trigger AddressSanitizer
     crashes and DoS.
imagemagick (8:7.1.1.43+dfsg1-1+deb13u2) trixie-security; urgency=high
 .
   * Fix CVE-2025-55004:
     ImageMagick is vulnerable to heap-buffer overflow
     read around the handling of images with separate alpha channels
     when performing image magnification in ReadOneMNGIMage.
     This can likely be used to leak subsequent memory contents
     into the output image
     (Closes: #1111101)
   * Fix CVE-2025-55005:
     when preparing to transform from Log to sRGB colorspaces,
     the logmap construction fails to handle cases where the
     reference-black or reference-white value is larger than 1024.
     This leads to corrupting memory beyond the end of the
     allocated logmap buffer.
     (Closes: #1111102)
   * Fix CVE-2025-55154:
     the magnified size calculations in ReadOneMNGIMage
     (in coders/png.c) are unsafe and can overflow, leading to
     memory corruption.
     (Closes: #1111103)
   * Fix CVE-2025-55212:
     Passing a geometry string containing only a colon (":")
     to montage -geometry leads GetGeometry() to set width/height to 0.
     Later, ThumbnailImage() divides by these zero dimensions,
     triggering a crash (SIGFPE/abort), resulting in a denial of service.
     (Closes: #1111587)
   * Fix CVE-2025-55298:
     A format string bug vulnerability exists in InterpretImageFilenam
     function where user input is directly passed to FormatLocaleString
     without proper sanitization. An attacker can overwrite arbitrary
     memory regions, enabling a wide range of attacks from heap
     overflow to remote code execution.
     (Closes: #1111586)
   * Fix CVE-2025-57803:
     A 32-bit integer overflow in the BMP encoder’s scanline-stride
     computation collapses bytes_per_line (stride) to a tiny
     value while the per-row writer still emits 3 × width bytes
     for 24-bpp images. The row base pointer advances using the
     (overflowed) stride, so the first row immediately writes
     past its slot and into adjacent heap memory with
     attacker-controlled bytes.
     (Closes: #1112469)
   * Fix CVE-2025-57807:
     A security problem was found in SeekBlob(), which permits
     advancing the stream offset beyond the current end without
     increasing capacity, and WriteBlob(), which then expands by
     quantum + length (amortized) instead of offset + length,
     and copies to data + offset. When offset ≫ extent, the
     copy targets memory beyond the allocation, producing a
     deterministic heap write on 64-bit builds. No 2⁶⁴
     arithmetic wrap, external delegates, or policy settings
     are required.
     (Closes: #1114520)

incus (6.0.4-2+deb13u1) trixie-security; urgency=high
 .
   * Backport fixes for the following security issues:
     - CVE-2025-54293 / GHSA-472f-vmf2-pr3h
     - CVE-2025-54287 / GHSA-w2hg-2v4p-vmh6
     - CVE-2025-54288 / GHSA-7232-97c6-j525
     - CVE-2025-54286 / GHSA-p8hw-rfjg-689h
     - CVE-2025-54290 / GHSA-p3x5-mvmp-5f35
     - CVE-2025-54291 / GHSA-xch9-h8qw-85c7
     - CVE-2025-54289 / GHSA-3g72-chj4-2228
incus (6.0.4-2+deb13u1~bpo12+1) bookworm-backports; urgency=medium
 .
   * Rebuild for bookworm-backports.
     - Drop dependency on virtiofsd, as it isn't available for bookworm
     - Drop apparmor 4.x patch
     - Relax dependency on lxcfs, since runit scripts aren't expected for
       bookworm
     - Add patch to remove dependency on go-criu
     - Add patch to build with older version of openfga-go-sdk
     - Add patch backporting RemoveAll from newer sftp

input-remapper (2.1.1-1+deb13u1) trixie; urgency=medium
 .
   * Add psutil to the list of module requirements. Closes: #1113695.

intel-microcode (3.20250812.1~deb13u1) trixie-security; urgency=medium
 .
   * Security upload, no changes.
 .
 intel-microcode (3.20250812.1) unstable; urgency=medium
 .
   [ Henrique de Moraes Holschuh ]
   * New upstream microcode datafile 20250812 (closes: #1110983, #1112168)
     - Mitgations for INTEL-SA-01249 (processor Stream Cache):
       CVE-2025-20109: Improper Isolation or Compartmentalization in the
       stream cache mechanism for some Intel Processors may allow an
       authenticated user to potentially enable escalation of privilege via
       local access.  Intel also disclosed that several processors models
       had already received this mitigation on the previous microcode
       release, 20250512.
     - Mitigations for INTEL-SA-01308:
       CVE-2025-22840: Sequence of processor instructions leads to
       unexpected behavior for some Intel Xeon 6 Scalable processors may
       allow an authenticated user to potentially enable escalation of
       privilege via local access.
     - Mitigations for INTEL-SA-01310 (OOBM services module):
       CVE-2025-22839: Insufficient granularity of access control in the
       OOB-MSM for some Intel Xeon 6 Scalable processors may allow a
       privileged user to potentially enable escalation of privilege via
       adjacent access.
     - Mitigations for INTEL-SA-01311 (Intel TDX):
       CVE-2025-22889: Improper handling of overlap between protected
       memory ranges for some Intel Xeon 6 processors with Intel TDX may
       allow a privileged user to potentially enable escalation of
       privilege via local access.
     - Mitigations for INTEL-SA-01313:
       CVE-2025-20053: Improper buffer restrictions for some Intel Xeon
       Processor firmware with SGX enabled may allow a privileged user to
       potentially enable escalation of privilege via local access.
       CVE-2025-21090: Missing reference to active allocated resource for
       some Intel Xeon processors may allow an authenticated user to
       potentially enable denial of service via local access.
       CVE-2025-24305: Insufficient control flow management in the Alias
       Checking Trusted Module (ACTM) firmware for some Intel Xeon
       processors may allow a privileged user to potentially enable
       escalation of privilege via local access.
     - Mitigations for INTEL-SA-01367 (Intel SGX, TDX):
       CVE-2025-26403: Out-of-bounds write in the memory subsystem for some
       Intel Xeon 6 processors when using Intel SGX or Intel TDX may allow
       a privileged user to potentially enable escalation of privilege via
       local access.
       CVE-2025-32086: Improperly implemented security check for standard
       in the DDRIO configuration for some Intel Xeon 6 Processors when
       using Intel SGX or Intel TDX may allow a privileged user to
       potentially enable escalation of privilege via local access.
     - Fixes for unspecified functional issues on several Intel Core and
       Intel Xeon processor models.
   * Updated microcodes:
     sig 0x000606a6, pf_mask 0x87, 2025-03-11, rev 0xd000410, size 309248
     sig 0x000606c1, pf_mask 0x10, 2025-03-06, rev 0x10002e0, size 301056
     sig 0x000806f8, pf_mask 0x87, 2025-04-04, rev 0x2b000643, size 592896
     sig 0x000806f7, pf_mask 0x87, 2025-04-04, rev 0x2b000643
     sig 0x000806f6, pf_mask 0x87, 2025-04-04, rev 0x2b000643
     sig 0x000806f5, pf_mask 0x87, 2025-04-04, rev 0x2b000643
     sig 0x000806f4, pf_mask 0x87, 2025-04-04, rev 0x2b000643
     sig 0x000806f8, pf_mask 0x10, 2025-04-08, rev 0x2c000401, size 625664
     sig 0x000806f6, pf_mask 0x10, 2025-04-08, rev 0x2c000401
     sig 0x000806f5, pf_mask 0x10, 2025-04-08, rev 0x2c000401
     sig 0x000806f4, pf_mask 0x10, 2025-04-08, rev 0x2c000401
     sig 0x000a06a4, pf_mask 0xe6, 2025-03-19, rev 0x0025, size 140288
     sig 0x000a06d1, pf_mask 0x95, 2025-05-15, rev 0x10003d0, size 1667072
     sig 0x000a06d1, pf_mask 0x20, 2025-05-15, rev 0xa000100, size 1638400
     sig 0x000a06f3, pf_mask 0x01, 2025-05-03, rev 0x3000362, size 1530880
     sig 0x000b06a2, pf_mask 0xe0, 2025-02-24, rev 0x4129, size 224256
     sig 0x000b06a3, pf_mask 0xe0, 2025-02-24, rev 0x4129
     sig 0x000b06a8, pf_mask 0xe0, 2025-02-24, rev 0x4129
     sig 0x000b06d1, pf_mask 0x80, 2025-05-21, rev 0x0123, size 80896
     sig 0x000c0662, pf_mask 0x82, 2025-05-14, rev 0x0119, size 90112
     sig 0x000c06a2, pf_mask 0x82, 2025-05-14, rev 0x0119
     sig 0x000c0652, pf_mask 0x82, 2025-05-14, rev 0x0119
     sig 0x000c0664, pf_mask 0x82, 2025-05-14, rev 0x0119
     sig 0x000c06f2, pf_mask 0x87, 2025-04-15, rev 0x210002b3, size 564224
     sig 0x000c06f1, pf_mask 0x87, 2025-04-15, rev 0x210002b3
   * update entry for 3.20250512.1 with new information
   * source: update symlinks to reflect id of the latest release, 20250812
 .
   [ Ben Hutchings ]
   * debian/tests/initramfs: Update to work with forky's initramfs-tools.
     In version 0.149 of initramfs-tools, unmkinitramfs was changed to no
     longer create early/ and main/ subdirectories.  Update the microcode
     file check to work with both old and new behaviours.
intel-microcode (3.20250812.1~deb12u1) bookworm-security; urgency=medium
 .
   * Backport to bookworm-security
   * debian/rules: revert use of /usr/lib/firmware for deb12
 .
 intel-microcode (3.20250812.1) unstable; urgency=medium
 .
   [ Henrique de Moraes Holschuh ]
   * New upstream microcode datafile 20250812 (closes: #1110983, #1112168)
     - Mitgations for INTEL-SA-01249 (processor Stream Cache):
       CVE-2025-20109: Improper Isolation or Compartmentalization in the
       stream cache mechanism for some Intel Processors may allow an
       authenticated user to potentially enable escalation of privilege via
       local access.  Intel also disclosed that several processors models
       had already received this mitigation on the previous microcode
       release, 20250512.
     - Mitigations for INTEL-SA-01308:
       CVE-2025-22840: Sequence of processor instructions leads to
       unexpected behavior for some Intel Xeon 6 Scalable processors may
       allow an authenticated user to potentially enable escalation of
       privilege via local access.
     - Mitigations for INTEL-SA-01310 (OOBM services module):
       CVE-2025-22839: Insufficient granularity of access control in the
       OOB-MSM for some Intel Xeon 6 Scalable processors may allow a
       privileged user to potentially enable escalation of privilege via
       adjacent access.
     - Mitigations for INTEL-SA-01311 (Intel TDX):
       CVE-2025-22889: Improper handling of overlap between protected
       memory ranges for some Intel Xeon 6 processors with Intel TDX may
       allow a privileged user to potentially enable escalation of
       privilege via local access.
     - Mitigations for INTEL-SA-01313:
       CVE-2025-20053: Improper buffer restrictions for some Intel Xeon
       Processor firmware with SGX enabled may allow a privileged user to
       potentially enable escalation of privilege via local access.
       CVE-2025-21090: Missing reference to active allocated resource for
       some Intel Xeon processors may allow an authenticated user to
       potentially enable denial of service via local access.
       CVE-2025-24305: Insufficient control flow management in the Alias
       Checking Trusted Module (ACTM) firmware for some Intel Xeon
       processors may allow a privileged user to potentially enable
       escalation of privilege via local access.
     - Mitigations for INTEL-SA-01367 (Intel SGX, TDX):
       CVE-2025-26403: Out-of-bounds write in the memory subsystem for some
       Intel Xeon 6 processors when using Intel SGX or Intel TDX may allow
       a privileged user to potentially enable escalation of privilege via
       local access.
       CVE-2025-32086: Improperly implemented security check for standard
       in the DDRIO configuration for some Intel Xeon 6 Processors when
       using Intel SGX or Intel TDX may allow a privileged user to
       potentially enable escalation of privilege via local access.
     - Fixes for unspecified functional issues on several Intel Core and
       Intel Xeon processor models.
   * Updated microcodes:
     sig 0x000606a6, pf_mask 0x87, 2025-03-11, rev 0xd000410, size 309248
     sig 0x000606c1, pf_mask 0x10, 2025-03-06, rev 0x10002e0, size 301056
     sig 0x000806f8, pf_mask 0x87, 2025-04-04, rev 0x2b000643, size 592896
     sig 0x000806f7, pf_mask 0x87, 2025-04-04, rev 0x2b000643
     sig 0x000806f6, pf_mask 0x87, 2025-04-04, rev 0x2b000643
     sig 0x000806f5, pf_mask 0x87, 2025-04-04, rev 0x2b000643
     sig 0x000806f4, pf_mask 0x87, 2025-04-04, rev 0x2b000643
     sig 0x000806f8, pf_mask 0x10, 2025-04-08, rev 0x2c000401, size 625664
     sig 0x000806f6, pf_mask 0x10, 2025-04-08, rev 0x2c000401
     sig 0x000806f5, pf_mask 0x10, 2025-04-08, rev 0x2c000401
     sig 0x000806f4, pf_mask 0x10, 2025-04-08, rev 0x2c000401
     sig 0x000a06a4, pf_mask 0xe6, 2025-03-19, rev 0x0025, size 140288
     sig 0x000a06d1, pf_mask 0x95, 2025-05-15, rev 0x10003d0, size 1667072
     sig 0x000a06d1, pf_mask 0x20, 2025-05-15, rev 0xa000100, size 1638400
     sig 0x000a06f3, pf_mask 0x01, 2025-05-03, rev 0x3000362, size 1530880
     sig 0x000b06a2, pf_mask 0xe0, 2025-02-24, rev 0x4129, size 224256
     sig 0x000b06a3, pf_mask 0xe0, 2025-02-24, rev 0x4129
     sig 0x000b06a8, pf_mask 0xe0, 2025-02-24, rev 0x4129
     sig 0x000b06d1, pf_mask 0x80, 2025-05-21, rev 0x0123, size 80896
     sig 0x000c0662, pf_mask 0x82, 2025-05-14, rev 0x0119, size 90112
     sig 0x000c06a2, pf_mask 0x82, 2025-05-14, rev 0x0119
     sig 0x000c0652, pf_mask 0x82, 2025-05-14, rev 0x0119
     sig 0x000c0664, pf_mask 0x82, 2025-05-14, rev 0x0119
     sig 0x000c06f2, pf_mask 0x87, 2025-04-15, rev 0x210002b3, size 564224
     sig 0x000c06f1, pf_mask 0x87, 2025-04-15, rev 0x210002b3
   * update entry for 3.20250512.1 with new information
   * source: update symlinks to reflect id of the latest release, 20250812
 .
   [ Ben Hutchings ]
   * debian/tests/initramfs: Update to work with forky's initramfs-tools.
     In version 0.149 of initramfs-tools, unmkinitramfs was changed to no
     longer create early/ and main/ subdirectories.  Update the microcode
     file check to work with both old and new behaviours.

irqbalance (1.9.4-1+deb13u1) trixie; urgency=medium
 .
   * d/gbp.conf: set debian-branch to debian/trixie
   * Drop ProtectKernelTunables=yes in irqbalance.service.
     Done via new patch: d/p/drop-protectkerneltunables.patch
     Thanks to Marco d'Itri (Closes: #1114676)

jdupes (1.28.0-1+deb13u1) trixie; urgency=medium
 .
   * debian/patches/020_fix-uniq-count.patch: created to fix flag overlap
     between FF_NOT_UNIQUE and FF_HASHDB_DIRTY.
     .
     Both FF_NOT_UNIQUE and FF_HASHDB_DIRTY were defined using the same
     bit (1U << 5), causing logic errors where files were incorrectly
     marked as not unique due to hash database state. This commit moves
     FF_HASHDB_DIRTY to (1U << 6) to eliminate the overlap. It fixes
     incorrect behavior when detecting unique files with --unique or -u.
     .
     Closes: #1063079

jetty12 (12.0.17-3.1~deb13u1) trixie-security; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie-security.
 .
 jetty12 (12.0.17-3.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2025-5115: MadeYouReset HTTP/2 vulnerability (Closes: #1111765)

jetty9 (9.4.57-1.1~deb13u1) trixie-security; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie-security.
 .
 jetty9 (9.4.57-1.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2025-5115: MadeYouReset HTTP/2 vulnerability (Closes: #1111766)
jetty9 (9.4.57-1.1~deb12u1) bookworm-security; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for bookworm-security.
 .
 jetty9 (9.4.57-1.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2025-5115: MadeYouReset HTTP/2 vulnerability (Closes: #1111766)

jing-trang (20241231+repack-1~deb13u1) trixie; urgency=medium
 .
   * Re-import new upstream release, with gbp filtering (Closes: Bug#1118457)

keepassxc-browser (1.9.7+repack1-1+deb13u1) trixie; urgency=medium
 .
   * Fixed integration with Chromium (Closes: #1111635)
     + Split installation for Chromium and Firefox in two separate directories.
       Each directory does now contain the correct manifest.json file for the
       respective browser.
     + Added maintainer preinst script to remove a symbolic link from previous
       package versions to have this revision create a directory instead
     + Added maintainer prerm script to permit a downgrade - just in case. It
       conditionally reverses the action of the above mentioned preinst script.
     + Extended fix-browser-polyfill-includex.patch to also adjust the Chromium
       manifest
     + Extended fix-nacl-includes.patch to also adjust the Chromium manifest
     + Extended chromium-extension-key.patch to add the extension's key in the
       manifest file which is installed from this revision on for Chromium
     + Extended lintian overrides for warnings produced by the additional
       installation for Chromium
     + Extended and updated debian/rules to rename and install files into the
       respective directories per browser. Removed obsolete file permission
       fixes and improved readability.

kmail-account-wizard (4:24.12.3-1+deb13u1) trixie; urgency=medium
 .
   * Detect QML-dependencies automatically.

lemonldap-ng (2.21.2+ds-1+deb13u1) trixie; urgency=medium
 .
   * Fix shell injection from admin interface (Closes: CVE-2025-59518)
   * Don't expose session-id into Ajax responses
   * Fix Google authentication

libcommons-lang-java (2.6-10+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * d/patches/CVE-2025-48924.patch: Add patch to fix CVE-2025-48924.
     - Fix an uncontrolled recursion vulnerability (closes: 1109126).

libcommons-lang3-java (3.17.0-1+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * d/patches/CVE-2025-48924.patch: Add patch to fix CVE-2025-48924.
     - Fix an uncontrolled recursion vulnerability (closes: 1109125).

libcpanel-json-xs-perl (4.39-2~deb13u1) trixie-security; urgency=high
 .
   * Rebuild for trixie-security
 .
 libcpanel-json-xs-perl (4.39-2) unstable; urgency=medium
 .
   * Team upload.
   * Fix json_atof_scan1 overflows (CVE-2025-40929)

libgpiod (2.2.1-2+deb13u1) trixie; urgency=medium
 .
   * d/control: Remove Breaks/Replaces on libgpiod2 and libgpiod2t64.
     This allows co-installation with older libraries. (Closes: #1110868)

libhtp (1:0.5.50-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2025-53537: memory leak with LZMA (Closes: #1109838)

libjson-xs-perl (4.040-1~deb13u1) trixie-security; urgency=high
 .
   * Rebuild for trixie-security
 .
 libjson-xs-perl (4.040-1) unstable; urgency=medium
 .
   * Team upload.
   * Import upstream version 4.040.
     - Fix json_atof_scan1 overflows (CVE-2025-40928)
   * Drop initial patch for CVE-2025-40928 in favour of upstream changes
   * Drop patches applied upstream
 .
 libjson-xs-perl (4.030-3) unstable; urgency=medium
 .
   * Team upload.
   * Fix json_atof_scan1 overflows (CVE-2025-40928)
libjson-xs-perl (4.040-1~deb12u1) bookworm-security; urgency=high
 .
   * Rebuild for bookworm-security
 .
 libjson-xs-perl (4.040-1) unstable; urgency=medium
 .
   * Team upload.
   * Import upstream version 4.040.
     - Fix json_atof_scan1 overflows (CVE-2025-40928)
   * Drop initial patch for CVE-2025-40928 in favour of upstream changes
   * Drop patches applied upstream
 .
 libjson-xs-perl (4.030-3) unstable; urgency=medium
 .
   * Team upload.
   * Fix json_atof_scan1 overflows (CVE-2025-40928)
libjson-xs-perl (4.030-3) unstable; urgency=medium
 .
   * Team upload.
   * Fix json_atof_scan1 overflows (CVE-2025-40928)

libsmb2 (6.2+dfsg-2+deb13u1) trixie; urgency=medium
 .
   * Import upstream patches to fix CVE-2025-57632
     - When processing SMB2 chained PDUs (NextCommand), libsmb2
       repeatedly calls smb2_add_iovector() to append to a
       fixed-size iovec array without checking the upper bound
       of v->niov (SMB2_MAX_VECTORS=256)
   * d/p/CVE-2025-57632-pt*.patch: Import upstream patches to fix CVE
   * d/p/CVE-2025-57632-pt2.patch: Backport patch and Update hunks' offsets
   * d/p/CVE-2025-57632-pt3.patch: Backport patch and Update hunks' offsets
   * d/p/CVE-2025-57632-pt4.patch: Backport patch and Change hunk to
     reflect new code indentation

libssh (0.11.2-1+deb13u1) trixie; urgency=medium
 .
   * CVE-2025-8277 (Closes: #1114859)
   * CVE-2025-8114 (Closes: #1109860)

libvirt (11.3.0-3+deb13u1) trixie; urgency=medium
 .
   * [6a549fc] patches: Add backports
     - backport/tlscert-Don-t-force-keyEncipherment[...]
     - backport/tls-Don-t-require-keyEncipherment-[...]
     - backport/tests-[...]-Drop-use-of-GNUTLS_KEY_KEY_ENCIPHERM[...]
       - Removes the requirement to have keyEncipherment enabled
         for TLS certificates
       - Closes: #1110816
   * [8b355a8] patches: Add backports
     - backport/daemon-Drop-log-level-of-VIR_ERR_NO_SUPPORT-[...]
       - Prevents journal spam when using the LXC driver
       - Closes: #1110963
   * [f5079ab] patches: Add backports
     - backport/qemu-capabilities-Check-if-cpuModels-is-not-NULL-[...]
       - Fixes a daemon crash that occurs when probing capabilities
         for a QEMU binary that doesn't report information about
         CPU models
       - Closes: #1112481

libwebsockets (4.3.5-1+deb13u1) trixie; urgency=medium
 .
   * CVE-2025-11677 (Closes: #1118747)
   * CVE-2025-11678 (Closes: #1118746)

libxml2 (2.12.7+dfsg+really2.9.14-2.1+deb13u2) trixie; urgency=high
 .
   * Non-maintainer upload.
   * Fix CVE-2025-9714: Denial of service vulnerability via uncontrolled
     recursion in XPath evaluation.
   * Amend d/p/CVE-2025-7425.patch to better reflect the original fix.

libxslt (1.1.35-1.2+deb13u2) trixie-security; urgency=high
 .
   * Non-maintainer upload.
   * Fix regression in the backport of upstream change for issue #123
     "generate-id() is non-deterministic".

libyaml-syck-perl (1.34-2+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * Address memory corruption leading to 'str' value being set on empty keys
     (CVE-2025-11683)
libyaml-syck-perl (1.34-2+deb12u1) bookworm; urgency=medium
 .
   * Team upload.
   * Address memory corruption leading to 'str' value being set on empty keys
     (CVE-2025-11683)

linux (6.12.57-1) trixie; urgency=medium
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.49
     - wifi: wilc1000: avoid buffer overflow in WID string configuration
     - nvme: fix PI insert on write
     - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not
       supported
     - wifi: mac80211: increase scan_ies_len for S1G
     - wifi: mac80211: fix incorrect type for ret
     - cgroup: split cgroup_destroy_wq into 3 workqueues
     - btrfs: fix invalid extref key setup when replaying dentry
     - net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR
     - qed: Don't collect too many protection override GRC elements
     - bonding: set random address only when slaves already exist
     - mptcp: set remote_deny_join_id0 on SYN recv
     - mptcp: tfo: record 'deny join id0' info
     - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
     - ice: store max_frame and rx_buf_len only in ice_rx_ring
     - ice: fix Rx page leak on multi-buffer frames
     - i40e: remove redundant memory barrier when cleaning Tx descs
     - igc: don't fail igc_probe() on LED setup error
     - net/mlx5e: Harden uplink netdev access against device unbind
     - bonding: don't set oif to bond dev when getting NS target destination
     - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
     - tls: make sure to abort the stream if headers are bogus
     - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
     - net: liquidio: fix overflow in octeon_init_instr_queue()
     - cnic: Fix use-after-free bugs in cnic_delete_task
     - [arm64] octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
     - [amd64] perf/x86/intel: Fix crash in icl_update_topdown_event()
       (CVE-2025-38322)
     - ksmbd: smbdirect: validate data_offset and data_length field of
       smb_direct_data_transfer
     - ksmbd: smbdirect: verify remaining_data_length respects
       max_fragmented_recv_size
     - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
     - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
     - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
     - power: supply: bq27xxx: restrict no-battery detection to bq27000
     - dm-raid: don't set io_min and io_opt for raid1
     - dm-stripe: fix a possible integer overflow
     - gup: optimize longterm pin_user_pages() for large folio
     - mm: revert "mm: vmscan.c: fix OOM on swap stress test"
     - [amd64] iommu/vt-d: Fix __domain_mapping()'s usage of
       switch_to_super_page()
     - [amd64] iommu/amd/pgtbl: Fix possible race while increase page table level
     - btrfs: tree-checker: fix the incorrect inode ref size check
     - [arm64] ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S
       interface
     - [arm64] ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if
       source graph failed
     - [arm64] ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S
     - mmc: mvsdio: Fix dma_unmap_sg() nents value
     - [amd64] KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is
       active
     - drm/amd/display: Allow RX6xxx & RX7700 to invoke amdgpu_irq_get/put
     - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
     - rds: ib: Increment i_fastreg_wrs before bailing out
     - mptcp: propagate shutdown to subflows when possible
     - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx
     - io_uring/cmd: let cmds to know about dying task
     - io_uring: backport io_should_terminate_tw()
     - io_uring: include dying ring in task_work "should cancel" state
     - io_uring/msg_ring: kill alloc_cache for io_kiocb allocations
     - io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check
       (CVE-2025-39816)
     - [amd64] ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error
       message
     - [amd64] ASoC: Intel: catpt: Expose correct bit depth to userspace
     - drm/xe/tile: Release kobject for the failure path
     - drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
     - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
     - drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue()
     - smb: client: fix filename matching of deferred files
     - smb: client: let smbd_destroy() call
       disable_work_sync(&info->post_send_credits_work)
     - crypto: af_alg - Set merge to zero early in af_alg_sendmsg
     - smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
     - io_uring: fix incorrect io_kiocb reference in io_link_skb
     - [amd64] platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on
       ASUS ROG Z13
     - [amd64] platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk
     - vmxnet3: unregister xdp rxq info in the reset path (CVE-2025-22106)
     - mm: add folio_expected_ref_count() for reference count calculation
     - mm/gup: check ref_count instead of lru before migration
     - mptcp: pm: nl: announce deny-join-id0 flag
     - usb: xhci: introduce macro for ring segment list iteration
     - usb: xhci: remove option to change a default ring's TRB cycle bit
     - xhci: dbc: decouple endpoint allocation from initialization
     - xhci: dbc: Fix full DbC transfer ring after several reconnects
     - rtc: pcf2127: fix SPI command byte for PCF2131 backport
     - minmax.h: add whitespace around operators and after commas
     - minmax.h: update some comments
     - minmax.h: reduce the #define expansion of min(), max() and clamp()
     - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()
     - minmax.h: move all the clamp() definitions after the min/max() ones
     - minmax.h: simplify the variants of clamp()
     - minmax.h: remove some #defines that are only expanded once
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.50
     - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE
     - firewire: core: fix overlooked update of subsystem ABI version
     - ALSA: usb-audio: Fix code alignment in mixer_quirks
     - ALSA: usb-audio: Fix block comments in mixer_quirks
     - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
     - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
     - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
     - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
     - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
     - ALSA: usb-audio: Convert comma to semicolon
     - ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA
     - ALSA: usb-audio: Fix build with CONFIG_INPUT=n
     - usb: core: Add 0x prefix to quirks debug output
     - [arm64,armhf] net: fec: rename struct fec_devinfo fec_imx6x_info ->
       fec_imx6sx_info
     - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick
     - [riscv64] mmc: sdhci-cadence: add Mobileye eyeQ support
     - i2c: designware: Add quirk for Intel Xe
     - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
     - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk
     - ALSA: usb-audio: Add mute TLV for playback volumes on more devices
     - net: sfp: add quirk for FLYPRO copper SFP+ module
     - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
     - [amd64] HID: amd_sfh: Add sync across amd sfh work functions
     - cpufreq: Initialize cpufreq-based invariance before subsys
     - smb: server: don't use delayed_work for post_recv_credits_work
     - smb: server: use disable_work_sync in transport_rdma.c
     - bpf: Check the helper function is valid in get_helper_proto
     - btrfs: don't allow adding block device of less than 1 MB
     - wifi: virt_wifi: Fix page fault on connect
     - bpf: Reject bpf_timer for PREEMPT_RT
     - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
     - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
     - [armhf] can: sun4i_can: populate ndo_change_mtu() to prevent buffer
       overflow
     - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
     - can: peak_usb: fix shift-out-of-bounds issue
     - net: tun: Update napi->skb after XDP process
     - net/smc: fix warning in smc_rx_splice() when calling get_page()
     - [arm64] ethernet: rvu-af: Remove slash from the driver name
     - Bluetooth: hci_sync: Fix hci_resume_advertising_sync
     - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
     - vhost: Take a reference on the task in struct vhost_task.
     - bnxt_en: correct offset handling for IPv6 destination address
     - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
     - nexthop: Forbid FDB status change while nexthop is in a group
     - mm/gup: local lru_add_drain() to avoid lru_add_drain_all()
     - mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU
       batch"
     - mm: folio_may_be_lru_cached() unless folio_test_large()
     - [amd64] drm/gma500: Fix null dereference in hdmi teardown
     - futex: Prevent use-after-free during requeue-PI
     - [arm64] drm/panthor: Defer scheduler entitiy destruction to queue release
     - [amd64] platform/x86: lg-laptop: Fix WMAB call in fan_mode_store()
     - smb: client: fix wrong index reference in smb2_compound_op()
     - HID: asus: add support for missing PX series fn keys
     - i40e: add validation for ring_len param
     - i40e: fix idx validation in i40e_validate_queue_map
     - i40e: fix idx validation in config queues msg
     - i40e: fix input validation logic for action_meta
     - i40e: fix validation of VF state in get resources
     - i40e: add max boundary check for VF filters
     - i40e: add mask to apply valid bits for itr_idx
     - i40e: improve VF MAC filters accounting
     - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
     - tracing: dynevent: Add a missing lockdown check on dynevent
     - [armhf] dts: socfpga: sodia: Fix mdio bus probe and PHY address
     - drm/ast: Use msleep instead of mdelay for edid read
     - afs: Fix potential null pointer dereference in afs_put_server
     - fs/proc/task_mmu: check p->vec_buf for NULL
     - gpiolib: Extend software-node support to support secondary software-nodes
     - mm/hugetlb: fix folio is still mapped when deleted
     - fbcon: fix integer overflow in fbcon_do_set_font
     - fbcon: Fix OOB access in font allocation
     - iommufd: Fix race during abort for file descriptors
     - Revert "usb: xhci: remove option to change a default ring's TRB cycle bit"
     - [amd64] drm/i915/backlight: Return immediately when scale() finds invalid
       parameters
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.51
     - crypto: sha256 - fix crash at kexec
     - scsi: target: target_core_configfs: Add length check to avoid buffer
       overflow
     - media: b2c2: Fix use-after-free causing by irq_check_work in
       flexcop_pci_remove
     - media: tuner: xc5000: Fix use-after-free in xc5000_release
     - media: rc: fix races with imon_disconnect()
     - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID
     - mm: swap: check for stable address space before operating on the VMA
     - wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()
     - [arm64] ASoC: qcom: audioreach: fix potential null pointer dereference
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.52
     - wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()
     - USB: serial: option: add SIMCom 8230C compositions
     - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1
     - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
     - wifi: rtl8xxxu: Don't claim USB ID 07b8:8188
     - dm-integrity: limit MAX_TAG_SIZE to 255
     - [amd64] platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042
       list
     - [amd64] platform/x86/amd/pmf: Support new ACPI ID AMDI0108
     - [amd64,arm64] ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue
     - btrfs: ref-verify: handle damaged extent root tree
     - netfs: Prevent duplicate unlocking
     - can: hi311x: fix null pointer dereference when resuming from sleep before
       interface was enabled
     - [amd64] platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042
       quirks list
     - drm/amd : Update MES API header file for v11 & v12
     - drm/amd/include : MES v11 and v12 API header update
     - drm/amd/include : Update MES v12 API for fence update
     - drm/amdgpu: Enable MES lr_compute_wa by default (Closes: #1118658)
     - ALSA: usb-audio: Kill timer properly at removal (CVE-2025-38105)
     - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free
     - hid: fix I2C read buffer overflow in raw_event() for mcp2221
     - nvmem: layouts: fix automatic module loading
     - binder: fix double-free in dbitmap
     - driver core/PM: Set power.no_callbacks along with power.no_pm
     - crypto: rng - Ensure set_ent is always present
     - net/9p: fix double req put in p9_fd_cancelled
     - [amd64] KVM: x86: Don't (re)check L1 intercepts when completing userspace
       I/O
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.53
     - filelock: add FL_RECLAIM to show_fl_flags() macro
     - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
     - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast
     - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote
     - [powerpc*] 8xx: Remove left-over instruction and comments in
       DataStoreTLBMiss handler
     - [powerpc*] 603: Really copy kernel PGD entries into all PGDIRs
     - uprobes: uprobe_warn should use passed task
     - [arm64] coresight: trbe: Prevent overflow in PERF_IDX2OFF()
     - [arm64] perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
     - smb: server: fix IRD/ORD negotiation with the client
     - [amd64] EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller
     - [amd64] x86/vdso: Fix output operand size of RDPID
     - lsm: CONFIG_LSM can depend on CONFIG_SECURITY
     - btrfs: return any hit error from extent_writepage_io()
     - [arm64] pinctrl: renesas: rzg2l: Fix invalid unsigned return in
       rzg3s_oen_read()
     - [arm64] dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
     - regmap: Remove superfluous check for !config in __regmap_init()
     - bpf: Remove migrate_disable in kprobe_multi_link_prog_run
     - libbpf: Fix reuse of DEVMAP
     - [arm64] dts: imx93-kontron: Fix GPIO for panel regulator
     - [arm64] dts: imx93-kontron: Fix USB port assignment
     - [arm64] dts: imx95: Correct the lpuart7 and lpuart8 srcid
     - ACPI: processor: idle: Fix memory leak when register cpuidle device failed
     - [arm64] soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
     - [arm64] pinctrl: meson-gxl: add missing i2c_d pinmux
     - blk-mq: check kobject state_in_sysfs before deleting in
       blk_mq_unregister_hctx
     - block: use int to store blk_stack_limits() return value
     - PM: sleep: core: Clear power.must_resume in noirq suspend error path
     - vdso: Add struct __kernel_old_timeval forward declaration to gettime.h
     - [armhf] dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer
       property
     - [arm64] PM / devfreq: mtk-cci: Fix potential error pointer dereference in
       probe()
     - [arm64] power: supply: cw2015: Fix a alignment coding style issue
     - [arm64] pinctrl: renesas: Use int type to store negative error codes
     - null_blk: Fix the description of the cache_size module argument
     - nbd: restrict sockets to TCP and UDP
     - [arm64] PM / devfreq: rockchip-dfi: double count on RK3588
     - [arm64] soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure
     - [arm64] soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure
     - [arm64] arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model
     - mmc: core: Fix variable shadowing in mmc_route_rpmb_frames()
     - [arm64] dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value
     - [arm64] dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes
     - [arm64] dts: mediatek: mt8516-pumpkin: Fix machine compatible
     - [armhf] pwm: tiehrpwm: Don't drop runtime PM reference in .free()
     - [armhf] pwm: tiehrpwm: Make code comment in .free() more useful
     - [armhf] pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle
       calculation
     - [armhf] pwm: tiehrpwm: Fix corner case in clock divisor calculation
     - ACPICA: Fix largest possible resource descriptor index
     - [riscv64] bpf: Sign extend struct ops return values properly
     - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
     - i3c: master: svc: Use manual response for IBI events
     - i3c: master: svc: Recycle unused IBI slot
     - bpf: Explicitly check accesses to bpf_sock_addr
     - bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free()
     - smp: Fix up and expand the smp_call_function_many() kerneldoc
     - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host
       headers
     - spi: fix return code when spi device has too many chipselects
     - bpf: Mark kfuncs as __noclone
     - once: fix race by moving DO_ONCE to separate section
     - [arm64] thermal/drivers/qcom/lmh: Add missing IRQ includes
     - [arm64] i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
     - i2c: designware: Fix clock issue when PM is disabled
     - i2c: designware: Add disabling clocks when probe fails
     - libbpf: Fix error when st-prefix_ops and ops from differ btf
     - bpf: Enforce expected_attach_type for tailcall compatibility
     - drm/radeon/r600_cs: clean up of dead code in r600_cs
     - f2fs: fix condition in __allow_reserved_blocks()
     - [arm64] phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568
     - drm/amd/display: Remove redundant semicolons
     - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
     - scsi: myrs: Fix dma_alloc_coherent() error check
     - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count
     - RDMA/mlx5: Fix vport loopback forcing for MPV device
     - PCI/ACPI: Fix pci_acpi_preserve_config() memory leak
     - ALSA: lx_core: use int type to store negative error codes
     - inet: ping: check sock_net() in ping_get_port() and ping_lookup()
     - [arm64,armhf] coresight: Only register perf symlink for sinks with
       alloc_buffer
     - drm/amdgpu: Power up UVD 3 for FW validation (v2)
     - drm/amd/pm: Disable ULV even if unsupported (v3)
     - drm/amd/pm: Fix si_upload_smc_data (v3)
     - drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
     - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
     - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)
     - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3)
     - wifi: mwifiex: send world regulatory domain to driver
     - [arm64,armhf] PCI: tegra: Fix devm_kcalloc() argument order for port->phys
       allocation
     - tcp: fix __tcp_close() to only send RST when required
     - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
     - [armhf] usb: phy: twl6030: Fix incorrect type for ret
     - usb: gadget: configfs: Correctly set use_os_string at bind
     - tty: n_gsm: Don't block input queue by waiting MSC
     - [powerpc*] misc: genwqe: Fix incorrect cmd field being reported in error
     - pps: fix warning in pps_register_cdev when register device fail
     - wifi: iwlwifi: Remove redundant header files
     - [amd64,arm64] idpf: fix Rx descriptor ready check barrier in splitq
     - [amd64] ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
     - [amd64] ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
     - [amd64] ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
     - [arm64] drm/msm/dpu: fix incorrect type for ret
     - fs: ntfs3: Fix integer overflow in run_unpack()
     - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist
     - iio: consumers: Fix handling of negative channel scale in
       iio_convert_raw_to_processed()
     - iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
     - netfilter: ipset: Remove unused htable_bits in macro ahash_region
     - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable
     - drivers/base/node: handle error properly in register_one_node()
     - RDMA/cm: Rate limit destroy CM ID timeout error message
     - wifi: mt76: fix potential memory leak in mt76_wmac_probe()
     - wifi: mt76: mt7996: Fix RX packets configuration for primary WED device
     - wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE
     - wifi: mt76: mt7915: fix mt7981 pre-calibration
     - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()
     - f2fs: fix to truncate first page in error path of f2fs_truncate()
     - f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page()
     - ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on
       PREEMPT_RT
     - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
     - scsi: qla2xxx: edif: Fix incorrect sign of error code
     - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
     - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp()
     - HID: hidraw: tighten ioctl command parsing
     - f2fs: fix zero-sized extent for precache extents
     - Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems
       Running"
     - RDMA/core: Resolve MAC of next-hop device without ARP support
     - IB/sa: Fix sa_local_svc_timeout_ms read race
     - Documentation: trace: historgram-design: Separate sched_waking histogram
       section heading and the following diagram
     - wifi: ath12k: fix wrong logging ID used for CE
     - wifi: ath10k: avoid unnecessary wait for service ready message
     - iommu/vt-d: debugfs: Fix legacy mode page table dump logic
     - wifi: mac80211: fix Rx packet handling when pubsta information is not
       available
     - [amd64] ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback
     - RDMA/rxe: Fix race in do_task() when draining
     - wifi: rtw89: avoid circular locking dependency in ser_state_run()
     - [arm64] remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
     - dm vdo: return error on corrupted metadata in start_restoring_volume
       functions
     - [arm64] coresight-etm4x: Conditionally access register TRCEXTINSELR
     - [arm64,armhf] coresight: tmc: Support atclk
     - [arm64,armhf] coresight: catu: Support atclk
     - [arm64,armhf] coresight: etm4x: Support atclk
     - [arm64,armhf] coresight: trbe: Return NULL pointer for allocation failures
     - [arm64,armhf] coresight: tpda: fix the logic to setup the element size
     - [arm64] coresight: Fix incorrect handling for return value of devm_kzalloc
     - NFSv4.1: fix backchannel max_resp_sz verification check
     - ipvs: Defer ip_vs_ftp unregister during netns cleanup
     - netfilter: nfnetlink: reset nlh pointer during batch replay
     - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
     - usb: vhci-hcd: Prevent suspending virtually attached devices
     - iommu/vt-d: Disallow dirty tracking if incoherent page walk
     - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
     - ptp: Add a upper bound on max_vclocks
     - vhost: vringh: Fix copy_to_iter return value check
     - Bluetooth: MGMT: Fix not exposing debug UUID on
       MGMT_OP_READ_EXP_FEATURES_INFO
     - Bluetooth: ISO: Fix possible UAF on iso_conn_free
     - Bluetooth: ISO: free rx_skb if not consumed
     - Bluetooth: ISO: don't leak skb in ISO_CONT RX
     - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements
     - KEYS: X.509: Fix Basic Constraints CA flag parsing
     - ocfs2: fix double free in user_cluster_connect()
     - drivers/base/node: fix double free in register_one_node()
     - [arm64] PCI: j721e: Fix incorrect error message in probe()
     - [amd64,arm64] idpf: fix mismatched free function for dma_alloc_coherent
     - nfp: fix RSS hash key size when RSS is not supported
     - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not
       configurable
     - net: dlink: handle copy_thresh allocation failure
     - net/mlx5: Stop polling for command response if interface goes down
     - net/mlx5: pagealloc: Fix reclaim race during command interface teardown
     - net/mlx5: fw reset, add reset timeout work
     - smb: client: fix crypto buffers in non-linear memory
     - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
     - bpf: Reject negative offsets for ALU ops
     - tpm: Disable TPM2_TCG_HMAC by default
     - Squashfs: fix uninit-value in squashfs_get_parent
     - uio_hv_generic: Let userspace take care of interrupt mask
     - io_uring/waitid: always prune wait queue entry in io_waitid_wait()
     - [arm64] ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
     - [amd64,arm64] ASoC: SOF: ipc3-topology: Fix multi-core and static
       pipelines tear down
     - fs: udf: fix OOB read in lengthAllocDescs handling
     - net: nfc: nci: Add parameter validation for packet data
     - [arm64,armhf] mfd: vexpress-sysreg: Check the return value of
       devm_gpiochip_add_data()
     - dm: fix queue start/stop imbalance under suspend/load/resume races
     - dm: fix NULL pointer dereference in __dm_suspend()
     - ksmbd: Fix race condition in RPC handle list access
     - ksmbd: fix error code overwriting in smb2_get_info_filesystem()
     - ksmbd: add max ip connections parameter
     - ext4: fix checks for orphan inodes
     - [amd64] KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't
       valid
     - fbdev: simplefb: Fix use after free in simplefb_detach_genpds()
     - mm: hugetlb: avoid soft lockup when mprotect to large memory area
     - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
     - [arm64] misc: fastrpc: Save actual DMA size in fastrpc_map structure
     - [arm64] misc: fastrpc: Fix fastrpc_map_lookup operation
     - [arm64] misc: fastrpc: fix possible map leak in fastrpc_put_args
     - [arm64] misc: fastrpc: Skip reference for DMA handles
     - Input: atmel_mxt_ts - allow reset GPIO to sleep
     - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
     - sunrpc: fix null pointer dereference on zero-length checksum
     - [arm64] remoteproc: pru: Fix potential NULL pointer dereference in
       pru_rproc_set_ctable()
     - [amd64,arm64] tee: fix register_shm_helper()
     - pinctrl: check the return value of pinmux_ops::get_function_name()
     - bus: fsl-mc: Check return value of platform_get_resource()
     - net/9p: Fix buffer overflow in USB transport layer
     - net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
     - usb: typec: tipd: Clear interrupts first
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.54
     - fs: always return zero on success from replace_fd()
     - fscontext: do not consume log entries when returning -EMSGSIZE
     - [arm64] map [_text, _stext) virtual address range non-executable+read-only
     - rseq: Protect event mask against membarrier IPI
     - listmount: don't call path_put() under namespace semaphore
     - page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches
     - dma-mapping: fix direction in dma_alloc direction traces
     - [amd64] KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2
     - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
     - media: v4l2-subdev: Fix alloc failure check in
       v4l2_subdev_call_state_try()
     - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled
     - perf disasm: Avoid undefined behavior in incrementing NULL
     - perf test trace_btf_enum: Skip if permissions are insufficient
     - perf evsel: Avoid container_of on a NULL leader
     - libperf event: Ensure tracing data is multiple of 8 sized
     - [arm64] clk: qcom: common: Fix NULL vs IS_ERR() check in
       qcom_cc_icc_register()
     - [arm64] clk: renesas: cpg-mssr: Fix memory leak in
       cpg_mssr_reserved_init()
     - perf util: Fix compression checks returning -1 as bool
     - perf arm_spe: Correct setting remote access
     - perf arm-spe: Rename the common data source encoding
     - perf arm_spe: Correct memory level for remote access
     - perf vendor events arm64 AmpereOneX: Fix typo - should be
       l1d_cache_access_prefetches
     - perf session: Fix handling when buffer exceeds 2 GiB
     - perf tools: Add fallback for exclude_guest
     - perf evsel: Ensure the fallback message is always written to
     - [arm64] clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
     - [arm64] clk: mediatek: clk-mux: Do not pass flags to
       clk_mux_determine_rate_flags()
     - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (CVE-2025-40001)
     - [amd64] ASoC: SOF: Intel: hda-pcm: Place the constraint on period time
       instead of buffer time
     - [amd64] ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel
     - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
     - drm/xe/hw_engine_group: Fix double write lock release in error path
     - [s390x] cio: Update purge function to unregister the unused subchannels
     - drm/vmwgfx: Fix a null-ptr access in the cursor snooper
     - drm/vmwgfx: Fix Use-after-free in validation
     - drm/vmwgfx: Fix copy-paste typo in validation
     - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
     - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
     - [arm64] net: mscc: ocelot: Fix use-after-free caused by cyclic delayed
       work (CVE-2025-40003)
     - ice: ice_adapter: release xa entry on adapter allocation failure
     - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat()
     - [arm64] mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister()
       call
     - [arm64] mailbox: zynqmp-ipi: Remove dev.parent check in
       zynqmp_ipi_free_mboxes
     - [arm64] mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup
       loop
     - [arm64] mailbox: zynqmp-ipi: Fix SGI cleanup on unbind
     - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
     - [arm64] mailbox: mtk-cmdq-mailbox: Switch to
       __pm_runtime_put_autosuspend()
     - [arm64] mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend()
     - [arm64] mailbox: mtk-cmdq: Remove pm_runtime APIs from
       cmdq_mbox_send_data()
     - drm/amdgpu: Add additional DCE6 SCL registers
     - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
     - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
     - drm/amd/display: Properly disable scaling on DCE6
     - netfilter: nft_objref: validate objref and objrefmap expressions
     - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
     - crypto: essiv - Check ssize for decryption and in-place encryption
     - cifs: Fix copy_to_iter return value check
     - smb: client: fix missing timestamp updates after utime(2)
     - cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points
     - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
     - [arm64] gpio: wcd934x: mark the GPIO controller as sleeping
     - bpf: Avoid RCU context warning when unpinning htab with internal structs
     - [s390x] vmlinux.lds.S: Reorder sections
     - [s390x] vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections
     - ACPI: property: Fix buffer properties extraction for subnodes
     - ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
     - ACPI: debug: fix signedness issues in read/write helpers
     - [arm64] dts: qcom: msm8916: Add missing MDSS reset
     - [arm64] dts: qcom: msm8939: Add missing MDSS reset
     - [arm64] dts: qcom: sdm845: Fix slimbam num-channels/ees
     - [arm64] dts: qcom: x1e80100-pmics: Disable pm8010 by default
     - [arm64] dts: ti: k3-am62a-main: Fix main padcfg length
     - [arm64] kprobes: call set_memory_rox() for kprobe page
     - [armhf] AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on
       reset)
     - [armhf] OMAP2+: pm33xx-core: ix device node reference leaks in
       amx3_idle_init
     - [arm64] perf/arm-cmn: Fix CMN S3 DTM offset
     - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required
     - xen/events: Cleanup find_virq() return codes
     - xen/manage: Fix suspend error path
     - xen/events: Return -EEXIST for bound VIRQs
     - xen/events: Update virq_to_irq on migration
     - [arm64] firmware: meson_sm: fix device leak at probe
     - media: cx18: Add missing check after DMA map
     - media: mc: Fix MUST_CONNECT handling for pads with no links
     - media: pci: ivtv: Add missing check after DMA map
     - media: pci: mg4b: fix uninitialized iio scan data
     - [arm64] media: venus: firmware: Use correct reset sequence for IRIS2
     - media: vivid: fix disappearing <Vendor Command With ID> messages
     - media: lirc: Fix error handling in lirc_register()
     - [arm64] drm/panthor: Fix memory leak in panthor_ioctl_group_create()
     - drm/nouveau: fix bad ret code in nouveau_bo_move_prep
     - drm/xe/uapi: loosen used tracking restriction
     - drm/amd/display: Enable Dynamic DTBCLK Switch
     - blk-crypto: fix missing blktrace bio split events
     - btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
     - bus: mhi: ep: Fix chained transfer handling in read path
     - bus: mhi: host: Do not use uninitialized 'dev' pointer in
       mhi_init_irq_setup()
     - [arm64] clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP
       refclk
     - copy_sighand: Handle architectures where sizeof(unsigned long) <
       sizeof(u64)
     - [amd64] cpufreq: intel_pstate: Fix object lifecycle issue in
       update_qos_request()
     - [arm64,armhf] crypto: rockchip - Fix dma_unmap_sg() nents value
     - eventpoll: Replace rwlock with spinlock
     - fbdev: Fix logic error in "offb" name match
     - fs/ntfs3: Fix a resource leak bug in wnd_extend()
     - fs: quota: create dedicated workqueue for quota_release_work
     - fuse: fix possibly missing fuse_copy_finish() call in fuse_notify()
     - fuse: fix livelock in synchronous file put from fuseblk workers
     - iio: dac: ad5360: use int type to store negative error codes
     - iio: dac: ad5421: use int type to store negative error codes
     - iio: frequency: adf4350: Fix prescaler usage.
     - init: handle bootloader identifier in kernel parameters
     - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in
       resume
     - [amd64] iommu/vt-d: PRS isn't usable if PDS isn't supported
     - kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in
       sys_prlimit64() paths
     - KEYS: trusted_tpm1: Compare HMAC values in constant time
     - lib/genalloc: fix device leak in of_gen_pool_get()
     - loop: fix backing file reference leak on validation error
     - openat2: don't trigger automounts with RESOLVE_NO_XDEV
     - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
     - [powerpc*] powernv/pci: Fix underflow and leak issue
     - [powerpc*] pseries/msi: Fix potential underflow and leak issue
     - Revert "ipmi: fix msg stack when IPMI is disconnected"
     - sched/deadline: Fix race in push_dl_task()
     - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
     - scsi: sd: Fix build warning in sd_revalidate_disk()
     - sctp: Fix MAC comparison to be constant-time
     - xsk: Harden userspace-supplied xdp_desc validation
     - mmc: core: SPI mode remove cmd7
     - mmc: mmc_spi: multiple block read remove read crc ack
     - [armhf] memory: samsung: exynos-srom: Fix of_iomap leak in
       exynos_srom_probe
     - rtc: interface: Ensure alarm irq is enabled when UIE is enabled
     - rtc: interface: Fix long-standing race when setting alarm
     - [arm64] PCI: xilinx-nwl: Fix ECAM programming
     - [arm64,armhf] PCI: tegra: Convert struct tegra_msi mask_lock into raw
       spinlock
     - PCI/sysfs: Ensure devices are powered for config reads
     - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
     - PCI/ERR: Fix uevent on failure to recover
     - PCI/AER: Fix missing uevent on recovery when a reset is requested
     - PCI/AER: Support errors introduced by PCIe r6.0
     - [arm64] PCI: j721e: Fix programming sequence of "strap" settings
     - spi: cadence-quadspi: Flush posted register writes before INDAC access
     - spi: cadence-quadspi: Flush posted register writes before DAC access
     - spi: cadence-quadspi: Fix cqspi_setup_flash()
     - [x86] fred: Remove ENDBR64 from FRED entry points
     - [x86] umip: Check that the instruction opcode is at least two bytes
     - [x86] umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT
       aliases)
     - [s390x] dasd: enforce dma_alignment to ensure proper buffer validation
     - [s390x] dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request
     - [s390x] Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR
     - slab: prevent warnings when slab obj_exts vector allocation fails
     - slab: mark slab->obj_exts allocation failures unconditionally
     - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again
     - wifi: mt76: mt7925u: Add VID/PID for Netgear A9000
     - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500
     - mm/thp: fix MTE tag mismatch when replacing zero-filled subpages
     - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
     - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when
       max_huge_pages=0
     - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success
     - mm/damon/lru_sort: use param_ctx for damon_attrs staging
     - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
     - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
     - ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches()
     - ext4: verify orphan file size is not too big
     - ext4: increase i_disksize to offset + len in
       ext4_update_disksize_before_punch()
     - ext4: correctly handle queries for metadata mappings
     - ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
     - ext4: fix an off-by-one issue during moving extents
     - ext4: guard against EA inode refcount underflow in xattr update
     - ext4: validate ea_ino and size in check_xattrs
     - ACPICA: Allow to skip Global Lock initialization
     - ext4: free orphan info with kvfree
     - media: mc: Clear minor number before put device
     - Squashfs: add additional inode sanity checking
     - Squashfs: reject negative file sizes in squashfs_read_inode()
     - tracing: Fix race condition in kprobe initialization causing NULL pointer
       dereference
     - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork
     - [amd64] ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams
     - [amd64] ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples
     - [amd64] mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config
       max_register value
     - [amd64] mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for
       cache_type
     - [amd64] mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config
       flag
     - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
     - cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency
     - [amd64] KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace
     - statmount: don't call path_put() under namespace semaphore
     - [arm64] mte: Do not flag the zero page as PG_mte_tagged
     - [x86] mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state()
     - [x86] kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP
     - nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT
     - NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock()
     - nfsd: refine and rename NFSD_MAY_LOCK
     - nfsd: don't use sv_nrthreads in connection limiting calculations.
     - nfsd: unregister with rpcbind when deleting a transport
     - ACPI: battery: allocate driver data through devm_ APIs
     - ACPI: battery: initialize mutexes through devm_ APIs
     - ACPI: battery: Check for error code from devm_mutex_init() call
     - ACPI: battery: Add synchronization between interface updates
     - ACPI: property: Disregard references in data-only subnode lists
     - ACPI: property: Add code comments explaining what is going on
     - ACPI: property: Do not pass NULL handles to acpi_attach_data()
     - mptcp: pm: in-kernel: usable client side with C-flag
     - ipmi: Rework user message limit handling
     - ipmi: Fix handling of messages with provided receive message pointer
     - mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled
       mTHP subpage to shared zeropage
     - [s390x] bpf: Centralize frame offset calculations
     - [s390x] bpf: Describe the frame using a struct instead of constants
     - [s390x] bpf: Write back tail call counter for BPF_PSEUDO_CALL
     - [s390x] bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG
     - [riscv64] irqchip/sifive-plic: Make use of __assign_bit()
     - [riscv64] irqchip/sifive-plic: Avoid interrupt ID 0 handling during
       suspend/resume
     - copy_file_range: limit size if in compat mode
     - minixfs: Verify inode mode when loading from disk
     - pid: Add a judgment for ns null in pid_nr_ns
     - fs: Add 'initramfs_options' to set initramfs mount options
     - cramfs: Verify inode mode when loading from disk
     - writeback: Avoid softlockup when switching many inodes
     - writeback: Avoid excessively long inode switching times
     - sched/fair: Block delayed tasks on throttled hierarchy during dequeue
     - nfsd: fix __fh_verify for localio
     - nfsd: fix access checking for NLM under XPRTSEC policies
     - [amd64] ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA
     - mount: handle NULL values in mnt_ns_release()
     - nfsd: decouple the xprtsec policy check from check_nfsd_access()
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.55
     - drm/xe/guc: Check GuC running state before deregistering exec queue
     - smb: client: Fix refcount leak for cifs_sb_tlink
     - slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL
     - r8152: add error handling in rtl8152_driver_init
     - f2fs: fix wrong block mapping for multi-devices
     - jbd2: ensure that all ongoing I/O complete before freeing blocks
     - ext4: wait for ongoing I/O to complete before freeing blocks
     - ext4: detect invalid INLINE_DATA + EXTENTS flag combination
     - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already
       running
     - btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl
     - btrfs: fix incorrect readahead expansion length
     - btrfs: fix memory leaks when rejecting a non SINGLE data profile without
       an RST
     - btrfs: do not assert we found block group item when creating free space
       tree
     - can: gs_usb: gs_make_candev(): populate net_device->dev_port
     - can: gs_usb: increase max interface to U8_MAX
     - cifs: parse_dfs_referrals: prevent oob on malformed input
     - drm/sched: Fix potential double free in
       drm_sched_job_add_resv_dependencies
     - drm/amdgpu: use atomic functions with memory barriers for vm fault info
     - drm/amdgpu: fix gfx12 mes packet status return check
     - perf/core: Fix address filter match with backing files
     - perf/core: Fix MMAP event path names with backing files
     - perf/core: Fix MMAP2 event device with backing files
     - drm/amd: Check whether secure display TA loaded successfully
     - irqdomain: cdx: Switch to of_fwnode_handle()
     - [arm64] drm/msm/a6xx: Fix PDC sleep sequence
     - usb: gadget: Store endpoint pointer in usb_request
     - usb: gadget: Introduce free_usb_request helper
     - usb: gadget: f_ncm: Refactor bind path to use __free()
     - usb: gadget: f_acm: Refactor bind path to use __free()
     - usb: gadget: f_ecm: Refactor bind path to use __free()
     - usb: gadget: f_rndis: Refactor bind path to use __free()
     - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay
     - Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()"
       (Closes: #1116358)
     - HID: multitouch: fix sticky fingers
     - dax: skip read lock assertion for read-only filesystems
     - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable()
     - can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error
       Active
     - can: m_can: m_can_chip_config(): bring up interface in correct state
     - can: m_can: add deinit callback
     - can: m_can: call deinit/init callback when going into suspend/resume
     - can: m_can: fix CAN state in system PM
     - net: dlink: handle dma_map_single() failure properly
     - doc: fix seg6_flowlabel path
     - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H
     - net/ip6_tunnel: Prevent perpetual tunnel growth
     - [amd64,arm64] amd-xgbe: Avoid spurious link down messages during interface
       toggle
     - tcp: fix tcp_tso_should_defer() vs large RTT
     - ksmbd: fix recursive locking in RPC handle list access
     - tg3: prevent use of uninitialized remote_adv and local_adv variables
     - tls: trim encrypted message to match the plaintext on short splice
     - tls: wait for async encrypt in case of error during latter iterations of
       sendmsg
     - tls: always set record_type in tls_process_cmsg
     - tls: wait for pending async decryptions if tls_strp_msg_hold fails
     - tls: don't rely on tx_work during send()
     - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address
     - net: usb: lan78xx: fix use of improperly initialized dev->chipid in
       lan78xx_reset
     - [arm64] drm/panthor: Ensure MCU is disabled on suspend
     - nvme-multipath: Skip nr_active increments in RETRY disposition
     - [riscv64] kprobes: Fix probe address validation
     - [amd64] ASoC: nau8821: Cancel jdet_work before handling jack ejection
     - [amd64] ASoC: nau8821: Generalize helper to clear IRQ status
     - [amd64] ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit
     - [amd64] drm/i915/guc: Skip communication warning on reset in progress
     - drm/amdgpu: add ip offset support for cyan skillfish
     - drm/amdgpu: add support for cyan skillfish without IP discovery
     - drm/amdgpu: fix handling of harvesting for ip_discovery firmware
     - drm/amd/powerplay: Fix CIK shutdown temperature
     - [arm64] drm/rockchip: vop2: use correct destination rectangle height check
     - sched/fair: Fix pelt lost idle time detection
     - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
     - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card
     - HID: hid-input: only ignore 0 battery events for digitizers
     - HID: multitouch: fix name of Stylus input devices
     - nvme/tcp: handle tls partially sent records in write_space()
     - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
     - xfs: rename the old_crc variable in xlog_recover_process
     - xfs: fix log CRC mismatches between i386 and other architectures
     - PM: runtime: Add new devm functions
     - iio: imu: inv_icm42600: Simplify pm_runtime setup
     - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended
     - nfsd: Use correct error code when decoding extents
     - nfsd: Drop dprintk in blocklayout xdr functions
     - NFSD: Rework encoding and decoding of nfsd4_deviceid
     - NFSD: Minor cleanup in layoutcommit processing
     - NFSD: Implement large extent array support in pNFS
     - NFSD: Fix last write offset handling in layoutcommit
     - wifi: rtw89: avoid possible TX wait initialization race
     - xfs: use deferred intent items for reaping crosslinked blocks
     - padata: Reset next CPU when reorder sequence wraps around
     - md/raid0: Handle bio_split() errors
     - md/raid1: Handle bio_split() errors
     - md/raid10: Handle bio_split() errors
     - md: fix mssing blktrace bio split events
     - [amd64] x86/resctrl: Refactor resctrl_arch_rmid_read()
     - [amd64] x86/resctrl: Fix miscount of bandwidth event when reactivating
       previously unavailable RMID
     - d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier
     - vfs: Don't leak disconnected dentries on umount
     - PCI: Add PCI_VDEVICE_SUB helper macro
     - ixgbevf: Add support for Intel(R) E610 device
     - ixgbevf: fix getting link speed data for E610 devices
     - ixgbevf: fix mailbox API compatibility by negotiating supported features
     - tcp: convert to dev_net_rcu()
     - tcp: cache RTAX_QUICKACK metric in a hot cache line
     - net: dst: add four helpers to annotate data-races around dst->dev
     - ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]
     - net: Add locking to protect skb->dev access in ip_output
     - mptcp: Call dst_release() in mptcp_active_enable().
     - mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().
     - mptcp: reset blackhole on success with non-loopback ifaces
     - NFSD: Define a proc_layoutcommit for the FlexFiles layout type
     - [arm64] cputype: Add Neoverse-V3AE definitions
     - [arm64] errata: Apply workarounds for Neoverse-V3AE
     - [amd64] dmaengine: Add missing cleanup on module unload
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.56
     - exec: Fix incorrect type for ret
     - hfs: clear offset and space out of valid records in b-tree node
     - hfs: make proper initalization of struct hfs_find_data
     - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
     - hfs: validate record offset in hfsplus_bmap_alloc
     - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
     - dlm: check for defined force value in dlm_lockspace_release
     - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
     - hfsplus: return EIO when type of hidden directory mismatch in
       hfsplus_fill_super()
     - PCI: Test for bit underflow in pcie_set_readrq()
     - [arm64] sysreg: Correct sign definitions for EIESB and DoubleLock
     - drivers/perf: hisi: Relax the event ID check in the framework
     - [s390x] mm: Use __GFP_ACCOUNT for user page table allocations
     - smb: server: let smb_direct_flush_send_list() invalidate a remote key
       first
     - PM: EM: Drop unused parameter from em_adjust_new_capacity()
     - PM: EM: Slightly reduce em_check_capacity_update() overhead
     - PM: EM: Move CPU capacity check to em_adjust_new_capacity()
     - PM: EM: Fix late boot with holes in CPU topology
     - net/mlx5e: Return 1 instead of 0 in invalid case in
       mlx5e_mpwrq_umr_entry_size()
     - rtnetlink: Allow deleting FDB entries in user namespace
     - [arm64] net: enetc: fix the deadlock of enetc_mdio_lock
     - [arm64] net: enetc: correct the value of ENETC_RXB_TRUESIZE
     - [arm64] dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path
     - net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead
     - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ
     - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ
     - net/smc: fix general protection fault in __smc_diag_dump
     - [arm64] net: ethernet: ti: am65-cpts: fix timestamp loss due to race
       conditions
     - [arm64] mm: avoid always making PTE dirty in pte_mkwrite()
     - ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop
     - sctp: avoid NULL dereference when chunk data buffer is missing
     - net: phy: micrel: always set shared->phydev for LAN8814
     - net/mlx5: Fix IPsec cleanup over MPV device
     - fs/notify: call exportfs_encode_fid with s_umount
     - net: bonding: fix possible peer notify event loss or dup issue
     - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC
     - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
     - btrfs: directly free partially initialized fs_info in
       btrfs_check_leaked_roots()
     - gpio: pci-idio-16: Define maximum valid register address offset
     - gpio: 104-idio-16: Define maximum valid register address offset
     - xfs: fix locking in xchk_nlinks_collect_dir
     - Revert "cpuidle: menu: Avoid discarding useful information"
     - slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts
     - slab: Fix obj_ext mistakenly considered NULL due to race condition
     - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11
     - can: netlink: can_changelink(): allow disabling of automatic restart
     - cifs: Fix TCP_Server_Info::credits to be signed
     - ocfs2: clear extent cache after moving/defragmenting extents
     - vsock: fix lock inversion in vsock_assign_transport()
     - [arm64,armhf] net: stmmac: dwmac-rk: Fix disabling set_clock_selection
     - net: usb: rtl8150: Fix frame padding
     - mm: prevent poison consumption when splitting THP
     - drm/amd/display: increase max link count and fix link->enc NULL pointer
       access
     - [arm64] spi: spi-nxp-fspi: add extra delay after dll locked
     - [arm64] dts: broadcom: bcm2712: Add default GIC address cells
     - [arm64] dts: broadcom: bcm2712: Define VGIC interrupt
     - [arm64] firmware: arm_scmi: Account for failed debug initialization
     - [arm64] firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing
       in raw mode
     - [arm64] drm/panthor: Fix kernel panic on partial unmap of a GPU VA region
     - [riscv64] Define pgprot_dmacoherent() for non-coherent devices
     - [riscv64] Don't print details of CPUs disabled in DT
     - [riscv64] hwprobe: avoid uninitialized variable use in hwprobe_arch_id()
     - hwmon: (sht3x) Fix error handling
     - nbd: override creds to kernel when calling sock_{send,recv}msg()
     - drm/panic: Fix drawing the logo on a small narrow screen
     - drm/panic: Fix qr_code, ensure vmargin is positive
     - [amd64] gpio: ljca: Fix duplicated IRQ mapping
     - io_uring: correct __must_hold annotation in io_install_fixed_file
     - sched: Remove never used code in mm_cid_get()
     - io_uring/sqpoll: switch away from getrusage() for CPU accounting
     - io_uring/sqpoll: be smarter on when to update the stime usage
     - Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP
       (Closes: #1118660)
     - platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL
       (CVE-2025-39678)
     - USB: serial: option: add UNISOC UIS7720
     - USB: serial: option: add Quectel RG255C
     - USB: serial: option: add Telit FN920C04 ECM compositions
     - usb/core/quirks: Add Huawei ME906S to wakeup quirk
     - usb: raw-gadget: do not limit transfer length
     - xhci: dbc: enable back DbC in resume if it was enabled before suspend
     - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall
       event
     - [amd64] x86/microcode: Fix Entrysign revision check for Zen1/Naples
     - [arm*] binder: remove "invalid inc weak" check
     - [amd64] comedi: fix divide-by-zero in comedi_buf_munge() (CVE-2025-40106)
     - [amd64] mei: me: add wildcat lake P DID
     - [arm64] misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup
     - [amd64,arm64] tcpm: switch check for role_sw device with fw_node
     - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp
     - serial: 8250_dw: handle reset control deassert error
     - serial: 8250_exar: add support for Advantech 2 port card with Device ID
       0x0018
     - [arm64] serial: 8250_mtk: Enable baud clock and manage in runtime PM
     - serial: sc16is7xx: remove useless enable of enhanced features
     - devcoredump: Fix circular locking dependency with devcd->mutex.
     - [arm64] mte: Do not warn if the page is already tagged in copy_highpage()
     - xfs: always warn about deprecated mount options
     - ksmbd: transport_ipc: validate payload size before reading handle
       (CVE-2025-40084)
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.57
     - net/sched: sch_qfq: Fix null-deref in agg_dequeue (CVE-2025-40083)
     - audit: record fanotify event regardless of presence of rules
     - [amd64] perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into
       INTEL_FIXED_BITS_MASK
     - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of
       current->mm == NULL
     - perf: Have get_perf_callchain() return NULL if crosstask and user are set
     - perf: Skip user unwind if the task is a kernel thread
     - seccomp: passthrough uprobe systemcall without filtering
     - [amd64] x86/bugs: Report correct retbleed mitigation status
     - [amd64] x86/bugs: Fix reporting of LFENCE retpoline
     - [amd64,arm64] EDAC/mc_sysfs: Increase legacy channel support to 16
     - cpuset: Use new excpus for nocpu error check when enabling root partition
     - btrfs: abort transaction on specific error places when walking log tree
     - btrfs: abort transaction in the process_one_buffer() log tree walk
       callback
     - btrfs: zoned: return error from btrfs_zone_finish_endio()
     - btrfs: zoned: refine extent allocator hint selection
     - btrfs: scrub: replace max_t()/min_t() with clamp() in
       scrub_throttle_dev_io()
     - btrfs: always drop log root tree reference in btrfs_replay_log()
     - btrfs: use level argument in log tree walk callback replay_one_buffer()
     - btrfs: abort transaction if we fail to update inode in log replay dir
       fixup
     - btrfs: tree-checker: add inode extref checks
     - btrfs: use smp_mb__after_atomic() when forcing COW in
       create_pending_snapshot()
     - sched_ext: Make qmap dump operation non-destructive
     - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c
     - docs: kdoc: handle the obsolescensce of docutils.ErrorString()
     - mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR
     - f2fs: fix to avoid panic once fallocation fails for pinfile
       (CVE-2025-23130)
     - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac()
       (CVE-2025-38643)
     - bonding: return detailed error when loading native XDP fails
     - bonding: check xdp prog when set bond mode (CVE-2025-22105)
     - bits: add comments and newlines to #if, #else and #endif directives
     - bits: introduce fixed-type GENMASK_U*()
     - gpio: regmap: Allow to allocate regmap-irq device
     - gpio: regmap: add the .fixed_direction_output configuration parameter
     - gpio: idio-16: Define fixed direction of the GPIO lines
     - [amd64] iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (CVE-2025-21833)
     - wifi: ath12k: fix read pointer after free in
       ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995)
     - [amd64,arm64] udmabuf: fix a buf size overflow issue during udmabuf
       creation (CVE-2025-37803)
     - sfc: fix NULL dereferences in ef100_process_design_param()
       (CVE-2025-37860)
     - btrfs: tree-checker: fix bounds check in check_inode_extref()
 .
   [ Salvatore Bonaccorso ]
   * drivers/infiniband/hw/bnxt_re: Enable INFINIBAND_BNXT_RE as module
     (Closes: #1109977)
 .
   [ Ben Hutchings ]
   * d/salsa-ci.yml: Adjust filenames to allow source package name suffix
   * tools/hv: Make the sample hv_get_dhcp_info script more useful
   * hyperv-daemons: Install the sample network info scripts (Closes: #919350)
   * d/salsa-ci.yml: Fix cache configuration for build job
   * d/salsa-ci.yml: Move orig tarball generation to a separate job again
   * d/salsa-ci.yml: Restore lintian checking of source package
linux (6.12.48-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.44
     - serial: 8250: fix panic due to PSLVERR
     - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
     - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister()
     - PM: runtime: Take active children into account in
       pm_runtime_get_if_in_use()
     - dm: dm-crypt: Do not partially accept write BIOs with zoned targets
     - dm: Check for forbidden splitting of zone write operations
     - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
     - usb: gadget: udc: renesas_usb3: fix device leak at unbind
     - usb: musb: omap2430: fix device leak at unbind
     - [arm64,armhf] usb: dwc3: meson-g12a: fix device leaks at unbind
     - [arm64] usb: dwc3: imx8mp: fix device leak at unbind
     - bus: mhi: host: Fix endianness of BHI vector table
     - bus: mhi: host: Detect events pointing to unexpected TREs
     - vt: keyboard: Don't process Unicode characters in K_OFF mode
     - vt: defkeymap: Map keycodes above 127 to K_HOLE
     - [amd64] crypto: qat - lower priority for skcipher and aead algorithms
     - [arm64,armhf] crypto: caam - Prevent crash on suspend with iMX8QM /
       iMX8ULP
     - [amd64] crypto: qat - flush misc workqueue during device shutdown
     - Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
     - ksmbd: fix refcount leak causing resource not released
     - ksmbd: extend the connection limiting mechanism to support IPv6
     - tracing: fprobe-event: Sanitize wildcard for fprobe event name
     - ext4: check fast symlink for ea_inode correctly
     - ext4: fix fsmap end of range reporting with bigalloc
     - ext4: fix reserved gdt blocks handling in fsmap
     - ext4: use kmalloc_array() for array space allocation
     - ext4: fix hole length calculation overflow in non-extent inodes
     - btrfs: zoned: fix write time activation failure for metadata block group
     - btrfs: fix incorrect log message for nobarrier mount option
     - btrfs: restore mount option info messages during mount
     - btrfs: fix printing of mount info messages for NODATACOW/NODATASUM
     - apparmor: Fix 8-byte alignment for initial dfa blob streams
     - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints
     - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks
       constraints
     - scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host
     - [arm64] scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
     - scsi: mpi3mr: Fix race between config read submit and interrupt completion
     - ata: libata-scsi: Fix ata_to_sense_error() status handling
     - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host
       controllers
     - scsi: ufs: ufs-pci: Fix default runtime and system PM levels
     - ata: libata-scsi: Fix CDL control
     - [arm64] soc: qcom: mdt_loader: Ensure we don't read past the ELF header
     - iio: imu: bno055: fix OOB access of hw_xlate array
     - iio: adc: ad_sigma_delta: change to buffer predisable
     - wifi: brcmsmac: Remove const from tbl_ptr parameter in
       wlc_lcnphy_common_read_table()
     - wifi: ath12k: fix dest ring-buffer corruption
     - wifi: ath12k: fix source ring-buffer corruption
     - wifi: ath12k: fix dest ring-buffer corruption when ring is full
     - wifi: ath11k: fix dest ring-buffer corruption
     - wifi: ath11k: fix source ring-buffer corruption
     - wifi: ath11k: fix dest ring-buffer corruption when ring is full
     - [arm64] pwm: mediatek: Handle hardware enable and clock enable separately
     - [arm64] pwm: mediatek: Fix duty and period setting
     - mtd: spi-nor: Fix spi_nor_try_unlock_all()
     - [arm64] mtd: spinand: propagate spinand_wait() errors from
       spinand_write_page()
     - readahead: fix return value of page_cache_next_miss() when no hole is
       found
     - PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge
     - PCI: endpoint: Fix configfs group list head handling
     - PCI: endpoint: Fix configfs group removal on driver teardown
     - [arm64,armhf] PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4
       in epc_features
     - [arm64,armhf] PCI: imx6: Remove apps_reset toggling from
       imx_pcie_{assert/deassert}_core_reset
     - [arm64,armhf] PCI: imx6: Delay link start until configfs 'start' written
     - vsock/virtio: Validate length in packet header before skb_put()
     - vhost/vsock: Avoid allocating arbitrarily-sized SKBs
     - amdgpu/amdgpu_discovery: increase timeout limit for IFWI init
     - [amd64] ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in
       resume context
     - f2fs: fix to avoid out-of-boundary access in dnode page (CVE-2025-38677)
     - jbd2: prevent softlockup in jbd2_log_do_checkpoint()
     - kbuild: userprogs: use correct linker when mixing clang and GNU ld
     - [arm64,armhf] soc/tegra: pmc: Ensure power-domains are in a known state
     - media: gspca: Add bounds checking to firmware parser
     - media: hi556: correct the test pattern configuration
     - [armhf] media: imx: fix a potential memory leak in
       imx_media_csc_scaler_device_init()
     - media: ipu6: isys: Use correct pads for xlate_streams()
     - media: vivid: fix wrong pixel_array control size
     - media: verisilicon: Fix AV1 decoder clock frequency
     - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
     - media: usbtv: Lock resolution while streaming
     - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
     - media: pisp_be: Fix pm_runtime underrun in probe
     - media: ov2659: Fix memory leaks in ov2659_probe()
     - media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval
     - media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable()
       calls
     - [arm64] media: qcom: camss: cleanup media device allocated resource on
       error path
     - [arm64] media: venus: Add a check for packet size after reading from
       shared memory
     - [arm64] media: venus: Fix MSM8998 frequency table
     - [arm64] media: venus: hfi: explicitly release IRQ during teardown
     - [arm64] media: venus: protect against spurious interrupts during probe
     - [arm64] media: venus: vdec: Clamp param smaller than 1fps and bigger than
       240.
     - [arm64] media: venus: venc: Clamp param smaller than 1fps and bigger than
       240
     - drm/amdgpu/discovery: fix fw based ip discovery
     - drm/amd: Restore cached power limit during resume
     - drm/amdgpu: Avoid extra evict-restore process.
     - drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities
     - drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram()
     - drm/amdgpu: Update external revid for GC v9.5.0
     - drm/amdgpu: update mmhub 3.0.1 client id mappings
     - drm/amdgpu: update mmhub 4.1.0 client id mappings
     - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
     - drm/amd/display: Add primary plane to commits for correct VRR handling
     - drm/amd/display: fix a Null pointer dereference vulnerability
     - drm/amd/display: Don't overwrite dce60_clk_mgr
     - net, hsr: reject HSR frame if skb can't hold tag
     - sched/ext: Fix invalid task state transitions on class switch
     - ipv6: sr: Fix MAC comparison to be constant-time
     - ACPI: pfr_update: Fix the driver update version check
     - mptcp: drop skb if MPTCP skb extension allocation fails
     - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit
     - mm/damon/ops-common: ignore migration request to invalid nodes
     - [amd64] x86/sev: Ensure SVSM reserved fields in a page validation entry
       are initialized to zero
     - USB: typec: Use str_enable_disable-like helpers
     - usb: typec: fusb302: cache PD RX state
     - btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb()
     - btrfs: qgroup: fix race between quota disable and quota rescan ioctl
     - btrfs: move transaction aborts to the error site in
       add_block_group_free_space()
     - btrfs: always abort transaction on failure to add block group to free
       space tree
     - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root()
     - btrfs: explicitly ref count block_group on new_bgs list
     - btrfs: codify pattern for adding block_group to bg_list
     - btrfs: zoned: requeue to unused block group list if zone finish failed
     - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags
     - btrfs: send: factor out common logic when sending xattrs
     - btrfs: send: only use boolean variables at process_recorded_refs()
     - btrfs: send: add and use helper to rename current inode when processing
       refs
     - btrfs: send: keep the current inode's path cached
     - btrfs: send: avoid path allocation for the current inode when issuing
       commands
     - btrfs: send: use fallocate for hole punching with send stream v2
     - btrfs: send: make fs_path_len() inline and constify its argument
     - netfs: Fix unbuffered write error handling
     - io_uring/net: commit partial buffers on retry
     - ata: libata-scsi: Return aborted command when missing sense and result TF
     - sched_ext: initialize built-in idle state before ops.init()
     - Revert "can: ti_hecc: fix -Woverflow compiler warning"
     - io_uring/futex: ensure io_futex_wait() cleans up properly on failure
     - iov_iter: iterate_folioq: fix handling of offset >= folio size
     - [arm64] iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement
     - mmc: sdhci-pci-gli: Add a new function to simplify the code
     - memstick: Fix deadlock by moving removing flag earlier
     - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER
     - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency
     - NFS: Fix a race when updating an existing write
     - squashfs: fix memory leak in squashfs_fill_super
     - mm/debug_vm_pgtable: clear page table entries at destroy_args()
     - mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn
     - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook
       830 G6
     - RDMA/rxe: Flush delayed SKBs while releasing RXE resources
     - [s390x] sclp: Fix SCCB present check
     - [amd64] platform/x86/intel-uncore-freq: Check write blocked for ELC
     - kvm: retry nx_huge_page_recovery_thread creation
     - [amd64] accel/habanalabs/gaudi2: Use kvfree() for memory allocated with
       kvcalloc()
     - drm/amdgpu/swm14: Update power limit logic
     - drm/amd/display: Avoid a NULL pointer dereference
     - drm/amd/display: Don't overclock DCE 6 by 15%
     - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
     - drm/amd/display: Fix Xorg desktop unresponsive on Replay panel
     - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6.
     - drm/amd/display: Find first CRTC and its line time in
       dce110_fill_display_configs
     - drm/amd/display: Fill display clock and vblank time in
       dce110_fill_display_configs
     - scsi: core: Fix command pass through retry regression
     - [arm64] soc: qcom: mdt_loader: Fix error return values in
       mdt_header_valid()
     - mptcp: remove duplicate sk_reset_timer call
     - mptcp: disable add_addr retransmission when timeout is 0
     - Mark xe driver as BROKEN if kernel page size is not 4kB
     - [arm64,armhf] PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support
     - [arm64,armhf] PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features
     - [arm64] PCI: rockchip: Use standard PCIe definitions
     - [arm64] PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining
     - iio: adc: ad7173: fix setting ODR in probe
     - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers
     - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems
     - ext4: preserve SB_I_VERSION on remount
     - btrfs: subpage: keep TOWRITE tag until folio is cleaned
     - [arm64] dts: ti: k3-am6*: Add boot phase flag to support MMC boot
     - [arm64] dts: ti: k3-am62*: Add non-removable flag for eMMC
     - [arm64] dts: ti: k3-am6*: Remove disable-wp for eMMC
     - [arm64] dts: ti: k3-am62*: Move eMMC pinmux to top level board file
     - debugfs: fix mount options not being applied
     - smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy()
     - fs/buffer: fix use-after-free when call bh_read() helper
     - use uniform permission checks for all mount propagation changes
     - cpuidle: menu: Remove iowait influence
     - cpuidle: governors: menu: Avoid selecting states with too much latency
     - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
     - [arm64] mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1
     - ftrace: Also allocate and copy hash for reading of filter files
     - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe()
     - iio: proximity: isl29501: fix buffered read on big-endian systems
     - most: core: Drop device reference after usage in get_channel()
     - kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq()
     - cdx: Fix off-by-one error in cdx_rpmsg_probe()
     - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
     - [amd64] comedi: Make insn_rw_emulate_bits() do insn->n samples
     - [amd64] comedi: pcl726: Prevent invalid irq number
     - [amd64] comedi: Fix use of uninitialized memory in do_insn_ioctl() and
       do_insnlist_ioctl()
     - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE
       test
     - usb: renesas-xhci: Fix External ROM access timeouts
     - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
     - usb: storage: realtek_cr: Use correct byte order for bcs->Residue
     - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
     - usb: typec: maxim_contaminant: disable low power mode when reading
       comparator values
     - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port
       is clean
     - usb: xhci: Fix slot_id resource race conflict
     - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
     - usb: dwc3: Remove WARN_ON for device endpoint command timeouts
     - usb: dwc3: pci: add support for the Intel Wildcat Lake
     - iio: light: Use aligned_s64 instead of open coding alignment.
     - iio: light: as73211: Ensure buffer holes are zeroed
     - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read()
     - tracing: Remove unneeded goto out logic
     - tracing: Limit access to parser->buffer when trace_get_user failed
     - [amd64] drm/i915/icl+/tc: Convert AUX powered WARN to a debug message
     - compiler: remove __ADDRESSABLE_ASM{_STR,}() again
     - [amd64] drm/i915/icl+/tc: Cache the max lane count value
     - ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp()
     - tls: fix handling of zero-length records on the rx_list
     - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to
       aligned_s64
     - iio: imu: inv_icm42600: use = { } instead of memset()
     - iio: imu: inv_icm42600: Convert to uXX and sXX integer types
     - iio: imu: inv_icm42600: change invalid data error to -EBUSY
     - [amd64] x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper
     - drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor().
     - cgroup/cpuset: Use static_branch_enable_cpuslocked() on
       cpusets_insane_config_key
     - cgroup/cpuset: Fix a partition error with CPU hotplug
     - drm/panic: Move drawing functions to drm_draw
     - drm/format-helper: Add conversion from XRGB8888 to BGR888
     - drm/format-helper: Move helpers for pixel conversion to header file
     - drm/format-helper: Add generic conversion to 32-bit formats
     - iosys-map: Fix undefined behavior in iosys_map_clear()
     - [arm64] RDMA/hns: Fix querying wrong SCC context for DIP algorithm
     - RDMA/bnxt_re: Fix to do SRQ armena by default
     - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path
     - RDMA/bnxt_re: Fix a possible memory leak in the driver
     - RDMA/bnxt_re: Fix to initialize the PBL array
     - RDMA/hns: Fix dip entries leak on devices newer than hip09
     - net: bridge: fix soft lockup in br_multicast_query_expired()
     - scsi: qla4xxx: Prevent a potential error pointer dereference
     - [amd64] iommu/amd: Avoid stack buffer overflow from kernel cmdline
       (CVE-2025-38676)
     - Bluetooth: hci_sync: Fix scan state after PA Sync has been established
     - Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown
     - Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF
     - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established
     - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync()
     - [arm64] drm/hisilicon/hibmc: refactored struct hibmc_drm_private
     - [arm64] drm/hisilicon/hibmc: fix the i2c device resource leak when vdac
       init failed
     - [arm64] drm/hisilicon/hibmc: fix the hibmc loaded failed bug
     - ALSA: usb-audio: Fix size validation in convert_chmap_v3()
     - drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session()
     - drm/amd/display: Don't print errors for nonexistent connectors
     - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
     - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
     - [arm64] net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path
     - ppp: fix race conditions in ppp_fill_forward_path
     - net: ti: icssg-prueth: Fix HSR and switch offload Enablement during
       firwmare reload.
     - cifs: Fix oops due to uninitialised variable
     - phy: mscc: Fix timestamping for vsc8584
     - net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization
     - gve: prevent ethtool ops after shutdown
     - net/smc: fix UAF on smcsk after smc_listen_out()
     - [s390x] mm: Do not map lowcore with identity mapping
     - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
     - igc: fix disabling L1.2 PCI-E link substate on I226 on init
     - [armhf] net: dsa: microchip: Fix KSZ9477 HSR port setup issue
     - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
     - net/sched: Remove unnecessary WARNING condition for empty child qdisc in
       htb_activate
     - ALSA: timer: fix ida_free call while not allocated
     - bonding: update LACP activity flag after setting lacp_active
     - bonding: send LACPDUs periodically in passive mode after receiving
       partner's LACPDU
     - [arm64] Octeontx2-af: Skip overlap check for SPI field
     - net/mlx5: Base ECVF devlink port attrs from 0
     - net/mlx5: Relocate function declarations from port.h to mlx5_core.h
     - net/mlx5: Add IFC bits and enums for buf_ownership
     - net/mlx5e: Query FW for buffer ownership
     - net/mlx5e: Preserve shared buffer capacity during headroom updates
     - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
     - [s390x] hypfs: Avoid unnecessary ioctl registration in debugfs
     - [s390x] hypfs: Enable limited access during lockdown
     - netfilter: nf_reject: don't leak dst refcount for loopback packets
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.45
     - rtla: Check pkg-config install
     - trace/fgraph: Fix the warning caused by missing unregister notifier
     - of: dynamic: Fix memleak when of_pci_add_properties() failed
     - of: dynamic: Fix use after free in of_changeset_add_prop_helper()
     - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
     - perf symbol-minimal: Fix ehdr reading in filename__read_build_id
     - vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER
     - scsi: core: sysfs: Correct sysfs attributes access rights
     - smb: client: fix race with concurrent opens in unlink(2)
     - smb: client: fix race with concurrent opens in rename(2)
     - [arm64] ASoC: codecs: tx-macro: correct tx_macro_component_drv name
     - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC
     - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list
     - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
     - [arm64] drm/msm: Defer fd_install in SUBMIT ioctl
     - of: reserved_mem: Restructure call site for dma_contiguous_early_fixup()
     - [arm64] drm/msm/kms: move snapshot init earlier in KMS init
     - [arm64] drm/msm: update the high bitfield of certain DSI registers
     - [arm64] drm/mediatek: Add error handling for old state CRTC in
       atomic_disable
     - [powerpc*] kvm: Fix ifdef to remove build warning
     - HID: input: rename hidinput_set_battery_charge_status()
     - HID: input: report battery status changes immediately
     - net: macb: fix unregister_netdev call order in macb_remove()
     - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success
     - Bluetooth: hci_event: Mark connection as closed during suspend disconnect
     - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
     - Bluetooth: hci_sync: fix set_local_name race condition
     - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
     - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr
     - drm/nouveau: remove unused memory target test
     - ice: don't leave device non-functional if Tx scheduler config fails
     - ice: use fixed adapter index for E825C embedded devices
     - ice: fix incorrect counter for buffer allocation failures
     - dt-bindings: display/msm: qcom,mdp5: drop lut clock
     - net: dlink: fix multicast stats being counted incorrectly
     - drm/xe/xe_sync: avoid race during ufence signaling
     - drm/xe: Don't trigger rebind on initial dma-buf validation
     - phy: mscc: Fix when PTP clock is register and unregister
     - bnxt_en: Fix memory corruption when FW resources change during ifdown
     - bnxt_en: Adjust TX rings if reservation is less than requested
     - bnxt_en: Fix stats context reservation logic
     - net/mlx5: Reload auxiliary drivers on fw_activate
     - net/mlx5: Fix lockdep assertion on sync reset unload event
     - net/mlx5: Nack sync reset when SFs are present
     - net/mlx5e: Update and set Xon/Xoff upon MTU set
     - net/mlx5e: Update and set Xon/Xoff upon port speed set
     - net/mlx5e: Set local Xoff after FW update
     - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
     - net: stmmac: xgmac: Correct supported speed modes
     - net: stmmac: Set CIC bit only for TX queues with COE
     - [amd64,arm64] hv_netvsc: Link queues to NAPIs
     - [amd64,arm64] net: hv_netvsc: fix loss of early receive events from host
       during channel open.
     - net: rose: split remove and free operations in rose_remove_neigh()
     - net: rose: convert 'use' field to refcount_t
     - net: rose: include node references in rose_neigh refcount
     - sctp: initialize more fields in sctp_v6_from_sk()
     - l2tp: do not use sock_hold() in pppol2tp_session_get_sock()
     - fbnic: Move phylink resume out of service_task and into open/close
     - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
     - net: macb: Disable clocks once
     - [amd64] KVM: x86: use array_index_nospec with indices that come from guest
     - [riscv64] KVM: fix stack overrun when loading vlenb
     - [amd64] x86/microcode/AMD: Handle the case of no BIOS microcode
     - [amd64] x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on
       AMD/HYGON
     - HID: asus: fix UAF via HID_CLAIMED_INPUT validation
     - HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
     - HID: quirks: add support for Legion Go dual dinput modes
     - HID: logitech: Add ids for G PRO 2 LIGHTSPEED
     - HID: wacom: Add a new Art Pen 2
     - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
     - Revert "drm/amdgpu: fix incorrect vm flags to map bo"
     - blk-zoned: Fix a lockdep complaint about recursive locking
     - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted
     - fs/smb: Fix inconsistent refcnt update
     - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
     - smb3 client: fix return code mapping of remap_file_range
     - xfs: do not propagate ENODATA disk errors into xattr code
     - drm/xe/vm: Clear the scratch_pt pointer on error
     - drm/nouveau/disp: Always accept linear modifier
     - drm/nouveau: fix error path in nvkm_gsp_fwsec_v2
     - drm/mediatek: Fix device/node reference count leaks in
       mtk_drm_get_all_drm_priv
     - drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode
     - net: rose: fix a typo in rose_clear_routes()
     - PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS
     - PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up
     - Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to
       LANE0_1_STATUS"
     - [arm64] thermal/drivers/mediatek/lvts_thermal: Change lvts commands array
       to static const
     - [arm64] thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their
       sizes to driver data
     - [arm64] thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.46
     - bpf: Add cookie object to bpf maps
     - bpf: Move bpf map owner out of common struct
     - bpf: Move cgroup iterator helpers to bpf.h
     - bpf: Fix oob access in cgroup local storage (CVE-2025-38502)
     - btrfs: fix race between logging inode and checking if it was logged before
     - btrfs: fix race between setting last_dir_index_offset and inode logging
     - btrfs: avoid load/store tearing races when checking if an inode was logged
     - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN
     - drm/amd/display: Don't warn when missing DCE encoder caps
     - cpupower: Fix a bug where the -t option of the set subcommand was not
       working.
     - Bluetooth: hci_sync: Avoid adding default advertising on startup
     - btrfs: zoned: skip ZONE FINISH of conventional zones
     - fs: writeback: fix use-after-free in __mark_inode_dirty()
     - tee: fix NULL pointer dereference in tee_shm_put
     - tee: fix memory leak in tee_dyn_shm_alloc_helper
     - [arm64] dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro
     - [arm64] tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible"
     - [arm64] dts: imx8mp-tqma8mpql: fix LDO5 power off
     - [arm64] dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics
       i.MX8M Plus DHCOM
     - [arm64] dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M
       Plus eDM SBC
     - HID: simplify snto32()
     - HID: stop exporting hid_snto32()
     - HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556)
     - net: usb: qmi_wwan: fix Telit Cinterion FN990A name
     - net: usb: qmi_wwan: fix Telit Cinterion FE990A name
     - net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition
     - [arm64] mmc: sdhci-of-arasan: Support for emmc hardware reset
     - [arm64] mmc: sdhci-of-arasan: Ensure CD logic stabilization before
       power-up
     - wifi: cfg80211: fix use-after-free in cmp_bss()
     - wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info
       work
     - wifi: mt76: mt7925: fix locking in mt7925_change_vif_links()
     - wifi: mt76: prevent non-offchannel mgmt tx during scan/roc
     - wifi: mt76: free pending offchannel tx frames on wcid cleanup
     - wifi: mt76: fix linked list corruption
     - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in()
       after confirm
     - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
     - wifi: iwlwifi: uefi: check DSM item validity
     - Bluetooth: vhci: Prevent use-after-free by removing debugfs files early
     - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
     - netfilter: nft_flowtable.sh: re-run with random mtu sizes
     - net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y
     - [amd64] xirc2ps_cs: fix register access when enabling FullDuplex
     - mISDN: Fix memory leak in dsp_hwec_enable()
     - bnxt_en: fix incorrect page count in RX aggr ring log
     - icmp: fix icmp_ndo_send address translation for reply direction
     - net: macb: Fix tx_ptr_lock locking
     - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint
     - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()
     - net: mctp: mctp_fraq_queue should take ownership of passed skb
     - ice: fix NULL access of tx->in_use in ice_ll_ts_intr
     - [amd64,arm64] idpf: set mac type when adding and removing MAC filters
     - i40e: remove read access to debugfs files
     - i40e: Fix potential invalid access when MAC list is empty
     - ixgbe: fix incorrect map used in eee linkmode
     - wifi: ath11k: fix group data packet drops during rekey
     - net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6
     - [arm64] net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
     - net: skb: add pskb_network_may_pull_reason() helper
     - net: tunnel: add pskb_inet_may_pull_reason() helper
     - net: vxlan: add skb drop reasons to vxlan_rcv()
     - net: vxlan: make vxlan_snoop() return drop reasons
     - vxlan: Fix NPD when refreshing an FDB entry with a nexthop object
     - net: vxlan: make vxlan_set_mac() return drop reasons
     - net: vxlan: use kfree_skb_reason() in vxlan_xmit()
     - net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit()
     - net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE
     - vxlan: Refresh FDB 'updated' time upon 'NTF_USE'
     - vxlan: Avoid unnecessary updates to FDB 'used' time
     - vxlan: Add RCU read-side critical sections in the Tx path
     - vxlan: Rename FDB Tx lookup function
     - vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
     - wifi: cw1200: cap SSID length in cw1200_do_join()
     - wifi: libertas: cap SSID len in lbs_associate()
     - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
     - [arm64] net: thunder_bgx: add a missing of_node_put
     - [arm64] net: thunder_bgx: decrement cleanup index before use
     - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
     - net/smc: Remove validation of reserved bits in CLC Decline message
     - mctp: return -ENOPROTOOPT for unknown getsockopt options
     - ax25: properly unshare skbs in ax25_kiss_rcv()
     - net: atm: fix memory leak in atm_register_sysfs when device_register fail
     - ppp: fix memory leak in pad_compress_skb
     - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock
     - ALSA: usb-audio: Add mute TLV for playback volumes on some devices
     - [amd64] accel/ivpu: Prevent recovery work from being queued during device
       removal
     - ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids()
     - [arm64] ftrace: fix unreachable PLT for ftrace_caller in init_module with
       CONFIG_DYNAMIC_FTRACE
     - pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
     - io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU
       (CVE-2025-38453)
     - [amd64] x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and
       arch_sync_kernel_mappings()
     - mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE
     - mm: move page table sync declarations to linux/pgtable.h
     - mm: fix possible deadlock in kmemleak
     - mm: slub: avoid wake up kswapd in set_track_prepare
     - sched: Fix sched_numa_find_nth_cpu() if mask offline
     - ocfs2: prevent release journal inode after journal shutdown
     - of_numa: fix uninitialized memory nodes causing kernel panic
     - [arm64] soc: qcom: mdt_loader: Deal with zero e_shentsize
     - wifi: mwifiex: Initialize the chan_stats array to zero
     - wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete
     - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data()
     - wifi: mt76: mt7925: fix the wrong bss cleanup for SAP
     - net: ethernet: oa_tc6: Handle failure of spi_setup
     - drm/amdgpu: drop hw access in non-DC audio fini
     - drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG
     - [amd64] platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042
       quirks list
     - scsi: lpfc: Fix buffer free/clear order in deferred receive path
     - batman-adv: fix OOB read/write in network-coding decode
     - cifs: prevent NULL pointer dereference in UTF16 conversion
     - e1000e: fix heap overflow in e1000_set_eeprom
     - net: pcs: rzn1-miic: Correct MODCTRL register offset
     - fs/fhandle.c: fix a race in call of has_locked_children() (CVE-2025-38306)
     - [arm64,armhf] net: dsa: add hook to determine whether EEE is supported
     - [arm64,armhf] net: dsa: provide implementation of .support_eee()
     - [armhf] net: dsa: b53/bcm_sf2: implement .support_eee() method
     - [armhf] net: dsa: b53: do not enable EEE on bcm63xx (CVE-2025-38272)
     - md/raid1,raid10: don't ignore IO flags (CVE-2025-22125)
     - md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT
     - md/raid1,raid10: strip REQ_NOWAIT from member bios
     - ext4: define ext4_journal_destroy wrapper
     - ext4: avoid journaling sb update on error if journal is destroying
       (CVE-2025-22113)
     - wifi: ath11k: update channel list in reg notifier instead reg worker
       (CVE-2025-23133)
     - wifi: ath11k: update channel list in worker when wait flag is set
     - net: fix NULL pointer dereference in l3mdev_l3_rcv (CVE-2025-22103)
     - md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb
       (CVE-2025-22124)
     - mm: slub: Print the broken data before restoring them
     - mm: slub: call WARN() when detecting a slab corruption
     - mm, slab: cleanup slab_bug() parameters
     - mm/slub: avoid accessing metadata when pointer is invalid in object_err()
     - nouveau: fix disabling the nonstall irq due to storm code
     - mm: fix accounting of memmap pages
     - [arm64] thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum
       threshold
     - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
     - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY
     - Revert "drm/amdgpu: Avoid extra evict-restore process."
     - pcmcia: omap: Add missing check for platform_get_resource
     - pcmcia: Add error handling for add_interval() in do_validate_mem()
     - [amd64] platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan
       quirk
     - [amd64] platform/x86/intel: power-domains: Use
       topology_logical_package_id() for package ID
     - block: add a queue_limits_commit_update_frozen helper
     - scsi: sr: Reinstate rotational media flag
     - drm/bridge: ti-sn65dsi86: fix REFCLK setting
     - perf bpf-event: Fix use-after-free in synthesis
     - perf bpf-utils: Constify bpil_array_desc
     - perf bpf-utils: Harden get_bpf_prog_info_linear
     - drm/amd/amdgpu: Fix missing error return on kzalloc failure
     - tools: gpio: remove the include directory on make clean
     - md: prevent incorrect update of resync/recovery offset
     - [riscv64] ACPI: RISC-V: Fix FFH_CPPC_CSR error handling
     - [riscv64] Only allow LTO with CMODEL_MEDANY
     - [riscv64] use lw when reading int cpu in new_vmalloc_check
     - [riscv64] use lw when reading int cpu in asm_per_cpu
     - [riscv64] bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG
     - [riscv64] bpf: use lw when reading int cpu in bpf_get_smp_processor_id
     - md/raid1: fix data lost for writemostly rdev
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.47
     - [amd64] Add mitigations for VMSCAPE (CVE-2025-40300):
       - Documentation/hw-vuln: Add VMSCAPE documentation
       - x86/vmscape: Enumerate VMSCAPE bug
       - x86/vmscape: Add conditional IBPB mitigation
       - x86/vmscape: Enable the mitigation
       - x86/bugs: Move cpu_bugs_smt_update() down
       - x86/vmscape: Warn when STIBP is disabled with SMT
       - x86/vmscape: Add old Intel CPUs to affected list
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.48
     - fhandle: use more consistent rules for decoding file handle from userns
     - dma-debug: store a phys_addr_t in struct dma_debug_entry
     - dma-mapping: trace dma_alloc/free direction
     - dma-mapping: use trace_dma_alloc for dma_alloc* instead of using
       trace_dma_map
     - dma-mapping: trace more error paths
     - dma-debug: don't enforce dma mapping check on noncoherent allocations
     - net/mlx5: HWS, change error flow on matcher disconnect
     - mm: introduce and use {pgd,p4d}_populate_kernel()
     - dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err
     - dma-debug: fix physical address calculation for struct dma_debug_entry
     - nvme-pci: skip nvme_write_sq_db on empty rqlist
     - Revert "udmabuf: fix vmap_udmabuf error page set"
     - ext4: introduce linear search for dentries
     - [amd64] drm/i915/pmu: Fix zero delta busyness issue
     - drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed
     - Revert "drm/amd/display: Optimize cursor position updates"
     - ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA
     - drm/amdgpu: Add back JPEG to video caps for carrizo and newer
     - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read
     - SUNRPC: call xs_sock_process_cmsg for all cmsg
     - NFSv4: Don't clear capabilities that won't be reset (Closes: #1114898)
     - trace/fgraph: Fix error handling
     - tracing: Fix tracing_marker may trigger page fault during preempt_disable
     - nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter
     - nfs/localio: add direct IO enablement with sync and async IO support
     - nfs/localio: restore creds before releasing pageio data
     - ftrace/samples: Fix function size computation
     - fs/nfs/io: make nfs_start_io_*() killable
     - NFS: Serialise O_DIRECT i/o and truncate()
     - NFSv4.2: Serialise O_DIRECT i/o and fallocate()
     - NFSv4.2: Serialise O_DIRECT i/o and clone range
     - NFSv4.2: Serialise O_DIRECT i/o and copy range
     - NFS: nfs_invalidate_folio() must observe the offset and size arguments
     - NFSv4/flexfiles: Fix layout merge mirror check.
     - tracing: Silence warning when chunk allocation fails in trace_pid_write
     - [s390x] pai: Deny all events not handled by this PMU
     - [s390x] cpum_cf: Deny all sampling events by counter PMU
     - bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt
     - bpf: Allow fall back to interpreter for programs with stack size <= 512
     - bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()
     - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate
       psock->cork.
     - proc: fix type confusion in pde_set_flags()
     - Revert "SUNRPC: Don't allow waiting for exiting tasks"
     - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN
     - ocfs2: fix recursive semaphore deadlock in fiemap call
     - btrfs: fix squota compressed stats leak
     - btrfs: fix subvolume deletion lockup caused by inodes xarray race
     - [amd64] i2c: i801: Hide Intel Birch Stream SoC TCO WDT
     - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM
       wakeups
     - [armhf] mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
     - [armhf] mtd: rawnand: stm32_fmc2: fix ECC overwrite
     - fuse: do not allow mapping a non-regular backing file
     - fuse: check if copy_file_range() returns larger than requested size
     - fuse: prevent overflow in copy_file_range return value
     - mm/khugepaged: fix the address passed to notifier on testing young
     - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison
       memory
     - mm/memory-failure: fix redundant updates for already poisoned pages
     - mm/damon/core: set quota->charged_from to jiffies at first charge window
     - mm/damon/lru_sort: avoid divide-by-zero in
       damon_lru_sort_apply_parameters()
     - [arm64] drm/mediatek: fix potential OF node use-after-free
     - drm/xe: Attempt to bring bos back to VRAM after eviction
     - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time
     - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages
     - netlink: specs: mptcp: add missing 'server-side' attr
     - netlink: specs: mptcp: clearly mention attributes
     - netlink: specs: mptcp: replace underscores with dashes in names
     - netlink: specs: mptcp: fix if-idx attribute type
     - kernfs: Fix UAF in polling when open file is released
     - libceph: fix invalid accesses to ceph_connection_v1_info
     - ceph: fix race condition validating r_parent before applying state
     - ceph: fix race condition where r_parent becomes stale before sending
       message
     - mm/damon/sysfs: fix use-after-free in state_show()
     - mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters()
     - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range()
     - [arm64] mtd: spinand: winbond: Fix oob_layout for W25N01JW
     - btrfs: use readahead_expand() on compressed extents
     - btrfs: fix corruption reading compressed range when block size is smaller
       than page size
     - hrtimers: Unconditionally update target CPU base after offline timer
       migration
     - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table
     - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO
       runtime PM wakeups"
     - tty: hvc_console: Call hvc_kick in hvc_write unconditionally
     - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks
     - USB: serial: option: add Telit Cinterion FN990A w/audio compositions
     - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
     - [arm64] drm/panthor: validate group queue count
     - [arm64,armhf] net: fec: Fix possible NPD in
       fec_enet_phy_reset_after_clk_enable()
     - genetlink: fix genl_bind() invoking bind() after -EPERM
     - net: bridge: Bounce invalid boolopts
     - tunnels: reset the GSO metadata before reusing the skb
     - docs: networking: can: change bcm_msg_head frames member to support
       flexible array
     - igb: fix link test skipping when interface is admin down
     - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
     - drm/amd/display: use udelay rather than fsleep
     - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when
       j1939_local_ecu_get() failed
     - can: j1939: j1939_local_ecu_get(): undo increment when
       j1939_local_ecu_get() fails
     - netfilter: nft_set_pipapo: remove unused arguments
     - netfilter: nft_set: remove one argument from lookup and update functions
     - netfilter: nft_set_pipapo: merge pipapo_get/lookup
     - netfilter: nft_set_pipapo: don't return bogus extension pointer
     - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups
     - netfilter: nft_set_rbtree: continue traversal if element is inactive
     - netfilter: nf_tables: Reintroduce shortened deletion notifications
     - netfilter: nf_tables: place base_seq in struct net
     - netfilter: nf_tables: make nft_set_do_lookup available unconditionally
     - netfilter: nf_tables: restart set lookup on base_seq change
     - net: hsr: Add VLAN CTAG filter support
     - hsr: use rtnl lock when iterating over ports
     - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr
     - [arm64] phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties
     - [amd64] dmaengine: idxd: Remove improper idxd_free
     - [amd64] dmaengine: idxd: Fix refcount underflow on module unload
     - [amd64] dmaengine: idxd: Fix double free in idxd_setup_wqs()
     - [amd64] dmaengine: ti: edma: Fix memory allocation size for
       queue_priority_map
     - xhci: fix memory leak regression when freeing xhci vdev devices depth
       first
     - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
     - [amd64,arm64] usb: typec: tcpm: properly deliver cable vdms to altmode
       drivers
     - [arm64] dmaengine: qcom: bam_dma: Fix DT error handling for
       num-channels/ees
     - [arm64] phy: tegra: xusb: fix device and OF node leak at probe
     - [armhf] phy: ti: omap-usb2: fix device leak at unbind
     - [armhf] phy: ti-pipe3: fix device leak at unbind
     - [amd64] x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon
     - net: mdiobus: release reset_gpio in mdiobus_unregister_device()
     - [amd64] drm/i915/power: fix size for for_each_set_bit() in abox iteration
     - drm/amdgpu: fix a memory leak in fence cleanup when unloading
     - netfilter: nft_set_pipapo: fix null deref for empty set
 .
   [ Santiago Ruano Rincón ]
   * d/salsa-ci.yml: Merge the extract-source job into the build's job script
   * d/salsa-ci.yml: Suppress unreleased changes and mismatching distribution
     lintian tags.
   * d/salsa-ci.yml: Early move orig tarballs back where they can be cached
 .
   [ Salvatore Bonaccorso ]
   * [rt] Add new signing key for Daniel Wagner
   * [rt] Update to 6.12.43-rt12
   * [amd64] x86/bugs: Add SRSO_USER_KERNEL_NO support
   * [amd64] x86/bugs: KVM: Add support for SRSO_MSR_FIX
   * [amd64] KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 <=> 1 VM count
     transitions

linux-signed-amd64 (6.12.57+1) trixie; urgency=medium
 .
   * Sign kernel from linux 6.12.57-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.49
     - wifi: wilc1000: avoid buffer overflow in WID string configuration
     - nvme: fix PI insert on write
     - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not
       supported
     - wifi: mac80211: increase scan_ies_len for S1G
     - wifi: mac80211: fix incorrect type for ret
     - cgroup: split cgroup_destroy_wq into 3 workqueues
     - btrfs: fix invalid extref key setup when replaying dentry
     - net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR
     - qed: Don't collect too many protection override GRC elements
     - bonding: set random address only when slaves already exist
     - mptcp: set remote_deny_join_id0 on SYN recv
     - mptcp: tfo: record 'deny join id0' info
     - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
     - ice: store max_frame and rx_buf_len only in ice_rx_ring
     - ice: fix Rx page leak on multi-buffer frames
     - i40e: remove redundant memory barrier when cleaning Tx descs
     - igc: don't fail igc_probe() on LED setup error
     - net/mlx5e: Harden uplink netdev access against device unbind
     - bonding: don't set oif to bond dev when getting NS target destination
     - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
     - tls: make sure to abort the stream if headers are bogus
     - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
     - net: liquidio: fix overflow in octeon_init_instr_queue()
     - cnic: Fix use-after-free bugs in cnic_delete_task
     - [arm64] octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
     - [amd64] perf/x86/intel: Fix crash in icl_update_topdown_event()
       (CVE-2025-38322)
     - ksmbd: smbdirect: validate data_offset and data_length field of
       smb_direct_data_transfer
     - ksmbd: smbdirect: verify remaining_data_length respects
       max_fragmented_recv_size
     - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
     - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
     - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
     - power: supply: bq27xxx: restrict no-battery detection to bq27000
     - dm-raid: don't set io_min and io_opt for raid1
     - dm-stripe: fix a possible integer overflow
     - gup: optimize longterm pin_user_pages() for large folio
     - mm: revert "mm: vmscan.c: fix OOM on swap stress test"
     - [amd64] iommu/vt-d: Fix __domain_mapping()'s usage of
       switch_to_super_page()
     - [amd64] iommu/amd/pgtbl: Fix possible race while increase page table level
     - btrfs: tree-checker: fix the incorrect inode ref size check
     - [arm64] ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S
       interface
     - [arm64] ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if
       source graph failed
     - [arm64] ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S
     - mmc: mvsdio: Fix dma_unmap_sg() nents value
     - [amd64] KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is
       active
     - drm/amd/display: Allow RX6xxx & RX7700 to invoke amdgpu_irq_get/put
     - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
     - rds: ib: Increment i_fastreg_wrs before bailing out
     - mptcp: propagate shutdown to subflows when possible
     - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx
     - io_uring/cmd: let cmds to know about dying task
     - io_uring: backport io_should_terminate_tw()
     - io_uring: include dying ring in task_work "should cancel" state
     - io_uring/msg_ring: kill alloc_cache for io_kiocb allocations
     - io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check
       (CVE-2025-39816)
     - [amd64] ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error
       message
     - [amd64] ASoC: Intel: catpt: Expose correct bit depth to userspace
     - drm/xe/tile: Release kobject for the failure path
     - drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
     - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
     - drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue()
     - smb: client: fix filename matching of deferred files
     - smb: client: let smbd_destroy() call
       disable_work_sync(&info->post_send_credits_work)
     - crypto: af_alg - Set merge to zero early in af_alg_sendmsg
     - smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
     - io_uring: fix incorrect io_kiocb reference in io_link_skb
     - [amd64] platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on
       ASUS ROG Z13
     - [amd64] platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk
     - vmxnet3: unregister xdp rxq info in the reset path (CVE-2025-22106)
     - mm: add folio_expected_ref_count() for reference count calculation
     - mm/gup: check ref_count instead of lru before migration
     - mptcp: pm: nl: announce deny-join-id0 flag
     - usb: xhci: introduce macro for ring segment list iteration
     - usb: xhci: remove option to change a default ring's TRB cycle bit
     - xhci: dbc: decouple endpoint allocation from initialization
     - xhci: dbc: Fix full DbC transfer ring after several reconnects
     - rtc: pcf2127: fix SPI command byte for PCF2131 backport
     - minmax.h: add whitespace around operators and after commas
     - minmax.h: update some comments
     - minmax.h: reduce the #define expansion of min(), max() and clamp()
     - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()
     - minmax.h: move all the clamp() definitions after the min/max() ones
     - minmax.h: simplify the variants of clamp()
     - minmax.h: remove some #defines that are only expanded once
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.50
     - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE
     - firewire: core: fix overlooked update of subsystem ABI version
     - ALSA: usb-audio: Fix code alignment in mixer_quirks
     - ALSA: usb-audio: Fix block comments in mixer_quirks
     - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
     - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
     - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
     - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
     - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
     - ALSA: usb-audio: Convert comma to semicolon
     - ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA
     - ALSA: usb-audio: Fix build with CONFIG_INPUT=n
     - usb: core: Add 0x prefix to quirks debug output
     - [arm64,armhf] net: fec: rename struct fec_devinfo fec_imx6x_info ->
       fec_imx6sx_info
     - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick
     - [riscv64] mmc: sdhci-cadence: add Mobileye eyeQ support
     - i2c: designware: Add quirk for Intel Xe
     - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
     - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk
     - ALSA: usb-audio: Add mute TLV for playback volumes on more devices
     - net: sfp: add quirk for FLYPRO copper SFP+ module
     - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
     - [amd64] HID: amd_sfh: Add sync across amd sfh work functions
     - cpufreq: Initialize cpufreq-based invariance before subsys
     - smb: server: don't use delayed_work for post_recv_credits_work
     - smb: server: use disable_work_sync in transport_rdma.c
     - bpf: Check the helper function is valid in get_helper_proto
     - btrfs: don't allow adding block device of less than 1 MB
     - wifi: virt_wifi: Fix page fault on connect
     - bpf: Reject bpf_timer for PREEMPT_RT
     - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
     - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
     - [armhf] can: sun4i_can: populate ndo_change_mtu() to prevent buffer
       overflow
     - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
     - can: peak_usb: fix shift-out-of-bounds issue
     - net: tun: Update napi->skb after XDP process
     - net/smc: fix warning in smc_rx_splice() when calling get_page()
     - [arm64] ethernet: rvu-af: Remove slash from the driver name
     - Bluetooth: hci_sync: Fix hci_resume_advertising_sync
     - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
     - vhost: Take a reference on the task in struct vhost_task.
     - bnxt_en: correct offset handling for IPv6 destination address
     - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
     - nexthop: Forbid FDB status change while nexthop is in a group
     - mm/gup: local lru_add_drain() to avoid lru_add_drain_all()
     - mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU
       batch"
     - mm: folio_may_be_lru_cached() unless folio_test_large()
     - [amd64] drm/gma500: Fix null dereference in hdmi teardown
     - futex: Prevent use-after-free during requeue-PI
     - [arm64] drm/panthor: Defer scheduler entitiy destruction to queue release
     - [amd64] platform/x86: lg-laptop: Fix WMAB call in fan_mode_store()
     - smb: client: fix wrong index reference in smb2_compound_op()
     - HID: asus: add support for missing PX series fn keys
     - i40e: add validation for ring_len param
     - i40e: fix idx validation in i40e_validate_queue_map
     - i40e: fix idx validation in config queues msg
     - i40e: fix input validation logic for action_meta
     - i40e: fix validation of VF state in get resources
     - i40e: add max boundary check for VF filters
     - i40e: add mask to apply valid bits for itr_idx
     - i40e: improve VF MAC filters accounting
     - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
     - tracing: dynevent: Add a missing lockdown check on dynevent
     - [armhf] dts: socfpga: sodia: Fix mdio bus probe and PHY address
     - drm/ast: Use msleep instead of mdelay for edid read
     - afs: Fix potential null pointer dereference in afs_put_server
     - fs/proc/task_mmu: check p->vec_buf for NULL
     - gpiolib: Extend software-node support to support secondary software-nodes
     - mm/hugetlb: fix folio is still mapped when deleted
     - fbcon: fix integer overflow in fbcon_do_set_font
     - fbcon: Fix OOB access in font allocation
     - iommufd: Fix race during abort for file descriptors
     - Revert "usb: xhci: remove option to change a default ring's TRB cycle bit"
     - [amd64] drm/i915/backlight: Return immediately when scale() finds invalid
       parameters
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.51
     - crypto: sha256 - fix crash at kexec
     - scsi: target: target_core_configfs: Add length check to avoid buffer
       overflow
     - media: b2c2: Fix use-after-free causing by irq_check_work in
       flexcop_pci_remove
     - media: tuner: xc5000: Fix use-after-free in xc5000_release
     - media: rc: fix races with imon_disconnect()
     - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID
     - mm: swap: check for stable address space before operating on the VMA
     - wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()
     - [arm64] ASoC: qcom: audioreach: fix potential null pointer dereference
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.52
     - wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()
     - USB: serial: option: add SIMCom 8230C compositions
     - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1
     - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
     - wifi: rtl8xxxu: Don't claim USB ID 07b8:8188
     - dm-integrity: limit MAX_TAG_SIZE to 255
     - [amd64] platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042
       list
     - [amd64] platform/x86/amd/pmf: Support new ACPI ID AMDI0108
     - [amd64,arm64] ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue
     - btrfs: ref-verify: handle damaged extent root tree
     - netfs: Prevent duplicate unlocking
     - can: hi311x: fix null pointer dereference when resuming from sleep before
       interface was enabled
     - [amd64] platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042
       quirks list
     - drm/amd : Update MES API header file for v11 & v12
     - drm/amd/include : MES v11 and v12 API header update
     - drm/amd/include : Update MES v12 API for fence update
     - drm/amdgpu: Enable MES lr_compute_wa by default (Closes: #1118658)
     - ALSA: usb-audio: Kill timer properly at removal (CVE-2025-38105)
     - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free
     - hid: fix I2C read buffer overflow in raw_event() for mcp2221
     - nvmem: layouts: fix automatic module loading
     - binder: fix double-free in dbitmap
     - driver core/PM: Set power.no_callbacks along with power.no_pm
     - crypto: rng - Ensure set_ent is always present
     - net/9p: fix double req put in p9_fd_cancelled
     - [amd64] KVM: x86: Don't (re)check L1 intercepts when completing userspace
       I/O
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.53
     - filelock: add FL_RECLAIM to show_fl_flags() macro
     - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
     - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast
     - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote
     - [powerpc*] 8xx: Remove left-over instruction and comments in
       DataStoreTLBMiss handler
     - [powerpc*] 603: Really copy kernel PGD entries into all PGDIRs
     - uprobes: uprobe_warn should use passed task
     - [arm64] coresight: trbe: Prevent overflow in PERF_IDX2OFF()
     - [arm64] perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
     - smb: server: fix IRD/ORD negotiation with the client
     - [amd64] EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller
     - [amd64] x86/vdso: Fix output operand size of RDPID
     - lsm: CONFIG_LSM can depend on CONFIG_SECURITY
     - btrfs: return any hit error from extent_writepage_io()
     - [arm64] pinctrl: renesas: rzg2l: Fix invalid unsigned return in
       rzg3s_oen_read()
     - [arm64] dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
     - regmap: Remove superfluous check for !config in __regmap_init()
     - bpf: Remove migrate_disable in kprobe_multi_link_prog_run
     - libbpf: Fix reuse of DEVMAP
     - [arm64] dts: imx93-kontron: Fix GPIO for panel regulator
     - [arm64] dts: imx93-kontron: Fix USB port assignment
     - [arm64] dts: imx95: Correct the lpuart7 and lpuart8 srcid
     - ACPI: processor: idle: Fix memory leak when register cpuidle device failed
     - [arm64] soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
     - [arm64] pinctrl: meson-gxl: add missing i2c_d pinmux
     - blk-mq: check kobject state_in_sysfs before deleting in
       blk_mq_unregister_hctx
     - block: use int to store blk_stack_limits() return value
     - PM: sleep: core: Clear power.must_resume in noirq suspend error path
     - vdso: Add struct __kernel_old_timeval forward declaration to gettime.h
     - [armhf] dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer
       property
     - [arm64] PM / devfreq: mtk-cci: Fix potential error pointer dereference in
       probe()
     - [arm64] power: supply: cw2015: Fix a alignment coding style issue
     - [arm64] pinctrl: renesas: Use int type to store negative error codes
     - null_blk: Fix the description of the cache_size module argument
     - nbd: restrict sockets to TCP and UDP
     - [arm64] PM / devfreq: rockchip-dfi: double count on RK3588
     - [arm64] soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure
     - [arm64] soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure
     - [arm64] arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model
     - mmc: core: Fix variable shadowing in mmc_route_rpmb_frames()
     - [arm64] dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value
     - [arm64] dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes
     - [arm64] dts: mediatek: mt8516-pumpkin: Fix machine compatible
     - [armhf] pwm: tiehrpwm: Don't drop runtime PM reference in .free()
     - [armhf] pwm: tiehrpwm: Make code comment in .free() more useful
     - [armhf] pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle
       calculation
     - [armhf] pwm: tiehrpwm: Fix corner case in clock divisor calculation
     - ACPICA: Fix largest possible resource descriptor index
     - [riscv64] bpf: Sign extend struct ops return values properly
     - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
     - i3c: master: svc: Use manual response for IBI events
     - i3c: master: svc: Recycle unused IBI slot
     - bpf: Explicitly check accesses to bpf_sock_addr
     - bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free()
     - smp: Fix up and expand the smp_call_function_many() kerneldoc
     - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host
       headers
     - spi: fix return code when spi device has too many chipselects
     - bpf: Mark kfuncs as __noclone
     - once: fix race by moving DO_ONCE to separate section
     - [arm64] thermal/drivers/qcom/lmh: Add missing IRQ includes
     - [arm64] i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
     - i2c: designware: Fix clock issue when PM is disabled
     - i2c: designware: Add disabling clocks when probe fails
     - libbpf: Fix error when st-prefix_ops and ops from differ btf
     - bpf: Enforce expected_attach_type for tailcall compatibility
     - drm/radeon/r600_cs: clean up of dead code in r600_cs
     - f2fs: fix condition in __allow_reserved_blocks()
     - [arm64] phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568
     - drm/amd/display: Remove redundant semicolons
     - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
     - scsi: myrs: Fix dma_alloc_coherent() error check
     - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count
     - RDMA/mlx5: Fix vport loopback forcing for MPV device
     - PCI/ACPI: Fix pci_acpi_preserve_config() memory leak
     - ALSA: lx_core: use int type to store negative error codes
     - inet: ping: check sock_net() in ping_get_port() and ping_lookup()
     - [arm64,armhf] coresight: Only register perf symlink for sinks with
       alloc_buffer
     - drm/amdgpu: Power up UVD 3 for FW validation (v2)
     - drm/amd/pm: Disable ULV even if unsupported (v3)
     - drm/amd/pm: Fix si_upload_smc_data (v3)
     - drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
     - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
     - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)
     - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3)
     - wifi: mwifiex: send world regulatory domain to driver
     - [arm64,armhf] PCI: tegra: Fix devm_kcalloc() argument order for port->phys
       allocation
     - tcp: fix __tcp_close() to only send RST when required
     - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
     - [armhf] usb: phy: twl6030: Fix incorrect type for ret
     - usb: gadget: configfs: Correctly set use_os_string at bind
     - tty: n_gsm: Don't block input queue by waiting MSC
     - [powerpc*] misc: genwqe: Fix incorrect cmd field being reported in error
     - pps: fix warning in pps_register_cdev when register device fail
     - wifi: iwlwifi: Remove redundant header files
     - [amd64,arm64] idpf: fix Rx descriptor ready check barrier in splitq
     - [amd64] ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
     - [amd64] ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
     - [amd64] ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
     - [arm64] drm/msm/dpu: fix incorrect type for ret
     - fs: ntfs3: Fix integer overflow in run_unpack()
     - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist
     - iio: consumers: Fix handling of negative channel scale in
       iio_convert_raw_to_processed()
     - iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
     - netfilter: ipset: Remove unused htable_bits in macro ahash_region
     - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable
     - drivers/base/node: handle error properly in register_one_node()
     - RDMA/cm: Rate limit destroy CM ID timeout error message
     - wifi: mt76: fix potential memory leak in mt76_wmac_probe()
     - wifi: mt76: mt7996: Fix RX packets configuration for primary WED device
     - wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE
     - wifi: mt76: mt7915: fix mt7981 pre-calibration
     - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()
     - f2fs: fix to truncate first page in error path of f2fs_truncate()
     - f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page()
     - ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on
       PREEMPT_RT
     - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
     - scsi: qla2xxx: edif: Fix incorrect sign of error code
     - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
     - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp()
     - HID: hidraw: tighten ioctl command parsing
     - f2fs: fix zero-sized extent for precache extents
     - Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems
       Running"
     - RDMA/core: Resolve MAC of next-hop device without ARP support
     - IB/sa: Fix sa_local_svc_timeout_ms read race
     - Documentation: trace: historgram-design: Separate sched_waking histogram
       section heading and the following diagram
     - wifi: ath12k: fix wrong logging ID used for CE
     - wifi: ath10k: avoid unnecessary wait for service ready message
     - iommu/vt-d: debugfs: Fix legacy mode page table dump logic
     - wifi: mac80211: fix Rx packet handling when pubsta information is not
       available
     - [amd64] ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback
     - RDMA/rxe: Fix race in do_task() when draining
     - wifi: rtw89: avoid circular locking dependency in ser_state_run()
     - [arm64] remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
     - dm vdo: return error on corrupted metadata in start_restoring_volume
       functions
     - [arm64] coresight-etm4x: Conditionally access register TRCEXTINSELR
     - [arm64,armhf] coresight: tmc: Support atclk
     - [arm64,armhf] coresight: catu: Support atclk
     - [arm64,armhf] coresight: etm4x: Support atclk
     - [arm64,armhf] coresight: trbe: Return NULL pointer for allocation failures
     - [arm64,armhf] coresight: tpda: fix the logic to setup the element size
     - [arm64] coresight: Fix incorrect handling for return value of devm_kzalloc
     - NFSv4.1: fix backchannel max_resp_sz verification check
     - ipvs: Defer ip_vs_ftp unregister during netns cleanup
     - netfilter: nfnetlink: reset nlh pointer during batch replay
     - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
     - usb: vhci-hcd: Prevent suspending virtually attached devices
     - iommu/vt-d: Disallow dirty tracking if incoherent page walk
     - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
     - ptp: Add a upper bound on max_vclocks
     - vhost: vringh: Fix copy_to_iter return value check
     - Bluetooth: MGMT: Fix not exposing debug UUID on
       MGMT_OP_READ_EXP_FEATURES_INFO
     - Bluetooth: ISO: Fix possible UAF on iso_conn_free
     - Bluetooth: ISO: free rx_skb if not consumed
     - Bluetooth: ISO: don't leak skb in ISO_CONT RX
     - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements
     - KEYS: X.509: Fix Basic Constraints CA flag parsing
     - ocfs2: fix double free in user_cluster_connect()
     - drivers/base/node: fix double free in register_one_node()
     - [arm64] PCI: j721e: Fix incorrect error message in probe()
     - [amd64,arm64] idpf: fix mismatched free function for dma_alloc_coherent
     - nfp: fix RSS hash key size when RSS is not supported
     - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not
       configurable
     - net: dlink: handle copy_thresh allocation failure
     - net/mlx5: Stop polling for command response if interface goes down
     - net/mlx5: pagealloc: Fix reclaim race during command interface teardown
     - net/mlx5: fw reset, add reset timeout work
     - smb: client: fix crypto buffers in non-linear memory
     - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
     - bpf: Reject negative offsets for ALU ops
     - tpm: Disable TPM2_TCG_HMAC by default
     - Squashfs: fix uninit-value in squashfs_get_parent
     - uio_hv_generic: Let userspace take care of interrupt mask
     - io_uring/waitid: always prune wait queue entry in io_waitid_wait()
     - [arm64] ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
     - [amd64,arm64] ASoC: SOF: ipc3-topology: Fix multi-core and static
       pipelines tear down
     - fs: udf: fix OOB read in lengthAllocDescs handling
     - net: nfc: nci: Add parameter validation for packet data
     - [arm64,armhf] mfd: vexpress-sysreg: Check the return value of
       devm_gpiochip_add_data()
     - dm: fix queue start/stop imbalance under suspend/load/resume races
     - dm: fix NULL pointer dereference in __dm_suspend()
     - ksmbd: Fix race condition in RPC handle list access
     - ksmbd: fix error code overwriting in smb2_get_info_filesystem()
     - ksmbd: add max ip connections parameter
     - ext4: fix checks for orphan inodes
     - [amd64] KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't
       valid
     - fbdev: simplefb: Fix use after free in simplefb_detach_genpds()
     - mm: hugetlb: avoid soft lockup when mprotect to large memory area
     - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
     - [arm64] misc: fastrpc: Save actual DMA size in fastrpc_map structure
     - [arm64] misc: fastrpc: Fix fastrpc_map_lookup operation
     - [arm64] misc: fastrpc: fix possible map leak in fastrpc_put_args
     - [arm64] misc: fastrpc: Skip reference for DMA handles
     - Input: atmel_mxt_ts - allow reset GPIO to sleep
     - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
     - sunrpc: fix null pointer dereference on zero-length checksum
     - [arm64] remoteproc: pru: Fix potential NULL pointer dereference in
       pru_rproc_set_ctable()
     - [amd64,arm64] tee: fix register_shm_helper()
     - pinctrl: check the return value of pinmux_ops::get_function_name()
     - bus: fsl-mc: Check return value of platform_get_resource()
     - net/9p: Fix buffer overflow in USB transport layer
     - net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
     - usb: typec: tipd: Clear interrupts first
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.54
     - fs: always return zero on success from replace_fd()
     - fscontext: do not consume log entries when returning -EMSGSIZE
     - [arm64] map [_text, _stext) virtual address range non-executable+read-only
     - rseq: Protect event mask against membarrier IPI
     - listmount: don't call path_put() under namespace semaphore
     - page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches
     - dma-mapping: fix direction in dma_alloc direction traces
     - [amd64] KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2
     - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
     - media: v4l2-subdev: Fix alloc failure check in
       v4l2_subdev_call_state_try()
     - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled
     - perf disasm: Avoid undefined behavior in incrementing NULL
     - perf test trace_btf_enum: Skip if permissions are insufficient
     - perf evsel: Avoid container_of on a NULL leader
     - libperf event: Ensure tracing data is multiple of 8 sized
     - [arm64] clk: qcom: common: Fix NULL vs IS_ERR() check in
       qcom_cc_icc_register()
     - [arm64] clk: renesas: cpg-mssr: Fix memory leak in
       cpg_mssr_reserved_init()
     - perf util: Fix compression checks returning -1 as bool
     - perf arm_spe: Correct setting remote access
     - perf arm-spe: Rename the common data source encoding
     - perf arm_spe: Correct memory level for remote access
     - perf vendor events arm64 AmpereOneX: Fix typo - should be
       l1d_cache_access_prefetches
     - perf session: Fix handling when buffer exceeds 2 GiB
     - perf tools: Add fallback for exclude_guest
     - perf evsel: Ensure the fallback message is always written to
     - [arm64] clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
     - [arm64] clk: mediatek: clk-mux: Do not pass flags to
       clk_mux_determine_rate_flags()
     - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (CVE-2025-40001)
     - [amd64] ASoC: SOF: Intel: hda-pcm: Place the constraint on period time
       instead of buffer time
     - [amd64] ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel
     - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
     - drm/xe/hw_engine_group: Fix double write lock release in error path
     - [s390x] cio: Update purge function to unregister the unused subchannels
     - drm/vmwgfx: Fix a null-ptr access in the cursor snooper
     - drm/vmwgfx: Fix Use-after-free in validation
     - drm/vmwgfx: Fix copy-paste typo in validation
     - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
     - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
     - [arm64] net: mscc: ocelot: Fix use-after-free caused by cyclic delayed
       work (CVE-2025-40003)
     - ice: ice_adapter: release xa entry on adapter allocation failure
     - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat()
     - [arm64] mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister()
       call
     - [arm64] mailbox: zynqmp-ipi: Remove dev.parent check in
       zynqmp_ipi_free_mboxes
     - [arm64] mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup
       loop
     - [arm64] mailbox: zynqmp-ipi: Fix SGI cleanup on unbind
     - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
     - [arm64] mailbox: mtk-cmdq-mailbox: Switch to
       __pm_runtime_put_autosuspend()
     - [arm64] mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend()
     - [arm64] mailbox: mtk-cmdq: Remove pm_runtime APIs from
       cmdq_mbox_send_data()
     - drm/amdgpu: Add additional DCE6 SCL registers
     - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
     - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
     - drm/amd/display: Properly disable scaling on DCE6
     - netfilter: nft_objref: validate objref and objrefmap expressions
     - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
     - crypto: essiv - Check ssize for decryption and in-place encryption
     - cifs: Fix copy_to_iter return value check
     - smb: client: fix missing timestamp updates after utime(2)
     - cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points
     - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
     - [arm64] gpio: wcd934x: mark the GPIO controller as sleeping
     - bpf: Avoid RCU context warning when unpinning htab with internal structs
     - [s390x] vmlinux.lds.S: Reorder sections
     - [s390x] vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections
     - ACPI: property: Fix buffer properties extraction for subnodes
     - ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
     - ACPI: debug: fix signedness issues in read/write helpers
     - [arm64] dts: qcom: msm8916: Add missing MDSS reset
     - [arm64] dts: qcom: msm8939: Add missing MDSS reset
     - [arm64] dts: qcom: sdm845: Fix slimbam num-channels/ees
     - [arm64] dts: qcom: x1e80100-pmics: Disable pm8010 by default
     - [arm64] dts: ti: k3-am62a-main: Fix main padcfg length
     - [arm64] kprobes: call set_memory_rox() for kprobe page
     - [armhf] AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on
       reset)
     - [armhf] OMAP2+: pm33xx-core: ix device node reference leaks in
       amx3_idle_init
     - [arm64] perf/arm-cmn: Fix CMN S3 DTM offset
     - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required
     - xen/events: Cleanup find_virq() return codes
     - xen/manage: Fix suspend error path
     - xen/events: Return -EEXIST for bound VIRQs
     - xen/events: Update virq_to_irq on migration
     - [arm64] firmware: meson_sm: fix device leak at probe
     - media: cx18: Add missing check after DMA map
     - media: mc: Fix MUST_CONNECT handling for pads with no links
     - media: pci: ivtv: Add missing check after DMA map
     - media: pci: mg4b: fix uninitialized iio scan data
     - [arm64] media: venus: firmware: Use correct reset sequence for IRIS2
     - media: vivid: fix disappearing <Vendor Command With ID> messages
     - media: lirc: Fix error handling in lirc_register()
     - [arm64] drm/panthor: Fix memory leak in panthor_ioctl_group_create()
     - drm/nouveau: fix bad ret code in nouveau_bo_move_prep
     - drm/xe/uapi: loosen used tracking restriction
     - drm/amd/display: Enable Dynamic DTBCLK Switch
     - blk-crypto: fix missing blktrace bio split events
     - btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
     - bus: mhi: ep: Fix chained transfer handling in read path
     - bus: mhi: host: Do not use uninitialized 'dev' pointer in
       mhi_init_irq_setup()
     - [arm64] clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP
       refclk
     - copy_sighand: Handle architectures where sizeof(unsigned long) <
       sizeof(u64)
     - [amd64] cpufreq: intel_pstate: Fix object lifecycle issue in
       update_qos_request()
     - [arm64,armhf] crypto: rockchip - Fix dma_unmap_sg() nents value
     - eventpoll: Replace rwlock with spinlock
     - fbdev: Fix logic error in "offb" name match
     - fs/ntfs3: Fix a resource leak bug in wnd_extend()
     - fs: quota: create dedicated workqueue for quota_release_work
     - fuse: fix possibly missing fuse_copy_finish() call in fuse_notify()
     - fuse: fix livelock in synchronous file put from fuseblk workers
     - iio: dac: ad5360: use int type to store negative error codes
     - iio: dac: ad5421: use int type to store negative error codes
     - iio: frequency: adf4350: Fix prescaler usage.
     - init: handle bootloader identifier in kernel parameters
     - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in
       resume
     - [amd64] iommu/vt-d: PRS isn't usable if PDS isn't supported
     - kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in
       sys_prlimit64() paths
     - KEYS: trusted_tpm1: Compare HMAC values in constant time
     - lib/genalloc: fix device leak in of_gen_pool_get()
     - loop: fix backing file reference leak on validation error
     - openat2: don't trigger automounts with RESOLVE_NO_XDEV
     - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
     - [powerpc*] powernv/pci: Fix underflow and leak issue
     - [powerpc*] pseries/msi: Fix potential underflow and leak issue
     - Revert "ipmi: fix msg stack when IPMI is disconnected"
     - sched/deadline: Fix race in push_dl_task()
     - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
     - scsi: sd: Fix build warning in sd_revalidate_disk()
     - sctp: Fix MAC comparison to be constant-time
     - xsk: Harden userspace-supplied xdp_desc validation
     - mmc: core: SPI mode remove cmd7
     - mmc: mmc_spi: multiple block read remove read crc ack
     - [armhf] memory: samsung: exynos-srom: Fix of_iomap leak in
       exynos_srom_probe
     - rtc: interface: Ensure alarm irq is enabled when UIE is enabled
     - rtc: interface: Fix long-standing race when setting alarm
     - [arm64] PCI: xilinx-nwl: Fix ECAM programming
     - [arm64,armhf] PCI: tegra: Convert struct tegra_msi mask_lock into raw
       spinlock
     - PCI/sysfs: Ensure devices are powered for config reads
     - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
     - PCI/ERR: Fix uevent on failure to recover
     - PCI/AER: Fix missing uevent on recovery when a reset is requested
     - PCI/AER: Support errors introduced by PCIe r6.0
     - [arm64] PCI: j721e: Fix programming sequence of "strap" settings
     - spi: cadence-quadspi: Flush posted register writes before INDAC access
     - spi: cadence-quadspi: Flush posted register writes before DAC access
     - spi: cadence-quadspi: Fix cqspi_setup_flash()
     - [x86] fred: Remove ENDBR64 from FRED entry points
     - [x86] umip: Check that the instruction opcode is at least two bytes
     - [x86] umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT
       aliases)
     - [s390x] dasd: enforce dma_alignment to ensure proper buffer validation
     - [s390x] dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request
     - [s390x] Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR
     - slab: prevent warnings when slab obj_exts vector allocation fails
     - slab: mark slab->obj_exts allocation failures unconditionally
     - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again
     - wifi: mt76: mt7925u: Add VID/PID for Netgear A9000
     - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500
     - mm/thp: fix MTE tag mismatch when replacing zero-filled subpages
     - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
     - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when
       max_huge_pages=0
     - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success
     - mm/damon/lru_sort: use param_ctx for damon_attrs staging
     - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
     - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
     - ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches()
     - ext4: verify orphan file size is not too big
     - ext4: increase i_disksize to offset + len in
       ext4_update_disksize_before_punch()
     - ext4: correctly handle queries for metadata mappings
     - ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
     - ext4: fix an off-by-one issue during moving extents
     - ext4: guard against EA inode refcount underflow in xattr update
     - ext4: validate ea_ino and size in check_xattrs
     - ACPICA: Allow to skip Global Lock initialization
     - ext4: free orphan info with kvfree
     - media: mc: Clear minor number before put device
     - Squashfs: add additional inode sanity checking
     - Squashfs: reject negative file sizes in squashfs_read_inode()
     - tracing: Fix race condition in kprobe initialization causing NULL pointer
       dereference
     - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork
     - [amd64] ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams
     - [amd64] ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples
     - [amd64] mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config
       max_register value
     - [amd64] mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for
       cache_type
     - [amd64] mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config
       flag
     - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
     - cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency
     - [amd64] KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace
     - statmount: don't call path_put() under namespace semaphore
     - [arm64] mte: Do not flag the zero page as PG_mte_tagged
     - [x86] mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state()
     - [x86] kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP
     - nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT
     - NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock()
     - nfsd: refine and rename NFSD_MAY_LOCK
     - nfsd: don't use sv_nrthreads in connection limiting calculations.
     - nfsd: unregister with rpcbind when deleting a transport
     - ACPI: battery: allocate driver data through devm_ APIs
     - ACPI: battery: initialize mutexes through devm_ APIs
     - ACPI: battery: Check for error code from devm_mutex_init() call
     - ACPI: battery: Add synchronization between interface updates
     - ACPI: property: Disregard references in data-only subnode lists
     - ACPI: property: Add code comments explaining what is going on
     - ACPI: property: Do not pass NULL handles to acpi_attach_data()
     - mptcp: pm: in-kernel: usable client side with C-flag
     - ipmi: Rework user message limit handling
     - ipmi: Fix handling of messages with provided receive message pointer
     - mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled
       mTHP subpage to shared zeropage
     - [s390x] bpf: Centralize frame offset calculations
     - [s390x] bpf: Describe the frame using a struct instead of constants
     - [s390x] bpf: Write back tail call counter for BPF_PSEUDO_CALL
     - [s390x] bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG
     - [riscv64] irqchip/sifive-plic: Make use of __assign_bit()
     - [riscv64] irqchip/sifive-plic: Avoid interrupt ID 0 handling during
       suspend/resume
     - copy_file_range: limit size if in compat mode
     - minixfs: Verify inode mode when loading from disk
     - pid: Add a judgment for ns null in pid_nr_ns
     - fs: Add 'initramfs_options' to set initramfs mount options
     - cramfs: Verify inode mode when loading from disk
     - writeback: Avoid softlockup when switching many inodes
     - writeback: Avoid excessively long inode switching times
     - sched/fair: Block delayed tasks on throttled hierarchy during dequeue
     - nfsd: fix __fh_verify for localio
     - nfsd: fix access checking for NLM under XPRTSEC policies
     - [amd64] ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA
     - mount: handle NULL values in mnt_ns_release()
     - nfsd: decouple the xprtsec policy check from check_nfsd_access()
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.55
     - drm/xe/guc: Check GuC running state before deregistering exec queue
     - smb: client: Fix refcount leak for cifs_sb_tlink
     - slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL
     - r8152: add error handling in rtl8152_driver_init
     - f2fs: fix wrong block mapping for multi-devices
     - jbd2: ensure that all ongoing I/O complete before freeing blocks
     - ext4: wait for ongoing I/O to complete before freeing blocks
     - ext4: detect invalid INLINE_DATA + EXTENTS flag combination
     - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already
       running
     - btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl
     - btrfs: fix incorrect readahead expansion length
     - btrfs: fix memory leaks when rejecting a non SINGLE data profile without
       an RST
     - btrfs: do not assert we found block group item when creating free space
       tree
     - can: gs_usb: gs_make_candev(): populate net_device->dev_port
     - can: gs_usb: increase max interface to U8_MAX
     - cifs: parse_dfs_referrals: prevent oob on malformed input
     - drm/sched: Fix potential double free in
       drm_sched_job_add_resv_dependencies
     - drm/amdgpu: use atomic functions with memory barriers for vm fault info
     - drm/amdgpu: fix gfx12 mes packet status return check
     - perf/core: Fix address filter match with backing files
     - perf/core: Fix MMAP event path names with backing files
     - perf/core: Fix MMAP2 event device with backing files
     - drm/amd: Check whether secure display TA loaded successfully
     - irqdomain: cdx: Switch to of_fwnode_handle()
     - [arm64] drm/msm/a6xx: Fix PDC sleep sequence
     - usb: gadget: Store endpoint pointer in usb_request
     - usb: gadget: Introduce free_usb_request helper
     - usb: gadget: f_ncm: Refactor bind path to use __free()
     - usb: gadget: f_acm: Refactor bind path to use __free()
     - usb: gadget: f_ecm: Refactor bind path to use __free()
     - usb: gadget: f_rndis: Refactor bind path to use __free()
     - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay
     - Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()"
       (Closes: #1116358)
     - HID: multitouch: fix sticky fingers
     - dax: skip read lock assertion for read-only filesystems
     - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable()
     - can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error
       Active
     - can: m_can: m_can_chip_config(): bring up interface in correct state
     - can: m_can: add deinit callback
     - can: m_can: call deinit/init callback when going into suspend/resume
     - can: m_can: fix CAN state in system PM
     - net: dlink: handle dma_map_single() failure properly
     - doc: fix seg6_flowlabel path
     - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H
     - net/ip6_tunnel: Prevent perpetual tunnel growth
     - [amd64,arm64] amd-xgbe: Avoid spurious link down messages during interface
       toggle
     - tcp: fix tcp_tso_should_defer() vs large RTT
     - ksmbd: fix recursive locking in RPC handle list access
     - tg3: prevent use of uninitialized remote_adv and local_adv variables
     - tls: trim encrypted message to match the plaintext on short splice
     - tls: wait for async encrypt in case of error during latter iterations of
       sendmsg
     - tls: always set record_type in tls_process_cmsg
     - tls: wait for pending async decryptions if tls_strp_msg_hold fails
     - tls: don't rely on tx_work during send()
     - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address
     - net: usb: lan78xx: fix use of improperly initialized dev->chipid in
       lan78xx_reset
     - [arm64] drm/panthor: Ensure MCU is disabled on suspend
     - nvme-multipath: Skip nr_active increments in RETRY disposition
     - [riscv64] kprobes: Fix probe address validation
     - [amd64] ASoC: nau8821: Cancel jdet_work before handling jack ejection
     - [amd64] ASoC: nau8821: Generalize helper to clear IRQ status
     - [amd64] ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit
     - [amd64] drm/i915/guc: Skip communication warning on reset in progress
     - drm/amdgpu: add ip offset support for cyan skillfish
     - drm/amdgpu: add support for cyan skillfish without IP discovery
     - drm/amdgpu: fix handling of harvesting for ip_discovery firmware
     - drm/amd/powerplay: Fix CIK shutdown temperature
     - [arm64] drm/rockchip: vop2: use correct destination rectangle height check
     - sched/fair: Fix pelt lost idle time detection
     - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
     - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card
     - HID: hid-input: only ignore 0 battery events for digitizers
     - HID: multitouch: fix name of Stylus input devices
     - nvme/tcp: handle tls partially sent records in write_space()
     - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
     - xfs: rename the old_crc variable in xlog_recover_process
     - xfs: fix log CRC mismatches between i386 and other architectures
     - PM: runtime: Add new devm functions
     - iio: imu: inv_icm42600: Simplify pm_runtime setup
     - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended
     - nfsd: Use correct error code when decoding extents
     - nfsd: Drop dprintk in blocklayout xdr functions
     - NFSD: Rework encoding and decoding of nfsd4_deviceid
     - NFSD: Minor cleanup in layoutcommit processing
     - NFSD: Implement large extent array support in pNFS
     - NFSD: Fix last write offset handling in layoutcommit
     - wifi: rtw89: avoid possible TX wait initialization race
     - xfs: use deferred intent items for reaping crosslinked blocks
     - padata: Reset next CPU when reorder sequence wraps around
     - md/raid0: Handle bio_split() errors
     - md/raid1: Handle bio_split() errors
     - md/raid10: Handle bio_split() errors
     - md: fix mssing blktrace bio split events
     - [amd64] x86/resctrl: Refactor resctrl_arch_rmid_read()
     - [amd64] x86/resctrl: Fix miscount of bandwidth event when reactivating
       previously unavailable RMID
     - d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier
     - vfs: Don't leak disconnected dentries on umount
     - PCI: Add PCI_VDEVICE_SUB helper macro
     - ixgbevf: Add support for Intel(R) E610 device
     - ixgbevf: fix getting link speed data for E610 devices
     - ixgbevf: fix mailbox API compatibility by negotiating supported features
     - tcp: convert to dev_net_rcu()
     - tcp: cache RTAX_QUICKACK metric in a hot cache line
     - net: dst: add four helpers to annotate data-races around dst->dev
     - ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]
     - net: Add locking to protect skb->dev access in ip_output
     - mptcp: Call dst_release() in mptcp_active_enable().
     - mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().
     - mptcp: reset blackhole on success with non-loopback ifaces
     - NFSD: Define a proc_layoutcommit for the FlexFiles layout type
     - [arm64] cputype: Add Neoverse-V3AE definitions
     - [arm64] errata: Apply workarounds for Neoverse-V3AE
     - [amd64] dmaengine: Add missing cleanup on module unload
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.56
     - exec: Fix incorrect type for ret
     - hfs: clear offset and space out of valid records in b-tree node
     - hfs: make proper initalization of struct hfs_find_data
     - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
     - hfs: validate record offset in hfsplus_bmap_alloc
     - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
     - dlm: check for defined force value in dlm_lockspace_release
     - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
     - hfsplus: return EIO when type of hidden directory mismatch in
       hfsplus_fill_super()
     - PCI: Test for bit underflow in pcie_set_readrq()
     - [arm64] sysreg: Correct sign definitions for EIESB and DoubleLock
     - drivers/perf: hisi: Relax the event ID check in the framework
     - [s390x] mm: Use __GFP_ACCOUNT for user page table allocations
     - smb: server: let smb_direct_flush_send_list() invalidate a remote key
       first
     - PM: EM: Drop unused parameter from em_adjust_new_capacity()
     - PM: EM: Slightly reduce em_check_capacity_update() overhead
     - PM: EM: Move CPU capacity check to em_adjust_new_capacity()
     - PM: EM: Fix late boot with holes in CPU topology
     - net/mlx5e: Return 1 instead of 0 in invalid case in
       mlx5e_mpwrq_umr_entry_size()
     - rtnetlink: Allow deleting FDB entries in user namespace
     - [arm64] net: enetc: fix the deadlock of enetc_mdio_lock
     - [arm64] net: enetc: correct the value of ENETC_RXB_TRUESIZE
     - [arm64] dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path
     - net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead
     - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ
     - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ
     - net/smc: fix general protection fault in __smc_diag_dump
     - [arm64] net: ethernet: ti: am65-cpts: fix timestamp loss due to race
       conditions
     - [arm64] mm: avoid always making PTE dirty in pte_mkwrite()
     - ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop
     - sctp: avoid NULL dereference when chunk data buffer is missing
     - net: phy: micrel: always set shared->phydev for LAN8814
     - net/mlx5: Fix IPsec cleanup over MPV device
     - fs/notify: call exportfs_encode_fid with s_umount
     - net: bonding: fix possible peer notify event loss or dup issue
     - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC
     - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
     - btrfs: directly free partially initialized fs_info in
       btrfs_check_leaked_roots()
     - gpio: pci-idio-16: Define maximum valid register address offset
     - gpio: 104-idio-16: Define maximum valid register address offset
     - xfs: fix locking in xchk_nlinks_collect_dir
     - Revert "cpuidle: menu: Avoid discarding useful information"
     - slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts
     - slab: Fix obj_ext mistakenly considered NULL due to race condition
     - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11
     - can: netlink: can_changelink(): allow disabling of automatic restart
     - cifs: Fix TCP_Server_Info::credits to be signed
     - ocfs2: clear extent cache after moving/defragmenting extents
     - vsock: fix lock inversion in vsock_assign_transport()
     - [arm64,armhf] net: stmmac: dwmac-rk: Fix disabling set_clock_selection
     - net: usb: rtl8150: Fix frame padding
     - mm: prevent poison consumption when splitting THP
     - drm/amd/display: increase max link count and fix link->enc NULL pointer
       access
     - [arm64] spi: spi-nxp-fspi: add extra delay after dll locked
     - [arm64] dts: broadcom: bcm2712: Add default GIC address cells
     - [arm64] dts: broadcom: bcm2712: Define VGIC interrupt
     - [arm64] firmware: arm_scmi: Account for failed debug initialization
     - [arm64] firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing
       in raw mode
     - [arm64] drm/panthor: Fix kernel panic on partial unmap of a GPU VA region
     - [riscv64] Define pgprot_dmacoherent() for non-coherent devices
     - [riscv64] Don't print details of CPUs disabled in DT
     - [riscv64] hwprobe: avoid uninitialized variable use in hwprobe_arch_id()
     - hwmon: (sht3x) Fix error handling
     - nbd: override creds to kernel when calling sock_{send,recv}msg()
     - drm/panic: Fix drawing the logo on a small narrow screen
     - drm/panic: Fix qr_code, ensure vmargin is positive
     - [amd64] gpio: ljca: Fix duplicated IRQ mapping
     - io_uring: correct __must_hold annotation in io_install_fixed_file
     - sched: Remove never used code in mm_cid_get()
     - io_uring/sqpoll: switch away from getrusage() for CPU accounting
     - io_uring/sqpoll: be smarter on when to update the stime usage
     - Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP
       (Closes: #1118660)
     - platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL
       (CVE-2025-39678)
     - USB: serial: option: add UNISOC UIS7720
     - USB: serial: option: add Quectel RG255C
     - USB: serial: option: add Telit FN920C04 ECM compositions
     - usb/core/quirks: Add Huawei ME906S to wakeup quirk
     - usb: raw-gadget: do not limit transfer length
     - xhci: dbc: enable back DbC in resume if it was enabled before suspend
     - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall
       event
     - [amd64] x86/microcode: Fix Entrysign revision check for Zen1/Naples
     - [arm*] binder: remove "invalid inc weak" check
     - [amd64] comedi: fix divide-by-zero in comedi_buf_munge() (CVE-2025-40106)
     - [amd64] mei: me: add wildcat lake P DID
     - [arm64] misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup
     - [amd64,arm64] tcpm: switch check for role_sw device with fw_node
     - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp
     - serial: 8250_dw: handle reset control deassert error
     - serial: 8250_exar: add support for Advantech 2 port card with Device ID
       0x0018
     - [arm64] serial: 8250_mtk: Enable baud clock and manage in runtime PM
     - serial: sc16is7xx: remove useless enable of enhanced features
     - devcoredump: Fix circular locking dependency with devcd->mutex.
     - [arm64] mte: Do not warn if the page is already tagged in copy_highpage()
     - xfs: always warn about deprecated mount options
     - ksmbd: transport_ipc: validate payload size before reading handle
       (CVE-2025-40084)
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.57
     - net/sched: sch_qfq: Fix null-deref in agg_dequeue (CVE-2025-40083)
     - audit: record fanotify event regardless of presence of rules
     - [amd64] perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into
       INTEL_FIXED_BITS_MASK
     - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of
       current->mm == NULL
     - perf: Have get_perf_callchain() return NULL if crosstask and user are set
     - perf: Skip user unwind if the task is a kernel thread
     - seccomp: passthrough uprobe systemcall without filtering
     - [amd64] x86/bugs: Report correct retbleed mitigation status
     - [amd64] x86/bugs: Fix reporting of LFENCE retpoline
     - [amd64,arm64] EDAC/mc_sysfs: Increase legacy channel support to 16
     - cpuset: Use new excpus for nocpu error check when enabling root partition
     - btrfs: abort transaction on specific error places when walking log tree
     - btrfs: abort transaction in the process_one_buffer() log tree walk
       callback
     - btrfs: zoned: return error from btrfs_zone_finish_endio()
     - btrfs: zoned: refine extent allocator hint selection
     - btrfs: scrub: replace max_t()/min_t() with clamp() in
       scrub_throttle_dev_io()
     - btrfs: always drop log root tree reference in btrfs_replay_log()
     - btrfs: use level argument in log tree walk callback replay_one_buffer()
     - btrfs: abort transaction if we fail to update inode in log replay dir
       fixup
     - btrfs: tree-checker: add inode extref checks
     - btrfs: use smp_mb__after_atomic() when forcing COW in
       create_pending_snapshot()
     - sched_ext: Make qmap dump operation non-destructive
     - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c
     - docs: kdoc: handle the obsolescensce of docutils.ErrorString()
     - mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR
     - f2fs: fix to avoid panic once fallocation fails for pinfile
       (CVE-2025-23130)
     - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac()
       (CVE-2025-38643)
     - bonding: return detailed error when loading native XDP fails
     - bonding: check xdp prog when set bond mode (CVE-2025-22105)
     - bits: add comments and newlines to #if, #else and #endif directives
     - bits: introduce fixed-type GENMASK_U*()
     - gpio: regmap: Allow to allocate regmap-irq device
     - gpio: regmap: add the .fixed_direction_output configuration parameter
     - gpio: idio-16: Define fixed direction of the GPIO lines
     - [amd64] iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (CVE-2025-21833)
     - wifi: ath12k: fix read pointer after free in
       ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995)
     - [amd64,arm64] udmabuf: fix a buf size overflow issue during udmabuf
       creation (CVE-2025-37803)
     - sfc: fix NULL dereferences in ef100_process_design_param()
       (CVE-2025-37860)
     - btrfs: tree-checker: fix bounds check in check_inode_extref()
 .
   [ Salvatore Bonaccorso ]
   * drivers/infiniband/hw/bnxt_re: Enable INFINIBAND_BNXT_RE as module
     (Closes: #1109977)
 .
   [ Ben Hutchings ]
   * d/salsa-ci.yml: Adjust filenames to allow source package name suffix
   * tools/hv: Make the sample hv_get_dhcp_info script more useful
   * hyperv-daemons: Install the sample network info scripts (Closes: #919350)
   * d/salsa-ci.yml: Fix cache configuration for build job
   * d/salsa-ci.yml: Move orig tarball generation to a separate job again
   * d/salsa-ci.yml: Restore lintian checking of source package
linux-signed-amd64 (6.12.48+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.48-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.44
     - serial: 8250: fix panic due to PSLVERR
     - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
     - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister()
     - PM: runtime: Take active children into account in
       pm_runtime_get_if_in_use()
     - dm: dm-crypt: Do not partially accept write BIOs with zoned targets
     - dm: Check for forbidden splitting of zone write operations
     - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
     - usb: gadget: udc: renesas_usb3: fix device leak at unbind
     - usb: musb: omap2430: fix device leak at unbind
     - [arm64,armhf] usb: dwc3: meson-g12a: fix device leaks at unbind
     - [arm64] usb: dwc3: imx8mp: fix device leak at unbind
     - bus: mhi: host: Fix endianness of BHI vector table
     - bus: mhi: host: Detect events pointing to unexpected TREs
     - vt: keyboard: Don't process Unicode characters in K_OFF mode
     - vt: defkeymap: Map keycodes above 127 to K_HOLE
     - [amd64] crypto: qat - lower priority for skcipher and aead algorithms
     - [arm64,armhf] crypto: caam - Prevent crash on suspend with iMX8QM /
       iMX8ULP
     - [amd64] crypto: qat - flush misc workqueue during device shutdown
     - Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
     - ksmbd: fix refcount leak causing resource not released
     - ksmbd: extend the connection limiting mechanism to support IPv6
     - tracing: fprobe-event: Sanitize wildcard for fprobe event name
     - ext4: check fast symlink for ea_inode correctly
     - ext4: fix fsmap end of range reporting with bigalloc
     - ext4: fix reserved gdt blocks handling in fsmap
     - ext4: use kmalloc_array() for array space allocation
     - ext4: fix hole length calculation overflow in non-extent inodes
     - btrfs: zoned: fix write time activation failure for metadata block group
     - btrfs: fix incorrect log message for nobarrier mount option
     - btrfs: restore mount option info messages during mount
     - btrfs: fix printing of mount info messages for NODATACOW/NODATASUM
     - apparmor: Fix 8-byte alignment for initial dfa blob streams
     - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints
     - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks
       constraints
     - scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host
     - [arm64] scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
     - scsi: mpi3mr: Fix race between config read submit and interrupt completion
     - ata: libata-scsi: Fix ata_to_sense_error() status handling
     - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host
       controllers
     - scsi: ufs: ufs-pci: Fix default runtime and system PM levels
     - ata: libata-scsi: Fix CDL control
     - [arm64] soc: qcom: mdt_loader: Ensure we don't read past the ELF header
     - iio: imu: bno055: fix OOB access of hw_xlate array
     - iio: adc: ad_sigma_delta: change to buffer predisable
     - wifi: brcmsmac: Remove const from tbl_ptr parameter in
       wlc_lcnphy_common_read_table()
     - wifi: ath12k: fix dest ring-buffer corruption
     - wifi: ath12k: fix source ring-buffer corruption
     - wifi: ath12k: fix dest ring-buffer corruption when ring is full
     - wifi: ath11k: fix dest ring-buffer corruption
     - wifi: ath11k: fix source ring-buffer corruption
     - wifi: ath11k: fix dest ring-buffer corruption when ring is full
     - [arm64] pwm: mediatek: Handle hardware enable and clock enable separately
     - [arm64] pwm: mediatek: Fix duty and period setting
     - mtd: spi-nor: Fix spi_nor_try_unlock_all()
     - [arm64] mtd: spinand: propagate spinand_wait() errors from
       spinand_write_page()
     - readahead: fix return value of page_cache_next_miss() when no hole is
       found
     - PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge
     - PCI: endpoint: Fix configfs group list head handling
     - PCI: endpoint: Fix configfs group removal on driver teardown
     - [arm64,armhf] PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4
       in epc_features
     - [arm64,armhf] PCI: imx6: Remove apps_reset toggling from
       imx_pcie_{assert/deassert}_core_reset
     - [arm64,armhf] PCI: imx6: Delay link start until configfs 'start' written
     - vsock/virtio: Validate length in packet header before skb_put()
     - vhost/vsock: Avoid allocating arbitrarily-sized SKBs
     - amdgpu/amdgpu_discovery: increase timeout limit for IFWI init
     - [amd64] ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in
       resume context
     - f2fs: fix to avoid out-of-boundary access in dnode page (CVE-2025-38677)
     - jbd2: prevent softlockup in jbd2_log_do_checkpoint()
     - kbuild: userprogs: use correct linker when mixing clang and GNU ld
     - [arm64,armhf] soc/tegra: pmc: Ensure power-domains are in a known state
     - media: gspca: Add bounds checking to firmware parser
     - media: hi556: correct the test pattern configuration
     - [armhf] media: imx: fix a potential memory leak in
       imx_media_csc_scaler_device_init()
     - media: ipu6: isys: Use correct pads for xlate_streams()
     - media: vivid: fix wrong pixel_array control size
     - media: verisilicon: Fix AV1 decoder clock frequency
     - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
     - media: usbtv: Lock resolution while streaming
     - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
     - media: pisp_be: Fix pm_runtime underrun in probe
     - media: ov2659: Fix memory leaks in ov2659_probe()
     - media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval
     - media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable()
       calls
     - [arm64] media: qcom: camss: cleanup media device allocated resource on
       error path
     - [arm64] media: venus: Add a check for packet size after reading from
       shared memory
     - [arm64] media: venus: Fix MSM8998 frequency table
     - [arm64] media: venus: hfi: explicitly release IRQ during teardown
     - [arm64] media: venus: protect against spurious interrupts during probe
     - [arm64] media: venus: vdec: Clamp param smaller than 1fps and bigger than
       240.
     - [arm64] media: venus: venc: Clamp param smaller than 1fps and bigger than
       240
     - drm/amdgpu/discovery: fix fw based ip discovery
     - drm/amd: Restore cached power limit during resume
     - drm/amdgpu: Avoid extra evict-restore process.
     - drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities
     - drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram()
     - drm/amdgpu: Update external revid for GC v9.5.0
     - drm/amdgpu: update mmhub 3.0.1 client id mappings
     - drm/amdgpu: update mmhub 4.1.0 client id mappings
     - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
     - drm/amd/display: Add primary plane to commits for correct VRR handling
     - drm/amd/display: fix a Null pointer dereference vulnerability
     - drm/amd/display: Don't overwrite dce60_clk_mgr
     - net, hsr: reject HSR frame if skb can't hold tag
     - sched/ext: Fix invalid task state transitions on class switch
     - ipv6: sr: Fix MAC comparison to be constant-time
     - ACPI: pfr_update: Fix the driver update version check
     - mptcp: drop skb if MPTCP skb extension allocation fails
     - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit
     - mm/damon/ops-common: ignore migration request to invalid nodes
     - [amd64] x86/sev: Ensure SVSM reserved fields in a page validation entry
       are initialized to zero
     - USB: typec: Use str_enable_disable-like helpers
     - usb: typec: fusb302: cache PD RX state
     - btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb()
     - btrfs: qgroup: fix race between quota disable and quota rescan ioctl
     - btrfs: move transaction aborts to the error site in
       add_block_group_free_space()
     - btrfs: always abort transaction on failure to add block group to free
       space tree
     - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root()
     - btrfs: explicitly ref count block_group on new_bgs list
     - btrfs: codify pattern for adding block_group to bg_list
     - btrfs: zoned: requeue to unused block group list if zone finish failed
     - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags
     - btrfs: send: factor out common logic when sending xattrs
     - btrfs: send: only use boolean variables at process_recorded_refs()
     - btrfs: send: add and use helper to rename current inode when processing
       refs
     - btrfs: send: keep the current inode's path cached
     - btrfs: send: avoid path allocation for the current inode when issuing
       commands
     - btrfs: send: use fallocate for hole punching with send stream v2
     - btrfs: send: make fs_path_len() inline and constify its argument
     - netfs: Fix unbuffered write error handling
     - io_uring/net: commit partial buffers on retry
     - ata: libata-scsi: Return aborted command when missing sense and result TF
     - sched_ext: initialize built-in idle state before ops.init()
     - Revert "can: ti_hecc: fix -Woverflow compiler warning"
     - io_uring/futex: ensure io_futex_wait() cleans up properly on failure
     - iov_iter: iterate_folioq: fix handling of offset >= folio size
     - [arm64] iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement
     - mmc: sdhci-pci-gli: Add a new function to simplify the code
     - memstick: Fix deadlock by moving removing flag earlier
     - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER
     - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency
     - NFS: Fix a race when updating an existing write
     - squashfs: fix memory leak in squashfs_fill_super
     - mm/debug_vm_pgtable: clear page table entries at destroy_args()
     - mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn
     - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook
       830 G6
     - RDMA/rxe: Flush delayed SKBs while releasing RXE resources
     - [s390x] sclp: Fix SCCB present check
     - [amd64] platform/x86/intel-uncore-freq: Check write blocked for ELC
     - kvm: retry nx_huge_page_recovery_thread creation
     - [amd64] accel/habanalabs/gaudi2: Use kvfree() for memory allocated with
       kvcalloc()
     - drm/amdgpu/swm14: Update power limit logic
     - drm/amd/display: Avoid a NULL pointer dereference
     - drm/amd/display: Don't overclock DCE 6 by 15%
     - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
     - drm/amd/display: Fix Xorg desktop unresponsive on Replay panel
     - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6.
     - drm/amd/display: Find first CRTC and its line time in
       dce110_fill_display_configs
     - drm/amd/display: Fill display clock and vblank time in
       dce110_fill_display_configs
     - scsi: core: Fix command pass through retry regression
     - [arm64] soc: qcom: mdt_loader: Fix error return values in
       mdt_header_valid()
     - mptcp: remove duplicate sk_reset_timer call
     - mptcp: disable add_addr retransmission when timeout is 0
     - Mark xe driver as BROKEN if kernel page size is not 4kB
     - [arm64,armhf] PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support
     - [arm64,armhf] PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features
     - [arm64] PCI: rockchip: Use standard PCIe definitions
     - [arm64] PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining
     - iio: adc: ad7173: fix setting ODR in probe
     - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers
     - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems
     - ext4: preserve SB_I_VERSION on remount
     - btrfs: subpage: keep TOWRITE tag until folio is cleaned
     - [arm64] dts: ti: k3-am6*: Add boot phase flag to support MMC boot
     - [arm64] dts: ti: k3-am62*: Add non-removable flag for eMMC
     - [arm64] dts: ti: k3-am6*: Remove disable-wp for eMMC
     - [arm64] dts: ti: k3-am62*: Move eMMC pinmux to top level board file
     - debugfs: fix mount options not being applied
     - smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy()
     - fs/buffer: fix use-after-free when call bh_read() helper
     - use uniform permission checks for all mount propagation changes
     - cpuidle: menu: Remove iowait influence
     - cpuidle: governors: menu: Avoid selecting states with too much latency
     - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
     - [arm64] mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1
     - ftrace: Also allocate and copy hash for reading of filter files
     - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe()
     - iio: proximity: isl29501: fix buffered read on big-endian systems
     - most: core: Drop device reference after usage in get_channel()
     - kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq()
     - cdx: Fix off-by-one error in cdx_rpmsg_probe()
     - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
     - [amd64] comedi: Make insn_rw_emulate_bits() do insn->n samples
     - [amd64] comedi: pcl726: Prevent invalid irq number
     - [amd64] comedi: Fix use of uninitialized memory in do_insn_ioctl() and
       do_insnlist_ioctl()
     - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE
       test
     - usb: renesas-xhci: Fix External ROM access timeouts
     - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
     - usb: storage: realtek_cr: Use correct byte order for bcs->Residue
     - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
     - usb: typec: maxim_contaminant: disable low power mode when reading
       comparator values
     - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port
       is clean
     - usb: xhci: Fix slot_id resource race conflict
     - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
     - usb: dwc3: Remove WARN_ON for device endpoint command timeouts
     - usb: dwc3: pci: add support for the Intel Wildcat Lake
     - iio: light: Use aligned_s64 instead of open coding alignment.
     - iio: light: as73211: Ensure buffer holes are zeroed
     - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read()
     - tracing: Remove unneeded goto out logic
     - tracing: Limit access to parser->buffer when trace_get_user failed
     - [amd64] drm/i915/icl+/tc: Convert AUX powered WARN to a debug message
     - compiler: remove __ADDRESSABLE_ASM{_STR,}() again
     - [amd64] drm/i915/icl+/tc: Cache the max lane count value
     - ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp()
     - tls: fix handling of zero-length records on the rx_list
     - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to
       aligned_s64
     - iio: imu: inv_icm42600: use = { } instead of memset()
     - iio: imu: inv_icm42600: Convert to uXX and sXX integer types
     - iio: imu: inv_icm42600: change invalid data error to -EBUSY
     - [amd64] x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper
     - drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor().
     - cgroup/cpuset: Use static_branch_enable_cpuslocked() on
       cpusets_insane_config_key
     - cgroup/cpuset: Fix a partition error with CPU hotplug
     - drm/panic: Move drawing functions to drm_draw
     - drm/format-helper: Add conversion from XRGB8888 to BGR888
     - drm/format-helper: Move helpers for pixel conversion to header file
     - drm/format-helper: Add generic conversion to 32-bit formats
     - iosys-map: Fix undefined behavior in iosys_map_clear()
     - [arm64] RDMA/hns: Fix querying wrong SCC context for DIP algorithm
     - RDMA/bnxt_re: Fix to do SRQ armena by default
     - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path
     - RDMA/bnxt_re: Fix a possible memory leak in the driver
     - RDMA/bnxt_re: Fix to initialize the PBL array
     - RDMA/hns: Fix dip entries leak on devices newer than hip09
     - net: bridge: fix soft lockup in br_multicast_query_expired()
     - scsi: qla4xxx: Prevent a potential error pointer dereference
     - [amd64] iommu/amd: Avoid stack buffer overflow from kernel cmdline
       (CVE-2025-38676)
     - Bluetooth: hci_sync: Fix scan state after PA Sync has been established
     - Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown
     - Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF
     - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established
     - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync()
     - [arm64] drm/hisilicon/hibmc: refactored struct hibmc_drm_private
     - [arm64] drm/hisilicon/hibmc: fix the i2c device resource leak when vdac
       init failed
     - [arm64] drm/hisilicon/hibmc: fix the hibmc loaded failed bug
     - ALSA: usb-audio: Fix size validation in convert_chmap_v3()
     - drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session()
     - drm/amd/display: Don't print errors for nonexistent connectors
     - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
     - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
     - [arm64] net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path
     - ppp: fix race conditions in ppp_fill_forward_path
     - net: ti: icssg-prueth: Fix HSR and switch offload Enablement during
       firwmare reload.
     - cifs: Fix oops due to uninitialised variable
     - phy: mscc: Fix timestamping for vsc8584
     - net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization
     - gve: prevent ethtool ops after shutdown
     - net/smc: fix UAF on smcsk after smc_listen_out()
     - [s390x] mm: Do not map lowcore with identity mapping
     - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
     - igc: fix disabling L1.2 PCI-E link substate on I226 on init
     - [armhf] net: dsa: microchip: Fix KSZ9477 HSR port setup issue
     - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
     - net/sched: Remove unnecessary WARNING condition for empty child qdisc in
       htb_activate
     - ALSA: timer: fix ida_free call while not allocated
     - bonding: update LACP activity flag after setting lacp_active
     - bonding: send LACPDUs periodically in passive mode after receiving
       partner's LACPDU
     - [arm64] Octeontx2-af: Skip overlap check for SPI field
     - net/mlx5: Base ECVF devlink port attrs from 0
     - net/mlx5: Relocate function declarations from port.h to mlx5_core.h
     - net/mlx5: Add IFC bits and enums for buf_ownership
     - net/mlx5e: Query FW for buffer ownership
     - net/mlx5e: Preserve shared buffer capacity during headroom updates
     - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
     - [s390x] hypfs: Avoid unnecessary ioctl registration in debugfs
     - [s390x] hypfs: Enable limited access during lockdown
     - netfilter: nf_reject: don't leak dst refcount for loopback packets
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.45
     - rtla: Check pkg-config install
     - trace/fgraph: Fix the warning caused by missing unregister notifier
     - of: dynamic: Fix memleak when of_pci_add_properties() failed
     - of: dynamic: Fix use after free in of_changeset_add_prop_helper()
     - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
     - perf symbol-minimal: Fix ehdr reading in filename__read_build_id
     - vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER
     - scsi: core: sysfs: Correct sysfs attributes access rights
     - smb: client: fix race with concurrent opens in unlink(2)
     - smb: client: fix race with concurrent opens in rename(2)
     - [arm64] ASoC: codecs: tx-macro: correct tx_macro_component_drv name
     - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC
     - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list
     - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
     - [arm64] drm/msm: Defer fd_install in SUBMIT ioctl
     - of: reserved_mem: Restructure call site for dma_contiguous_early_fixup()
     - [arm64] drm/msm/kms: move snapshot init earlier in KMS init
     - [arm64] drm/msm: update the high bitfield of certain DSI registers
     - [arm64] drm/mediatek: Add error handling for old state CRTC in
       atomic_disable
     - [powerpc*] kvm: Fix ifdef to remove build warning
     - HID: input: rename hidinput_set_battery_charge_status()
     - HID: input: report battery status changes immediately
     - net: macb: fix unregister_netdev call order in macb_remove()
     - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success
     - Bluetooth: hci_event: Mark connection as closed during suspend disconnect
     - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
     - Bluetooth: hci_sync: fix set_local_name race condition
     - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
     - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr
     - drm/nouveau: remove unused memory target test
     - ice: don't leave device non-functional if Tx scheduler config fails
     - ice: use fixed adapter index for E825C embedded devices
     - ice: fix incorrect counter for buffer allocation failures
     - dt-bindings: display/msm: qcom,mdp5: drop lut clock
     - net: dlink: fix multicast stats being counted incorrectly
     - drm/xe/xe_sync: avoid race during ufence signaling
     - drm/xe: Don't trigger rebind on initial dma-buf validation
     - phy: mscc: Fix when PTP clock is register and unregister
     - bnxt_en: Fix memory corruption when FW resources change during ifdown
     - bnxt_en: Adjust TX rings if reservation is less than requested
     - bnxt_en: Fix stats context reservation logic
     - net/mlx5: Reload auxiliary drivers on fw_activate
     - net/mlx5: Fix lockdep assertion on sync reset unload event
     - net/mlx5: Nack sync reset when SFs are present
     - net/mlx5e: Update and set Xon/Xoff upon MTU set
     - net/mlx5e: Update and set Xon/Xoff upon port speed set
     - net/mlx5e: Set local Xoff after FW update
     - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
     - net: stmmac: xgmac: Correct supported speed modes
     - net: stmmac: Set CIC bit only for TX queues with COE
     - [amd64,arm64] hv_netvsc: Link queues to NAPIs
     - [amd64,arm64] net: hv_netvsc: fix loss of early receive events from host
       during channel open.
     - net: rose: split remove and free operations in rose_remove_neigh()
     - net: rose: convert 'use' field to refcount_t
     - net: rose: include node references in rose_neigh refcount
     - sctp: initialize more fields in sctp_v6_from_sk()
     - l2tp: do not use sock_hold() in pppol2tp_session_get_sock()
     - fbnic: Move phylink resume out of service_task and into open/close
     - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
     - net: macb: Disable clocks once
     - [amd64] KVM: x86: use array_index_nospec with indices that come from guest
     - [riscv64] KVM: fix stack overrun when loading vlenb
     - [amd64] x86/microcode/AMD: Handle the case of no BIOS microcode
     - [amd64] x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on
       AMD/HYGON
     - HID: asus: fix UAF via HID_CLAIMED_INPUT validation
     - HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
     - HID: quirks: add support for Legion Go dual dinput modes
     - HID: logitech: Add ids for G PRO 2 LIGHTSPEED
     - HID: wacom: Add a new Art Pen 2
     - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
     - Revert "drm/amdgpu: fix incorrect vm flags to map bo"
     - blk-zoned: Fix a lockdep complaint about recursive locking
     - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted
     - fs/smb: Fix inconsistent refcnt update
     - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
     - smb3 client: fix return code mapping of remap_file_range
     - xfs: do not propagate ENODATA disk errors into xattr code
     - drm/xe/vm: Clear the scratch_pt pointer on error
     - drm/nouveau/disp: Always accept linear modifier
     - drm/nouveau: fix error path in nvkm_gsp_fwsec_v2
     - drm/mediatek: Fix device/node reference count leaks in
       mtk_drm_get_all_drm_priv
     - drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode
     - net: rose: fix a typo in rose_clear_routes()
     - PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS
     - PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up
     - Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to
       LANE0_1_STATUS"
     - [arm64] thermal/drivers/mediatek/lvts_thermal: Change lvts commands array
       to static const
     - [arm64] thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their
       sizes to driver data
     - [arm64] thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.46
     - bpf: Add cookie object to bpf maps
     - bpf: Move bpf map owner out of common struct
     - bpf: Move cgroup iterator helpers to bpf.h
     - bpf: Fix oob access in cgroup local storage (CVE-2025-38502)
     - btrfs: fix race between logging inode and checking if it was logged before
     - btrfs: fix race between setting last_dir_index_offset and inode logging
     - btrfs: avoid load/store tearing races when checking if an inode was logged
     - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN
     - drm/amd/display: Don't warn when missing DCE encoder caps
     - cpupower: Fix a bug where the -t option of the set subcommand was not
       working.
     - Bluetooth: hci_sync: Avoid adding default advertising on startup
     - btrfs: zoned: skip ZONE FINISH of conventional zones
     - fs: writeback: fix use-after-free in __mark_inode_dirty()
     - tee: fix NULL pointer dereference in tee_shm_put
     - tee: fix memory leak in tee_dyn_shm_alloc_helper
     - [arm64] dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro
     - [arm64] tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible"
     - [arm64] dts: imx8mp-tqma8mpql: fix LDO5 power off
     - [arm64] dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics
       i.MX8M Plus DHCOM
     - [arm64] dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M
       Plus eDM SBC
     - HID: simplify snto32()
     - HID: stop exporting hid_snto32()
     - HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556)
     - net: usb: qmi_wwan: fix Telit Cinterion FN990A name
     - net: usb: qmi_wwan: fix Telit Cinterion FE990A name
     - net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition
     - [arm64] mmc: sdhci-of-arasan: Support for emmc hardware reset
     - [arm64] mmc: sdhci-of-arasan: Ensure CD logic stabilization before
       power-up
     - wifi: cfg80211: fix use-after-free in cmp_bss()
     - wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info
       work
     - wifi: mt76: mt7925: fix locking in mt7925_change_vif_links()
     - wifi: mt76: prevent non-offchannel mgmt tx during scan/roc
     - wifi: mt76: free pending offchannel tx frames on wcid cleanup
     - wifi: mt76: fix linked list corruption
     - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in()
       after confirm
     - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
     - wifi: iwlwifi: uefi: check DSM item validity
     - Bluetooth: vhci: Prevent use-after-free by removing debugfs files early
     - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
     - netfilter: nft_flowtable.sh: re-run with random mtu sizes
     - net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y
     - [amd64] xirc2ps_cs: fix register access when enabling FullDuplex
     - mISDN: Fix memory leak in dsp_hwec_enable()
     - bnxt_en: fix incorrect page count in RX aggr ring log
     - icmp: fix icmp_ndo_send address translation for reply direction
     - net: macb: Fix tx_ptr_lock locking
     - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint
     - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()
     - net: mctp: mctp_fraq_queue should take ownership of passed skb
     - ice: fix NULL access of tx->in_use in ice_ll_ts_intr
     - [amd64,arm64] idpf: set mac type when adding and removing MAC filters
     - i40e: remove read access to debugfs files
     - i40e: Fix potential invalid access when MAC list is empty
     - ixgbe: fix incorrect map used in eee linkmode
     - wifi: ath11k: fix group data packet drops during rekey
     - net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6
     - [arm64] net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
     - net: skb: add pskb_network_may_pull_reason() helper
     - net: tunnel: add pskb_inet_may_pull_reason() helper
     - net: vxlan: add skb drop reasons to vxlan_rcv()
     - net: vxlan: make vxlan_snoop() return drop reasons
     - vxlan: Fix NPD when refreshing an FDB entry with a nexthop object
     - net: vxlan: make vxlan_set_mac() return drop reasons
     - net: vxlan: use kfree_skb_reason() in vxlan_xmit()
     - net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit()
     - net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE
     - vxlan: Refresh FDB 'updated' time upon 'NTF_USE'
     - vxlan: Avoid unnecessary updates to FDB 'used' time
     - vxlan: Add RCU read-side critical sections in the Tx path
     - vxlan: Rename FDB Tx lookup function
     - vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
     - wifi: cw1200: cap SSID length in cw1200_do_join()
     - wifi: libertas: cap SSID len in lbs_associate()
     - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
     - [arm64] net: thunder_bgx: add a missing of_node_put
     - [arm64] net: thunder_bgx: decrement cleanup index before use
     - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
     - net/smc: Remove validation of reserved bits in CLC Decline message
     - mctp: return -ENOPROTOOPT for unknown getsockopt options
     - ax25: properly unshare skbs in ax25_kiss_rcv()
     - net: atm: fix memory leak in atm_register_sysfs when device_register fail
     - ppp: fix memory leak in pad_compress_skb
     - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock
     - ALSA: usb-audio: Add mute TLV for playback volumes on some devices
     - [amd64] accel/ivpu: Prevent recovery work from being queued during device
       removal
     - ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids()
     - [arm64] ftrace: fix unreachable PLT for ftrace_caller in init_module with
       CONFIG_DYNAMIC_FTRACE
     - pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
     - io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU
       (CVE-2025-38453)
     - [amd64] x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and
       arch_sync_kernel_mappings()
     - mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE
     - mm: move page table sync declarations to linux/pgtable.h
     - mm: fix possible deadlock in kmemleak
     - mm: slub: avoid wake up kswapd in set_track_prepare
     - sched: Fix sched_numa_find_nth_cpu() if mask offline
     - ocfs2: prevent release journal inode after journal shutdown
     - of_numa: fix uninitialized memory nodes causing kernel panic
     - [arm64] soc: qcom: mdt_loader: Deal with zero e_shentsize
     - wifi: mwifiex: Initialize the chan_stats array to zero
     - wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete
     - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data()
     - wifi: mt76: mt7925: fix the wrong bss cleanup for SAP
     - net: ethernet: oa_tc6: Handle failure of spi_setup
     - drm/amdgpu: drop hw access in non-DC audio fini
     - drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG
     - [amd64] platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042
       quirks list
     - scsi: lpfc: Fix buffer free/clear order in deferred receive path
     - batman-adv: fix OOB read/write in network-coding decode
     - cifs: prevent NULL pointer dereference in UTF16 conversion
     - e1000e: fix heap overflow in e1000_set_eeprom
     - net: pcs: rzn1-miic: Correct MODCTRL register offset
     - fs/fhandle.c: fix a race in call of has_locked_children() (CVE-2025-38306)
     - [arm64,armhf] net: dsa: add hook to determine whether EEE is supported
     - [arm64,armhf] net: dsa: provide implementation of .support_eee()
     - [armhf] net: dsa: b53/bcm_sf2: implement .support_eee() method
     - [armhf] net: dsa: b53: do not enable EEE on bcm63xx (CVE-2025-38272)
     - md/raid1,raid10: don't ignore IO flags (CVE-2025-22125)
     - md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT
     - md/raid1,raid10: strip REQ_NOWAIT from member bios
     - ext4: define ext4_journal_destroy wrapper
     - ext4: avoid journaling sb update on error if journal is destroying
       (CVE-2025-22113)
     - wifi: ath11k: update channel list in reg notifier instead reg worker
       (CVE-2025-23133)
     - wifi: ath11k: update channel list in worker when wait flag is set
     - net: fix NULL pointer dereference in l3mdev_l3_rcv (CVE-2025-22103)
     - md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb
       (CVE-2025-22124)
     - mm: slub: Print the broken data before restoring them
     - mm: slub: call WARN() when detecting a slab corruption
     - mm, slab: cleanup slab_bug() parameters
     - mm/slub: avoid accessing metadata when pointer is invalid in object_err()
     - nouveau: fix disabling the nonstall irq due to storm code
     - mm: fix accounting of memmap pages
     - [arm64] thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum
       threshold
     - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
     - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY
     - Revert "drm/amdgpu: Avoid extra evict-restore process."
     - pcmcia: omap: Add missing check for platform_get_resource
     - pcmcia: Add error handling for add_interval() in do_validate_mem()
     - [amd64] platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan
       quirk
     - [amd64] platform/x86/intel: power-domains: Use
       topology_logical_package_id() for package ID
     - block: add a queue_limits_commit_update_frozen helper
     - scsi: sr: Reinstate rotational media flag
     - drm/bridge: ti-sn65dsi86: fix REFCLK setting
     - perf bpf-event: Fix use-after-free in synthesis
     - perf bpf-utils: Constify bpil_array_desc
     - perf bpf-utils: Harden get_bpf_prog_info_linear
     - drm/amd/amdgpu: Fix missing error return on kzalloc failure
     - tools: gpio: remove the include directory on make clean
     - md: prevent incorrect update of resync/recovery offset
     - [riscv64] ACPI: RISC-V: Fix FFH_CPPC_CSR error handling
     - [riscv64] Only allow LTO with CMODEL_MEDANY
     - [riscv64] use lw when reading int cpu in new_vmalloc_check
     - [riscv64] use lw when reading int cpu in asm_per_cpu
     - [riscv64] bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG
     - [riscv64] bpf: use lw when reading int cpu in bpf_get_smp_processor_id
     - md/raid1: fix data lost for writemostly rdev
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.47
     - [amd64] Add mitigations for VMSCAPE (CVE-2025-40300):
       - Documentation/hw-vuln: Add VMSCAPE documentation
       - x86/vmscape: Enumerate VMSCAPE bug
       - x86/vmscape: Add conditional IBPB mitigation
       - x86/vmscape: Enable the mitigation
       - x86/bugs: Move cpu_bugs_smt_update() down
       - x86/vmscape: Warn when STIBP is disabled with SMT
       - x86/vmscape: Add old Intel CPUs to affected list
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.48
     - fhandle: use more consistent rules for decoding file handle from userns
     - dma-debug: store a phys_addr_t in struct dma_debug_entry
     - dma-mapping: trace dma_alloc/free direction
     - dma-mapping: use trace_dma_alloc for dma_alloc* instead of using
       trace_dma_map
     - dma-mapping: trace more error paths
     - dma-debug: don't enforce dma mapping check on noncoherent allocations
     - net/mlx5: HWS, change error flow on matcher disconnect
     - mm: introduce and use {pgd,p4d}_populate_kernel()
     - dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err
     - dma-debug: fix physical address calculation for struct dma_debug_entry
     - nvme-pci: skip nvme_write_sq_db on empty rqlist
     - Revert "udmabuf: fix vmap_udmabuf error page set"
     - ext4: introduce linear search for dentries
     - [amd64] drm/i915/pmu: Fix zero delta busyness issue
     - drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed
     - Revert "drm/amd/display: Optimize cursor position updates"
     - ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA
     - drm/amdgpu: Add back JPEG to video caps for carrizo and newer
     - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read
     - SUNRPC: call xs_sock_process_cmsg for all cmsg
     - NFSv4: Don't clear capabilities that won't be reset (Closes: #1114898)
     - trace/fgraph: Fix error handling
     - tracing: Fix tracing_marker may trigger page fault during preempt_disable
     - nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter
     - nfs/localio: add direct IO enablement with sync and async IO support
     - nfs/localio: restore creds before releasing pageio data
     - ftrace/samples: Fix function size computation
     - fs/nfs/io: make nfs_start_io_*() killable
     - NFS: Serialise O_DIRECT i/o and truncate()
     - NFSv4.2: Serialise O_DIRECT i/o and fallocate()
     - NFSv4.2: Serialise O_DIRECT i/o and clone range
     - NFSv4.2: Serialise O_DIRECT i/o and copy range
     - NFS: nfs_invalidate_folio() must observe the offset and size arguments
     - NFSv4/flexfiles: Fix layout merge mirror check.
     - tracing: Silence warning when chunk allocation fails in trace_pid_write
     - [s390x] pai: Deny all events not handled by this PMU
     - [s390x] cpum_cf: Deny all sampling events by counter PMU
     - bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt
     - bpf: Allow fall back to interpreter for programs with stack size <= 512
     - bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()
     - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate
       psock->cork.
     - proc: fix type confusion in pde_set_flags()
     - Revert "SUNRPC: Don't allow waiting for exiting tasks"
     - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN
     - ocfs2: fix recursive semaphore deadlock in fiemap call
     - btrfs: fix squota compressed stats leak
     - btrfs: fix subvolume deletion lockup caused by inodes xarray race
     - [amd64] i2c: i801: Hide Intel Birch Stream SoC TCO WDT
     - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM
       wakeups
     - [armhf] mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
     - [armhf] mtd: rawnand: stm32_fmc2: fix ECC overwrite
     - fuse: do not allow mapping a non-regular backing file
     - fuse: check if copy_file_range() returns larger than requested size
     - fuse: prevent overflow in copy_file_range return value
     - mm/khugepaged: fix the address passed to notifier on testing young
     - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison
       memory
     - mm/memory-failure: fix redundant updates for already poisoned pages
     - mm/damon/core: set quota->charged_from to jiffies at first charge window
     - mm/damon/lru_sort: avoid divide-by-zero in
       damon_lru_sort_apply_parameters()
     - [arm64] drm/mediatek: fix potential OF node use-after-free
     - drm/xe: Attempt to bring bos back to VRAM after eviction
     - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time
     - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages
     - netlink: specs: mptcp: add missing 'server-side' attr
     - netlink: specs: mptcp: clearly mention attributes
     - netlink: specs: mptcp: replace underscores with dashes in names
     - netlink: specs: mptcp: fix if-idx attribute type
     - kernfs: Fix UAF in polling when open file is released
     - libceph: fix invalid accesses to ceph_connection_v1_info
     - ceph: fix race condition validating r_parent before applying state
     - ceph: fix race condition where r_parent becomes stale before sending
       message
     - mm/damon/sysfs: fix use-after-free in state_show()
     - mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters()
     - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range()
     - [arm64] mtd: spinand: winbond: Fix oob_layout for W25N01JW
     - btrfs: use readahead_expand() on compressed extents
     - btrfs: fix corruption reading compressed range when block size is smaller
       than page size
     - hrtimers: Unconditionally update target CPU base after offline timer
       migration
     - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table
     - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO
       runtime PM wakeups"
     - tty: hvc_console: Call hvc_kick in hvc_write unconditionally
     - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks
     - USB: serial: option: add Telit Cinterion FN990A w/audio compositions
     - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
     - [arm64] drm/panthor: validate group queue count
     - [arm64,armhf] net: fec: Fix possible NPD in
       fec_enet_phy_reset_after_clk_enable()
     - genetlink: fix genl_bind() invoking bind() after -EPERM
     - net: bridge: Bounce invalid boolopts
     - tunnels: reset the GSO metadata before reusing the skb
     - docs: networking: can: change bcm_msg_head frames member to support
       flexible array
     - igb: fix link test skipping when interface is admin down
     - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
     - drm/amd/display: use udelay rather than fsleep
     - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when
       j1939_local_ecu_get() failed
     - can: j1939: j1939_local_ecu_get(): undo increment when
       j1939_local_ecu_get() fails
     - netfilter: nft_set_pipapo: remove unused arguments
     - netfilter: nft_set: remove one argument from lookup and update functions
     - netfilter: nft_set_pipapo: merge pipapo_get/lookup
     - netfilter: nft_set_pipapo: don't return bogus extension pointer
     - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups
     - netfilter: nft_set_rbtree: continue traversal if element is inactive
     - netfilter: nf_tables: Reintroduce shortened deletion notifications
     - netfilter: nf_tables: place base_seq in struct net
     - netfilter: nf_tables: make nft_set_do_lookup available unconditionally
     - netfilter: nf_tables: restart set lookup on base_seq change
     - net: hsr: Add VLAN CTAG filter support
     - hsr: use rtnl lock when iterating over ports
     - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr
     - [arm64] phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties
     - [amd64] dmaengine: idxd: Remove improper idxd_free
     - [amd64] dmaengine: idxd: Fix refcount underflow on module unload
     - [amd64] dmaengine: idxd: Fix double free in idxd_setup_wqs()
     - [amd64] dmaengine: ti: edma: Fix memory allocation size for
       queue_priority_map
     - xhci: fix memory leak regression when freeing xhci vdev devices depth
       first
     - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
     - [amd64,arm64] usb: typec: tcpm: properly deliver cable vdms to altmode
       drivers
     - [arm64] dmaengine: qcom: bam_dma: Fix DT error handling for
       num-channels/ees
     - [arm64] phy: tegra: xusb: fix device and OF node leak at probe
     - [armhf] phy: ti: omap-usb2: fix device leak at unbind
     - [armhf] phy: ti-pipe3: fix device leak at unbind
     - [amd64] x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon
     - net: mdiobus: release reset_gpio in mdiobus_unregister_device()
     - [amd64] drm/i915/power: fix size for for_each_set_bit() in abox iteration
     - drm/amdgpu: fix a memory leak in fence cleanup when unloading
     - netfilter: nft_set_pipapo: fix null deref for empty set
 .
   [ Santiago Ruano Rincón ]
   * d/salsa-ci.yml: Merge the extract-source job into the build's job script
   * d/salsa-ci.yml: Suppress unreleased changes and mismatching distribution
     lintian tags.
   * d/salsa-ci.yml: Early move orig tarballs back where they can be cached
 .
   [ Salvatore Bonaccorso ]
   * [rt] Add new signing key for Daniel Wagner
   * [rt] Update to 6.12.43-rt12
   * [amd64] x86/bugs: Add SRSO_USER_KERNEL_NO support
   * [amd64] x86/bugs: KVM: Add support for SRSO_MSR_FIX
   * [amd64] KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 <=> 1 VM count
     transitions

linux-signed-arm64 (6.12.57+1) trixie; urgency=medium
 .
   * Sign kernel from linux 6.12.57-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.49
     - wifi: wilc1000: avoid buffer overflow in WID string configuration
     - nvme: fix PI insert on write
     - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not
       supported
     - wifi: mac80211: increase scan_ies_len for S1G
     - wifi: mac80211: fix incorrect type for ret
     - cgroup: split cgroup_destroy_wq into 3 workqueues
     - btrfs: fix invalid extref key setup when replaying dentry
     - net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR
     - qed: Don't collect too many protection override GRC elements
     - bonding: set random address only when slaves already exist
     - mptcp: set remote_deny_join_id0 on SYN recv
     - mptcp: tfo: record 'deny join id0' info
     - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
     - ice: store max_frame and rx_buf_len only in ice_rx_ring
     - ice: fix Rx page leak on multi-buffer frames
     - i40e: remove redundant memory barrier when cleaning Tx descs
     - igc: don't fail igc_probe() on LED setup error
     - net/mlx5e: Harden uplink netdev access against device unbind
     - bonding: don't set oif to bond dev when getting NS target destination
     - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
     - tls: make sure to abort the stream if headers are bogus
     - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
     - net: liquidio: fix overflow in octeon_init_instr_queue()
     - cnic: Fix use-after-free bugs in cnic_delete_task
     - [arm64] octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
     - [amd64] perf/x86/intel: Fix crash in icl_update_topdown_event()
       (CVE-2025-38322)
     - ksmbd: smbdirect: validate data_offset and data_length field of
       smb_direct_data_transfer
     - ksmbd: smbdirect: verify remaining_data_length respects
       max_fragmented_recv_size
     - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
     - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
     - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
     - power: supply: bq27xxx: restrict no-battery detection to bq27000
     - dm-raid: don't set io_min and io_opt for raid1
     - dm-stripe: fix a possible integer overflow
     - gup: optimize longterm pin_user_pages() for large folio
     - mm: revert "mm: vmscan.c: fix OOM on swap stress test"
     - [amd64] iommu/vt-d: Fix __domain_mapping()'s usage of
       switch_to_super_page()
     - [amd64] iommu/amd/pgtbl: Fix possible race while increase page table level
     - btrfs: tree-checker: fix the incorrect inode ref size check
     - [arm64] ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S
       interface
     - [arm64] ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if
       source graph failed
     - [arm64] ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S
     - mmc: mvsdio: Fix dma_unmap_sg() nents value
     - [amd64] KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is
       active
     - drm/amd/display: Allow RX6xxx & RX7700 to invoke amdgpu_irq_get/put
     - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
     - rds: ib: Increment i_fastreg_wrs before bailing out
     - mptcp: propagate shutdown to subflows when possible
     - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx
     - io_uring/cmd: let cmds to know about dying task
     - io_uring: backport io_should_terminate_tw()
     - io_uring: include dying ring in task_work "should cancel" state
     - io_uring/msg_ring: kill alloc_cache for io_kiocb allocations
     - io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check
       (CVE-2025-39816)
     - [amd64] ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error
       message
     - [amd64] ASoC: Intel: catpt: Expose correct bit depth to userspace
     - drm/xe/tile: Release kobject for the failure path
     - drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
     - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
     - drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue()
     - smb: client: fix filename matching of deferred files
     - smb: client: let smbd_destroy() call
       disable_work_sync(&info->post_send_credits_work)
     - crypto: af_alg - Set merge to zero early in af_alg_sendmsg
     - smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
     - io_uring: fix incorrect io_kiocb reference in io_link_skb
     - [amd64] platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on
       ASUS ROG Z13
     - [amd64] platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk
     - vmxnet3: unregister xdp rxq info in the reset path (CVE-2025-22106)
     - mm: add folio_expected_ref_count() for reference count calculation
     - mm/gup: check ref_count instead of lru before migration
     - mptcp: pm: nl: announce deny-join-id0 flag
     - usb: xhci: introduce macro for ring segment list iteration
     - usb: xhci: remove option to change a default ring's TRB cycle bit
     - xhci: dbc: decouple endpoint allocation from initialization
     - xhci: dbc: Fix full DbC transfer ring after several reconnects
     - rtc: pcf2127: fix SPI command byte for PCF2131 backport
     - minmax.h: add whitespace around operators and after commas
     - minmax.h: update some comments
     - minmax.h: reduce the #define expansion of min(), max() and clamp()
     - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()
     - minmax.h: move all the clamp() definitions after the min/max() ones
     - minmax.h: simplify the variants of clamp()
     - minmax.h: remove some #defines that are only expanded once
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.50
     - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE
     - firewire: core: fix overlooked update of subsystem ABI version
     - ALSA: usb-audio: Fix code alignment in mixer_quirks
     - ALSA: usb-audio: Fix block comments in mixer_quirks
     - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
     - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
     - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
     - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
     - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
     - ALSA: usb-audio: Convert comma to semicolon
     - ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA
     - ALSA: usb-audio: Fix build with CONFIG_INPUT=n
     - usb: core: Add 0x prefix to quirks debug output
     - [arm64,armhf] net: fec: rename struct fec_devinfo fec_imx6x_info ->
       fec_imx6sx_info
     - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick
     - [riscv64] mmc: sdhci-cadence: add Mobileye eyeQ support
     - i2c: designware: Add quirk for Intel Xe
     - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
     - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk
     - ALSA: usb-audio: Add mute TLV for playback volumes on more devices
     - net: sfp: add quirk for FLYPRO copper SFP+ module
     - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
     - [amd64] HID: amd_sfh: Add sync across amd sfh work functions
     - cpufreq: Initialize cpufreq-based invariance before subsys
     - smb: server: don't use delayed_work for post_recv_credits_work
     - smb: server: use disable_work_sync in transport_rdma.c
     - bpf: Check the helper function is valid in get_helper_proto
     - btrfs: don't allow adding block device of less than 1 MB
     - wifi: virt_wifi: Fix page fault on connect
     - bpf: Reject bpf_timer for PREEMPT_RT
     - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
     - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
     - [armhf] can: sun4i_can: populate ndo_change_mtu() to prevent buffer
       overflow
     - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
     - can: peak_usb: fix shift-out-of-bounds issue
     - net: tun: Update napi->skb after XDP process
     - net/smc: fix warning in smc_rx_splice() when calling get_page()
     - [arm64] ethernet: rvu-af: Remove slash from the driver name
     - Bluetooth: hci_sync: Fix hci_resume_advertising_sync
     - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
     - vhost: Take a reference on the task in struct vhost_task.
     - bnxt_en: correct offset handling for IPv6 destination address
     - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
     - nexthop: Forbid FDB status change while nexthop is in a group
     - mm/gup: local lru_add_drain() to avoid lru_add_drain_all()
     - mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU
       batch"
     - mm: folio_may_be_lru_cached() unless folio_test_large()
     - [amd64] drm/gma500: Fix null dereference in hdmi teardown
     - futex: Prevent use-after-free during requeue-PI
     - [arm64] drm/panthor: Defer scheduler entitiy destruction to queue release
     - [amd64] platform/x86: lg-laptop: Fix WMAB call in fan_mode_store()
     - smb: client: fix wrong index reference in smb2_compound_op()
     - HID: asus: add support for missing PX series fn keys
     - i40e: add validation for ring_len param
     - i40e: fix idx validation in i40e_validate_queue_map
     - i40e: fix idx validation in config queues msg
     - i40e: fix input validation logic for action_meta
     - i40e: fix validation of VF state in get resources
     - i40e: add max boundary check for VF filters
     - i40e: add mask to apply valid bits for itr_idx
     - i40e: improve VF MAC filters accounting
     - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
     - tracing: dynevent: Add a missing lockdown check on dynevent
     - [armhf] dts: socfpga: sodia: Fix mdio bus probe and PHY address
     - drm/ast: Use msleep instead of mdelay for edid read
     - afs: Fix potential null pointer dereference in afs_put_server
     - fs/proc/task_mmu: check p->vec_buf for NULL
     - gpiolib: Extend software-node support to support secondary software-nodes
     - mm/hugetlb: fix folio is still mapped when deleted
     - fbcon: fix integer overflow in fbcon_do_set_font
     - fbcon: Fix OOB access in font allocation
     - iommufd: Fix race during abort for file descriptors
     - Revert "usb: xhci: remove option to change a default ring's TRB cycle bit"
     - [amd64] drm/i915/backlight: Return immediately when scale() finds invalid
       parameters
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.51
     - crypto: sha256 - fix crash at kexec
     - scsi: target: target_core_configfs: Add length check to avoid buffer
       overflow
     - media: b2c2: Fix use-after-free causing by irq_check_work in
       flexcop_pci_remove
     - media: tuner: xc5000: Fix use-after-free in xc5000_release
     - media: rc: fix races with imon_disconnect()
     - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID
     - mm: swap: check for stable address space before operating on the VMA
     - wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()
     - [arm64] ASoC: qcom: audioreach: fix potential null pointer dereference
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.52
     - wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()
     - USB: serial: option: add SIMCom 8230C compositions
     - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1
     - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
     - wifi: rtl8xxxu: Don't claim USB ID 07b8:8188
     - dm-integrity: limit MAX_TAG_SIZE to 255
     - [amd64] platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042
       list
     - [amd64] platform/x86/amd/pmf: Support new ACPI ID AMDI0108
     - [amd64,arm64] ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue
     - btrfs: ref-verify: handle damaged extent root tree
     - netfs: Prevent duplicate unlocking
     - can: hi311x: fix null pointer dereference when resuming from sleep before
       interface was enabled
     - [amd64] platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042
       quirks list
     - drm/amd : Update MES API header file for v11 & v12
     - drm/amd/include : MES v11 and v12 API header update
     - drm/amd/include : Update MES v12 API for fence update
     - drm/amdgpu: Enable MES lr_compute_wa by default (Closes: #1118658)
     - ALSA: usb-audio: Kill timer properly at removal (CVE-2025-38105)
     - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free
     - hid: fix I2C read buffer overflow in raw_event() for mcp2221
     - nvmem: layouts: fix automatic module loading
     - binder: fix double-free in dbitmap
     - driver core/PM: Set power.no_callbacks along with power.no_pm
     - crypto: rng - Ensure set_ent is always present
     - net/9p: fix double req put in p9_fd_cancelled
     - [amd64] KVM: x86: Don't (re)check L1 intercepts when completing userspace
       I/O
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.53
     - filelock: add FL_RECLAIM to show_fl_flags() macro
     - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
     - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast
     - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote
     - [powerpc*] 8xx: Remove left-over instruction and comments in
       DataStoreTLBMiss handler
     - [powerpc*] 603: Really copy kernel PGD entries into all PGDIRs
     - uprobes: uprobe_warn should use passed task
     - [arm64] coresight: trbe: Prevent overflow in PERF_IDX2OFF()
     - [arm64] perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
     - smb: server: fix IRD/ORD negotiation with the client
     - [amd64] EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller
     - [amd64] x86/vdso: Fix output operand size of RDPID
     - lsm: CONFIG_LSM can depend on CONFIG_SECURITY
     - btrfs: return any hit error from extent_writepage_io()
     - [arm64] pinctrl: renesas: rzg2l: Fix invalid unsigned return in
       rzg3s_oen_read()
     - [arm64] dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
     - regmap: Remove superfluous check for !config in __regmap_init()
     - bpf: Remove migrate_disable in kprobe_multi_link_prog_run
     - libbpf: Fix reuse of DEVMAP
     - [arm64] dts: imx93-kontron: Fix GPIO for panel regulator
     - [arm64] dts: imx93-kontron: Fix USB port assignment
     - [arm64] dts: imx95: Correct the lpuart7 and lpuart8 srcid
     - ACPI: processor: idle: Fix memory leak when register cpuidle device failed
     - [arm64] soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
     - [arm64] pinctrl: meson-gxl: add missing i2c_d pinmux
     - blk-mq: check kobject state_in_sysfs before deleting in
       blk_mq_unregister_hctx
     - block: use int to store blk_stack_limits() return value
     - PM: sleep: core: Clear power.must_resume in noirq suspend error path
     - vdso: Add struct __kernel_old_timeval forward declaration to gettime.h
     - [armhf] dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer
       property
     - [arm64] PM / devfreq: mtk-cci: Fix potential error pointer dereference in
       probe()
     - [arm64] power: supply: cw2015: Fix a alignment coding style issue
     - [arm64] pinctrl: renesas: Use int type to store negative error codes
     - null_blk: Fix the description of the cache_size module argument
     - nbd: restrict sockets to TCP and UDP
     - [arm64] PM / devfreq: rockchip-dfi: double count on RK3588
     - [arm64] soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure
     - [arm64] soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure
     - [arm64] arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model
     - mmc: core: Fix variable shadowing in mmc_route_rpmb_frames()
     - [arm64] dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value
     - [arm64] dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes
     - [arm64] dts: mediatek: mt8516-pumpkin: Fix machine compatible
     - [armhf] pwm: tiehrpwm: Don't drop runtime PM reference in .free()
     - [armhf] pwm: tiehrpwm: Make code comment in .free() more useful
     - [armhf] pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle
       calculation
     - [armhf] pwm: tiehrpwm: Fix corner case in clock divisor calculation
     - ACPICA: Fix largest possible resource descriptor index
     - [riscv64] bpf: Sign extend struct ops return values properly
     - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
     - i3c: master: svc: Use manual response for IBI events
     - i3c: master: svc: Recycle unused IBI slot
     - bpf: Explicitly check accesses to bpf_sock_addr
     - bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free()
     - smp: Fix up and expand the smp_call_function_many() kerneldoc
     - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host
       headers
     - spi: fix return code when spi device has too many chipselects
     - bpf: Mark kfuncs as __noclone
     - once: fix race by moving DO_ONCE to separate section
     - [arm64] thermal/drivers/qcom/lmh: Add missing IRQ includes
     - [arm64] i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
     - i2c: designware: Fix clock issue when PM is disabled
     - i2c: designware: Add disabling clocks when probe fails
     - libbpf: Fix error when st-prefix_ops and ops from differ btf
     - bpf: Enforce expected_attach_type for tailcall compatibility
     - drm/radeon/r600_cs: clean up of dead code in r600_cs
     - f2fs: fix condition in __allow_reserved_blocks()
     - [arm64] phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568
     - drm/amd/display: Remove redundant semicolons
     - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
     - scsi: myrs: Fix dma_alloc_coherent() error check
     - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count
     - RDMA/mlx5: Fix vport loopback forcing for MPV device
     - PCI/ACPI: Fix pci_acpi_preserve_config() memory leak
     - ALSA: lx_core: use int type to store negative error codes
     - inet: ping: check sock_net() in ping_get_port() and ping_lookup()
     - [arm64,armhf] coresight: Only register perf symlink for sinks with
       alloc_buffer
     - drm/amdgpu: Power up UVD 3 for FW validation (v2)
     - drm/amd/pm: Disable ULV even if unsupported (v3)
     - drm/amd/pm: Fix si_upload_smc_data (v3)
     - drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
     - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
     - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)
     - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3)
     - wifi: mwifiex: send world regulatory domain to driver
     - [arm64,armhf] PCI: tegra: Fix devm_kcalloc() argument order for port->phys
       allocation
     - tcp: fix __tcp_close() to only send RST when required
     - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
     - [armhf] usb: phy: twl6030: Fix incorrect type for ret
     - usb: gadget: configfs: Correctly set use_os_string at bind
     - tty: n_gsm: Don't block input queue by waiting MSC
     - [powerpc*] misc: genwqe: Fix incorrect cmd field being reported in error
     - pps: fix warning in pps_register_cdev when register device fail
     - wifi: iwlwifi: Remove redundant header files
     - [amd64,arm64] idpf: fix Rx descriptor ready check barrier in splitq
     - [amd64] ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
     - [amd64] ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
     - [amd64] ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
     - [arm64] drm/msm/dpu: fix incorrect type for ret
     - fs: ntfs3: Fix integer overflow in run_unpack()
     - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist
     - iio: consumers: Fix handling of negative channel scale in
       iio_convert_raw_to_processed()
     - iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
     - netfilter: ipset: Remove unused htable_bits in macro ahash_region
     - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable
     - drivers/base/node: handle error properly in register_one_node()
     - RDMA/cm: Rate limit destroy CM ID timeout error message
     - wifi: mt76: fix potential memory leak in mt76_wmac_probe()
     - wifi: mt76: mt7996: Fix RX packets configuration for primary WED device
     - wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE
     - wifi: mt76: mt7915: fix mt7981 pre-calibration
     - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()
     - f2fs: fix to truncate first page in error path of f2fs_truncate()
     - f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page()
     - ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on
       PREEMPT_RT
     - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
     - scsi: qla2xxx: edif: Fix incorrect sign of error code
     - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
     - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp()
     - HID: hidraw: tighten ioctl command parsing
     - f2fs: fix zero-sized extent for precache extents
     - Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems
       Running"
     - RDMA/core: Resolve MAC of next-hop device without ARP support
     - IB/sa: Fix sa_local_svc_timeout_ms read race
     - Documentation: trace: historgram-design: Separate sched_waking histogram
       section heading and the following diagram
     - wifi: ath12k: fix wrong logging ID used for CE
     - wifi: ath10k: avoid unnecessary wait for service ready message
     - iommu/vt-d: debugfs: Fix legacy mode page table dump logic
     - wifi: mac80211: fix Rx packet handling when pubsta information is not
       available
     - [amd64] ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback
     - RDMA/rxe: Fix race in do_task() when draining
     - wifi: rtw89: avoid circular locking dependency in ser_state_run()
     - [arm64] remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
     - dm vdo: return error on corrupted metadata in start_restoring_volume
       functions
     - [arm64] coresight-etm4x: Conditionally access register TRCEXTINSELR
     - [arm64,armhf] coresight: tmc: Support atclk
     - [arm64,armhf] coresight: catu: Support atclk
     - [arm64,armhf] coresight: etm4x: Support atclk
     - [arm64,armhf] coresight: trbe: Return NULL pointer for allocation failures
     - [arm64,armhf] coresight: tpda: fix the logic to setup the element size
     - [arm64] coresight: Fix incorrect handling for return value of devm_kzalloc
     - NFSv4.1: fix backchannel max_resp_sz verification check
     - ipvs: Defer ip_vs_ftp unregister during netns cleanup
     - netfilter: nfnetlink: reset nlh pointer during batch replay
     - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
     - usb: vhci-hcd: Prevent suspending virtually attached devices
     - iommu/vt-d: Disallow dirty tracking if incoherent page walk
     - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
     - ptp: Add a upper bound on max_vclocks
     - vhost: vringh: Fix copy_to_iter return value check
     - Bluetooth: MGMT: Fix not exposing debug UUID on
       MGMT_OP_READ_EXP_FEATURES_INFO
     - Bluetooth: ISO: Fix possible UAF on iso_conn_free
     - Bluetooth: ISO: free rx_skb if not consumed
     - Bluetooth: ISO: don't leak skb in ISO_CONT RX
     - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements
     - KEYS: X.509: Fix Basic Constraints CA flag parsing
     - ocfs2: fix double free in user_cluster_connect()
     - drivers/base/node: fix double free in register_one_node()
     - [arm64] PCI: j721e: Fix incorrect error message in probe()
     - [amd64,arm64] idpf: fix mismatched free function for dma_alloc_coherent
     - nfp: fix RSS hash key size when RSS is not supported
     - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not
       configurable
     - net: dlink: handle copy_thresh allocation failure
     - net/mlx5: Stop polling for command response if interface goes down
     - net/mlx5: pagealloc: Fix reclaim race during command interface teardown
     - net/mlx5: fw reset, add reset timeout work
     - smb: client: fix crypto buffers in non-linear memory
     - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
     - bpf: Reject negative offsets for ALU ops
     - tpm: Disable TPM2_TCG_HMAC by default
     - Squashfs: fix uninit-value in squashfs_get_parent
     - uio_hv_generic: Let userspace take care of interrupt mask
     - io_uring/waitid: always prune wait queue entry in io_waitid_wait()
     - [arm64] ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
     - [amd64,arm64] ASoC: SOF: ipc3-topology: Fix multi-core and static
       pipelines tear down
     - fs: udf: fix OOB read in lengthAllocDescs handling
     - net: nfc: nci: Add parameter validation for packet data
     - [arm64,armhf] mfd: vexpress-sysreg: Check the return value of
       devm_gpiochip_add_data()
     - dm: fix queue start/stop imbalance under suspend/load/resume races
     - dm: fix NULL pointer dereference in __dm_suspend()
     - ksmbd: Fix race condition in RPC handle list access
     - ksmbd: fix error code overwriting in smb2_get_info_filesystem()
     - ksmbd: add max ip connections parameter
     - ext4: fix checks for orphan inodes
     - [amd64] KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't
       valid
     - fbdev: simplefb: Fix use after free in simplefb_detach_genpds()
     - mm: hugetlb: avoid soft lockup when mprotect to large memory area
     - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
     - [arm64] misc: fastrpc: Save actual DMA size in fastrpc_map structure
     - [arm64] misc: fastrpc: Fix fastrpc_map_lookup operation
     - [arm64] misc: fastrpc: fix possible map leak in fastrpc_put_args
     - [arm64] misc: fastrpc: Skip reference for DMA handles
     - Input: atmel_mxt_ts - allow reset GPIO to sleep
     - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
     - sunrpc: fix null pointer dereference on zero-length checksum
     - [arm64] remoteproc: pru: Fix potential NULL pointer dereference in
       pru_rproc_set_ctable()
     - [amd64,arm64] tee: fix register_shm_helper()
     - pinctrl: check the return value of pinmux_ops::get_function_name()
     - bus: fsl-mc: Check return value of platform_get_resource()
     - net/9p: Fix buffer overflow in USB transport layer
     - net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
     - usb: typec: tipd: Clear interrupts first
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.54
     - fs: always return zero on success from replace_fd()
     - fscontext: do not consume log entries when returning -EMSGSIZE
     - [arm64] map [_text, _stext) virtual address range non-executable+read-only
     - rseq: Protect event mask against membarrier IPI
     - listmount: don't call path_put() under namespace semaphore
     - page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches
     - dma-mapping: fix direction in dma_alloc direction traces
     - [amd64] KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2
     - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
     - media: v4l2-subdev: Fix alloc failure check in
       v4l2_subdev_call_state_try()
     - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled
     - perf disasm: Avoid undefined behavior in incrementing NULL
     - perf test trace_btf_enum: Skip if permissions are insufficient
     - perf evsel: Avoid container_of on a NULL leader
     - libperf event: Ensure tracing data is multiple of 8 sized
     - [arm64] clk: qcom: common: Fix NULL vs IS_ERR() check in
       qcom_cc_icc_register()
     - [arm64] clk: renesas: cpg-mssr: Fix memory leak in
       cpg_mssr_reserved_init()
     - perf util: Fix compression checks returning -1 as bool
     - perf arm_spe: Correct setting remote access
     - perf arm-spe: Rename the common data source encoding
     - perf arm_spe: Correct memory level for remote access
     - perf vendor events arm64 AmpereOneX: Fix typo - should be
       l1d_cache_access_prefetches
     - perf session: Fix handling when buffer exceeds 2 GiB
     - perf tools: Add fallback for exclude_guest
     - perf evsel: Ensure the fallback message is always written to
     - [arm64] clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
     - [arm64] clk: mediatek: clk-mux: Do not pass flags to
       clk_mux_determine_rate_flags()
     - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (CVE-2025-40001)
     - [amd64] ASoC: SOF: Intel: hda-pcm: Place the constraint on period time
       instead of buffer time
     - [amd64] ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel
     - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
     - drm/xe/hw_engine_group: Fix double write lock release in error path
     - [s390x] cio: Update purge function to unregister the unused subchannels
     - drm/vmwgfx: Fix a null-ptr access in the cursor snooper
     - drm/vmwgfx: Fix Use-after-free in validation
     - drm/vmwgfx: Fix copy-paste typo in validation
     - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
     - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
     - [arm64] net: mscc: ocelot: Fix use-after-free caused by cyclic delayed
       work (CVE-2025-40003)
     - ice: ice_adapter: release xa entry on adapter allocation failure
     - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat()
     - [arm64] mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister()
       call
     - [arm64] mailbox: zynqmp-ipi: Remove dev.parent check in
       zynqmp_ipi_free_mboxes
     - [arm64] mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup
       loop
     - [arm64] mailbox: zynqmp-ipi: Fix SGI cleanup on unbind
     - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
     - [arm64] mailbox: mtk-cmdq-mailbox: Switch to
       __pm_runtime_put_autosuspend()
     - [arm64] mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend()
     - [arm64] mailbox: mtk-cmdq: Remove pm_runtime APIs from
       cmdq_mbox_send_data()
     - drm/amdgpu: Add additional DCE6 SCL registers
     - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
     - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
     - drm/amd/display: Properly disable scaling on DCE6
     - netfilter: nft_objref: validate objref and objrefmap expressions
     - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
     - crypto: essiv - Check ssize for decryption and in-place encryption
     - cifs: Fix copy_to_iter return value check
     - smb: client: fix missing timestamp updates after utime(2)
     - cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points
     - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
     - [arm64] gpio: wcd934x: mark the GPIO controller as sleeping
     - bpf: Avoid RCU context warning when unpinning htab with internal structs
     - [s390x] vmlinux.lds.S: Reorder sections
     - [s390x] vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections
     - ACPI: property: Fix buffer properties extraction for subnodes
     - ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
     - ACPI: debug: fix signedness issues in read/write helpers
     - [arm64] dts: qcom: msm8916: Add missing MDSS reset
     - [arm64] dts: qcom: msm8939: Add missing MDSS reset
     - [arm64] dts: qcom: sdm845: Fix slimbam num-channels/ees
     - [arm64] dts: qcom: x1e80100-pmics: Disable pm8010 by default
     - [arm64] dts: ti: k3-am62a-main: Fix main padcfg length
     - [arm64] kprobes: call set_memory_rox() for kprobe page
     - [armhf] AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on
       reset)
     - [armhf] OMAP2+: pm33xx-core: ix device node reference leaks in
       amx3_idle_init
     - [arm64] perf/arm-cmn: Fix CMN S3 DTM offset
     - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required
     - xen/events: Cleanup find_virq() return codes
     - xen/manage: Fix suspend error path
     - xen/events: Return -EEXIST for bound VIRQs
     - xen/events: Update virq_to_irq on migration
     - [arm64] firmware: meson_sm: fix device leak at probe
     - media: cx18: Add missing check after DMA map
     - media: mc: Fix MUST_CONNECT handling for pads with no links
     - media: pci: ivtv: Add missing check after DMA map
     - media: pci: mg4b: fix uninitialized iio scan data
     - [arm64] media: venus: firmware: Use correct reset sequence for IRIS2
     - media: vivid: fix disappearing <Vendor Command With ID> messages
     - media: lirc: Fix error handling in lirc_register()
     - [arm64] drm/panthor: Fix memory leak in panthor_ioctl_group_create()
     - drm/nouveau: fix bad ret code in nouveau_bo_move_prep
     - drm/xe/uapi: loosen used tracking restriction
     - drm/amd/display: Enable Dynamic DTBCLK Switch
     - blk-crypto: fix missing blktrace bio split events
     - btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
     - bus: mhi: ep: Fix chained transfer handling in read path
     - bus: mhi: host: Do not use uninitialized 'dev' pointer in
       mhi_init_irq_setup()
     - [arm64] clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP
       refclk
     - copy_sighand: Handle architectures where sizeof(unsigned long) <
       sizeof(u64)
     - [amd64] cpufreq: intel_pstate: Fix object lifecycle issue in
       update_qos_request()
     - [arm64,armhf] crypto: rockchip - Fix dma_unmap_sg() nents value
     - eventpoll: Replace rwlock with spinlock
     - fbdev: Fix logic error in "offb" name match
     - fs/ntfs3: Fix a resource leak bug in wnd_extend()
     - fs: quota: create dedicated workqueue for quota_release_work
     - fuse: fix possibly missing fuse_copy_finish() call in fuse_notify()
     - fuse: fix livelock in synchronous file put from fuseblk workers
     - iio: dac: ad5360: use int type to store negative error codes
     - iio: dac: ad5421: use int type to store negative error codes
     - iio: frequency: adf4350: Fix prescaler usage.
     - init: handle bootloader identifier in kernel parameters
     - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in
       resume
     - [amd64] iommu/vt-d: PRS isn't usable if PDS isn't supported
     - kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in
       sys_prlimit64() paths
     - KEYS: trusted_tpm1: Compare HMAC values in constant time
     - lib/genalloc: fix device leak in of_gen_pool_get()
     - loop: fix backing file reference leak on validation error
     - openat2: don't trigger automounts with RESOLVE_NO_XDEV
     - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
     - [powerpc*] powernv/pci: Fix underflow and leak issue
     - [powerpc*] pseries/msi: Fix potential underflow and leak issue
     - Revert "ipmi: fix msg stack when IPMI is disconnected"
     - sched/deadline: Fix race in push_dl_task()
     - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
     - scsi: sd: Fix build warning in sd_revalidate_disk()
     - sctp: Fix MAC comparison to be constant-time
     - xsk: Harden userspace-supplied xdp_desc validation
     - mmc: core: SPI mode remove cmd7
     - mmc: mmc_spi: multiple block read remove read crc ack
     - [armhf] memory: samsung: exynos-srom: Fix of_iomap leak in
       exynos_srom_probe
     - rtc: interface: Ensure alarm irq is enabled when UIE is enabled
     - rtc: interface: Fix long-standing race when setting alarm
     - [arm64] PCI: xilinx-nwl: Fix ECAM programming
     - [arm64,armhf] PCI: tegra: Convert struct tegra_msi mask_lock into raw
       spinlock
     - PCI/sysfs: Ensure devices are powered for config reads
     - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
     - PCI/ERR: Fix uevent on failure to recover
     - PCI/AER: Fix missing uevent on recovery when a reset is requested
     - PCI/AER: Support errors introduced by PCIe r6.0
     - [arm64] PCI: j721e: Fix programming sequence of "strap" settings
     - spi: cadence-quadspi: Flush posted register writes before INDAC access
     - spi: cadence-quadspi: Flush posted register writes before DAC access
     - spi: cadence-quadspi: Fix cqspi_setup_flash()
     - [x86] fred: Remove ENDBR64 from FRED entry points
     - [x86] umip: Check that the instruction opcode is at least two bytes
     - [x86] umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT
       aliases)
     - [s390x] dasd: enforce dma_alignment to ensure proper buffer validation
     - [s390x] dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request
     - [s390x] Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR
     - slab: prevent warnings when slab obj_exts vector allocation fails
     - slab: mark slab->obj_exts allocation failures unconditionally
     - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again
     - wifi: mt76: mt7925u: Add VID/PID for Netgear A9000
     - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500
     - mm/thp: fix MTE tag mismatch when replacing zero-filled subpages
     - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
     - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when
       max_huge_pages=0
     - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success
     - mm/damon/lru_sort: use param_ctx for damon_attrs staging
     - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
     - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
     - ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches()
     - ext4: verify orphan file size is not too big
     - ext4: increase i_disksize to offset + len in
       ext4_update_disksize_before_punch()
     - ext4: correctly handle queries for metadata mappings
     - ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
     - ext4: fix an off-by-one issue during moving extents
     - ext4: guard against EA inode refcount underflow in xattr update
     - ext4: validate ea_ino and size in check_xattrs
     - ACPICA: Allow to skip Global Lock initialization
     - ext4: free orphan info with kvfree
     - media: mc: Clear minor number before put device
     - Squashfs: add additional inode sanity checking
     - Squashfs: reject negative file sizes in squashfs_read_inode()
     - tracing: Fix race condition in kprobe initialization causing NULL pointer
       dereference
     - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork
     - [amd64] ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams
     - [amd64] ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples
     - [amd64] mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config
       max_register value
     - [amd64] mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for
       cache_type
     - [amd64] mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config
       flag
     - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
     - cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency
     - [amd64] KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace
     - statmount: don't call path_put() under namespace semaphore
     - [arm64] mte: Do not flag the zero page as PG_mte_tagged
     - [x86] mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state()
     - [x86] kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP
     - nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT
     - NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock()
     - nfsd: refine and rename NFSD_MAY_LOCK
     - nfsd: don't use sv_nrthreads in connection limiting calculations.
     - nfsd: unregister with rpcbind when deleting a transport
     - ACPI: battery: allocate driver data through devm_ APIs
     - ACPI: battery: initialize mutexes through devm_ APIs
     - ACPI: battery: Check for error code from devm_mutex_init() call
     - ACPI: battery: Add synchronization between interface updates
     - ACPI: property: Disregard references in data-only subnode lists
     - ACPI: property: Add code comments explaining what is going on
     - ACPI: property: Do not pass NULL handles to acpi_attach_data()
     - mptcp: pm: in-kernel: usable client side with C-flag
     - ipmi: Rework user message limit handling
     - ipmi: Fix handling of messages with provided receive message pointer
     - mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled
       mTHP subpage to shared zeropage
     - [s390x] bpf: Centralize frame offset calculations
     - [s390x] bpf: Describe the frame using a struct instead of constants
     - [s390x] bpf: Write back tail call counter for BPF_PSEUDO_CALL
     - [s390x] bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG
     - [riscv64] irqchip/sifive-plic: Make use of __assign_bit()
     - [riscv64] irqchip/sifive-plic: Avoid interrupt ID 0 handling during
       suspend/resume
     - copy_file_range: limit size if in compat mode
     - minixfs: Verify inode mode when loading from disk
     - pid: Add a judgment for ns null in pid_nr_ns
     - fs: Add 'initramfs_options' to set initramfs mount options
     - cramfs: Verify inode mode when loading from disk
     - writeback: Avoid softlockup when switching many inodes
     - writeback: Avoid excessively long inode switching times
     - sched/fair: Block delayed tasks on throttled hierarchy during dequeue
     - nfsd: fix __fh_verify for localio
     - nfsd: fix access checking for NLM under XPRTSEC policies
     - [amd64] ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA
     - mount: handle NULL values in mnt_ns_release()
     - nfsd: decouple the xprtsec policy check from check_nfsd_access()
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.55
     - drm/xe/guc: Check GuC running state before deregistering exec queue
     - smb: client: Fix refcount leak for cifs_sb_tlink
     - slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL
     - r8152: add error handling in rtl8152_driver_init
     - f2fs: fix wrong block mapping for multi-devices
     - jbd2: ensure that all ongoing I/O complete before freeing blocks
     - ext4: wait for ongoing I/O to complete before freeing blocks
     - ext4: detect invalid INLINE_DATA + EXTENTS flag combination
     - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already
       running
     - btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl
     - btrfs: fix incorrect readahead expansion length
     - btrfs: fix memory leaks when rejecting a non SINGLE data profile without
       an RST
     - btrfs: do not assert we found block group item when creating free space
       tree
     - can: gs_usb: gs_make_candev(): populate net_device->dev_port
     - can: gs_usb: increase max interface to U8_MAX
     - cifs: parse_dfs_referrals: prevent oob on malformed input
     - drm/sched: Fix potential double free in
       drm_sched_job_add_resv_dependencies
     - drm/amdgpu: use atomic functions with memory barriers for vm fault info
     - drm/amdgpu: fix gfx12 mes packet status return check
     - perf/core: Fix address filter match with backing files
     - perf/core: Fix MMAP event path names with backing files
     - perf/core: Fix MMAP2 event device with backing files
     - drm/amd: Check whether secure display TA loaded successfully
     - irqdomain: cdx: Switch to of_fwnode_handle()
     - [arm64] drm/msm/a6xx: Fix PDC sleep sequence
     - usb: gadget: Store endpoint pointer in usb_request
     - usb: gadget: Introduce free_usb_request helper
     - usb: gadget: f_ncm: Refactor bind path to use __free()
     - usb: gadget: f_acm: Refactor bind path to use __free()
     - usb: gadget: f_ecm: Refactor bind path to use __free()
     - usb: gadget: f_rndis: Refactor bind path to use __free()
     - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay
     - Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()"
       (Closes: #1116358)
     - HID: multitouch: fix sticky fingers
     - dax: skip read lock assertion for read-only filesystems
     - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable()
     - can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error
       Active
     - can: m_can: m_can_chip_config(): bring up interface in correct state
     - can: m_can: add deinit callback
     - can: m_can: call deinit/init callback when going into suspend/resume
     - can: m_can: fix CAN state in system PM
     - net: dlink: handle dma_map_single() failure properly
     - doc: fix seg6_flowlabel path
     - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H
     - net/ip6_tunnel: Prevent perpetual tunnel growth
     - [amd64,arm64] amd-xgbe: Avoid spurious link down messages during interface
       toggle
     - tcp: fix tcp_tso_should_defer() vs large RTT
     - ksmbd: fix recursive locking in RPC handle list access
     - tg3: prevent use of uninitialized remote_adv and local_adv variables
     - tls: trim encrypted message to match the plaintext on short splice
     - tls: wait for async encrypt in case of error during latter iterations of
       sendmsg
     - tls: always set record_type in tls_process_cmsg
     - tls: wait for pending async decryptions if tls_strp_msg_hold fails
     - tls: don't rely on tx_work during send()
     - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address
     - net: usb: lan78xx: fix use of improperly initialized dev->chipid in
       lan78xx_reset
     - [arm64] drm/panthor: Ensure MCU is disabled on suspend
     - nvme-multipath: Skip nr_active increments in RETRY disposition
     - [riscv64] kprobes: Fix probe address validation
     - [amd64] ASoC: nau8821: Cancel jdet_work before handling jack ejection
     - [amd64] ASoC: nau8821: Generalize helper to clear IRQ status
     - [amd64] ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit
     - [amd64] drm/i915/guc: Skip communication warning on reset in progress
     - drm/amdgpu: add ip offset support for cyan skillfish
     - drm/amdgpu: add support for cyan skillfish without IP discovery
     - drm/amdgpu: fix handling of harvesting for ip_discovery firmware
     - drm/amd/powerplay: Fix CIK shutdown temperature
     - [arm64] drm/rockchip: vop2: use correct destination rectangle height check
     - sched/fair: Fix pelt lost idle time detection
     - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
     - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card
     - HID: hid-input: only ignore 0 battery events for digitizers
     - HID: multitouch: fix name of Stylus input devices
     - nvme/tcp: handle tls partially sent records in write_space()
     - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
     - xfs: rename the old_crc variable in xlog_recover_process
     - xfs: fix log CRC mismatches between i386 and other architectures
     - PM: runtime: Add new devm functions
     - iio: imu: inv_icm42600: Simplify pm_runtime setup
     - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended
     - nfsd: Use correct error code when decoding extents
     - nfsd: Drop dprintk in blocklayout xdr functions
     - NFSD: Rework encoding and decoding of nfsd4_deviceid
     - NFSD: Minor cleanup in layoutcommit processing
     - NFSD: Implement large extent array support in pNFS
     - NFSD: Fix last write offset handling in layoutcommit
     - wifi: rtw89: avoid possible TX wait initialization race
     - xfs: use deferred intent items for reaping crosslinked blocks
     - padata: Reset next CPU when reorder sequence wraps around
     - md/raid0: Handle bio_split() errors
     - md/raid1: Handle bio_split() errors
     - md/raid10: Handle bio_split() errors
     - md: fix mssing blktrace bio split events
     - [amd64] x86/resctrl: Refactor resctrl_arch_rmid_read()
     - [amd64] x86/resctrl: Fix miscount of bandwidth event when reactivating
       previously unavailable RMID
     - d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier
     - vfs: Don't leak disconnected dentries on umount
     - PCI: Add PCI_VDEVICE_SUB helper macro
     - ixgbevf: Add support for Intel(R) E610 device
     - ixgbevf: fix getting link speed data for E610 devices
     - ixgbevf: fix mailbox API compatibility by negotiating supported features
     - tcp: convert to dev_net_rcu()
     - tcp: cache RTAX_QUICKACK metric in a hot cache line
     - net: dst: add four helpers to annotate data-races around dst->dev
     - ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]
     - net: Add locking to protect skb->dev access in ip_output
     - mptcp: Call dst_release() in mptcp_active_enable().
     - mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().
     - mptcp: reset blackhole on success with non-loopback ifaces
     - NFSD: Define a proc_layoutcommit for the FlexFiles layout type
     - [arm64] cputype: Add Neoverse-V3AE definitions
     - [arm64] errata: Apply workarounds for Neoverse-V3AE
     - [amd64] dmaengine: Add missing cleanup on module unload
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.56
     - exec: Fix incorrect type for ret
     - hfs: clear offset and space out of valid records in b-tree node
     - hfs: make proper initalization of struct hfs_find_data
     - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
     - hfs: validate record offset in hfsplus_bmap_alloc
     - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
     - dlm: check for defined force value in dlm_lockspace_release
     - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
     - hfsplus: return EIO when type of hidden directory mismatch in
       hfsplus_fill_super()
     - PCI: Test for bit underflow in pcie_set_readrq()
     - [arm64] sysreg: Correct sign definitions for EIESB and DoubleLock
     - drivers/perf: hisi: Relax the event ID check in the framework
     - [s390x] mm: Use __GFP_ACCOUNT for user page table allocations
     - smb: server: let smb_direct_flush_send_list() invalidate a remote key
       first
     - PM: EM: Drop unused parameter from em_adjust_new_capacity()
     - PM: EM: Slightly reduce em_check_capacity_update() overhead
     - PM: EM: Move CPU capacity check to em_adjust_new_capacity()
     - PM: EM: Fix late boot with holes in CPU topology
     - net/mlx5e: Return 1 instead of 0 in invalid case in
       mlx5e_mpwrq_umr_entry_size()
     - rtnetlink: Allow deleting FDB entries in user namespace
     - [arm64] net: enetc: fix the deadlock of enetc_mdio_lock
     - [arm64] net: enetc: correct the value of ENETC_RXB_TRUESIZE
     - [arm64] dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path
     - net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead
     - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ
     - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ
     - net/smc: fix general protection fault in __smc_diag_dump
     - [arm64] net: ethernet: ti: am65-cpts: fix timestamp loss due to race
       conditions
     - [arm64] mm: avoid always making PTE dirty in pte_mkwrite()
     - ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop
     - sctp: avoid NULL dereference when chunk data buffer is missing
     - net: phy: micrel: always set shared->phydev for LAN8814
     - net/mlx5: Fix IPsec cleanup over MPV device
     - fs/notify: call exportfs_encode_fid with s_umount
     - net: bonding: fix possible peer notify event loss or dup issue
     - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC
     - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
     - btrfs: directly free partially initialized fs_info in
       btrfs_check_leaked_roots()
     - gpio: pci-idio-16: Define maximum valid register address offset
     - gpio: 104-idio-16: Define maximum valid register address offset
     - xfs: fix locking in xchk_nlinks_collect_dir
     - Revert "cpuidle: menu: Avoid discarding useful information"
     - slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts
     - slab: Fix obj_ext mistakenly considered NULL due to race condition
     - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11
     - can: netlink: can_changelink(): allow disabling of automatic restart
     - cifs: Fix TCP_Server_Info::credits to be signed
     - ocfs2: clear extent cache after moving/defragmenting extents
     - vsock: fix lock inversion in vsock_assign_transport()
     - [arm64,armhf] net: stmmac: dwmac-rk: Fix disabling set_clock_selection
     - net: usb: rtl8150: Fix frame padding
     - mm: prevent poison consumption when splitting THP
     - drm/amd/display: increase max link count and fix link->enc NULL pointer
       access
     - [arm64] spi: spi-nxp-fspi: add extra delay after dll locked
     - [arm64] dts: broadcom: bcm2712: Add default GIC address cells
     - [arm64] dts: broadcom: bcm2712: Define VGIC interrupt
     - [arm64] firmware: arm_scmi: Account for failed debug initialization
     - [arm64] firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing
       in raw mode
     - [arm64] drm/panthor: Fix kernel panic on partial unmap of a GPU VA region
     - [riscv64] Define pgprot_dmacoherent() for non-coherent devices
     - [riscv64] Don't print details of CPUs disabled in DT
     - [riscv64] hwprobe: avoid uninitialized variable use in hwprobe_arch_id()
     - hwmon: (sht3x) Fix error handling
     - nbd: override creds to kernel when calling sock_{send,recv}msg()
     - drm/panic: Fix drawing the logo on a small narrow screen
     - drm/panic: Fix qr_code, ensure vmargin is positive
     - [amd64] gpio: ljca: Fix duplicated IRQ mapping
     - io_uring: correct __must_hold annotation in io_install_fixed_file
     - sched: Remove never used code in mm_cid_get()
     - io_uring/sqpoll: switch away from getrusage() for CPU accounting
     - io_uring/sqpoll: be smarter on when to update the stime usage
     - Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP
       (Closes: #1118660)
     - platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL
       (CVE-2025-39678)
     - USB: serial: option: add UNISOC UIS7720
     - USB: serial: option: add Quectel RG255C
     - USB: serial: option: add Telit FN920C04 ECM compositions
     - usb/core/quirks: Add Huawei ME906S to wakeup quirk
     - usb: raw-gadget: do not limit transfer length
     - xhci: dbc: enable back DbC in resume if it was enabled before suspend
     - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall
       event
     - [amd64] x86/microcode: Fix Entrysign revision check for Zen1/Naples
     - [arm*] binder: remove "invalid inc weak" check
     - [amd64] comedi: fix divide-by-zero in comedi_buf_munge() (CVE-2025-40106)
     - [amd64] mei: me: add wildcat lake P DID
     - [arm64] misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup
     - [amd64,arm64] tcpm: switch check for role_sw device with fw_node
     - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp
     - serial: 8250_dw: handle reset control deassert error
     - serial: 8250_exar: add support for Advantech 2 port card with Device ID
       0x0018
     - [arm64] serial: 8250_mtk: Enable baud clock and manage in runtime PM
     - serial: sc16is7xx: remove useless enable of enhanced features
     - devcoredump: Fix circular locking dependency with devcd->mutex.
     - [arm64] mte: Do not warn if the page is already tagged in copy_highpage()
     - xfs: always warn about deprecated mount options
     - ksmbd: transport_ipc: validate payload size before reading handle
       (CVE-2025-40084)
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.57
     - net/sched: sch_qfq: Fix null-deref in agg_dequeue (CVE-2025-40083)
     - audit: record fanotify event regardless of presence of rules
     - [amd64] perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into
       INTEL_FIXED_BITS_MASK
     - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of
       current->mm == NULL
     - perf: Have get_perf_callchain() return NULL if crosstask and user are set
     - perf: Skip user unwind if the task is a kernel thread
     - seccomp: passthrough uprobe systemcall without filtering
     - [amd64] x86/bugs: Report correct retbleed mitigation status
     - [amd64] x86/bugs: Fix reporting of LFENCE retpoline
     - [amd64,arm64] EDAC/mc_sysfs: Increase legacy channel support to 16
     - cpuset: Use new excpus for nocpu error check when enabling root partition
     - btrfs: abort transaction on specific error places when walking log tree
     - btrfs: abort transaction in the process_one_buffer() log tree walk
       callback
     - btrfs: zoned: return error from btrfs_zone_finish_endio()
     - btrfs: zoned: refine extent allocator hint selection
     - btrfs: scrub: replace max_t()/min_t() with clamp() in
       scrub_throttle_dev_io()
     - btrfs: always drop log root tree reference in btrfs_replay_log()
     - btrfs: use level argument in log tree walk callback replay_one_buffer()
     - btrfs: abort transaction if we fail to update inode in log replay dir
       fixup
     - btrfs: tree-checker: add inode extref checks
     - btrfs: use smp_mb__after_atomic() when forcing COW in
       create_pending_snapshot()
     - sched_ext: Make qmap dump operation non-destructive
     - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c
     - docs: kdoc: handle the obsolescensce of docutils.ErrorString()
     - mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR
     - f2fs: fix to avoid panic once fallocation fails for pinfile
       (CVE-2025-23130)
     - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac()
       (CVE-2025-38643)
     - bonding: return detailed error when loading native XDP fails
     - bonding: check xdp prog when set bond mode (CVE-2025-22105)
     - bits: add comments and newlines to #if, #else and #endif directives
     - bits: introduce fixed-type GENMASK_U*()
     - gpio: regmap: Allow to allocate regmap-irq device
     - gpio: regmap: add the .fixed_direction_output configuration parameter
     - gpio: idio-16: Define fixed direction of the GPIO lines
     - [amd64] iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (CVE-2025-21833)
     - wifi: ath12k: fix read pointer after free in
       ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995)
     - [amd64,arm64] udmabuf: fix a buf size overflow issue during udmabuf
       creation (CVE-2025-37803)
     - sfc: fix NULL dereferences in ef100_process_design_param()
       (CVE-2025-37860)
     - btrfs: tree-checker: fix bounds check in check_inode_extref()
 .
   [ Salvatore Bonaccorso ]
   * drivers/infiniband/hw/bnxt_re: Enable INFINIBAND_BNXT_RE as module
     (Closes: #1109977)
 .
   [ Ben Hutchings ]
   * d/salsa-ci.yml: Adjust filenames to allow source package name suffix
   * tools/hv: Make the sample hv_get_dhcp_info script more useful
   * hyperv-daemons: Install the sample network info scripts (Closes: #919350)
   * d/salsa-ci.yml: Fix cache configuration for build job
   * d/salsa-ci.yml: Move orig tarball generation to a separate job again
   * d/salsa-ci.yml: Restore lintian checking of source package
linux-signed-arm64 (6.12.48+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.48-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.44
     - serial: 8250: fix panic due to PSLVERR
     - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
     - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister()
     - PM: runtime: Take active children into account in
       pm_runtime_get_if_in_use()
     - dm: dm-crypt: Do not partially accept write BIOs with zoned targets
     - dm: Check for forbidden splitting of zone write operations
     - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
     - usb: gadget: udc: renesas_usb3: fix device leak at unbind
     - usb: musb: omap2430: fix device leak at unbind
     - [arm64,armhf] usb: dwc3: meson-g12a: fix device leaks at unbind
     - [arm64] usb: dwc3: imx8mp: fix device leak at unbind
     - bus: mhi: host: Fix endianness of BHI vector table
     - bus: mhi: host: Detect events pointing to unexpected TREs
     - vt: keyboard: Don't process Unicode characters in K_OFF mode
     - vt: defkeymap: Map keycodes above 127 to K_HOLE
     - [amd64] crypto: qat - lower priority for skcipher and aead algorithms
     - [arm64,armhf] crypto: caam - Prevent crash on suspend with iMX8QM /
       iMX8ULP
     - [amd64] crypto: qat - flush misc workqueue during device shutdown
     - Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
     - ksmbd: fix refcount leak causing resource not released
     - ksmbd: extend the connection limiting mechanism to support IPv6
     - tracing: fprobe-event: Sanitize wildcard for fprobe event name
     - ext4: check fast symlink for ea_inode correctly
     - ext4: fix fsmap end of range reporting with bigalloc
     - ext4: fix reserved gdt blocks handling in fsmap
     - ext4: use kmalloc_array() for array space allocation
     - ext4: fix hole length calculation overflow in non-extent inodes
     - btrfs: zoned: fix write time activation failure for metadata block group
     - btrfs: fix incorrect log message for nobarrier mount option
     - btrfs: restore mount option info messages during mount
     - btrfs: fix printing of mount info messages for NODATACOW/NODATASUM
     - apparmor: Fix 8-byte alignment for initial dfa blob streams
     - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints
     - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks
       constraints
     - scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host
     - [arm64] scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
     - scsi: mpi3mr: Fix race between config read submit and interrupt completion
     - ata: libata-scsi: Fix ata_to_sense_error() status handling
     - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host
       controllers
     - scsi: ufs: ufs-pci: Fix default runtime and system PM levels
     - ata: libata-scsi: Fix CDL control
     - [arm64] soc: qcom: mdt_loader: Ensure we don't read past the ELF header
     - iio: imu: bno055: fix OOB access of hw_xlate array
     - iio: adc: ad_sigma_delta: change to buffer predisable
     - wifi: brcmsmac: Remove const from tbl_ptr parameter in
       wlc_lcnphy_common_read_table()
     - wifi: ath12k: fix dest ring-buffer corruption
     - wifi: ath12k: fix source ring-buffer corruption
     - wifi: ath12k: fix dest ring-buffer corruption when ring is full
     - wifi: ath11k: fix dest ring-buffer corruption
     - wifi: ath11k: fix source ring-buffer corruption
     - wifi: ath11k: fix dest ring-buffer corruption when ring is full
     - [arm64] pwm: mediatek: Handle hardware enable and clock enable separately
     - [arm64] pwm: mediatek: Fix duty and period setting
     - mtd: spi-nor: Fix spi_nor_try_unlock_all()
     - [arm64] mtd: spinand: propagate spinand_wait() errors from
       spinand_write_page()
     - readahead: fix return value of page_cache_next_miss() when no hole is
       found
     - PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge
     - PCI: endpoint: Fix configfs group list head handling
     - PCI: endpoint: Fix configfs group removal on driver teardown
     - [arm64,armhf] PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4
       in epc_features
     - [arm64,armhf] PCI: imx6: Remove apps_reset toggling from
       imx_pcie_{assert/deassert}_core_reset
     - [arm64,armhf] PCI: imx6: Delay link start until configfs 'start' written
     - vsock/virtio: Validate length in packet header before skb_put()
     - vhost/vsock: Avoid allocating arbitrarily-sized SKBs
     - amdgpu/amdgpu_discovery: increase timeout limit for IFWI init
     - [amd64] ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in
       resume context
     - f2fs: fix to avoid out-of-boundary access in dnode page (CVE-2025-38677)
     - jbd2: prevent softlockup in jbd2_log_do_checkpoint()
     - kbuild: userprogs: use correct linker when mixing clang and GNU ld
     - [arm64,armhf] soc/tegra: pmc: Ensure power-domains are in a known state
     - media: gspca: Add bounds checking to firmware parser
     - media: hi556: correct the test pattern configuration
     - [armhf] media: imx: fix a potential memory leak in
       imx_media_csc_scaler_device_init()
     - media: ipu6: isys: Use correct pads for xlate_streams()
     - media: vivid: fix wrong pixel_array control size
     - media: verisilicon: Fix AV1 decoder clock frequency
     - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
     - media: usbtv: Lock resolution while streaming
     - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
     - media: pisp_be: Fix pm_runtime underrun in probe
     - media: ov2659: Fix memory leaks in ov2659_probe()
     - media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval
     - media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable()
       calls
     - [arm64] media: qcom: camss: cleanup media device allocated resource on
       error path
     - [arm64] media: venus: Add a check for packet size after reading from
       shared memory
     - [arm64] media: venus: Fix MSM8998 frequency table
     - [arm64] media: venus: hfi: explicitly release IRQ during teardown
     - [arm64] media: venus: protect against spurious interrupts during probe
     - [arm64] media: venus: vdec: Clamp param smaller than 1fps and bigger than
       240.
     - [arm64] media: venus: venc: Clamp param smaller than 1fps and bigger than
       240
     - drm/amdgpu/discovery: fix fw based ip discovery
     - drm/amd: Restore cached power limit during resume
     - drm/amdgpu: Avoid extra evict-restore process.
     - drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities
     - drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram()
     - drm/amdgpu: Update external revid for GC v9.5.0
     - drm/amdgpu: update mmhub 3.0.1 client id mappings
     - drm/amdgpu: update mmhub 4.1.0 client id mappings
     - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
     - drm/amd/display: Add primary plane to commits for correct VRR handling
     - drm/amd/display: fix a Null pointer dereference vulnerability
     - drm/amd/display: Don't overwrite dce60_clk_mgr
     - net, hsr: reject HSR frame if skb can't hold tag
     - sched/ext: Fix invalid task state transitions on class switch
     - ipv6: sr: Fix MAC comparison to be constant-time
     - ACPI: pfr_update: Fix the driver update version check
     - mptcp: drop skb if MPTCP skb extension allocation fails
     - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit
     - mm/damon/ops-common: ignore migration request to invalid nodes
     - [amd64] x86/sev: Ensure SVSM reserved fields in a page validation entry
       are initialized to zero
     - USB: typec: Use str_enable_disable-like helpers
     - usb: typec: fusb302: cache PD RX state
     - btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb()
     - btrfs: qgroup: fix race between quota disable and quota rescan ioctl
     - btrfs: move transaction aborts to the error site in
       add_block_group_free_space()
     - btrfs: always abort transaction on failure to add block group to free
       space tree
     - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root()
     - btrfs: explicitly ref count block_group on new_bgs list
     - btrfs: codify pattern for adding block_group to bg_list
     - btrfs: zoned: requeue to unused block group list if zone finish failed
     - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags
     - btrfs: send: factor out common logic when sending xattrs
     - btrfs: send: only use boolean variables at process_recorded_refs()
     - btrfs: send: add and use helper to rename current inode when processing
       refs
     - btrfs: send: keep the current inode's path cached
     - btrfs: send: avoid path allocation for the current inode when issuing
       commands
     - btrfs: send: use fallocate for hole punching with send stream v2
     - btrfs: send: make fs_path_len() inline and constify its argument
     - netfs: Fix unbuffered write error handling
     - io_uring/net: commit partial buffers on retry
     - ata: libata-scsi: Return aborted command when missing sense and result TF
     - sched_ext: initialize built-in idle state before ops.init()
     - Revert "can: ti_hecc: fix -Woverflow compiler warning"
     - io_uring/futex: ensure io_futex_wait() cleans up properly on failure
     - iov_iter: iterate_folioq: fix handling of offset >= folio size
     - [arm64] iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement
     - mmc: sdhci-pci-gli: Add a new function to simplify the code
     - memstick: Fix deadlock by moving removing flag earlier
     - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER
     - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency
     - NFS: Fix a race when updating an existing write
     - squashfs: fix memory leak in squashfs_fill_super
     - mm/debug_vm_pgtable: clear page table entries at destroy_args()
     - mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn
     - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook
       830 G6
     - RDMA/rxe: Flush delayed SKBs while releasing RXE resources
     - [s390x] sclp: Fix SCCB present check
     - [amd64] platform/x86/intel-uncore-freq: Check write blocked for ELC
     - kvm: retry nx_huge_page_recovery_thread creation
     - [amd64] accel/habanalabs/gaudi2: Use kvfree() for memory allocated with
       kvcalloc()
     - drm/amdgpu/swm14: Update power limit logic
     - drm/amd/display: Avoid a NULL pointer dereference
     - drm/amd/display: Don't overclock DCE 6 by 15%
     - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
     - drm/amd/display: Fix Xorg desktop unresponsive on Replay panel
     - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6.
     - drm/amd/display: Find first CRTC and its line time in
       dce110_fill_display_configs
     - drm/amd/display: Fill display clock and vblank time in
       dce110_fill_display_configs
     - scsi: core: Fix command pass through retry regression
     - [arm64] soc: qcom: mdt_loader: Fix error return values in
       mdt_header_valid()
     - mptcp: remove duplicate sk_reset_timer call
     - mptcp: disable add_addr retransmission when timeout is 0
     - Mark xe driver as BROKEN if kernel page size is not 4kB
     - [arm64,armhf] PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support
     - [arm64,armhf] PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features
     - [arm64] PCI: rockchip: Use standard PCIe definitions
     - [arm64] PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining
     - iio: adc: ad7173: fix setting ODR in probe
     - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers
     - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems
     - ext4: preserve SB_I_VERSION on remount
     - btrfs: subpage: keep TOWRITE tag until folio is cleaned
     - [arm64] dts: ti: k3-am6*: Add boot phase flag to support MMC boot
     - [arm64] dts: ti: k3-am62*: Add non-removable flag for eMMC
     - [arm64] dts: ti: k3-am6*: Remove disable-wp for eMMC
     - [arm64] dts: ti: k3-am62*: Move eMMC pinmux to top level board file
     - debugfs: fix mount options not being applied
     - smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy()
     - fs/buffer: fix use-after-free when call bh_read() helper
     - use uniform permission checks for all mount propagation changes
     - cpuidle: menu: Remove iowait influence
     - cpuidle: governors: menu: Avoid selecting states with too much latency
     - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
     - [arm64] mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1
     - ftrace: Also allocate and copy hash for reading of filter files
     - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe()
     - iio: proximity: isl29501: fix buffered read on big-endian systems
     - most: core: Drop device reference after usage in get_channel()
     - kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq()
     - cdx: Fix off-by-one error in cdx_rpmsg_probe()
     - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
     - [amd64] comedi: Make insn_rw_emulate_bits() do insn->n samples
     - [amd64] comedi: pcl726: Prevent invalid irq number
     - [amd64] comedi: Fix use of uninitialized memory in do_insn_ioctl() and
       do_insnlist_ioctl()
     - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE
       test
     - usb: renesas-xhci: Fix External ROM access timeouts
     - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
     - usb: storage: realtek_cr: Use correct byte order for bcs->Residue
     - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
     - usb: typec: maxim_contaminant: disable low power mode when reading
       comparator values
     - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port
       is clean
     - usb: xhci: Fix slot_id resource race conflict
     - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
     - usb: dwc3: Remove WARN_ON for device endpoint command timeouts
     - usb: dwc3: pci: add support for the Intel Wildcat Lake
     - iio: light: Use aligned_s64 instead of open coding alignment.
     - iio: light: as73211: Ensure buffer holes are zeroed
     - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read()
     - tracing: Remove unneeded goto out logic
     - tracing: Limit access to parser->buffer when trace_get_user failed
     - [amd64] drm/i915/icl+/tc: Convert AUX powered WARN to a debug message
     - compiler: remove __ADDRESSABLE_ASM{_STR,}() again
     - [amd64] drm/i915/icl+/tc: Cache the max lane count value
     - ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp()
     - tls: fix handling of zero-length records on the rx_list
     - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to
       aligned_s64
     - iio: imu: inv_icm42600: use = { } instead of memset()
     - iio: imu: inv_icm42600: Convert to uXX and sXX integer types
     - iio: imu: inv_icm42600: change invalid data error to -EBUSY
     - [amd64] x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper
     - drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor().
     - cgroup/cpuset: Use static_branch_enable_cpuslocked() on
       cpusets_insane_config_key
     - cgroup/cpuset: Fix a partition error with CPU hotplug
     - drm/panic: Move drawing functions to drm_draw
     - drm/format-helper: Add conversion from XRGB8888 to BGR888
     - drm/format-helper: Move helpers for pixel conversion to header file
     - drm/format-helper: Add generic conversion to 32-bit formats
     - iosys-map: Fix undefined behavior in iosys_map_clear()
     - [arm64] RDMA/hns: Fix querying wrong SCC context for DIP algorithm
     - RDMA/bnxt_re: Fix to do SRQ armena by default
     - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path
     - RDMA/bnxt_re: Fix a possible memory leak in the driver
     - RDMA/bnxt_re: Fix to initialize the PBL array
     - RDMA/hns: Fix dip entries leak on devices newer than hip09
     - net: bridge: fix soft lockup in br_multicast_query_expired()
     - scsi: qla4xxx: Prevent a potential error pointer dereference
     - [amd64] iommu/amd: Avoid stack buffer overflow from kernel cmdline
       (CVE-2025-38676)
     - Bluetooth: hci_sync: Fix scan state after PA Sync has been established
     - Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown
     - Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF
     - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established
     - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync()
     - [arm64] drm/hisilicon/hibmc: refactored struct hibmc_drm_private
     - [arm64] drm/hisilicon/hibmc: fix the i2c device resource leak when vdac
       init failed
     - [arm64] drm/hisilicon/hibmc: fix the hibmc loaded failed bug
     - ALSA: usb-audio: Fix size validation in convert_chmap_v3()
     - drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session()
     - drm/amd/display: Don't print errors for nonexistent connectors
     - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
     - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
     - [arm64] net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path
     - ppp: fix race conditions in ppp_fill_forward_path
     - net: ti: icssg-prueth: Fix HSR and switch offload Enablement during
       firwmare reload.
     - cifs: Fix oops due to uninitialised variable
     - phy: mscc: Fix timestamping for vsc8584
     - net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization
     - gve: prevent ethtool ops after shutdown
     - net/smc: fix UAF on smcsk after smc_listen_out()
     - [s390x] mm: Do not map lowcore with identity mapping
     - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
     - igc: fix disabling L1.2 PCI-E link substate on I226 on init
     - [armhf] net: dsa: microchip: Fix KSZ9477 HSR port setup issue
     - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
     - net/sched: Remove unnecessary WARNING condition for empty child qdisc in
       htb_activate
     - ALSA: timer: fix ida_free call while not allocated
     - bonding: update LACP activity flag after setting lacp_active
     - bonding: send LACPDUs periodically in passive mode after receiving
       partner's LACPDU
     - [arm64] Octeontx2-af: Skip overlap check for SPI field
     - net/mlx5: Base ECVF devlink port attrs from 0
     - net/mlx5: Relocate function declarations from port.h to mlx5_core.h
     - net/mlx5: Add IFC bits and enums for buf_ownership
     - net/mlx5e: Query FW for buffer ownership
     - net/mlx5e: Preserve shared buffer capacity during headroom updates
     - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
     - [s390x] hypfs: Avoid unnecessary ioctl registration in debugfs
     - [s390x] hypfs: Enable limited access during lockdown
     - netfilter: nf_reject: don't leak dst refcount for loopback packets
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.45
     - rtla: Check pkg-config install
     - trace/fgraph: Fix the warning caused by missing unregister notifier
     - of: dynamic: Fix memleak when of_pci_add_properties() failed
     - of: dynamic: Fix use after free in of_changeset_add_prop_helper()
     - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
     - perf symbol-minimal: Fix ehdr reading in filename__read_build_id
     - vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER
     - scsi: core: sysfs: Correct sysfs attributes access rights
     - smb: client: fix race with concurrent opens in unlink(2)
     - smb: client: fix race with concurrent opens in rename(2)
     - [arm64] ASoC: codecs: tx-macro: correct tx_macro_component_drv name
     - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC
     - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list
     - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
     - [arm64] drm/msm: Defer fd_install in SUBMIT ioctl
     - of: reserved_mem: Restructure call site for dma_contiguous_early_fixup()
     - [arm64] drm/msm/kms: move snapshot init earlier in KMS init
     - [arm64] drm/msm: update the high bitfield of certain DSI registers
     - [arm64] drm/mediatek: Add error handling for old state CRTC in
       atomic_disable
     - [powerpc*] kvm: Fix ifdef to remove build warning
     - HID: input: rename hidinput_set_battery_charge_status()
     - HID: input: report battery status changes immediately
     - net: macb: fix unregister_netdev call order in macb_remove()
     - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success
     - Bluetooth: hci_event: Mark connection as closed during suspend disconnect
     - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
     - Bluetooth: hci_sync: fix set_local_name race condition
     - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
     - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr
     - drm/nouveau: remove unused memory target test
     - ice: don't leave device non-functional if Tx scheduler config fails
     - ice: use fixed adapter index for E825C embedded devices
     - ice: fix incorrect counter for buffer allocation failures
     - dt-bindings: display/msm: qcom,mdp5: drop lut clock
     - net: dlink: fix multicast stats being counted incorrectly
     - drm/xe/xe_sync: avoid race during ufence signaling
     - drm/xe: Don't trigger rebind on initial dma-buf validation
     - phy: mscc: Fix when PTP clock is register and unregister
     - bnxt_en: Fix memory corruption when FW resources change during ifdown
     - bnxt_en: Adjust TX rings if reservation is less than requested
     - bnxt_en: Fix stats context reservation logic
     - net/mlx5: Reload auxiliary drivers on fw_activate
     - net/mlx5: Fix lockdep assertion on sync reset unload event
     - net/mlx5: Nack sync reset when SFs are present
     - net/mlx5e: Update and set Xon/Xoff upon MTU set
     - net/mlx5e: Update and set Xon/Xoff upon port speed set
     - net/mlx5e: Set local Xoff after FW update
     - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
     - net: stmmac: xgmac: Correct supported speed modes
     - net: stmmac: Set CIC bit only for TX queues with COE
     - [amd64,arm64] hv_netvsc: Link queues to NAPIs
     - [amd64,arm64] net: hv_netvsc: fix loss of early receive events from host
       during channel open.
     - net: rose: split remove and free operations in rose_remove_neigh()
     - net: rose: convert 'use' field to refcount_t
     - net: rose: include node references in rose_neigh refcount
     - sctp: initialize more fields in sctp_v6_from_sk()
     - l2tp: do not use sock_hold() in pppol2tp_session_get_sock()
     - fbnic: Move phylink resume out of service_task and into open/close
     - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
     - net: macb: Disable clocks once
     - [amd64] KVM: x86: use array_index_nospec with indices that come from guest
     - [riscv64] KVM: fix stack overrun when loading vlenb
     - [amd64] x86/microcode/AMD: Handle the case of no BIOS microcode
     - [amd64] x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on
       AMD/HYGON
     - HID: asus: fix UAF via HID_CLAIMED_INPUT validation
     - HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
     - HID: quirks: add support for Legion Go dual dinput modes
     - HID: logitech: Add ids for G PRO 2 LIGHTSPEED
     - HID: wacom: Add a new Art Pen 2
     - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
     - Revert "drm/amdgpu: fix incorrect vm flags to map bo"
     - blk-zoned: Fix a lockdep complaint about recursive locking
     - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted
     - fs/smb: Fix inconsistent refcnt update
     - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
     - smb3 client: fix return code mapping of remap_file_range
     - xfs: do not propagate ENODATA disk errors into xattr code
     - drm/xe/vm: Clear the scratch_pt pointer on error
     - drm/nouveau/disp: Always accept linear modifier
     - drm/nouveau: fix error path in nvkm_gsp_fwsec_v2
     - drm/mediatek: Fix device/node reference count leaks in
       mtk_drm_get_all_drm_priv
     - drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode
     - net: rose: fix a typo in rose_clear_routes()
     - PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS
     - PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up
     - Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to
       LANE0_1_STATUS"
     - [arm64] thermal/drivers/mediatek/lvts_thermal: Change lvts commands array
       to static const
     - [arm64] thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their
       sizes to driver data
     - [arm64] thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.46
     - bpf: Add cookie object to bpf maps
     - bpf: Move bpf map owner out of common struct
     - bpf: Move cgroup iterator helpers to bpf.h
     - bpf: Fix oob access in cgroup local storage (CVE-2025-38502)
     - btrfs: fix race between logging inode and checking if it was logged before
     - btrfs: fix race between setting last_dir_index_offset and inode logging
     - btrfs: avoid load/store tearing races when checking if an inode was logged
     - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN
     - drm/amd/display: Don't warn when missing DCE encoder caps
     - cpupower: Fix a bug where the -t option of the set subcommand was not
       working.
     - Bluetooth: hci_sync: Avoid adding default advertising on startup
     - btrfs: zoned: skip ZONE FINISH of conventional zones
     - fs: writeback: fix use-after-free in __mark_inode_dirty()
     - tee: fix NULL pointer dereference in tee_shm_put
     - tee: fix memory leak in tee_dyn_shm_alloc_helper
     - [arm64] dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro
     - [arm64] tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible"
     - [arm64] dts: imx8mp-tqma8mpql: fix LDO5 power off
     - [arm64] dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics
       i.MX8M Plus DHCOM
     - [arm64] dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M
       Plus eDM SBC
     - HID: simplify snto32()
     - HID: stop exporting hid_snto32()
     - HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556)
     - net: usb: qmi_wwan: fix Telit Cinterion FN990A name
     - net: usb: qmi_wwan: fix Telit Cinterion FE990A name
     - net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition
     - [arm64] mmc: sdhci-of-arasan: Support for emmc hardware reset
     - [arm64] mmc: sdhci-of-arasan: Ensure CD logic stabilization before
       power-up
     - wifi: cfg80211: fix use-after-free in cmp_bss()
     - wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info
       work
     - wifi: mt76: mt7925: fix locking in mt7925_change_vif_links()
     - wifi: mt76: prevent non-offchannel mgmt tx during scan/roc
     - wifi: mt76: free pending offchannel tx frames on wcid cleanup
     - wifi: mt76: fix linked list corruption
     - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in()
       after confirm
     - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
     - wifi: iwlwifi: uefi: check DSM item validity
     - Bluetooth: vhci: Prevent use-after-free by removing debugfs files early
     - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
     - netfilter: nft_flowtable.sh: re-run with random mtu sizes
     - net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y
     - [amd64] xirc2ps_cs: fix register access when enabling FullDuplex
     - mISDN: Fix memory leak in dsp_hwec_enable()
     - bnxt_en: fix incorrect page count in RX aggr ring log
     - icmp: fix icmp_ndo_send address translation for reply direction
     - net: macb: Fix tx_ptr_lock locking
     - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint
     - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()
     - net: mctp: mctp_fraq_queue should take ownership of passed skb
     - ice: fix NULL access of tx->in_use in ice_ll_ts_intr
     - [amd64,arm64] idpf: set mac type when adding and removing MAC filters
     - i40e: remove read access to debugfs files
     - i40e: Fix potential invalid access when MAC list is empty
     - ixgbe: fix incorrect map used in eee linkmode
     - wifi: ath11k: fix group data packet drops during rekey
     - net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6
     - [arm64] net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
     - net: skb: add pskb_network_may_pull_reason() helper
     - net: tunnel: add pskb_inet_may_pull_reason() helper
     - net: vxlan: add skb drop reasons to vxlan_rcv()
     - net: vxlan: make vxlan_snoop() return drop reasons
     - vxlan: Fix NPD when refreshing an FDB entry with a nexthop object
     - net: vxlan: make vxlan_set_mac() return drop reasons
     - net: vxlan: use kfree_skb_reason() in vxlan_xmit()
     - net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit()
     - net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE
     - vxlan: Refresh FDB 'updated' time upon 'NTF_USE'
     - vxlan: Avoid unnecessary updates to FDB 'used' time
     - vxlan: Add RCU read-side critical sections in the Tx path
     - vxlan: Rename FDB Tx lookup function
     - vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
     - wifi: cw1200: cap SSID length in cw1200_do_join()
     - wifi: libertas: cap SSID len in lbs_associate()
     - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
     - [arm64] net: thunder_bgx: add a missing of_node_put
     - [arm64] net: thunder_bgx: decrement cleanup index before use
     - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
     - net/smc: Remove validation of reserved bits in CLC Decline message
     - mctp: return -ENOPROTOOPT for unknown getsockopt options
     - ax25: properly unshare skbs in ax25_kiss_rcv()
     - net: atm: fix memory leak in atm_register_sysfs when device_register fail
     - ppp: fix memory leak in pad_compress_skb
     - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock
     - ALSA: usb-audio: Add mute TLV for playback volumes on some devices
     - [amd64] accel/ivpu: Prevent recovery work from being queued during device
       removal
     - ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids()
     - [arm64] ftrace: fix unreachable PLT for ftrace_caller in init_module with
       CONFIG_DYNAMIC_FTRACE
     - pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
     - io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU
       (CVE-2025-38453)
     - [amd64] x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and
       arch_sync_kernel_mappings()
     - mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE
     - mm: move page table sync declarations to linux/pgtable.h
     - mm: fix possible deadlock in kmemleak
     - mm: slub: avoid wake up kswapd in set_track_prepare
     - sched: Fix sched_numa_find_nth_cpu() if mask offline
     - ocfs2: prevent release journal inode after journal shutdown
     - of_numa: fix uninitialized memory nodes causing kernel panic
     - [arm64] soc: qcom: mdt_loader: Deal with zero e_shentsize
     - wifi: mwifiex: Initialize the chan_stats array to zero
     - wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete
     - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data()
     - wifi: mt76: mt7925: fix the wrong bss cleanup for SAP
     - net: ethernet: oa_tc6: Handle failure of spi_setup
     - drm/amdgpu: drop hw access in non-DC audio fini
     - drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG
     - [amd64] platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042
       quirks list
     - scsi: lpfc: Fix buffer free/clear order in deferred receive path
     - batman-adv: fix OOB read/write in network-coding decode
     - cifs: prevent NULL pointer dereference in UTF16 conversion
     - e1000e: fix heap overflow in e1000_set_eeprom
     - net: pcs: rzn1-miic: Correct MODCTRL register offset
     - fs/fhandle.c: fix a race in call of has_locked_children() (CVE-2025-38306)
     - [arm64,armhf] net: dsa: add hook to determine whether EEE is supported
     - [arm64,armhf] net: dsa: provide implementation of .support_eee()
     - [armhf] net: dsa: b53/bcm_sf2: implement .support_eee() method
     - [armhf] net: dsa: b53: do not enable EEE on bcm63xx (CVE-2025-38272)
     - md/raid1,raid10: don't ignore IO flags (CVE-2025-22125)
     - md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT
     - md/raid1,raid10: strip REQ_NOWAIT from member bios
     - ext4: define ext4_journal_destroy wrapper
     - ext4: avoid journaling sb update on error if journal is destroying
       (CVE-2025-22113)
     - wifi: ath11k: update channel list in reg notifier instead reg worker
       (CVE-2025-23133)
     - wifi: ath11k: update channel list in worker when wait flag is set
     - net: fix NULL pointer dereference in l3mdev_l3_rcv (CVE-2025-22103)
     - md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb
       (CVE-2025-22124)
     - mm: slub: Print the broken data before restoring them
     - mm: slub: call WARN() when detecting a slab corruption
     - mm, slab: cleanup slab_bug() parameters
     - mm/slub: avoid accessing metadata when pointer is invalid in object_err()
     - nouveau: fix disabling the nonstall irq due to storm code
     - mm: fix accounting of memmap pages
     - [arm64] thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum
       threshold
     - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
     - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY
     - Revert "drm/amdgpu: Avoid extra evict-restore process."
     - pcmcia: omap: Add missing check for platform_get_resource
     - pcmcia: Add error handling for add_interval() in do_validate_mem()
     - [amd64] platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan
       quirk
     - [amd64] platform/x86/intel: power-domains: Use
       topology_logical_package_id() for package ID
     - block: add a queue_limits_commit_update_frozen helper
     - scsi: sr: Reinstate rotational media flag
     - drm/bridge: ti-sn65dsi86: fix REFCLK setting
     - perf bpf-event: Fix use-after-free in synthesis
     - perf bpf-utils: Constify bpil_array_desc
     - perf bpf-utils: Harden get_bpf_prog_info_linear
     - drm/amd/amdgpu: Fix missing error return on kzalloc failure
     - tools: gpio: remove the include directory on make clean
     - md: prevent incorrect update of resync/recovery offset
     - [riscv64] ACPI: RISC-V: Fix FFH_CPPC_CSR error handling
     - [riscv64] Only allow LTO with CMODEL_MEDANY
     - [riscv64] use lw when reading int cpu in new_vmalloc_check
     - [riscv64] use lw when reading int cpu in asm_per_cpu
     - [riscv64] bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG
     - [riscv64] bpf: use lw when reading int cpu in bpf_get_smp_processor_id
     - md/raid1: fix data lost for writemostly rdev
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.47
     - [amd64] Add mitigations for VMSCAPE (CVE-2025-40300):
       - Documentation/hw-vuln: Add VMSCAPE documentation
       - x86/vmscape: Enumerate VMSCAPE bug
       - x86/vmscape: Add conditional IBPB mitigation
       - x86/vmscape: Enable the mitigation
       - x86/bugs: Move cpu_bugs_smt_update() down
       - x86/vmscape: Warn when STIBP is disabled with SMT
       - x86/vmscape: Add old Intel CPUs to affected list
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.48
     - fhandle: use more consistent rules for decoding file handle from userns
     - dma-debug: store a phys_addr_t in struct dma_debug_entry
     - dma-mapping: trace dma_alloc/free direction
     - dma-mapping: use trace_dma_alloc for dma_alloc* instead of using
       trace_dma_map
     - dma-mapping: trace more error paths
     - dma-debug: don't enforce dma mapping check on noncoherent allocations
     - net/mlx5: HWS, change error flow on matcher disconnect
     - mm: introduce and use {pgd,p4d}_populate_kernel()
     - dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err
     - dma-debug: fix physical address calculation for struct dma_debug_entry
     - nvme-pci: skip nvme_write_sq_db on empty rqlist
     - Revert "udmabuf: fix vmap_udmabuf error page set"
     - ext4: introduce linear search for dentries
     - [amd64] drm/i915/pmu: Fix zero delta busyness issue
     - drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed
     - Revert "drm/amd/display: Optimize cursor position updates"
     - ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA
     - drm/amdgpu: Add back JPEG to video caps for carrizo and newer
     - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read
     - SUNRPC: call xs_sock_process_cmsg for all cmsg
     - NFSv4: Don't clear capabilities that won't be reset (Closes: #1114898)
     - trace/fgraph: Fix error handling
     - tracing: Fix tracing_marker may trigger page fault during preempt_disable
     - nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter
     - nfs/localio: add direct IO enablement with sync and async IO support
     - nfs/localio: restore creds before releasing pageio data
     - ftrace/samples: Fix function size computation
     - fs/nfs/io: make nfs_start_io_*() killable
     - NFS: Serialise O_DIRECT i/o and truncate()
     - NFSv4.2: Serialise O_DIRECT i/o and fallocate()
     - NFSv4.2: Serialise O_DIRECT i/o and clone range
     - NFSv4.2: Serialise O_DIRECT i/o and copy range
     - NFS: nfs_invalidate_folio() must observe the offset and size arguments
     - NFSv4/flexfiles: Fix layout merge mirror check.
     - tracing: Silence warning when chunk allocation fails in trace_pid_write
     - [s390x] pai: Deny all events not handled by this PMU
     - [s390x] cpum_cf: Deny all sampling events by counter PMU
     - bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt
     - bpf: Allow fall back to interpreter for programs with stack size <= 512
     - bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()
     - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate
       psock->cork.
     - proc: fix type confusion in pde_set_flags()
     - Revert "SUNRPC: Don't allow waiting for exiting tasks"
     - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN
     - ocfs2: fix recursive semaphore deadlock in fiemap call
     - btrfs: fix squota compressed stats leak
     - btrfs: fix subvolume deletion lockup caused by inodes xarray race
     - [amd64] i2c: i801: Hide Intel Birch Stream SoC TCO WDT
     - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM
       wakeups
     - [armhf] mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
     - [armhf] mtd: rawnand: stm32_fmc2: fix ECC overwrite
     - fuse: do not allow mapping a non-regular backing file
     - fuse: check if copy_file_range() returns larger than requested size
     - fuse: prevent overflow in copy_file_range return value
     - mm/khugepaged: fix the address passed to notifier on testing young
     - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison
       memory
     - mm/memory-failure: fix redundant updates for already poisoned pages
     - mm/damon/core: set quota->charged_from to jiffies at first charge window
     - mm/damon/lru_sort: avoid divide-by-zero in
       damon_lru_sort_apply_parameters()
     - [arm64] drm/mediatek: fix potential OF node use-after-free
     - drm/xe: Attempt to bring bos back to VRAM after eviction
     - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time
     - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages
     - netlink: specs: mptcp: add missing 'server-side' attr
     - netlink: specs: mptcp: clearly mention attributes
     - netlink: specs: mptcp: replace underscores with dashes in names
     - netlink: specs: mptcp: fix if-idx attribute type
     - kernfs: Fix UAF in polling when open file is released
     - libceph: fix invalid accesses to ceph_connection_v1_info
     - ceph: fix race condition validating r_parent before applying state
     - ceph: fix race condition where r_parent becomes stale before sending
       message
     - mm/damon/sysfs: fix use-after-free in state_show()
     - mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters()
     - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range()
     - [arm64] mtd: spinand: winbond: Fix oob_layout for W25N01JW
     - btrfs: use readahead_expand() on compressed extents
     - btrfs: fix corruption reading compressed range when block size is smaller
       than page size
     - hrtimers: Unconditionally update target CPU base after offline timer
       migration
     - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table
     - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO
       runtime PM wakeups"
     - tty: hvc_console: Call hvc_kick in hvc_write unconditionally
     - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks
     - USB: serial: option: add Telit Cinterion FN990A w/audio compositions
     - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
     - [arm64] drm/panthor: validate group queue count
     - [arm64,armhf] net: fec: Fix possible NPD in
       fec_enet_phy_reset_after_clk_enable()
     - genetlink: fix genl_bind() invoking bind() after -EPERM
     - net: bridge: Bounce invalid boolopts
     - tunnels: reset the GSO metadata before reusing the skb
     - docs: networking: can: change bcm_msg_head frames member to support
       flexible array
     - igb: fix link test skipping when interface is admin down
     - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
     - drm/amd/display: use udelay rather than fsleep
     - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when
       j1939_local_ecu_get() failed
     - can: j1939: j1939_local_ecu_get(): undo increment when
       j1939_local_ecu_get() fails
     - netfilter: nft_set_pipapo: remove unused arguments
     - netfilter: nft_set: remove one argument from lookup and update functions
     - netfilter: nft_set_pipapo: merge pipapo_get/lookup
     - netfilter: nft_set_pipapo: don't return bogus extension pointer
     - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups
     - netfilter: nft_set_rbtree: continue traversal if element is inactive
     - netfilter: nf_tables: Reintroduce shortened deletion notifications
     - netfilter: nf_tables: place base_seq in struct net
     - netfilter: nf_tables: make nft_set_do_lookup available unconditionally
     - netfilter: nf_tables: restart set lookup on base_seq change
     - net: hsr: Add VLAN CTAG filter support
     - hsr: use rtnl lock when iterating over ports
     - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr
     - [arm64] phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties
     - [amd64] dmaengine: idxd: Remove improper idxd_free
     - [amd64] dmaengine: idxd: Fix refcount underflow on module unload
     - [amd64] dmaengine: idxd: Fix double free in idxd_setup_wqs()
     - [amd64] dmaengine: ti: edma: Fix memory allocation size for
       queue_priority_map
     - xhci: fix memory leak regression when freeing xhci vdev devices depth
       first
     - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
     - [amd64,arm64] usb: typec: tcpm: properly deliver cable vdms to altmode
       drivers
     - [arm64] dmaengine: qcom: bam_dma: Fix DT error handling for
       num-channels/ees
     - [arm64] phy: tegra: xusb: fix device and OF node leak at probe
     - [armhf] phy: ti: omap-usb2: fix device leak at unbind
     - [armhf] phy: ti-pipe3: fix device leak at unbind
     - [amd64] x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon
     - net: mdiobus: release reset_gpio in mdiobus_unregister_device()
     - [amd64] drm/i915/power: fix size for for_each_set_bit() in abox iteration
     - drm/amdgpu: fix a memory leak in fence cleanup when unloading
     - netfilter: nft_set_pipapo: fix null deref for empty set
 .
   [ Santiago Ruano Rincón ]
   * d/salsa-ci.yml: Merge the extract-source job into the build's job script
   * d/salsa-ci.yml: Suppress unreleased changes and mismatching distribution
     lintian tags.
   * d/salsa-ci.yml: Early move orig tarballs back where they can be cached
 .
   [ Salvatore Bonaccorso ]
   * [rt] Add new signing key for Daniel Wagner
   * [rt] Update to 6.12.43-rt12
   * [amd64] x86/bugs: Add SRSO_USER_KERNEL_NO support
   * [amd64] x86/bugs: KVM: Add support for SRSO_MSR_FIX
   * [amd64] KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 <=> 1 VM count
     transitions

lnav (0.12.4-1+deb13u1) trixie; urgency=medium
 .
   * [notcurses] handle failure to set cregs from tmux (Closes: #1109004)

log4cxx (1.4.0-1+deb13u1) trixie; urgency=medium
 .
   [ Lukas Märdian and Tobias Frost ]
   * Backport fixes for:
     - CVE-2025-54812: Improper HTML escaping in HTMLLayout (Closes: #1111879)
     - CVE-2025-54813: Improper escaping with JSONLayout (Closes: #1111881)

logcheck (1.4.5+deb13u1) trixie; urgency=medium
 .
   [ Paul Aurich ]
   * Update and simplify regex in ignore.d.paranoid/ssh
 .
   [ Yasuhiro Kimura ]
   * Update ignore.d.paranoid/ssh and ignore.d.server/ssh

lttng-modules (2.13.18-1+deb13u1) trixie; urgency=medium
 .
   * Fix potential kernel crash with syscall tracing (Closes: ##1117551)
   * [4b4342c] debian/gbp.conf: branch config for trixie
   * [a8a56d6] Add patch to fix syscall tracing with kernels >= v6.13

luksmeta (9-4+deb13u1) trixie; urgency=high
 .
   * Cherry-pick "Fix handling of large metadata". Closes: #111828
     [CVE-2025-11568]
luksmeta (9-4+deb12u1) bookworm; urgency=high
 .
   * Cherry-pick "Fix handling of large metadata". Closes: #111828
     [CVE-2025-11568]

lxcfs (6.0.4-1+deb13u1) trixie; urgency=medium
 .
   * d/control:
     - Add a dependency on fuse3 (Closes: #1114596)

lxd (5.0.2+git20231211.1364ae4-9+deb13u1) trixie-security; urgency=high
 .
   * Backport fixes for the following security issues that are unfixed by
     Canonical in the stable-5.0 branch:
     - CVE-2025-54293 / GHSA-472f-vmf2-pr3h
     - CVE-2025-54287 / GHSA-w2hg-2v4p-vmh6
     - CVE-2025-54288 / GHSA-7232-97c6-j525
   * Backport fixes for the following security issues fixed by Canonical:
     - CVE-2025-54286 / GHSA-p8hw-rfjg-689h

magit (4.3.5-1+deb13u1) trixie; urgency=medium
 .
   * Update d/gbp.conf to track trixie branch
   * Ship missing magit-dired.el in elpa-magit (Closes: 1120049)

mailmindr (1.7.1-2~deb13u1) trixie; urgency=medium
 .
   * Rebuild to upload to trixie after thunderbird 140.3

malcontent (0.13.0-2+deb13u1) trixie; urgency=medium
 .
   * Team upload
 .
   [ Alessandro Astone ]
   * Fix filtering snaps after snapd 2.72 (Closes: #1120080, LP: #2128350)
   * Fix listing flatpaks in parental control UI (Closes: #1113776)
   * Fix memory leak when checking snaps

mapserver (8.4.0-4+deb13u1) trixie; urgency=medium
 .
   * Update branch in gbp.conf & Vcs-Git URL.
   * Add upstream patch to fix CVE-2025-59431.
   * Update symbols for msStringUnescape.

mc (3:4.8.33-1+deb13u1) trixie; urgency=high
 .
   * Non-maintainer upload.
   * Added debian/patches/subshell-fd.patch (Closes: #1108061)

modsecurity-apache (2.9.11-1+deb13u1) trixie; urgency=medium
 .
   * Add patch against new CVE; Fixes CVE-2025-54571 (Closes: #1110480)
   * Remove d/patches/aclocal.patch, not necessary

monitoring-plugins (2.4.0-3+deb13u1) trixie; urgency=medium
 .
   * [3cb6abf] d/.gitlab-ci.yml: Change RELEASE to trixie
   * [1b5ea7b] Adding d/patches/25_check_users_sd_get_uids to fix user count
   * [b92ed85] Adding d/p/26_check_mysql_replica from upstream (Closes: #1116027)
   * [4362a8d] d/control: Adding libsystemd-dev and libsystemd0 as build-dep
     (Closes: #1110265)
   * [22de282] d/control: Drop libsystemd0 from build-deps, pulled by libsystemd-dev

mpv (0.40.0-3+deb13u1) trixie; urgency=medium
 .
   * debian/gbp.conf: Work on debian/trixie branch
   * debian/patches: Create missing folders for watch history (Closes: #1115938)

mrtg (2.17.10-13+deb13u1) trixie; urgency=medium
 .
   * debian/patches/010_enable-www-dir.patch: dropped because it is generating
     duplicate information in config file when using the cfgmaker command
     (WorkDir field). Thanks to Lloyd <ng2d68@proton.me>. (Closes: #1111333)

nextcloud-desktop (3.16.7-1~deb13u1) trixie; urgency=medium
 .
   * Rebuild for Trixie.
 .
 nextcloud-desktop (3.16.7-1) unstable; urgency=medium
 .
   * New upstream release.
 .
 nextcloud-desktop (3.16.6-3) unstable; urgency=medium
 .
   * Release to unstable (#1091614 is fixed).
 .
 nextcloud-desktop (3.16.6-2) experimental; urgency=medium
 .
   * Fix again "nextcloud enters busy loop when using a share on NTFS."
     (Closes: 1091614)
 .
 nextcloud-desktop (3.16.6-1) experimental; urgency=medium
 .
   * New upstream release.
   * Update patch hunks.
   * Remove patch for #1091614, it seems fixed on upstream.
nextcloud-desktop (3.16.6-3) unstable; urgency=medium
 .
   * Release to unstable (#1091614 is fixed).
 .
 nextcloud-desktop (3.16.6-2) experimental; urgency=medium
 .
   * Fix again "nextcloud enters busy loop when using a share on NTFS."
     (Closes: 1091614)
 .
 nextcloud-desktop (3.16.6-1) experimental; urgency=medium
 .
   * New upstream release.
   * Update patch hunks.
   * Remove patch for #1091614, it seems fixed on upstream.
nextcloud-desktop (3.16.6-2) experimental; urgency=medium
 .
   * Fix again "nextcloud enters busy loop when using a share on NTFS."
     (Closes: 1091614)
nextcloud-desktop (3.16.6-1) experimental; urgency=medium
 .
   * New upstream release.
   * Update patch hunks.
   * Remove patch for #1091614, it seems fixed on upstream.

nfdump (1.7.5-2+deb13u1) trixie; urgency=medium
 .
   * [3d717345] Cherry-Pick upstream fix for -S (subdir) together with -M
     (multiple sources) (Closes: #1112376)
   * [018d04be] Salsa CI: Adjust for trixie
   * [5cb8e85c] d/gbp.conf: Adjust for trixie

nncp (8.11.0-4+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Prevent path traversal during freq/file (CVE-2025-60020)
     (Closes: #1115848)

node-sha.js (2.4.11+~2.4.0-2+deb13u1) trixie-security; urgency=medium
 .
   * Team upload
   * Fix improper input validation vulnerability (Closes: #1111769, CVE-2025-9288)
   * Add dependencies to node-get-intrinsic, node-isarray and node-is-typed-array
node-sha.js (2.4.11+~2.4.0-2+deb12u1) bookworm-security; urgency=medium
 .
   * Fix improper input validation vulnerability (Closes: #1111769, CVE-2025-9288)
   * Add dependencies to node-get-intrinsic, node-isarray and node-is-typed-array

node-tar-fs (3.0.9+~cs2.0.4-1+deb13u1) trixie-security; urgency=medium
 .
   * Team upload
   * Apply fix for CVE-2025-59343 (Closes: #1116338)

nova (2:31.0.0-6+deb13u1) trixie; urgency=high
 .
   * A vulnerability has been identified in OpenStack Nova and OpenStack Watcher
     in conjunction with volume swap operations performed by the Watcher
     service. Under specific circumstances, this can lead to a situation where
     two Nova libvirt instances could reference the same block device, allowing
     accidental information disclosure to the unauthorized instance. Added
     upstream patch: OSSN-0094_restrict_swap_volume_to_cinder.patch.
     (Closes: #1111689).
   * Blacklist non-deterministic unit test:
     - ComputeTestCase.test_add_remove_fixed_ip_updates_instance_updated_at

nvidia-graphics-drivers-tesla-535 (535.274.02-1~deb13u1) trixie; urgency=medium
 .
   * Rebuild for trixie.
 .
 nvidia-graphics-drivers-tesla-535 (535.274.02-1) unstable; urgency=medium
 .
   * New upstream LTS and Tesla branch release 535.274.02 (2025-09-30).
     * Fixed CVE-2025-23280, CVE-2025-23282, CVE-2025-23300, CVE-2025-23330,
       CVE-2025-23332, CVE-2025-23345.  (Closes: #1118688)
       https://nvidia.custhelp.com/app/answers/detail/a_id/5703
 .
   [ Andreas Beckmann ]
   * Refresh patches.

onetbb (2022.1.0-1+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * Skip some tests when the machine has a single CPU. Closes: #1108053.
   * Skip test_mutex, it fails in Salsa CI. Closes: #1094260.

open-vm-tools (2:12.5.0-2+deb13u1) trixie; urgency=high
 .
   * [eb68735] Gitlab CI / GBP configs: use trixie
   * [21e31a4] Disable (default) the execution of the SDMP get-versions.sh script
     (CVE-2025-41244)
     Thanks to Salvatore Bonaccorso
   * [0e87684] Generate debdiffs in salsa CI automatically

openjdk-21 (21.0.9+10-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie
openjdk-21 (21.0.9~8ea-1) unstable; urgency=medium
 .
   * OpenJDK 21.0.9 early access, build 8.
 .
   [ Matthias Klose ]
   * d/rules: Let the install target depend on the build target. Closes: #1105471.
 .
   [ Vladimir Petko ]
   * d/t/problems.csv: Synchronize problem list.
openjdk-21 (21.0.9~5ea-1) unstable; urgency=medium
 .
   * OpenJDK 21.0.9 early access, build 5.
 .
   [ Vladimir Petko ]
   * d/copyright-generator/copyright-gen.py: bump copyright year.
   * d/copyright: regenerate.
 .
   [ Matthias Klose ]
   * Build using GCC 15 on development releases.

openjdk-25 (25.0.1+8-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie
openjdk-25 (25+36-1) unstable; urgency=medium
 .
   * OpenJDK 25 GA, build 36. Release notes:
     https://mail.openjdk.org/pipermail/jdk-dev/2025-September/010483.html
 .
   [ Vladimir Petko ]
   * d/rules: Mark as release.
   * d/watch: Regenerate.
openjdk-25 (25~36ea-1) unstable; urgency=medium
 .
   * OpenJDK 25 snapshot, Build 36.
   * Build using GCC 15 on development releases.
openjdk-25 (25~34ea-1) unstable; urgency=medium
 .
   * OpenJDK 25 snapshot, Build 34.
 .
   [ Matthias Klose ]
   * Update VCS attributes.
 .
   [ Vladimir Petko ]
   * d/copyright-generator/copyright-gen.py: bump copyright year.
   * d/copyright: regenerate.

openssl (3.5.4-1~deb13u1) trixie; urgency=medium
 .
   * Import 3.5.4
openssl (3.5.3-1) unstable; urgency=medium
 .
   * Import 3.5.3
   * Drop pic & Bsymbolic patches. This shouldn't be needed anymore.
openssl (3.5.2-1) unstable; urgency=medium
 .
   * Import 3.5.2
openssl (3.5.1-1+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2025-9230 (Out-of-bounds read & write in RFC 3211 KEK Unwrap)
   * CVE-2025-9231 (Timing side-channel in SM2 algorithm on 64 bit ARM)
   * CVE-2025-9232 (Out-of-bounds read in HTTP client no_proxy handling)

openvpn-auth-radius (2.1-9+deb13u1) trixie; urgency=medium
 .
   * patches/0008-authenticate-fix: Fix packet authentication
     (Closes: Bug#1118479)

orphan-sysvinit-scripts (0.21+deb13u2) trixie; urgency=medium
 .
   * Add haveged init script (Closes: #1118622)

patroni (4.0.7-3~deb13u1) trixie; urgency=medium
 .
   * Upload to stable.
patroni (4.0.7-2) unstable; urgency=medium
 .
   * debian/tests/acceptance: Further changes to stopping etcd. If the init
     script exists, use it. Otherwise, if systemd is available, use that. If
     neither are available, do not try to stop etcd.
patroni (4.0.7-1) unstable; urgency=medium
 .
   * New upstream release.
   * debian/patches/startup_scripts.patch: Refreshed.
   * debian/patches/avoid_overwriting_configuration_during_boostrap.patch:
     Likewise.
   * debian/patches/replslot-cluster-type-attribute.patch: Likewise.
   * debian/tests/acceptance: Only stop etcd if init script exists.

pdns-recursor (5.2.6-0+deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 5.2.6, fixing CVE-2025-59023.
pdns-recursor (5.2.5-1) unstable; urgency=medium
 .
   * New upstream version 5.2.5
pdns-recursor (5.2.4-2+deb13u1) trixie; urgency=medium
 .
   * d/gbp.conf: update for trixie branch
   * d/rules: fix DEB_VERSION/DEB_VENDOR being empty.
     Thanks to Steve Mokris <steve@kosada.com> (Closes: #1113814)
   * d/rules: stop setting CARGO_REGISTRY, fixes Static-Built-Using
     Thanks to Fabian Gruenbichler.

phpmyadmin (4:5.2.2-really+dfsg-1+deb13u1) trixie; urgency=medium
 .
   * Update d/missing-source for CVE-2025-3573 - jquery-validation
     - Fix XSS in the showLabel() function

poppler (25.03.0-5+deb13u2) trixie; urgency=high
 .
   [ Leonidas Da Silva Barbosa ]
   * SECURITY UPDATE: Denial of service
     - debian/patches/CVE-2025-50420.patch: don't continue
       recursing in PDFDoc in poppler/PDFDoc.cc.
     - CVE-2025-50420 (Closes: #1110463)

postfix (3.10.5-1~deb13u1) trixie; urgency=medium
 .
   * new upstream stable/bugfix 3.10.5 release, with multiple fixes.
     From the upstream release notes:
   - Workaround for an interface mis-match between the Postfix SMTP client
     and MTA-STS policy plugins.
      * The existing behavior is to connect to any MX host listed in DNS, and
        to match the server certificate against any STS policy MX host pattern.
      * The corrected behavior is to connect to an MX host only if its
        name matches any STS policy MX host pattern, and to match the server
        certificate against the MX hostname.
     The corrected behavior must be enabled in two places: in Postfix with a
     new parameter "smtp_tls_enforce_sts_mx_patterns" (default: "yes") and in
     an MTA-STS plugin by enabling TLSRPT support, so that the plugin forwards
     STS policy attributes to Postfix. This works even if Postfix TLSRPT
     support is disabled at build time or at runtime.
   - TLSRPT Workaround: when a TLSRPT policy-type value is "no-policy-found",
     pretend that the TLSRPT policy domain value is equal to the recipient
     domain. This ignores that different policy types (TLSA, STS) use different
     policy domains.  But this is what Microsoft does, and therefore,
     what other tools expect.
   - Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP client's
     connection reuse logic did not distinguish between sessions that
     require SMTPUTF8 support, and sessions that do not. The solution is
      1) to store sessions with different SMTPUTF8 requirements
         under distinct connection cache storage keys, and
      2) to not cache a connection when SMTPUTF8 is required
         but the server does not support that feature
   - Bugfix (defect introduced: Postfix 3.0, date 20140731):
     the smtpd 'disconnect' command statistics did not count commands
     with "bad syntax" and "bad UTF-8 syntax" errors
   - Postfix 3.11 forward compatibility: to avoid ugly warnings when
     Postfix 3.11 is rolled back to an older version, allow a preliminary
     'size' record in maildrop queue files created with Postfix 3.11 or later
   - Bugfix (defect introduced: Postfix 3.8, date 20220128):
     non-reproducible build, because the 'postconf -e' output order
     for new main.cf entries was no longer deterministic
   - To make builds predictable, add missing meta_directory and
     shlib_directory settings to the stock main.cf file
   - Bugfix (defect introduced: Postfix 3.9, date 20230517):
     posttls-finger(1) logged an incorrectly-formatted port number
   * debian/patches/debian-defaults.patch: refresh, update for 2 new
     parameters (with defaults) in main.cf, and make it with less context
   * configure-instance.in: fix typo which caused recreating
     cadir in chroot and excessive logging (Closes: #1115412)
postfix (3.10.4-3) unstable; urgency=medium
 .
   * Revert "std23-bool.patch: gcc-15 support (#1097639)" (didn't work)
   * rules: specify -std=gnu17 for CC for now (actually Closes: #1097639)
postfix (3.10.4-2) unstable; urgency=medium
 .
   * std23-bool.patch: gcc-15 support (Closes: #1097639)
   * configure-instance.in: fix typo which caused recreating
     cadir in chroot and excessive logging (Closes: #1115412)
postfix (3.10.4-1) unstable; urgency=medium
 .
   * New upstream stable/bugfix version 3.10.4, with a handful of fixes
   * d/rules: use pkgconf for mongoc instead of hard-coding paths/libs

presage (0.9.1-2.6+deb13u1) trixie; urgency=medium
 .
   * debian/patches:
     + Add allow-words-with-apostrophes-to-be-predicted.patch. Support suggesting
       words containing apostrophes. Don't crash maliit-server / lomiri-keyboard
       / lomiri when using /usr/lib/lomiri-keyboard/plugins/en/database_en.db
       presage DB. (Closes: #770831, LP:#1384800).

privatebin-cli (2.0.2-1+deb13u1) trixie; urgency=medium
 .
   * d/patches: Add patch to fix GCM issues with newer golang. (Closes: #1108675)

proftpd-dfsg (1.3.8.c+dfsg-4+deb13u1) trixie; urgency=medium
 .
   [ Evgeni Golov <evgeni@debian.org> ]
   * Do not remove non-empty /srv/ftp upon purge (Closes: #1119295).

puppet-module-puppetlabs-rabbitmq (8.5.0-8+deb13u1) trixie; urgency=medium
 .
   * fix-list_users-provider.patch: also handle the case when there's no users
     at all.
   * Add setup-all-nodes-as-disk-nodes.patch.

puppet-module-tempest (25.0.0-1+deb13u1) trixie; urgency=medium
 .
   * Add Fix_autoloading_of_openstack_provider.patch.

python-eventlet (0.39.1-2+deb13u1) trixie; urgency=medium
 .
   * CVE-2025-58068: Eventlet is a concurrent networking library for Python.
     Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP
     Request Smuggling due to improper handling of HTTP trailer sections. This
     vulnerability could enable attackers to, bypass front-end security
     controls, launch targeted attacks against active site users, and poison web
     caches. Applied upstream patch (Closes: #1112515):
     - Fix_request_smuggling_vulnerability_by_discarding_trailers.patch

python-internetarchive (5.4.0-2~deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * backport fix for directory transversal issue (Closes: #1114635,
     CVE-2025-58438)

qemu (1:10.0.6+ds-0+deb13u2) trixie; urgency=medium
 .
   * d/changelog: remove wrong closes: #1095935 from the previous changelog
     entry (and reopen the bug): I confused it with another bug
   * linux-user-use-correct-type-for-FIBMAP-and-FIGETBSZ.patch - add a patch
     from upstream stable series (before next stable release) - fix wrong
     emulation of FIBMAP and FIGETBSZ ioctls.  Needed for s390x cloud images.
     Will be in next upstream stable release, so will be removed in next debian.
     (Closes: #1119257)
qemu (1:10.0.6+ds-0+deb13u1) trixie; urgency=medium
 .
   * new upstream stable/bugfix release:
    - Update version for 10.0.6 release
    - linux-user/microblaze: Fix little-endianness binary
    - target/hppa: correct size bit parity for fmpyadd
    - target/i386: user: do not set up a valid LDT on reset
    - async: access bottom half flags with qatomic_read
    - target/i386: fix x86_64 pushw op
    - i386/tcg/smm_helper: Properly apply DR values on SMM entry / exit
    - i386/cpu: Prevent delivering SIPI during SMM in TCG mode
    - i386/kvm: Expose ARCH_CAP_FB_CLEAR when invulnerable to MDS
    - target/i386: Fix CR2 handling for non-canonical addresses
    - block/curl.c: Use explicit long constants in curl_easy_setopt calls
    - pcie_sriov: Fix broken MMIO accesses from SR-IOV VFs
    - target/riscv: rvv: Fix vslide1[up|down].vx unexpected result
      when XLEN=32 and SEW=64
    - target/riscv: Fix ssamoswap error handling
    - target/riscv: Fix SSP CSR error handling in VU/VS mode
    - target/riscv: Fix the mepc when sspopchk triggers the exception
    - target/arm: Don't set HCR.RW for AArch32 only CPUs
    - pcie_sriov: make pcie_sriov_pf_exit() safe on non-SR-IOV devices
    - docs/devel: Correct uefi-vars-x64 device name
    - hid: fix incorrect return value for hid
    - ui/gtk: Fix callback function signature
    - ui/gtk: Consider scaling when propagating ui info
    - Revert "i386/cpu: Move adjustment of CPUID_EXT_PDCM
      before feature_dependencies[] check"
    - Revert "target/i386: do not expose ARCH_CAPABILITIES on AMD CPU"
   * new upstream stable/bugfix release:
    - Update version for 10.0.5 release
    - tests/functional/test_aarch64_sbsaref_freebsd:
      Fix the URL of the ISO image
    - tests/functional/test_ppc_bamboo: Replace broken link with working assets
    - physmem: Destroy all CPU AddressSpaces on unrealize
    - memory: New AS helper to serialize destroy+free
    - include/system/memory.h: Clarify address_space_destroy() behaviour
    - migration: Fix state transition in postcopy_start() error handling
    - target/riscv: rvv: Modify minimum VLEN according to enabled
      vector extensions
    - target/riscv: rvv: Replace checking V by checking Zve32x
    - target/riscv: Fix endianness swap on compressed instructions
    - hw/riscv/riscv-iommu: Fixup PDT Nested Walk
    - target/riscv: do not use translator_ldl in opcode_at
    - target/riscv: use riscv_csrr in riscv_csr_read
    - hw/char: sifive_uart: Raise IRQ according to the Tx/Rx
      watermark thresholds
    - docs/interop/firmware: Add riscv64 to FirmwareArchitecture
    - hw/riscv/riscv-iommu: Fix MSI table size limit
    - ui/icons/qemu.svg: Add metadata information (author, license) to the logo
    - ui/spice: Fix abort on macOS
    - ppc/spapr: init lrdr-capapcity phys with ram size if maxmem not provided
    - hw/intc/xics: Add missing call to register vmstate_icp_server
    - hw/usb/hcd-uhci: don't assert for SETUP to non-0 endpoint
      Closes: #1082377 (CVE-2024-8354)
    - tests/tcg/multiarch: Add tb-link test
    - accel/tcg: Properly unlink a TB linked to itself
    - tests: Fix "make check-functional" for targets without thorough tests
    - .gitlab-ci.d/buildtest.yml: Unset CI_COMMIT_DESCRIPTION for htags
    - tcg/optimize: Fix folding of vector bitsel
    - hw/pci-host/astro: Don't call pci_regsiter_root_bus() in init
    - hw/pci-host/dino: Don't call pci_register_root_bus() in init
    - target/sparc: Relax decode of rs2_or_imm for v7
    - target/sparc: Loosen decode of RDTBR for v7
    - target/sparc: Loosen decode of RDWIM for v7
    - target/sparc: Loosen decode of RDPSR for v7
    - target/sparc: Loosen decode of RDY for v7
    - target/sparc: Loosen decode of STBAR for v8
    - target/sparc: Allow TRANS macro with no extra arguments
    - linux-user: avoid -Werror=int-in-bool-context
    - multiboot: Fix the split lock
    - target/i386: Define enum X86ASIdx for x86's address spaces
    - i386/cpu: Enable SMM cpu address space under KVM
    - hw/usb/network: Remove hardcoded 0x40 prefix in STRING_ETHADDR response
    - rust: hpet: fix new warning
    - ci: run RISC-V cross jobs by default
    - tests/docker/dockerfiles/python.docker: pull fedora:40 image
      instead of fedora:latest
    - .gitmodules: move u-boot mirrors to qemu-project-mirrors
    - iotests/check: always enable all python warnings
    - iotests/151: ensure subprocesses are cleaned up
    - iotests/147: ensure temporary sockets are closed before exiting
    - python: ensure QEMUQtestProtocol closes its socket
    - iotests: drop compat for old version context manager
    - python: backport 'avoid creating additional event loops per thread'
    - python: backport 'Remove deprecated get_event_loop calls'
    - python: backport 'qmp-tui: Do not crash if optional dependencies
      are not met'
    - python: backport 'qmp-shell-wrap: handle missing binary gracefully'
    - python: backport 'Use @asynciocontextmanager'
    - python: backport 'drop Python3.6 workarounds'
    - python: backport 'kick event queue on legacy event_pull()'
    - ui/vnc: Fix crash when specifying [vnc] without id in the config file
    - target/loongarch: Guard 64-bit-only insn translation with TRANS64 macro
    - target/loongarch: Add CRC feature flag and use it to gate CRC instructions
   * new upstream stable/bugfix release:
    - Update version for 10.0.4 release
    - block/curl: fix curl internal handles handling
      (Closes: #1111809)
    - hw/gpio/pca9554: Avoid leak in pca9554_set_pin()
    - hw/ppc: Fix build error with CONFIG_POWERNV disabled
    - target/mips: fix TLB huge page check to use 64-bit shift
    - linux-user/mips: Select M14Kc CPU to run microMIPS binaries
    - linux-user/mips: Select 74Kf CPU to run MIPS16e binaries
    - elf: Add EF_MIPS_ARCH_ASE definitions
    - e1000e: Prevent crash from legacy interrupt firing after MSI-X enable
    - Revert "tests/qtest: use qos_printf instead of g_test_message"
    - vfio scsi ui: Error-check qio_channel_socket_connect_sync() the same way
    - i386/kvm/vmsr_energy: Plug memory leak on failure to connect socket
    - qga: Fix truncated output handling in guest-exec status reporting
    - qga-vss: Write hex value of error in log
    - qga/installer: Remove QGA VSS if QGA installation failed
    - hw/arm/stm32f205_soc: Don't leak TYPE_OR_IRQ objects
    - qemu/atomic: Finish renaming atomic128-cas.h headers
    - scripts/kernel-doc: Avoid new Perl precedence warning
    - target/arm: Trap PMCR when MDCR_EL2.TPMCR is set
    - hw/intc/arm_gicv3_kvm: preserve pending interrupts during cpr
    - linux-user: Add strace for rseq
    - i386/tcg/svm: fix incorrect canonicalization
    - python: mkvenv: fix messages printed by mkvenv
    - hw/uefi: open json file in binary mode
    - hw/uefi: check access for first variable
    - hw/uefi: return success for notifications
    - hw/uefi: clear uefi-vars buffer in uefi_vars_write callback
    - mkvenv: Support pip 25.2
    - hw/sd/ssi-sd: Return noise (dummy byte) when no card connected
    - qemu-iotests: Ignore indentation in Killed messages
    - rbd: Fix .bdrv_get_specific_info implementation
    - hw/nvme: cap MDTS value for internal limitation
    - hw/nvme: revert CMIC behavior
    - hw/nvme: fix namespace attachment
    - target/loongarch: Fix [X]VLDI raising exception incorrectly
    - ui/curses: Fix infinite loop on windows
    - ppc/xive2: Fix treatment of PIPR in CPPR update
    - ppc/xive2: Fix irq preempted by lower priority group irq
    - ppc/xive2: Reset Generation Flipped bit on END Cache Watch
    - ppc/xive: Fix PHYS NSR ring matching
    - ppc/xive2: fix context push calculation of IPB priority
    - ppc/xive2: Remote VSDs need to match on forwarding address
    - ppc/xive2: Fix calculation of END queue sizes
    - ppc/xive: Report access size in XIVE TM operation error logs
    - ppc/xive: Fix xive trace event output
    - target/i386/cpu: Move addressable ID encoding out of compat property
      in CPUID[0x1]
    - i386/cpu: Fix cpu number overflow in CPUID.01H.EBX[23:16]
    - i386/cpu: Fix number of addressable IDs field for CPUID.01H.EBX[23:16]
    - i386/cpu: Move adjustment of CPUID_EXT_PDCM before feature_dependencies[]
      check
    - Revert "i386/cpu: Fix cpu number overflow in CPUID.01H.EBX[23:16]"
      (The 5 changes above Closes: #1095935 in 10.0.x)
    - qga: correctly write to /sys/power/state on linux
      (Closes: #1108387)
    - scripts/make-release: Go back to cloning all the EDK2 submodules
    - target/arm: add support for 64-bit PMCCNTR in AArch32 mode
    - hw/ssi/aspeed_smc: Fix incorrect FMC_WDT2 register read on AST1030
    - target/arm: Fix handling of setting SVE registers from gdb
    - target/arm: Fix big-endian handling of NEON gdb remote debugging
    - hw/intc/arm_gicv3_kvm: Write all 1's to clear enable/active
    - hw/i386/amd_iommu: Move IOAPIC memory region initialization to the end
    - intel_iommu: Allow both Status Write and Interrupt Flag in QI wait
    - pcie_sriov: Fix configuration and state synchronization
    - virtio-net: Fix VLAN filter table reset timing
    - vhost: Do not abort on log-stop error
    - vhost: Do not abort on log-start error
    - virtio: fix off-by-one and invalid access in virtqueue_ordered_fill
    - target/loongarch: Fix valid virtual address checking
    - target/riscv: Restrict midelegh access to S-mode harts
    - target/riscv: Restrict mideleg/medeleg/medelegh access to S-mode harts
    - intc/riscv_aplic: Fix target register read when source is inactive
    - target/riscv: Fix pmp range wraparound on zero
    - target/riscv: Fix exception type when VU accesses supervisor CSRs
    - target/riscv: do not call GETPC() in check_ret_from_m_mode()
    - linux-user/strace.list: add riscv_hwprobe entry
    - roms/Makefile: fix npcmNxx_bootrom build rules
    - system/physmem: fix use-after-free with dispatch
    - hw/net/cadence_gem: fix register mask initialization
    - target/mips: Only update MVPControl.EVP bit if executed by master VPE
    - docs/user: clarify user-mode expects the same OS
    - linux-user/aarch64: Support TPIDR2_MAGIC signal frame record
    - linux-user/aarch64: Clear TPIDR2_EL0 when delivering signals
    - target/i386: fix width of third operand of VINSERTx128
    - hw/display/qxl-render.c: fix qxl_unpack_chunks() chunk size calculation
    - host-utils: Drop workaround for buggy Apple Clang __builtin_subcll()
   * drop patches included upstream:
    - hw-display-qxl-render.c-fix-qxl_unpack_chunks-chunk-.patch
    - pcie_sriov-Fix-configuration-and-state-synchronizati.patch
    - system-physmem-fix-use-after-free-with-dispatch.patch
   * d/control.mk: 10.0.6+ds
qemu (1:10.0.3+ds-4) unstable; urgency=medium
 .
   [ Heinrich Schuchardt ]
   * d/control: qemu-system-riscv missing recommends
     qemu-system-riscv needs the same/similar packages for EFI, spice,
     opengl, special block devices, as qemu-system-arm and qemu-system-x86
 .
   [ Michael Tokarev ]
   * d/control: omit system-xen if omit-system build profile is specified
     this makes pkg.qemu.omit-system to omit all system components,
     including xen
   * qemu-user binfmts: stop supporting old kernels using custom patch
     qemu supports argv[0] handling with a help of kernel support since
     at least bullseye (or even buster), - for a really long time.
     There's no need to use custom code for older kernels anymore.
     Also closes: #1054104
   * d/binfmt-install: do not generate update-binfmt un-registration
     postinst script for upgrades from bookworm
   * d/control: drop old (pre-bookworm) breaks/replaces/conflicts/provides
   * hw-uefi-clear-uefi-vars-buffer-in-uefi_vars_write-CVE-2025-8860.patch
     Closes: #1111030, CVE-2025-8860
   * d/control: remove long-forgotten qemu-system-common dependency on acl
     (for #762192) which is not needed
   * remove qemu-user-static package (& qemu-debootstrap)
     remove links to qemu-user with -static suffix, together with
     obsolete qemu-debootstrap command.
     qemu-user-static is now provided by qemu-user-binfmt package.
     Also closes: #1107554
   * d/gbp.conf: switch to master branch
qemu (1:10.0.3+ds-3) unstable; urgency=medium
 .
   * d/binfmt-install: stop using C (Credentials) flag for binfmt_misc
     registration.  This means suid and sgid binaries under qemu-user
     will work without changing credentials.  This is a serious security
     issue, since qemu-user never supposed to be used in this way, and
     it is trivial to get elevated privileges for an attacker if there's
     any suid/sgid binary under qemu-user which is runnable for an
     attacker.  This change might break CI/testing environment expectations.
   * d/qemu-user.postinst: trigger /usr/lib/binfmt.d (#1110982)
   * d/rules: fix typo in comment (it is qemu-system-data, not qemu-user-data)
qemu (1:10.0.3+ds-2) unstable; urgency=medium
 .
   * d/control: (temporarily) build-depend on python3-distlib
     to work around new pip 25.2+ in forky
qemu (1:10.0.3+ds-1) unstable; urgency=medium
 .
   * new upstream stable/bugfix release:
    - Update version for 10.0.3 release
    - hvf: arm: Emulate ICC_RPR_EL1 accesses properly
    - target/arm: Correct encoding of Debug Communications Channel registers
      https://gitlab.com/qemu-project/qemu/-/issues/2986
    - ui: fix setting client_endian field defaults
    - hw/net/npcm_gmac.c: Send the right data for second packet in a row
    - target/i386: do not expose ARCH_CAPABILITIES on AMD CPU
    - i386/cpu: Honor maximum value for CPUID.8000001DH.EAX[25:14]
    - i386/cpu: Fix overflow of cache topology fields in CPUID.04H
    - i386/cpu: Fix cpu number overflow in CPUID.01H.EBX[23:16]
    - ui/vnc: Do not copy z_stream
    - vhost: Fix used memslot tracking when destroying a vhost device
    - roms: re-remove execute bit from hppa-firmware*
    - file-posix: Fix aio=reads performance regression after enablign FUA
      https://issues.redhat.com/browse/RHEL-96854
    - amd_iommu: Fix truncation of oldval in amdvi_writeq
    - amd_iommu: Remove duplicated definitions
    - amd_iommu: Fix the calculation for Device Table size
    - amd_iommu: Fix mask to retrieve Interrupt Table Root Pointer from DTE
    - amd_iommu: Fix masks for various IOMMU MMIO Registers
    - amd_iommu: Update bitmasks representing DTE reserved fields
    - amd_iommu: Fix Device ID decoding for INVALIDATE_IOTLB_PAGES command
    - amd_iommu: Fix Miscellaneous Information Register 0 encoding
    - virtio-net: Add queues for RSS during migration
    - net: fix buffer overflow in af_xdp_umem_create()
    - accel/kvm: Adjust the note about the minimum required kernel version
    - linux-user: Use qemu_set_cloexec() to mark pidfd as FD_CLOEXEC
    - migration: Don't sync volatile memory after migration completes
    - linux-user: Hold the fd-trans lock across fork
      https://gitlab.com/qemu-project/qemu/-/issues/2846
    - linux-user: Check for EFAULT failure in nanosleep
    - linux-user: Implement fchmodat2 syscall
      https://gitlab.com/qemu-project/qemu/-/issues/3019
    - hw/arm/fsl-imx8mp: Wire VIRQ and VFIQ
    - target/arm: Don't enforce NSE,NS check for EL3->EL3 returns
      https://gitlab.com/qemu-project/qemu/-/issues/3016
    - target/i386: fix TB exit logic in gen_movl_seg() when writing to SS
      https://gitlab.com/qemu-project/qemu/-/issues/2987
    - target/arm: Fix bfdotadd_ebf vs nan selection
    - target/arm: Fix f16_dotadd vs nan selection
    - target/arm: Fix PSEL size operands to tcg_gen_gvec_ands
    - target/arm: Fix 128-bit element ZIP, UZP, TRN
    - target/arm: Fix sve_access_check for SME
    - target/arm: Fix SME vs AdvSIMD exception priority
    - hw/s390x/ccw-device: Fix memory leak in loadparm setter
    - virtio-gpu: support context init multiple timeline
    - target/arm: Correct KVM & HVF dtb_compatible value
    - target/arm: Make RETA[AB] UNDEF when pauth is not implemented
    - tcg: Fix constant propagation in tcg_reg_alloc_dup
      https://gitlab.com/qemu-project/qemu/-/issues/3002
    - target/loongarch: fix vldi/xvldi raise wrong error
    - target/loongarch: add check for fcond
    - linux-user/arm: Fix return value of SYS_cacheflush
    - hw/arm/mps2: Configure the AN500 CPU with 16 MPU regions
    - qemu-options.hx: Fix reversed description of icount sleep behavior
    - hw/arm/virt: Check bypass iommu is not set for iommu-map DT property
    - hw/loongarch/virt: Fix big endian support with MCFG table
    - hw/core/qdev-properties-system: Add missing return in set_drive_helper()
    - iotests: fix 240
    - target/i386: Remove FRED dependency on WRMSRNS
    - hw/audio/asc: fix SIGSEGV in asc_realize()
    - audio: fix size calculation in AUD_get_buffer_size_out()
    - audio: fix SIGSEGV in AUD_get_buffer_size_out()
    - hw/i386/amd_iommu: Fix xtsup when vcpus < 255
    - hw/i386/amd_iommu: Fix device setup failure when PT is on.
    - hw/i386/pc_piix: Fix RTC ISA IRQ wiring of isapc machine
    - vhost: Don't set vring call if guest notifier is unused
    - hw/arm: Add missing psci_conduit to NPCM8XX SoC boot info
    - ui/vnc: fix tight palette pixel encoding for 8/16-bpp formats
    - ui/vnc: take account of client byte order in pixman format
    - ui/vnc.c: replace big endian flag with byte order value
    - ui/sdl: Consider scaling in mouse event handling
    - ui/gtk: Update scales in fixed-scale mode when rendering GL area
    - gtk/ui: Introduce helper gd_update_scale
    - ui/gtk: Use consistent naming for variables in different coordinates
    - ui/gtk: Document scale and coordinate handling
    - hw/arm/aspeed_ast27x0: Fix RAM size detection failure on BE hosts
    - hw/misc/aspeed_hace: Ensure HASH_IRQ is always set
      to prevent firmware hang
   * d/gbp.conf: switch to debian-trixie branch
   * d/control.mk: checked-version=10.0.3+ds
   * qemu-img-options.patch: adjust help text for "convert" subcommand:
     use the historic option which were accepted by the upstream, not
     the new option introduced in this patch
   * pcie_sriov-Fix-configuration-and-state-synchronizati.patch from upstream
     Closes: #1109989, CVE-2025-54566, CVE-2025-54567

qt6-base (6.8.2+dfsg-9+deb13u1) trixie; urgency=medium
 .
   * Backport patch to fix high CPU load of kwin_x11 when locking the
     screen.

quicktext (6.4.6-1~deb13u1) trixie; urgency=medium
 .
   * Rebuildfor trixie after upload thunderbird 140.3
quicktext (6.4.4-1~exp1) experimental; urgency=medium
 .
   [ Mechtilde ]
   * [c2fa859] Improved d/u/metadata using Mozilla repo
   * [747d9c9] Fixed d/dpb.conf
   * [be3897e] New upstream version 6.4.4
   * [c2fa859] Improved d/u/metadata using Mozilla repo
   * [747d9c9] Fixed d/dpb.conf
   * [be3897e] New upstream version 6.4.4
quicktext (6.4.1-1~exp1) experimental; urgency=medium
 .
   [ Mechtilde ]
   * [19f530b] New upstream version 6.4.1
   * [a42d224] New upstream version 6.4
   * [f37aa19] Bumped version of thunderbird
   * [1fc0b84] Added d/dpb.conf for using with debian-package-scripts
   * [a72aabf] Bumped version for thunderbird

rabbitmq-server (4.0.5-6+deb13u2) trixie; urgency=medium
 .
   * CVE-2025-50200: In versions 3.13.7 and prior, RabbitMQ is logging
     authorization headers in plaintext encoded in base64. When querying
     RabbitMQ api with HTTP/s with basic authentication it creates logs with all
     headers in request, including authorization headers which show base64
     encoded username:password. This is easy to decode and afterwards could be
     used to obtain control to the system depending on credentials.
     Added upstream patch: Fix_Cowboy_crashes_caused_by_double_reply.patch.
     (Closes: #1108075)

redis (5:8.0.2-3+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2025-49844 / CVE-2025-46819 / CVE-2025-46818 / CVE-2025-46817

request-tracker5 (5.0.7+dfsg-4+deb13u1) trixie-security; urgency=medium
 .
   * Apply upstream patch which fixes several security vulnerabilities:
     - [CVE-2025-61873] Fix CSV injection via ticket values with special
       characters that are exported to a TSV from search results.
     - [CVE-2025-9158] Fix XSS via calendar invitations added to a ticket.

riseup-vpn (0.24.10+ds1-1+deb13u1) trixie; urgency=medium
 .
   * Add qml6-module-qtcore to Depends (Closes: #1110558)

rocm-hipamd (5.7.1-6+deb13u1) trixie; urgency=medium
 .
   [ Cordell Bloor ]
   * Add d/p/0041-inline-bf16-functions.patch to mark functions defined
     in amd_hip_bf16.h as inline. This change prevents multiple
     definition errors during linking for programs that include
     <hip/hip_bf16.h> in more than one translation unit (Closes: #1116585)
   * Fix hipcc manpage title (Closes: #1107681)
   * Fix spelling error in roc-obj-ls manpage

rsyslog-doc (8.2504.0+dfsg-1+deb13u1) trixie; urgency=medium
 .
   * Switch debian-branch to debian/trixie
   * Use sphinx_rtd_theme instead of the sphinx default theme.
     This matches what upstream has been using in the past and results in a
     nicer looking and more usable output, e.g. it produces a proper toc in
     the sidebar.

ruby-rack (3.1.18-1~deb13u1) trixie-security; urgency=medium
 .
   * New upstream version 3.1.18.
     - CVE-2025-61772: Multipart parser buffers unbounded per-part headers,
       enabling DoS (memory exhaustion).
     - CVE-2025-61771: Multipart parser buffers large non‑file fields
       entirely in memory, enabling DoS (memory exhaustion).
     - CVE-2025-61770: Unbounded multipart preamble buffering enables DoS
       (memory exhaustion).
     - CVE-2025-61780 Improper handling of headers in Rack::Sendfile may
       allow proxy bypass.
     - CVE-2025-61919 Unbounded read in Rack::Request form parsing can lead
       to memory exhaustion.
     - Closes: #1117855, #1117856, #1117627, #1117628

ruby-sys-filesystem (1.4.4-1+deb13u1) trixie; urgency=medium
 .
   * Backport upstream PR#82 to fix linux64 detection fails on s390x and alpha
     (Closes: #1114552).

rust-virtiofsd (1.13.2-1+deb13u1) trixie; urgency=medium
 .
   * add Depends: uidmap.  Closes: #1109051
     virtiofsd uses uidmap when run in a user namespace,
     and this is the most secure way to use it.
     So uidmap package is basically required.

sail (0.9.8-1+deb13u1) trixie; urgency=medium
 .
   * Add upstream patches to fix security vulnerabilities. (Closes: #1112346)
     - CVE-2025-32468
     - CVE-2025-35984
     - CVE-2025-46407
     - CVE-2025-50129
     - CVE-2025-52456
     - CVE-2025-52930
     - CVE-2025-53085
     - CVE-2025-53510

samba (2:4.22.6+dfsg-0+deb13u1) trixie; urgency=medium
 .
   * new upstream stable/security release:
    - https://bugzilla.samba.org/show_bug.cgi?id=15843:
      macOS Finder client DFS broken on 4.22.0
    - https://bugzilla.samba.org/show_bug.cgi?id=15900:
      'net ads group' failed to list domain groups
    - https://bugzilla.samba.org/show_bug.cgi?id=15905:
      samba-4.21 fails to join AD when multiple DCs are returned
    - https://bugzilla.samba.org/show_bug.cgi?id=15919:
      vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev for fsync_send
    - https://bugzilla.samba.org/show_bug.cgi?id=15921:
      CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set
    - https://bugzilla.samba.org/show_bug.cgi?id=15926:
      Samba 4.22 breaks Time Machine
    - https://bugzilla.samba.org/show_bug.cgi?id=15927:
      Spotlight search restriction for shares incomplete and default search
      searches in too many attributes
    - https://bugzilla.samba.org/show_bug.cgi?id=15931:
      rpcd_mdssvc may crash because name mangling is not initialized
    - https://bugzilla.samba.org/show_bug.cgi?id=15933:
      Only increment lease epoch if a lease was granted
 .
   * new upstream security release:
    - CVE-2025-9640: Uninitialized memory disclosure via vfs_streams_xattr
      https://www.samba.org/samba/security/CVE-2025-9640.html
    - CVE-2025-10230: Command injection via WINS server hook script
      https://www.samba.org/samba/security/CVE-2025-10230.html
samba (2:4.22.6+dfsg-0+deb13u1~bpo12+1) bookworm-backports; urgency=medium
 .
   * Rebuild for bookworm-backports (resolve before-trixie build profile).
samba (2:4.22.4+dfsg-1) unstable; urgency=medium
 .
   * new upstream stable/bugfix release:
    - https://bugzilla.samba.org/show_bug.cgi?id=14981:
      netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with SysvolReady=0
    - https://bugzilla.samba.org/show_bug.cgi?id=15663:
      Apparently there is a conflict between shadow_copy2 module
      and virusfilter (action quarantine)
    - https://bugzilla.samba.org/show_bug.cgi?id=15816:
      vfs_streams_depot fstatat broken
    - https://bugzilla.samba.org/show_bug.cgi?id=15840:
      kinit command is failing with Missing cache Error
    - https://bugzilla.samba.org/show_bug.cgi?id=15844:
      getpwuid does not shift to new DC when current DC is down
    - https://bugzilla.samba.org/show_bug.cgi?id=15876:
      Windows security hardening locks out schannel'ed
      netlogon dc calls like netr_DsRGetDCName
    - https://bugzilla.samba.org/show_bug.cgi?id=15877:
      Fix handling of empty GPO link
    - https://bugzilla.samba.org/show_bug.cgi?id=15880:
      SMB ACL inheritance doesn't work for files created
    - https://bugzilla.samba.org/show_bug.cgi?id=15881:
      Unresponsive second DC can cause idmapping failure when using idmap_ad
      (was libads-fix-get_kdc_ip_string.patch)
    - https://bugzilla.samba.org/show_bug.cgi?id=15891:
      Figuring out the DC name from IP address fails
      and breaks fork_domain_child()
    - https://bugzilla.samba.org/show_bug.cgi?id=15892:
      Delayed leader broadcast can block ctdb forever
   * libads-fix-get_kdc_ip_string.patch: remove, included upstream
   * d/gbp.conf: debian-branch=debian/4.22

samhain (4.1.4-6+deb13u1) trixie; urgency=medium
 .
   * d/rules:
     - Quick fix preventing potential segfaults (Closes: #1111631)

shibboleth-sp (3.5.0+dfsg-2+deb13u1) trixie-security; urgency=high
 .
   * [627cc27] New patch: SSPCPP-1014 - Extend escaping in strings.
     Fix SQL injection vulnerability in Service Provider ODBC plugin:
     specially crafted inputs can exfiltrate information stored in the
     database used by the SP.  The vulnerability is moderate to high
     severity for anyone using the ODBC plugin, and of no impact for others.
     Thanks to Scott Cantor (Closes: #1114506)

spip (4.4.3+dfsg-1+deb13u1) trixie; urgency=medium
 .
   * Track debian/trixie
   * Backport security fix from 4.4.5: Fix open redirect on ajax login form

squid (6.13-2+deb13u1) trixie-security; urgency=high
 .
   * Non Maintainer Upload by LTS team
   * Fix CVE-2025-62168 (Closes: #1118341)
     Due to a failure to redact HTTP Authentication credentials
     Squid is vulnerable to an Information Disclosure attack.
   * Fix CVE-2025-59362 (Closes: #1117048)
     Squid mishandles ASN.1 encoding of long SNMP OIDs.

stardict (3.0.7+git20220909+dfsg-8~deb13u1) trixie; urgency=medium
 .
   * Upload to trixie
   * Update d/gbp.conf for trixie-specific
stardict (3.0.7+git20220909+dfsg-7) unstable; urgency=medium
 .
   * d/stardict-plugin.install:not install stardict_dictdotcn.so, Closes: #806960
   * d/rules:Added --disable-dictdotcn option, dictdotcn is not provid server now

suricata (1:7.0.10-1+deb13u1) trixie; urgency=medium
 .
   * Fix CVE-2025-53538 in 7.0.10.
     Cherry-Picked from upstream 97eee2cadacf3423a1ebcdd1943a7a7917f5cc56.
     Closes: #1109806
     Reference: #1116945
   * Fix CVE-2025-59147 in 7.0.10.
     Cherry-Picked from upstream e91b03c90385db15e21cf1a0e85b921bf92b039e
     and slightly modified to fit for Suricata 7.0.10.
     Reference: #1119940

syslog-ng (4.8.1-5+deb13u1) trixie; urgency=medium
 .
   * Turn off writing log statistics (closes: #1110329).

systemd (257.9-1~deb13u1) trixie; urgency=medium
 .
   * Update upstream source from tag 'upstream/257.9' Update to upstream
     version '257.9' with Debian dir
     9b05cb6904e089147c1521b0ced983a575d8abe4
systemd (257.8-1~deb13u2) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * systemd-networkd: Fix segfault on VLAN-aware bridges. (Closes: #1112535)

systemd-boot-efi-amd64-signed (257.9+1~deb13u1) trixie; urgency=high
 .
   * Sign EFI binaries from systemd-boot-efi 257.9-1~deb13u1
 .
   * Update upstream source from tag 'upstream/257.9' Update to upstream
     version '257.9' with Debian dir
     9b05cb6904e089147c1521b0ced983a575d8abe4
systemd-boot-efi-amd64-signed (257.8+1~deb13u2) trixie; urgency=high
 .
   * Sign EFI binaries from systemd-boot-efi 257.8-1~deb13u2
 .
   * Non-maintainer upload.
   * systemd-networkd: Fix segfault on VLAN-aware bridges. (Closes: #1112535)

systemd-boot-efi-arm64-signed (257.9+1~deb13u1) trixie; urgency=high
 .
   * Sign EFI binaries from systemd-boot-efi 257.9-1~deb13u1
 .
   * Update upstream source from tag 'upstream/257.9' Update to upstream
     version '257.9' with Debian dir
     9b05cb6904e089147c1521b0ced983a575d8abe4
systemd-boot-efi-arm64-signed (257.8+1~deb13u2) trixie; urgency=high
 .
   * Sign EFI binaries from systemd-boot-efi 257.8-1~deb13u2
 .
   * Non-maintainer upload.
   * systemd-networkd: Fix segfault on VLAN-aware bridges. (Closes: #1112535)

tango (10.0.2+dfsg1-2+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * Fix broken communication between major versions: libtango9 cannot receive
     events from libtango10 (Closes: #1118207)
   * d/gitlab-ci.yml (Salsa CI):
     - Set RELEASE to trixie in d/gitlab-ci.yml to explicitly trigger
       trixie-based pipelines.
     - Disable the reprotest job. Releases older than unstable are not very
       well supported by the Salsa CI's reprotest job, and this failing without
       a good reason.
tango (10.0.2+dfsg1-2+deb13u1~bpo12+1) bookworm-backports; urgency=medium
 .
   * Team upload.
   * Rebuild for bookworm-backports.
   * Set RELEASE to bookworm-backports in d/gitlab-ci.yml.
     To explicitly trigger bookworm-backports-based pipelines.

tbsync (4.16-1~deb13u2) trixie; urgency=medium
 .
   * Added dir api/ to d/rules.
     It follows 4.16-2 in unstable #1118180.
tbsync (4.16-1~deb13u1) trixie; urgency=medium
 .
   * Rebuild for uploading with thunderbird>= 140.3 to trixie

thunderbird (1:140.4.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security
thunderbird (1:140.4.0esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * Rebuild for bookworm-security
thunderbird (1:140.3.1esr-1) unstable; urgency=medium
 .
   * [f86a89f] New upstream version 140.3.1esr
   * [87cb9f6] d/control: Update packages need to have a Breaks
     Updating the packages in the Breaks field as like very often with a new
     ESR version some AddOns need to be bumped too. Removing old non existing
     or not relevant packages from the field. Adding these new packages:
     webext-allow-html-temp (<= 10.0.8-1~)
     webext-dav4tbsync (<= 4.8-2~)
     webext-eas4tbsync (<= 4.17-1~)
     webext-mailmindr (<= 1.7.1-2~)
     webext-quicktext (<= 6.4.6-1~)
     webext-tbsync (<= 4.16-1~)
     webext-xnotepp (<= 4.5.81-1~)
     (Closes: #1116976)
thunderbird (1:140.3.0esr-1) unstable; urgency=medium
 .
   [ Carsten Schoenert ]
   * [de64a72] d/watch: Mangle 'esr' suffix from version
   * [85543ab] New upstream version 140.3.0esr
     Fixed CVE issues in upstream version 140.3 (MFSA 2025-78):
     CVE-2025-10527: Sandbox escape due to use-after-free in the Graphics:
                     Canvas2D component
     CVE-2025-10528: Sandbox escape due to undefined behavior, invalid pointer
                     in the Graphics: Canvas2D component
     CVE-2025-10529: Same-origin policy bypass in the Layout component
     CVE-2025-10532: Incorrect boundary conditions in the JavaScript:
                     GC component
     CVE-2025-10533: Integer overflow in the SVG component
     CVE-2025-10536: Information disclosure in the Networking: Cache component
     CVE-2025-10537: Memory safety bugs fixed in Firefox ESR 140.3,
                     Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143
     (Closes: #1115605)
   * [635002d] Rebuild patch queue from patch-queue branch
   * [6d2f42d] d/control: Remove Rules-Requires-Root
 .
   [ Carles Pina i Estany ]
   * [634cd34] d/control: Drop Recommends on thunderbird-l10n-fi
     (Closes: #1115457)
 .
   [ Dandan Zhang ]
   * [00691f6] d/control: Adding loong64 architecture
     (Closes: #1059966)
thunderbird (1:140.2.0esr-1) experimental; urgency=medium
 .
   [ Christoph Goehre ]
   * [3449bf5] d/rules: export CC and CXX definitions on ppc64
     This is a follow-up fix for [cb1ed45].
 .
   [ Carsten Schoenert ]
   * [2e811f6] d/watch: Migrate to version 5
   * [ddad9bc] New upstream version 140.2.0esr
thunderbird (1:140.1.1esr-1) experimental; urgency=medium
 .
   * [e6e4d2d] d/source.filter: Update content to filter out
   * [4b7d308] New upstream version 140.1.1esr
   * [472919e] d/rules: Add target for NSS and NSPR versions
   * [3e7b6b0] d/control: Bump B-D for libnss3-dev
thunderbird (1:140.1.0esr-1) experimental; urgency=medium
 .
   [ Christoph Goehre ]
   * [7ac28d3] d/rules: export 'Clto=thin' on i386 to stay in the memory budged
     Added patch:
     debian-hacks/Allow-to-override-rust-LTO-flag.patch
 .
   [ Carsten Schoenert ]
   * [2ed0df2] d/create-upstream-tarballs.py: Use the real CDN URL
   * [82f0f9e] New upstream version 140.1.0esr
   * [fb16995] Rebuild patch queue from patch-queue branch
     Added patch:
     porting-ppc64el/skia-Adjust-detection-of-ppc64-architecture.patch
   * [ad0c4b4] d/control: Increase Standards-Version to 4.7.2
     No further changes needed.
   * [dc57502] d/copyright: Update content due upstream changes
   * [3e8fe05] d/s/lintian-overrides: Update data due upstream changes
   * [4378ab3] d/t-lintian-overrides: Update due build changes
 .
   [ John Paul Adrian Glaubitz ]
   * [cb1ed45] d/rules: Use gcc and g++ on ppc64
     (Closes: #1109861)
thunderbird (1:140.0.1esr-1) experimental; urgency=medium
 .
   [ Christoph Goehre ]
   * [259f52c] New upstream version 140.0.1esr (Closes: #1109451)
   * [a5a86f3] rebuild patch queue from patch-queue branch
     obsolete patches (fixed upstream):
     debian-hacks/Downgrade-cbindgen-requirement.patch
   * [fe04434] d/rules, d/thunderbird.install: ignore additional binary
     crashhelper for now
 .
   [ Alessandro Astone ]
   * [f5a46a4] Update rule to drop dependency on gtk2 with the new t64 package
     name
thunderbird (1:138.0-1) experimental; urgency=medium
 .
   * [870fc65] New upstream version 138.0
   * [cc0885e] rebuild patch queue from patch-queue branch
     added patches:
     debian-hacks/Downgrade-cbindgen-requirement.patch
   * [f7487ae] d/control: bump cbindgen build dependency
   * [61f6d95] d/thunderbird.install: install interesting_serverknobs.json file
thunderbird (1:137.0-1) experimental; urgency=medium
 .
   * [148e2f7] New upstream version 137.0
thunderbird (1:136.0-1) experimental; urgency=medium
 .
   * [3f06ac7] New upstream version 136.0
thunderbird (1:135.0-1) experimental; urgency=medium
 .
   * [bdcaf66] Revert "d/rules: Move/rename third party Python modul temporarly"
     (Closes: #1093362)
   * [e33e9d8] New upstream version 135.0
   * [e68ae48] rebuild patch queue from patch-queue branch
     modified patches:
     porting-mips64el/skia-Disable-musttail-on-mips64.patch
     porting-ppc64el/Work-around-GCC-ICE-on-ppc64el.patch
     thunderbird-l10n/sl-change-Edit-Uredi-to-CTRL-E.patch
     obsolete patches (fixed upstream):
     porting-ppc64el/skia-Disable-musttail-on-ppc64el.patch
thunderbird (1:132.0~b6-1) experimental; urgency=medium
 .
   * [282778e] d/changelog: Correct small typo
   * [b5b363b] New upstream version 132.0~b6
   * [7e23518] d/control: Bump various B-D versions, drop non needed
   * [f979f8f] d/thunderbird.postinst: Correct misspelled THUNDERBIRD_LIBDIR
     (Closes: #1082842)
thunderbird (1:130.0~b3-1) experimental; urgency=medium
 .
   * [041e622] d/control: Fix short description for thunderbird-l10n-lv
     (Closes: #1079029)
   * [820aec2] New upstream version 130.0~b3
   * [628eb92] d/control: Readd dependencies on librnp{0,-dev}
   * [8e6b0e8] d/rules: Move/rename third party Python modul temporarly
   * [ee4c48d] d/source.filter: Exclude some JS files from exclusion
thunderbird (1:129.0~b6-1) experimental; urgency=medium
 .
   [ Carsten Schoenert ]
   * [5ee74f4] d/watch: Now watch out for 'esr' suffixed versions
   * [8e4b85a] d/thunderbird.desktop: Update data with upstream data
     (Closes: #1042912, #1051261)
   * [a0e3d2e] New upstream version 129.0~b6
   * [0b12902] d/control: Drop B-D on libdbus-glib-1-dev
     (Closes: #955955)
   * [cf730a8] d/create-upstream-tarballs.py: Ignore version 129.0
   * [0528b45] d/s/lintian-overrides: Update some overrides
 .
   [ Michael Weghorn ]
   * [e4d3be0] Use app ID that matches the desktop file name
     (Closes: #1022037)
thunderbird (1:128.14.0esr-1) unstable; urgency=medium
 .
   * [4f3d4b8] New upstream version 128.14.0esr
     Fixed CVE issues in upstream version 128.14 (MFSA 2025-71):
     CVE-2025-9179: Sandbox escape due to invalid pointer in the
                    Audio/Video: GMP component
     CVE-2025-9180: Same-origin policy bypass in the Graphics: Canvas2D
                    component
     CVE-2025-9181: Uninitialized memory in the JavaScript Engine component
     CVE-2025-9185: Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR
                    128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,
                    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142

tiff (4.7.0-3+deb13u1) trixie-security; urgency=medium
 .
   * CVE-2024-13978 (Closes: #1111323)
   * CVE-2025-8961 (Closes: #1111317)
   * CVE-2025-9165 (Closes: #1111878)
   * CVE-2025-9900

tryton-sao (7.0.28+ds1-1+deb13u1) trixie-security; urgency=high
 .
   * Add 01_xss_vulnerability_attachments_preview.patch.
     Patch for security issue:
     https://discuss.tryton.org/t/security-release-for-issue-14290/8895
     The HTML element used to display the document is based on the mimetype.
     And by default a sandboxed iframe is used to isolate the unsafe content from
     the parent context.

ublock-origin (1.67.0+dfsg-1~deb13u1) trixie; urgency=medium
 .
   * Backport version 1.67.0 to trixie to improve user experience and add new
     filter capabilities.
ublock-origin (1.67.0+dfsg-1~deb12u1) bookworm; urgency=medium
 .
   * Backport version 1.67.0 to bookworm to improve user experience and
     add new filter capabilities. (Closes: #1059545)
   * Fix CVE-2025-4215: Regular Expression Denial of Service (ReDoS)
     (Closes: #1104635)

valkey (8.1.1+dfsg1-3+deb13u1) trixie-security; urgency=medium
 .
   * (CVE-2025-49844) A Lua script may lead to remote code execution
   * (CVE-2025-46817) A Lua script may lead to integer overflow and potential RCE
   * (CVE-2025-46818) A Lua script can be executed in the context of another user
   * (CVE-2025-46819) LUA out-of-bound read

virt-manager (1:5.0.0-5+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Fix: Clicking on "Browse Local" has no effect and throws an error (Closes:
     #1112514)
   * Update debian/gbp.conf to point to trixie branches

watcher (14.0.0-1+deb13u1) trixie; urgency=medium
 .
   * Add export OS_OSLO_MESSAGING_RABBIT__PROCESSNAME for all daemons.
   * A vulnerability has been identified in OpenStack Nova and OpenStack Watcher
     in conjunction with volume swap operations performed by the Watcher
     service. Under specific circumstances, this can lead to a situation where
     two Nova libvirt instances could reference the same block device, allowing
     accidental information disclosure to the unauthorized instance. Added
     upstream patch: OSSN-0094_use_cinder_migrate_for_swap_volume.patch.
     (Closes: #1111692).

webkit2gtk (2.50.1-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security.
   * Re-enable libmanette in i386.
   * Enable the transitional packages.
   * Don't override the gcc compiler on mips64el since trixie already uses
     gcc-14 by default.
webkit2gtk (2.50.1-1~deb12u1) bookworm-security; urgency=medium
 .
   * Rebuild for bookworm-security.
   * Disable sysprof profiling integration to avoid new dependencies:
     - debian/control.in: Don't depend on libsysprof-capture-4-dev.
     - debian/rules: Build with -DUSE_SYSPROF_CAPTURE=OFF.
   * Disable JPEG XL to avoid adding new dependencies.
     - debian/control.in: Remove build dependency on libjxl-dev.
     - debian/rules: Build with -DUSE_JPEGXL=OFF.
   * debian/rules:
     - Enable ENABLE_SOUP2 and USE_OLD_PKG_NAMES to keep using the old
       package names.
     - Re-enable libmanette in i386.
   * debian/control-common.in:
     - Make the -dev packages depend on the gir packages.
   * debian/control.in:
     - Build depend on ccache.
   * Use clang-16 instead of clang.
   * Don't override the gcc compiler on mips64el since bookworm uses gcc 12
     and not gcc 15 (#1116217).
   * debian/patches/fix-minibrowser.patch:
     - Fix the MiniBrowser with clang-16.
webkit2gtk (2.50.0-2) unstable; urgency=medium
 .
   * debian/patches/fix-ftbfs-i386.patch:
     - Update patch to also fix the armhf build.
   * Force gcc-14 in mips64el because gcc 15 fails with an internal
     compiler error (#1116217) and clang is not an option ("failed to
     perform tail call elimination").
   * debian/rules:
     - Remove unused variable EXTRA_BUILD_ARGUMENTS.
   * debian/patches/disable-nvidia-dmabuf.patch:
     - Bring back this patch, now adapted to WebKitGTK 2.50.0.
webkit2gtk (2.50.0-1) unstable; urgency=medium
 .
   * New upstream release.
   * Bring all changes from the 2.49 (experimental) branch.
   * debian/copyright:
     - Update copyright information of all files.
   * debian/gbp.conf:
     - Update upstream branch name.
   * debian/libwebkit2gtk-4.0-37.symbols:
     - Update symbols.
   * Refresh all patches.
     - Drop disable-nvidia-dmabuf.patch for now, it needs changes.
   * debian/patches/fix-ftbfs-s390x.patch:
     - Fix FTBFS in s390x (WebKit bug #298308).
   * debian/patches/fix-ftbfs-i386.patch:
     - Fix FTBFS in i386 (WebKit bug #299018).
   * Stop building the transitional packages for forky.
   * debian/source/lintian-overrides:
     - Update source-is-missing overrides.
webkit2gtk (2.49.90-1) experimental; urgency=medium
 .
   * New upstream development release.
   * debian/watch, debian/gbp.conf:
     - Branch for 2.49.x in experimental.
   * Refresh all patches.
     - Drop fix-ftbfs-armv7.patch.
     - Drop disable-nvidia-dmabuf.patch for now, it needs changes.
   * Stop building the transitional packages for forky.
   * debian/copyright:
     - Update copyright information of all files.
   * Stop supporting non-SSE2 i386 CPUs since trixie now requires SSE2
     support.
     - Drop dont-detect-sse2.patch.
     - Enable the JIT again and disable CLoop.
   * debian/libwebkit2gtk-4.0-37.symbols:
     - Update symbols.
   * debian/source/lintian-overrides:
     - Update source-is-missing overrides.
webkit2gtk (2.48.6-1) unstable; urgency=medium
 .
   [ Alberto Garcia ]
   * New upstream release.
   * Drop fix-ftbfs-armv7.patch.
   * Stop supporting non-SSE2 i386 CPUs since SSE2 is required starting
     from trixie.
     - Drop dont-detect-sse2.patch.
     - Enable the JIT again and disable CLoop.
   * Use clang in i386. This is now possible since we require SSE2.
 .
   [ Jeremy Bicha ]
   * Disable gamepad feature on Ubuntu since libmanette is in universe
     there.
   * Don't require libmanette on i386.
webkit2gtk (2.48.5-1) unstable; urgency=high
 .
   * New upstream release.
   * The WebKitGTK security advisory WSA-2025-0005 lists the following
     security fixes in the latest versions of WebKitGTK:
     - CVE-2025-24189 (fixed in 2.48.0).
     - CVE-2025-31273, CVE-2025-31278, CVE-2025-43211, CVE-2025-43212,
       CVE-2025-43216, CVE-2025-43227, CVE-2025-43228, CVE-2025-43240,
       CVE-2025-43265, CVE-2025-6558 (fixed in 2.48.5).
   * debian/upstream/signing-key.asc:
     - Update Adrian Perez's PGP key.
   * debian/patches/fix-ftbfs-armv7.patch:
     - Fix arm build.

wike (3.1.1-1+deb13u1) trixie; urgency=medium
 .
   * Add cherry-picked upstream patch setting correct useragent (Closes: #1119977)

wtmpdb (0.73.0-3+deb13u1) trixie; urgency=medium
 .
   * Rotate and prune logs using logrotate (Closes: #1094965)
     - patch to handle empty file reading
     - remove units and cron jobs for old (disabled) rotation solution
     - cause new and rotated files to keep permissions (Closes: #1076308)
   * Store logs in system log directory, /var/log (Closes: #1117719)
   * Remove logs on package purge
   * README.Debian: document new log handling

xnote (4.5.48-1~deb13u1) trixie; urgency=medium
 .
   * Rebuild for upload after thunderbird 140.3 in trixie

xorg (1:7.7+24+deb13u1) trixie; urgency=medium
 .
   * Team upload
 .
   [ Jochen Sprickerhof ]
   * 20x11-common_process-args: Only use the first word for command -v
     (Closes: #1094494)

xorg-server (2:21.1.16-1.3+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * present: Fix use-after-free in present_create_notifies() (CVE-2025-62229)
   * xkb: Make the RT_XKBCLIENT resource private (CVE-2025-62230)
   * xkb: Free the XKB resource when freeing XkbInterest (CVE-2025-62230)
   * xkb: Prevent overflow in XkbSetCompatMap() (CVE-2025-62231)

xssproxy (1.0.0-1+deb13u1) trixie; urgency=medium
 .
   * Add listen-path.patch, listening on object path
     /org/freedesktop/ScreenSaver too (Closes: #1092965)
   * Add cookie-not-zero.patch, avoiding problem with xdg-desktop-portal-gtk
     (Closes: #1115458)
=======================================
Sat, 06 Sep 2025 - Debian 13.1 released
=======================================
aide (0.19.1-2+deb13u1) trixie-security; urgency=high
 .
   * Apply upstream patch to escape control characters in report and log output
     (CVE-2025-54389)
   * Apply upstream patch to fix null pointer dereference after reading
     incorrectly encoded xattr attributes from database (CVE-2025-54409)

auto-apt-proxy (16.8+deb13u1) trixie; urgency=medium
 .
   * Check explicitly configured proxies before network gateway
     (Closes: #1108265)
   * Add trixie-specific gbp.conf

base-files (13.8+deb13u1) trixie; urgency=medium
 .
   * Update debian_version and os-release for Debian 13.1 point release.

chromium (139.0.7258.154-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream security release.
     - CVE-2025-9478: Use after free in ANGLE.
       Reported by Google Big Sleep.
chromium (139.0.7258.154-1~deb12u1) bookworm-security; urgency=high
 .
   * New upstream security release.
     - CVE-2025-9478: Use after free in ANGLE.
       Reported by Google Big Sleep.
   * d/patches/bookworm/stdarch-arm.patch: drop to fix FTBFS on arm64
     with newer rustc-web.
chromium (139.0.7258.138-1) unstable; urgency=high
 .
   * New upstream security release.
     - CVE-2025-9132: Out of bounds write in V8.
       Reported by Google Big Sleep.
chromium (139.0.7258.138-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream security release.
     - CVE-2025-9132: Out of bounds write in V8.
       Reported by Google Big Sleep.
chromium (139.0.7258.138-1~deb12u1) bookworm-security; urgency=high
 .
   * New upstream security release.
     - CVE-2025-9132: Out of bounds write in V8.
       Reported by Google Big Sleep.
chromium (139.0.7258.127-2) unstable; urgency=high
 .
   * d/patches:
       - bookworm/adler1.patch: drop, rustc in sid is now new enough for
         adler2. Also move it into trixie/adler1.patch.
       - bookworm/libxml-parseerr.patch: drop, libxml in sid is upgraded.
         Also move it to trixie/libxml-parseerr.patch.
   * d/control: update build-deps to require rust >= 1.86, libxml >= 2.14.
chromium (139.0.7258.127-1) unstable; urgency=high
 .
   * New upstream security release.
     - CVE-2025-8879: Heap buffer overflow in libaom. Reported by Anonymous
     - CVE-2025-8880: Race in V8. Reported by Seunghyun Lee (@0x10n).
     - CVE-2025-8901: Out of bounds write in ANGLE.
       Reported by Google Big Sleep.
     - CVE-2025-8881: Inappropriate implementation in File Picker.
       Reported by Alesandro Ortiz.
     - CVE-2025-8882: Use after free in Aura. Reported by Umar Farooq.
chromium (139.0.7258.127-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream security release.
     - CVE-2025-8879: Heap buffer overflow in libaom. Reported by Anonymous
     - CVE-2025-8880: Race in V8. Reported by Seunghyun Lee (@0x10n).
     - CVE-2025-8901: Out of bounds write in ANGLE.
       Reported by Google Big Sleep.
     - CVE-2025-8881: Inappropriate implementation in File Picker.
       Reported by Alesandro Ortiz.
     - CVE-2025-8882: Use after free in Aura. Reported by Umar Farooq.
 .
 chromium (139.0.7258.66-1) unstable; urgency=high
 .
   * New upstream stable release.
     - CVE-2025-8576: Use after free in Extensions. Reported by asnine.
     - CVE-2025-8577: Inappropriate implementation in Picture In Picture.
       Reported by Umar Farooq.
     - CVE-2025-8578: Use after free in Cast. Reported by Fayez.
     - CVE-2025-8579: Inappropriate implementation in Gemini Live in
       Chrome. Reported by Alesandro Ortiz.
     - CVE-2025-8580: Inappropriate implementation in Filesystems.
       Reported by Huuuuu.
     - CVE-2025-8581: Inappropriate implementation in Extensions.
       Reported by Vincent Dragnea.
     - CVE-2025-8582: Insufficient validation of untrusted input in DOM.
       Reported by Anonymous.
     - CVE-2025-8583: Inappropriate implementation in Permissions.
       Reported by Shaheen Fazim.
   * d/copyright: delete third_party/enterprise_companion, as it includes
     a binary.
   * d/control: Replace elfutils build-dep with llvm-19 for switch to
     llvm-strip.
   * d/rules:
     - drop enable_nacl=false; upstream removed NaCL.
     - set enable_enterprise_companion=false.
     - disable Gemini AI (enable_glic=false).
   * d/patches:
     - disable/catapult.patch: refresh.
     - disable/buildtools-libc.patch: refresh.
     - system/eu-strip.patch: drop, upstream switched to llvm-strip.
     - bookworm/gn-revert-path-exists.patch: refresh & drop unused part.
     - ungoogled/disable-privacy-sandbox.patch: refresh.
     - fixes/bindgen.patch: rename to bookworm/bindgen.patch, since trixie
       now has a newer bindgen.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - sandbox/0001-sandbox-linux-Update-syscall-helpers-lists-for-ppc64.patch:
       Refresh for upstream changes
     - sandbox/0009-sandbox-updates-138.patch: Properly handle IPC and send
       syscalls
     - third_party/0001-add-xnn-ppc64el-support.patch: Refresh for upstream
       changes
     - third_party/0002-regenerate-xnn-buildgn.patch: Regenerate from upstream
       sources
     - third_party/skia-vsx-instructions.patch: Refresh for upstream changes
     - fixes/fix-partition-alloc-compile.patch: Refresh for upstream changes
chromium (139.0.7258.127-1~deb12u1) bookworm-security; urgency=high
 .
   * New upstream security release.
     - CVE-2025-8879: Heap buffer overflow in libaom. Reported by Anonymous
     - CVE-2025-8880: Race in V8. Reported by Seunghyun Lee (@0x10n).
     - CVE-2025-8901: Out of bounds write in ANGLE.
       Reported by Google Big Sleep.
     - CVE-2025-8881: Inappropriate implementation in File Picker.
       Reported by Alesandro Ortiz.
     - CVE-2025-8882: Use after free in Aura. Reported by Umar Farooq.
chromium (139.0.7258.66-1) unstable; urgency=high
 .
   * New upstream stable release.
     - CVE-2025-8576: Use after free in Extensions. Reported by asnine.
     - CVE-2025-8577: Inappropriate implementation in Picture In Picture.
       Reported by Umar Farooq.
     - CVE-2025-8578: Use after free in Cast. Reported by Fayez.
     - CVE-2025-8579: Inappropriate implementation in Gemini Live in
       Chrome. Reported by Alesandro Ortiz.
     - CVE-2025-8580: Inappropriate implementation in Filesystems.
       Reported by Huuuuu.
     - CVE-2025-8581: Inappropriate implementation in Extensions.
       Reported by Vincent Dragnea.
     - CVE-2025-8582: Insufficient validation of untrusted input in DOM.
       Reported by Anonymous.
     - CVE-2025-8583: Inappropriate implementation in Permissions.
       Reported by Shaheen Fazim.
   * d/copyright: delete third_party/enterprise_companion, as it includes
     a binary.
   * d/control: Replace elfutils build-dep with llvm-19 for switch to
     llvm-strip.
   * d/rules:
     - drop enable_nacl=false; upstream removed NaCL.
     - set enable_enterprise_companion=false.
     - disable Gemini AI (enable_glic=false).
   * d/patches:
     - disable/catapult.patch: refresh.
     - disable/buildtools-libc.patch: refresh.
     - system/eu-strip.patch: drop, upstream switched to llvm-strip.
     - bookworm/gn-revert-path-exists.patch: refresh & drop unused part.
     - ungoogled/disable-privacy-sandbox.patch: refresh.
     - fixes/bindgen.patch: rename to bookworm/bindgen.patch, since trixie
       now has a newer bindgen.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - sandbox/0001-sandbox-linux-Update-syscall-helpers-lists-for-ppc64.patch:
       Refresh for upstream changes
     - sandbox/0009-sandbox-updates-138.patch: Properly handle IPC and send
       syscalls
     - third_party/0001-add-xnn-ppc64el-support.patch: Refresh for upstream
       changes
     - third_party/0002-regenerate-xnn-buildgn.patch: Regenerate from upstream
       sources
     - third_party/skia-vsx-instructions.patch: Refresh for upstream changes
     - fixes/fix-partition-alloc-compile.patch: Refresh for upstream changes
chromium (139.0.7258.66-1~deb12u1) bookworm-security; urgency=high
 .
   * New upstream stable release.
     - CVE-2025-8576: Use after free in Extensions. Reported by asnine.
     - CVE-2025-8577: Inappropriate implementation in Picture In Picture.
       Reported by Umar Farooq.
     - CVE-2025-8578: Use after free in Cast. Reported by Fayez.
     - CVE-2025-8579: Inappropriate implementation in Gemini Live in
       Chrome. Reported by Alesandro Ortiz.
     - CVE-2025-8580: Inappropriate implementation in Filesystems.
       Reported by Huuuuu.
     - CVE-2025-8581: Inappropriate implementation in Extensions.
       Reported by Vincent Dragnea.
     - CVE-2025-8582: Insufficient validation of untrusted input in DOM.
       Reported by Anonymous.
     - CVE-2025-8583: Inappropriate implementation in Permissions.
       Reported by Shaheen Fazim.
   * d/copyright: delete third_party/enterprise_companion, as it includes
     a binary.
   * d/control:
     - Replace elfutils build-dep with llvm-19 for switch to llvm-strip.
     - Update rustc-web build-dep to >= 1.84.
   * d/rules:
     - drop enable_nacl=false; upstream removed NaCL.
     - set enable_enterprise_companion=false.
     - disable Gemini AI (enable_glic=false).
   * d/patches:
     - disable/catapult.patch: refresh.
     - disable/buildtools-libc.patch: refresh.
     - system/eu-strip.patch: drop, upstream switched to llvm-strip.
     - bookworm/gn-revert-path-exists.patch: refresh & drop unused part.
     - ungoogled/disable-privacy-sandbox.patch: refresh.
     - fixes/bindgen.patch: rename to bookworm/bindgen.patch, since trixie
       now has a newer bindgen.
     - bookworm/gn-absl.patch: refresh.
     - bookworm/rust-is-none-or.patch: drop, thanks to newer rustc-web.
     - bookworm/rust-unstable-features.patch: drop - newer rustc-web.
     - bookworm/bubble-contents.patch: drop, no longer needed.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - sandbox/0001-sandbox-linux-Update-syscall-helpers-lists-for-ppc64.patch:
       Refresh for upstream changes
     - sandbox/0009-sandbox-updates-138.patch: Properly handle IPC and send
       syscalls
     - third_party/0001-add-xnn-ppc64el-support.patch: Refresh for upstream
       changes
     - third_party/0002-regenerate-xnn-buildgn.patch: Regenerate from upstream
       sources
     - third_party/skia-vsx-instructions.patch: Refresh for upstream changes
     - fixes/fix-partition-alloc-compile.patch: Refresh for upstream changes

courier (1.4.1-3+deb13u1) trixie; urgency=medium
 .
   * Add debian/courier-webadmin.init and debian/courier-webadmin.service
     (closes: #1111836).
   * Add debian/tests/smoke-webadmin.
   * Add debian/courier-webadmin.links to create a cgi-bin link.
   * Add debian/patches/webadmin-restart-commands.patch.
   * debian/control:  Add "Pre-Depends: ${misc:Pre-Depends}".
   * debian/courier.base.postinst:
     - Remove the dpkg-statoverride for /var/lib/courier, which diverged from
       upstream and caused problems with webadmin.
   * debian/courier-base.postrm:  Remove the deletion of the dpkg-statoverride
     for /var/lib/courier.
   * debian/courier-webadmin.config:  Remove the courier-webadmin/install-cgi
     section.
   * debian/courier-webadmin.dirs:  Remove the unnecessary etc/courier/webadmin
     entry.
   * debian/courier-webadmin.install:
     - Install the new etc/courier/webadmin/restartcmd.
     - Install /etc/courier/webadmin/password.
   * debian/courier-webadmin.postinst:
     - Remove the processing of the now-removed install-cgi debconf question.
     - Stop manually creating and setting permissions for
       /etc/courier/webadmin/password.
     - Add a dpkg-statoverride for /etc/courier/webadmin/password.
   * debian/courier-webadmin.postrm:
     - Remove the processing of the now-removed install-cgi debconf question.
     - Remove the webadmin socket on purge if it was left behind by the service.
     - Remove the dpkg-statoverride for /etc/courier/webadmin/password on purge.
   * debian/courier-webadmin.README.Debian:
     - Refactor to reflect the new, non-SUID webadmin architecture.
     - Add information about enabling cgi-bin symlinks.
   * debian/courier-webadmin.templates:  Remove obsolete install-cgi question.
     The link is now created automatically on install.
   * debian/rules:  Create an empty /etc/courier/webadmin/password file.
   * debian/tests/control:  Enable the smoke-webadmin test.

debian-installer (20250803+deb13u1) trixie; urgency=medium
 .
   * Bootstrap trixie stable branch:
     - Set USE_PROPOSED_UPDATES=1 in debian/rules
     - Set USE_UDEBS_FROM?=trixie in build/config/common
   * Bump Linux kernel ABI to 6.12.43+deb13.
   * Adjust linux-image build-deps accordingly.
   * Add a workaround for a GRUB graphics initialisation bug (#1110759):
     adding a simple text output before switching terminal_output to
     gfxterm makes the graphical display work on older machines. With many
     thanks to Fab Stz for drawing our attention to this problem and the
     proposed workaround.

debian-installer-netboot-images (20250803+deb13u1) trixie; urgency=medium
 .
   * Update to 20250803+deb13u1, from trixie-proposed-updates.
   * Update DISTRIBUTION and DISTRIBUTION_FALLBACK for the trixie
     branch.
debian-installer-netboot-images (20250803) unstable; urgency=medium
 .
   [ Holger Levsen ]
   * Fix missing build dependency on apt, thanks to Jochen Sprickerhof
     (Closes: #1099535). Packages which are installed on the buildds but
     which are not listed in Build-Depends are not recorded in .buildinfo
     files. Thus rebuilding (e.g. on reproduce.debian.net) then fails.
 .
   [ Cyril Brulebois ]
   * Update supported architectures:
      - Delete mips64el
   * Clean debian/rules:
      - Delete (unused and incomplete) UNSUPPORTED_ARCHITECTURES.
   * Update for D-I Trixie RC 3.

desktop-base (13.0.4) trixie; urgency=medium
 .
   [ Aurélien COUDERC ]
   * Fix ceratopsian-theme’s plymouth password/fsck prompts off-center on
     multi-monitor mixed-resolution set-ups. Thanks Shaun Lewis for the patch.
     (Closes: #1110858)

devscripts (2.25.15+deb13u1) trixie; urgency=medium
 .
   * Team upload.
   * Update branch in gbp.conf & Vcs-Git URL.
   * debchange: trixie is now stable, forky is testing.

dpdk (24.11.3-1~deb13u1) trixie; urgency=medium
 .
   * Upload to trixie
 .
 dpdk (24.11.3-1) unstable; urgency=medium
 .
   * New upstream release 24.11.3. For a full list of changes in 24.11.3 see:
     https://doc.dpdk.org/guides/rel_notes/release_24_11.html

ethtool (1:6.14.2-1) trixie; urgency=medium
 .
   * New upstream release: 6.14.2
 .
   [ Salvatore Bonaccorso ]
   * debian/salsa-ci.yml: Set release to trixie
   * netlink: fix print_string when the value is NULL

firebird3.0 (3.0.12.ds7-13+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2025-54989: XDR Message Parsing NULL Pointer Dereference
     (Closes: #1111321)

firebird4.0 (4.0.5.3140.ds6-17+deb13u1) trixie-security; urgency=medium
 .
   * cherry pick fix for CVE-2025-54989 from upstream (Closes: #1111320)
   * cherry pick fix for CVE-2025-24975 from upstream (Closes: #1111322)
   * switch debian-branch to debian/trixie-security in gbp.conf

firefox-esr (128.14.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2025-66, also known as:
     CVE-2025-9179, CVE-2025-9180, CVE-2025-9181, CVE-2025-9185.
firefox-esr (128.14.0esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * New upstream release.
   * Fixes for mfsa2025-66, also known as:
     CVE-2025-9179, CVE-2025-9180, CVE-2025-9181, CVE-2025-9185.

flvstreamer (2.1c1-2+deb13u1) trixie; urgency=medium
 .
   * debian/gbp.conf: Work in debian/trixie branch
   * Revert "Build and install all programs of `progs` target in Makefile
     (Closes: #1098981)

galera-4 (26.4.23-0+deb13u1) trixie; urgency=medium
 .
   * New upstream release 26.4.23. Includes multiple bug fixes, see
     https://github.com/codership/documentation/blob/master/release-notes/release-notes-galera-26.4.23.txt
   * Drop patch to fix garbd's -w/WORK_DIR parameter that is now applied upstream
galera-4 (26.4.23-0+deb12u1) bookworm; urgency=medium
 .
   * New upstream release 26.4.23. Includes multiple bug fixes, see
     https://github.com/codership/documentation/blob/master/release-notes/release-notes-galera-26.4.23.txt
     https://github.com/codership/documentation/blob/master/release-notes/release-notes-galera-26.4.22.txt
     https://github.com/codership/documentation/blob/master/release-notes/release-notes-galera-26.4.21.txt
   * New upstream release fixes garbd's -w/WORK_DIR parameter (Closes: #1088076)

git (1:2.47.3-0+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * New upstream release.
     - CVE-2025-27613: gitk: file creation/truncation after cloning
       untrusted repository
     - CVE-2025-27614: gitk: user can be tricked into running any
       script after cloning untrusted repository
     - CVE-2025-46835: git-gui: file creation/overwriting after
       cloning untrusted repository
     - CVE-2025-48384: script execution after cloning untrusted
       repository
     - CVE-2025-48385: protocol injection when fetching
     - Closes: #1108983

glib2.0 (2.84.4-3~deb13u1) trixie; urgency=medium
 .
   * Go back to debian/trixie branch for a stable update
   * d/tests/manual/1065022.sh: Update manual test script used to reproduce
     and test fixes for #1065022
     - Adapt to upgrade from bookworm to trixie, rather than bookworm to sid
     - Optionally reproduce #1110696 instead
     - Optionally test the extra safety checks in the postrm
     - Add a simpler mechanism to test proposed packages for either
       bookworm or trixie
     - Improve diagnostic output
 .
 glib2.0 (2.84.4-3) unstable; urgency=medium
 .
   * d/control: Generate the intended Provides in libgirepository-2.0-0
 .
 glib2.0 (2.84.4-2) unstable; urgency=medium
 .
   * Mention #1110640 in previous changelog entry
   * libgirepository-2.0-0: Generate a dependency on a virtual package
     for libffi-related symbols, to avoid trouble during future libffi ABI
     transitions (Closes: #1110825)
   * libglib2.0-0t64: Make maintainer scripts shellcheck-clean
   * libglib2.0-0t64.postrm:
     - Refactor to use functions that early-return if we do not want to
       do the cleanup, avoiding stacking conditionals
     - Don't remove cache files if they would be non-empty,
       guarding against issues similar to #1065022 and #1110696
       (mitigates: #1110696)
   * libglib2.0-0t64.preinst: Disarm libglib2.0-0 postrm for all
     architectures, avoiding a corner case where the faulty postrm that
     suffered from #1065022 would still exist if it belonged to a former
     foreign architecture that was already disabled, but libglib2.0-0
     from that architecture was still in removed-but-not-purged state,
     resulting in #1065022 recurring when that version of libglib2.0-0
     was subsequently purged (Closes: #1110696)
   * d/tests/1065022-futureproofing:
     - Fix a test regression by generating a versioned Provides when
       building a mockup of a hypothetical future libglib2.0-0xyz.
       This regression wasn't immediately obvious because the autopkgtest
       is marked as flaky (it depends on various implementation details
       which we can't completely rely on).
     - Make sure required packages stay installed, failing the test early
       if their dependencies cannot be satisfied
     - Produce only TAP output on stdout, and a diagnostic log on stderr
     - Improve diagnostic output
 .
 glib2.0 (2.84.4-1) unstable; urgency=medium
 .
   * d/control, d/gbp.conf: Use debian/forky packaging branch.
     The debian/latest branch is now tracking 2.85.x for Debian
     experimental.
   * New upstream stable release
     - Ensure that generating temporary file names does not access memory
       outside the intended array of alphanumeric characters if a long-running
       program generates billions of temporary file names
       (CVE-2025-7039, glib#3716 upstream; believed to be unlikely to be
       exploitable in practice. Closes: #1110640)
     - Fix the intended ability for g_settings_bind_with_mapping_closures()
       to copy a value to the destination object
       (glib!4667 upstream)
     - If creating a thread pool fails, report a recoverable error instead
       of crashing with a fatal error
       (glib#3712 upstream)
     - Fix several memory leaks
       (glib#3721, glib!4702 upstream)
glib2.0 (2.84.4-2) unstable; urgency=medium
 .
   * Mention #1110640 in previous changelog entry
   * libgirepository-2.0-0: Generate a dependency on a virtual package
     for libffi-related symbols, to avoid trouble during future libffi ABI
     transitions (Closes: #1110825)
   * libglib2.0-0t64: Make maintainer scripts shellcheck-clean
   * libglib2.0-0t64.postrm:
     - Refactor to use functions that early-return if we do not want to
       do the cleanup, avoiding stacking conditionals
     - Don't remove cache files if they would be non-empty,
       guarding against issues similar to #1065022 and #1110696
       (mitigates: #1110696)
   * libglib2.0-0t64.preinst: Disarm libglib2.0-0 postrm for all
     architectures, avoiding a corner case where the faulty postrm that
     suffered from #1065022 would still exist if it belonged to a former
     foreign architecture that was already disabled, but libglib2.0-0
     from that architecture was still in removed-but-not-purged state,
     resulting in #1065022 recurring when that version of libglib2.0-0
     was subsequently purged (Closes: #1110696)
   * d/tests/1065022-futureproofing:
     - Fix a test regression by generating a versioned Provides when
       building a mockup of a hypothetical future libglib2.0-0xyz.
       This regression wasn't immediately obvious because the autopkgtest
       is marked as flaky (it depends on various implementation details
       which we can't completely rely on).
     - Make sure required packages stay installed, failing the test early
       if their dependencies cannot be satisfied
     - Produce only TAP output on stdout, and a diagnostic log on stderr
     - Improve diagnostic output
glib2.0 (2.84.4-1) unstable; urgency=medium
 .
   * d/control, d/gbp.conf: Use debian/forky packaging branch.
     The debian/latest branch is now tracking 2.85.x for Debian
     experimental.
   * New upstream stable release
     - Ensure that generating temporary file names does not access memory
       outside the intended array of alphanumeric characters if a long-running
       program generates billions of temporary file names
       (CVE-2025-7039, glib#3716 upstream; believed to be unlikely to be
       exploitable in practice)
     - Fix the intended ability for g_settings_bind_with_mapping_closures()
       to copy a value to the destination object
       (glib!4667 upstream)
     - If creating a thread pool fails, report a recoverable error instead
       of crashing with a fatal error
       (glib#3712 upstream)
     - Fix several memory leaks
       (glib#3721, glib!4702 upstream)

gnome-control-center (1:48.4-1~deb13u1) trixie; urgency=medium
 .
   * Team upload
   * d/control, d/gbp.conf: Set packaging branch for trixie stable updates
 .
 gnome-control-center (1:48.4-1) unstable; urgency=medium
 .
   * Team upload
   * d/control, d/gbp.conf, d/watch: Limit to 48.x versions.
     We'll stick to 48.x in testing/unstable for now, to get better
     testing for 48.x updates in trixie later.
   * New upstream stable release
     - In the Power panel, move the General section to the top, avoiding a UI
       reflow when the notice recommending automatic suspend is shown
       or hidden (gnome-control-center#3373 upstream)
     - Disable Pango markup when displaying errors from gnome-online-accounts,
       fixing display of some error messages that contain URLs
     - Translation updates

gnome-online-accounts (3.54.5-1~deb13u1) trixie; urgency=medium
 .
   * New upstream bugfix release with these fixes (Closes: #1111674):
     - Adding GOA account fails with sonic.net IMAP service
     - Cannot add a ProtonMail bridge with IMAP + TLS
     - Nextcloud login does not work anymore due to OPTIONS /login request
     - Linked online accounts no longer work
     - Invalid URI when adding Google account
     - goamsgraphprovider: ensure a valid PresentationIdentity
     - goadaemon: complete GTasks to avoid a scary debug warning
     - Fix Nextcloud and mailbox.org preconfiguration
     - Add DAV preconfig for mail.ru
     - Authentication failure in goa IMAP accounts
     - Handle unexpected casing in domain names
     - Various translations updates
   * debian/gbp.conf: branch for trixie
gnome-online-accounts (3.54.3-2) experimental; urgency=medium
 .
   * Disable Microsoft provider (Closes: #1100711)
     - It only handles email but Microsoft 365 handles email,
       calendar, contacts, and files
     - It was removed from GNOME 49
gnome-online-accounts (3.54.3-1) experimental; urgency=medium
 .
   * New upstream bugfix release

gnome-shell (48.4-1~deb13u1) trixie; urgency=medium
 .
   * Team upload
   * d/control, d/gbp.conf: Set packaging branch for trixie stable updates
 .
 gnome-shell (48.4-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream stable release
     - network: If a network has no ID, don't treat it as available,
       avoiding breaking the network menu
       (gnome-shell!3785 upstream)
     - Improve URL recognition heuristic for notifications so that non-URLs do
       not become a link
       (gnome-shell#8517 upstream)
     - In gdm, improve efficiency of user list
       (gnome-shell!3799 upstream)
     - Fix signal order when taking a screenshot interactively is triggered
       via D-Bus, for example from xdg-desktop-portal
       (gnome-shell#8499 upstream)
     - Improve cursor scaling on systems with different-DPI monitors when using
       the Magnifier accessibility tool
       (gnome-shell!475 upstream)
     - In sliders like volume and brightness, avoid drawing part of the bar
       over the handle in RTL locales
       (gnome-shell!3817 upstream)
     - Improve robustness of signal connections in the Thunderbolt and
       smart-card code
       (gnome-shell!3796 upstream)
     - Code cleanups in extensions management service
       (part of gnome-shell!3750 upstream)
     - Translation updates
   * d/control: Bump gjs version to 1.81.2 as per meson.build.
     No practical effect, 1.82.x is already in trixie.
   * d/gbp.conf: Use debian/forky branch for uploads targeting forky.
     We'll stick to 48.x in testing/unstable for now, to get better testing
     for future 48.x updates in trixie. Preliminary 49.x packaging for
     experimental is already using the debian/latest branch.

golang-github-gin-contrib-cors (1.4.0-1+deb13u1) trixie; urgency=medium
 .
   * CVE-2019-25211
     fix handling of wildcards
golang-github-gin-contrib-cors (1.4.0-1+deb12u1) bookworm; urgency=medium
 .
   * CVE-2019-25211
     fix handling of wildcards

gssdp (1.6.4-1~deb13u1) trixie; urgency=medium
 .
   * New upstream bugfix release
     - Improve reproducibility of gssdp-enums.c
     - Fix issues with Since: and Deprecated: declarations in documentation
       (Closes: #1111683)

imagemagick (8:7.1.1.43+dfsg1-1+deb13u1) trixie; urgency=medium
 .
   * Fix CVE-2025-53014:
     A heap buffer overflow was found in the `InterpretImageFilename`
     function. The issue stems from an off-by-one error that
     causes out-of-bounds memory access when processing format
     strings containing consecutive percent signs (`%%`).
     (Closes: #1109339)
   * Fix CVE-2025-53015:
     Infinite loop occur when writing during a specific XMP
     file conversion command
     (Closes: #1109339)
   * Fix CVE-2025-53019:
     `magick stream` command, specifying
     multiple consecutive `%d` format specifiers in a
     filename template causes a memory leak
     (Closes: #1109339)
   * Fix CVE-2025-53101:
     `magick mogrify` command, specifying multiple consecutive
     `%d` format specifiers in a filename template causes
     internal pointer arithmetic to generate an address
     below the beginning of the stack buffer, resulting
     in a stack overflow through `vsnprintf()`
     (Closes: #1109339)
   * Fix CVE-2025-43965:
     In MIFF image processing, image depth is mishandled
     after SetQuantumFormat is used.
   * Fix CVE-2025-46393:
     In multispectral MIFF image processing, packet_size is mishandled.

init-system-helpers (1.69~deb13u1) trixie; urgency=medium
 .
   * Upload to trixie
 .
 init-system-helpers (1.69) unstable; urgency=medium
 .
   * Add postinst to hotfix an upgrade bug on certain newly live-installed
     systems built using Trixie's live-build (Closes: #1111039)

installation-guide (20250803+deb13u1) trixie; urgency=medium
 .
   * Add Ukrainian (new translation) and Hungarian (re-completed) to langlist,
     to make them appear in the package and on the website.
   * Fix boot-dev-select-arm64 and armhf-armmp-supported-platforms hyperlinks.

iperf3 (3.18-2+deb13u1) trixie; urgency=high
 .
   * Fix no-dsa security issues:
     - CVE-2025-54349
     - CVE-2025-54350

kamailio (6.0.1-1+deb13u1) trixie; urgency=medium
 .
   * Team upload
   * Check only major OpenSSL version (Closes: #1110867)

libadwaita-1 (1.7.6-1~deb13u1) trixie; urgency=medium
 .
   * New upstream bugfix release 1.7.5
     - Explicitly set the size of a custom avatar image, avoiding a
       regression with GTK 4.19.x
       (libadwaita!1492 upstream)
     - Always set the document font name, even if all of the debug
       environment variables ADW_DEBUG_HIGH_CONTRAST,
       ADW_DEBUG_COLOR_SCHEME and DEBUG_ACCENT_COLOR are set
       (libadwaita#1042 upstream)
     - Slightly increase the window border radius for AdwTabOverview
       (libadwaita!1489 upstream)
     - Fix an assertion failure when showing a "toast" notification while its
       hiding animation is still in progress
       (libadwaita#997 upstream)
     - Fix some memory leaks
     - CI updates, not relevant to how this package is built in Debian
   * New upstream bugfix release 1.7.6 (Closes: #1111847)
     - Make cancelling an alert dialog go through the same code path as
       the user interacting with it
       (libadwaita!1511 upstream)
     - Avoid type-check warnings when a dialog is presented as a window
       (libadwaita!1519 upstream)
     - Fix keyboard activation on AdwButtonRow inside AdwDialog presented
       as a window
       (libadwaita#1062 upstream)
     - Crash with a somewhat graceful assertion error if a layout slot is
       invalidly constructed without an ID, instead of segfaulting
       (libadwaita#1059 upstream)
     - Fix a memory leak
       (libadwaita#1067 upstream)
     - Avoid AdwNavigationPage "showing" and "hidden" signals being
       spuriously triggered when swiping left on a touchscreen
       (libadwaita#1065 upstream)
     - Make tab overview buttons easier to press on touchscreens
       (libadwaita#1039 upstream)
     - Fix scan-build warnings by programming more defensively
       (libadwaita!1517 upstream)
     - Remove some dead code
       (libadwaita!1521 upstream)
   * debian/gbp.conf: branch for trixie

libcgi-simple-perl (1.282-1~deb13u1) trixie; urgency=medium
 .
   * Rebuild for trixie
 .
 libcgi-simple-perl (1.282-1) unstable; urgency=medium
 .
   * Team upload.
   * Import upstream version 1.282.
     - Sanitize all user-supplied values before inserting into HTTP headers
       (CVE-2025-40927)
   * Drop "Port latest header-injection refinement from CGI.pm"

libcoap3 (4.3.4-1.1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload by the LTS Team.
   * CVE-2024-0962 (Closes: #1061704)
     fix stacked-based buffer overflow
   * CVE-2024-31031 (Closes: #1070362)
     fix unsigned integer overflow

libreoffice (4:25.2.3-2+deb13u2) trixie; urgency=medium
 .
   * debian/patches/avmedia-qt-use-gstreamer-frame-grabber-by-default.diff: add
     back
   * debian/patches/qt-Consolidate-to-one-toOUString-helper.diff: add from
     upstream; fixes --enable-qt6 builds with the above
 .
   * debian/rules:
     - remove USE_GSTREAMER=n setting on build-indep since it somehow also
       affects the AVMEDIA conditional which makes build-indep builds loose
       the gallery sound files (closes: #1108832), and move the gstreamer -dev
       packages from B-D-A to B-D consequently
libreoffice (4:25.2.3-2+deb13u1) trixie; urgency=medium
 .
    * debian/patches/add-EUR-for-Bulgaria-Lew.diff: add Euro support for
      Bulgaria from libreoffice-25-8 branch (to-be 25.8.1)

librepo (1.20.0-1~deb13u1) trixie; urgency=medium
 .
   * Upload to trixie
 .
 librepo (1.20.0-1) unstable; urgency=medium
 .
   * Improve handling of SELinux in the Debian packaging
   * Update upstream source from tag 'upstream/1.20.0'
   * Drop patches merged upstream
   * d/control: bump Standards-Version to 4.7.2, no changes
   * d/copyright: use GPL URL instead of old FSF postal address
   * Add new symbols to librepo0.symbols

libxml2 (2.12.7+dfsg+really2.9.14-2.1+deb13u1) trixie-security; urgency=high
 .
   * CVE-2025-7425: heap-use-after-free in xmlFreeID caused by `atype`
     corruption (Closes: #1109122)

libxslt (1.1.35-1.2+deb13u1) trixie-security; urgency=medium
 .
   * Fix information disclosure with improved memory handling of generated-id()
     (Closes: #1108074, CVE-2023-40403)
   * Fix type confusion in xmlNode.psvi between stylesheet and source nodes
     (Closes: #1109123, CVE-2025-7424)

linux (6.12.43-1) trixie; urgency=medium
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.42
     - [amd64] ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx
     - ethernet: intel: fix building with large NR_CPUS
     - [amd64] ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx
     - ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX
     - [amd64] ASoC: Intel: fix SND_SOC_SOF dependencies
     - [amd64] ASoC: amd: yc: add DMI quirk for ASUS M6501RM
     - audit,module: restore audit logging in load failure case
     - parse_longname(): strrchr() expects NUL-terminated string
     - fs_context: fix parameter name in infofc() macro
     - fs/ntfs3: cancle set bad inode after removing name fails
     - ublk: use vmalloc for ublk_device's __queues
     - hfsplus: make splice write available again
     - hfs: make splice write available again
     - hfsplus: remove mutex_lock check in hfsplus_free_extents
     - Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
     - gfs2: No more self recovery
     - io_uring: fix breakage in EXPERT menu
     - ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask()
     - ASoC: ops: dynamically allocate struct snd_ctl_elem_value
     - ASoC: mediatek: use reserved memory or enable buffer pre-allocation
     - [arm64] dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV
     - [arm64] soc: qcom: QMI encoding/decoding for big endian
     - [arm64] dts: qcom: sdm845: Expand IMEM region
     - [arm64] dts: qcom: sc7180: Expand IMEM region
     - [arm64] dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes
     - [arm64] dts: qcom: sa8775p: Correct the interrupt for remoteproc
     - [arm64] dts: qcom: msm8976: Make blsp_dma controlled-remotely
     - usb: host: xhci-plat: fix incorrect type for of_match variable in
       xhci_plat_probe()
     - usb: misc: apple-mfi-fastcharge: Make power supply names unique
     - [arm64] dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports
     - [arm64] dts: ti: k3-am62p-j722s: fix pinctrl-single size
     - [arm64] firmware: arm_scmi: Fix up turbo frequencies selection
     - usb: typec: ucsi: yoga-c630: fix error and remove paths
     - mei: vsc: Destroy mutex after freeing the IRQ
     - mei: vsc: Event notifier fixes
     - mei: vsc: Unset the event callback on remove and probe errors
     - [armhf] spi: stm32: Check for cfg availability in stm32_spi_probe
     - vmci: Prevent the dispatching of uninitialized payloads
     - pps: fix poll support
     - Revert "vmci: Prevent the dispatching of uninitialized payloads"
     - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()
     - usb: early: xhci-dbc: Fix early_ioremap leak
     - [armhf] dts: ti: omap: Fixup pinheader typo
     - [arm64] dts: st: fix timer used for ticks
     - [arm64] dts: imx8mm-beacon: Fix HS400 USDHC clock speed
     - [arm64] dts: imx8mn-beacon: Fix HS400 USDHC clock speed
     - PM / devfreq: Check governor before using governor->name
     - PM / devfreq: Fix a index typo in trans_stat
     - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode
     - cpufreq: Initialize cpufreq-based frequency-invariance later
     - cpufreq: Init policy->rwsem before it may be possibly used
     - staging: greybus: gbphy: fix up const issue with the match callback
     - [arm64] soc: qcom: pmic_glink: fix OF node leak
     - [arm64] interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg
     - [arm64] interconnect: qcom: sc8180x: specify num_nodes
     - bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640
     - [arm64,armhf] drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed
     - [arm64,armhf] drm/panfrost: Fix panfrost device variable name in devfreq
     - drm/panthor: Add missing explicit padding in drm_panthor_gpu_info
     - bpf, sockmap: Fix psock incorrectly pointing to sk
     - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
     - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain
     - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel
     - drm/amdgpu: Remove nbiov7.9 replay count reporting
     - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
     - [powerpc*] pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add
     - wifi: rtw89: avoid NULL dereference when RX problematic packet on
       unsupported 6 GHz band
     - wifi: rtl818x: Kill URBs before clearing tx status queue
     - wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
     - iwlwifi: Add missing check for alloc_ordered_workqueue
     - wifi: ath11k: clear initialized flag for deinit-ed srng lists
     - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
     - net/mlx5: Check device memory pointer before usage
     - net: dst: annotate data-races around dst->input
     - net: dst: annotate data-races around dst->output
     - bpf: Ensure RCU lock is held around bpf_prog_ksym_find
     - [arm64] drm/msm/dpu: Fill in min_prefill_lines for SC8180X
     - refscale: Check that nreaders and loops multiplication doesn't overflow
     - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
     - sched/psi: Optimize psi_group_change() cpu_clock() usage
     - fbcon: Fix outdated registered_fb reference in comment
     - netfilter: nf_tables: Drop dead code from fill_*_info routines
     - netfilter: nf_tables: adjust lockdep assertions handling
     - [amd64] iommu/amd: Enable PASID and ATS capabilities in the correct order
     - net/sched: Restrict conditions for adding duplicating netems to qdisc tree
     - net_sched: act_ctinfo: use atomic64_t for three counters
     - RDMA/mlx5: Fix UMR modifying of mkey page size
     - xen: fix UAF in dmabuf_exp_from_pages()
     - xen/gntdev: remove struct gntdev_copy_batch from stack
     - tcp: call tcp_measure_rcv_mss() for ooo packets
     - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
     - wifi: rtw88: Fix macid assigned to TDLS station
     - mwl8k: Add missing check after DMA map
     - wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()
     - drm/amdgpu/gfx9: fix kiq locking in KCQ reset
     - drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset
     - drm/amdgpu/gfx10: fix kiq locking in KCQ reset
     - [amd64] iommu/amd: Fix geometry.aperture_end for V2 tables
     - rcu: Fix delayed execution of hurry callbacks
     - wifi: mac80211: reject TDLS operations when station is not associated
     - wifi: plfxlc: Fix error handling in usb driver probe
     - wifi: mac80211: Do not schedule stopped TXQs
     - wifi: mac80211: Don't call fq_flow_idx() for management frames
     - wifi: mac80211: Check 802.11 encaps offloading in
       ieee80211_tx_h_select_key()
     - Reapply "wifi: mac80211: Update skb's control block key in
       ieee80211_tx_dequeue()"
     - wifi: ath12k: fix endianness handling while accessing wmi service bit
     - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P
       IE
     - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon()
     - wifi: nl80211: Set num_sub_specs before looping through sub_specs
     - ring-buffer: Remove ring_buffer_read_prepare_sync()
     - memcg_slabinfo: Fix use of PG_slab
     - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'
     - Bluetooth: hci_event: Mask data status from LE ext adv reports
     - bpf: Disable migration in nf_hook_run_bpf().
     - can: peak_usb: fix USB FD devices potential malfunction
     - can: kvaser_pciefd: Store device channel index
     - can: kvaser_usb: Assign netdev.dev_port based on device channel index
     - netfilter: xt_nfacct: don't assume acct name is null-terminated
     - net/mlx5e: Clear Read-Only port buffer size in PBMC before update
     - net/mlx5e: Remove skb secpath if xfrm state is not found
     - stmmac: xsk: fix negative overflow of budget in zerocopy mode
     - vrf: Drop existing dst reference in vrf_ip6_input_dst
     - ipv6: prevent infinite loop in rt6_nlmsg_size()
     - ipv6: fix possible infinite loop in fib6_info_uses_dev()
     - ipv6: annotate data-races around rt->fib6_nsiblings
     - bpf/preload: Don't select USERMODE_DRIVER
     - [arm64] bpf, arm64: Fix fp initialization for exception boundary
     - fortify: Fix incorrect reporting of read buffer size
     - [arm64] PCI: rockchip-host: Fix "Unexpected Completion" log message
     - [arm64] clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv
       clocks
     - [arm64] crypto: sun8i-ce - fix nents passed to dma_unmap_sg()
     - [amd64] crypto: qat - use unmanaged allocation for dc_data
     - [arm64,armhf] crypto: marvell/cesa - Fix engine load inaccuracy
     - [amd64] crypto: qat - allow enabling VFs in the absence of IOMMU
     - [amd64] crypto: qat - fix state restore for banks with exceptions
     - mtd: fix possible integer overflow in erase_xfer()
     - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check
     - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name
     - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
     - [armhf] crypto: arm/aes-neonbs - work around gcc-15 warning
     - pinctrl: sunxi: Fix memory leak on krealloc failure
     - dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning
     - [arm64] phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers
     - fanotify: sanitize handle_type values when reporting fid
     - Fix dma_unmap_sg() nents value
     - perf tools: Fix use-after-free in help_unknown_cmd()
     - perf dso: Add missed dso__put to dso__load_kcore
     - mtd: spi-nor: spansion: Fixup params->set_4byte_addr_mode for SEMPER
     - perf sched: Make sure it frees the usage string
     - perf sched: Free thread->priv using priv_destructor
     - perf sched: Fix memory leaks in 'perf sched map'
     - perf sched: Fix memory leaks for evsel->priv in timehist
     - perf sched: Use RC_CHK_EQUAL() to compare pointers
     - perf sched: Fix memory leaks in 'perf sched latency'
     - [arm64] RDMA/hns: Fix double destruction of rsv_qp
     - [arm64] RDMA/hns: Fix HW configurations not cleared in error flow
     - [amd64] crypto: ccp - Fix locking on alloc failure handling
     - [arm64] crypto: inside-secure - Fix `dma_unmap_sg()` nents value
     - [amd64] crypto: ccp - Fix crash when rebind ccp device for ccp.ko
     - [arm64] RDMA/hns: Get message length of ack_req from FW
     - [arm64] RDMA/hns: Fix accessing uninitialized resources
     - [arm64] RDMA/hns: Drop GFP_NOWARN
     - [arm64] RDMA/hns: Fix -Wframe-larger-than issue
     - kernel: trace: preemptirq_delay_test: use offstack cpu mask
     - proc: use the same treatment to check proc_lseek as ones for
       proc_read_iter et.al
     - pinmux: fix race causing mux_owner NULL with active mux_usecount
     - perf tests bp_account: Fix leaked file descriptor
     - [riscv64] clk: thead: th1520-ap: Correctly refer the parent of osc_12m
     - [armhf] clk: sunxi-ng: v3s: Fix de clock definition
     - [ppc64el] scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
     - scsi: mvsas: Fix dma_unmap_sg() nents value
     - scsi: isci: Fix dma_unmap_sg() nents value
     - ext4: Make sure BH_New bit is cleared in ->write_end handler
     - [arm64] hwrng: mtk - handle devm_pm_runtime_enable errors
     - [amd64] crypto: qat - disable ZUC-256 capability for QAT GEN5
     - soundwire: stream: restore params when prepare ports fail
     - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute
     - remoteproc: xlnx: Disable unsupported features
     - fs/orangefs: Allow 2 more characters in do_c_string()
     - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
     - dmaengine: nbpfaxi: Add missing check after DMA map
     - perf tools: Remove libtraceevent in .gitignore
     - [amd64] crypto: qat - fix DMA direction for compression on GEN2 devices
     - [amd64] crypto: qat - fix seq_file position update in adf_ring_next()
     - fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref
     - jfs: fix metapage reference count leak in dbAllocCtl
     - drm/xe/vf: Disable CSC support on VF
     - perf record: Cache build-ID of hit DSOs only
     - vdpa/mlx5: Fix needs_teardown flag calculation
     - vhost-scsi: Fix log flooding with target does not exist errors
     - vdpa/mlx5: Fix release of uninitialized resources on error path
     - vdpa: Fix IDR memory leak in VDUSE module exit
     - vhost: Reintroduce kthread API and add mode selection
     - bpf: Check flow_dissector ctx accesses are aligned
     - bpf: Check netfilter ctx accesses are aligned
     - apparmor: ensure WB_HISTORY_SIZE value is a power of 2
     - apparmor: fix loop detection used in conflicting attachment resolution
     - apparmor: Fix unaligned memory accesses in KUnit test
     - module: Restore the moduleparam prefix length check
     - ucount: fix atomic_long_inc_below() argument type
     - rtc: ds1307: fix incorrect maximum clock rate handling
     - rtc: hym8563: fix incorrect maximum clock rate handling
     - rtc: nct3018y: fix incorrect maximum clock rate handling
     - rtc: pcf85063: fix incorrect maximum clock rate handling
     - rtc: pcf8563: fix incorrect maximum clock rate handling
     - rtc: rv3028: fix incorrect maximum clock rate handling
     - f2fs: turn off one_time when forcibly set to foreground GC
     - f2fs: fix bio memleak when committing super block
     - f2fs: fix KMSAN uninit-value in extent_info usage
     - f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent
     - f2fs: fix to check upper boundary for gc_valid_thresh_ratio
     - f2fs: fix to check upper boundary for gc_no_zoned_gc_percent
     - f2fs: doc: fix wrong quota mount option description
     - f2fs: fix to avoid UAF in f2fs_sync_inode_meta()
     - f2fs: fix to avoid panic in f2fs_evict_inode
     - f2fs: fix to avoid out-of-boundary access in devs.path
     - f2fs: vm_unmap_ram() may be called from an invalid context
     - f2fs: fix to update upper_p in __get_secs_required() correctly
     - f2fs: fix to calculate dirty data during has_not_enough_free_secs()
     - f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode
     - exfat: fdatasync flag should be same like generic_write_sync()
     - i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe()
     - vfio: Fix unbalanced vfio_df_close call in no-iommu mode
     - vfio: Prevent open_count decrement to negative
     - vfio/pds: Fix missing detach_ioas op
     - vfio/pci: Separate SR-IOV VF dev_set
     - scsi: mpt3sas: Fix a fw_event memory leak
     - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free"
     - scsi: ufs: core: Use link recovery when h8 exit fails during runtime
       resume
     - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately
     - kconfig: qconf: fix ConfigList::updateListAllforAll()
     - sched/psi: Fix psi_seq initialization
     - PCI: pnv_php: Clean up allocated IRQs on unplug
     - PCI: pnv_php: Work around switches with broken presence detection
     - [powerpc*] eeh: Export eeh_unfreeze_pe()
     - [powerpc*] eeh: Make EEH driver device hotplug safe
     - PCI: pnv_php: Fix surprise plug detection and recovery
     - pNFS/flexfiles: don't attempt pnfs on fatal DS errors
     - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up()
     - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate()
     - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
     - NFSv4.2: another fix for listxattr
     - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY
     - md/md-cluster: handle REMOVE message earlier
     - netpoll: prevent hanging NAPI when netcons gets enabled
     - phy: mscc: Fix parsing of unicast frames
     - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string()
     - pptp: ensure minimal skb length in pptp_xmit()
     - nvmet: initialize discovery subsys after debugfs is initialized
     - [s390x] ap: Unmask SLCF bit in card and queue ap functions sysfs
     - netlink: specs: ethtool: fix module EEPROM input/output arguments
     - block: Fix default IO priority if there is no IO context
     - block: ensure discard_granularity is zero when discard is not supported
     - ASoC: tas2781: Fix the wrong step for TLV on tas2781
     - [amd64] spi: cs42l43: Property entry should be a null-terminated array
     - net/mlx5: Correctly set gso_segs when LRO is used
     - ipv6: reject malicious packets in ipv6_gso_segment()
     - net: mdio: mdio-bcm-unimac: Correct rate fallback logic
     - net: drop UFO packets in udp_rcv_segment()
     - net/sched: taprio: enforce minimum value for picos_per_byte
     - sunrpc: fix client side handling of tls alerts
     - [x86] irq: Plug vector setup race
     - benet: fix BUG when creating VFs
     - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
     - [s390x] mm: Allocate page table with PAGE_SIZE granularity
     - eth: fbnic: remove the debugging trick of super high page bias
     - irqchip: Build IMX_MU_MSI only on ARM
     - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out()
     - smb: server: remove separate empty_recvmsg_queue
     - smb: server: make sure we call ib_dma_unmap_single() only if we called
       ib_dma_map_single already
     - smb: server: let recv_done() consistently call
       put_recvmsg/smb_direct_disconnect_rdma_connection
     - smb: server: let recv_done() avoid touching data_transfer after
       cleanup/move
     - smb: client: remove separate empty_packet_queue
     - smb: client: make sure we call ib_dma_unmap_single() only if we called
       ib_dma_map_single already
     - smb: client: let recv_done() cleanup before notifying the callers.
     - smb: client: let recv_done() avoid touching data_transfer after
       cleanup/move
     - nvmet: exit debugfs after discovery subsystem exits
     - pptp: fix pptp_xmit() error path
     - smb: client: return an error if rdma_connect does not return within 5
       seconds
     - sunrpc: fix handling of server side tls alerts
     - perf/core: Don't leak AUX buffer refcount on allocation failure
     - perf/core: Exit early on perf_mmap() fail
     - perf/core: Prevent VMA split of buffer mappings
     - selftests/perf_events: Add a mmap() correctness test
     - net/packet: fix a race in packet_set_ring() and packet_notifier()
     - vsock: Do not allow binding to VMADDR_PORT_ANY
     - [amd64] accel/ivpu: Fix reset_engine debugfs file logic
     - Revert "bcache: remove heap-related macros and switch to generic min_heap"
     - ice/ptp: fix crosstimestamp reporting
     - [amd64] drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return
       type
     - [amd64] drm/i915/hdmi: propagate errors from intel_hdmi_init_connector()
     - [amd64] drm/i915/hdmi: add error handling in g4x_hdmi_init()
     - [amd64] drm/i915/ddi: gracefully handle errors from
       intel_ddi_init_hdmi_connector()
     - [amd64] drm/i915/display: add intel_encoder_is_hdmi()
     - [amd64] drm/i915/ddi: only call shutdown hooks for valid encoders
     - ksmbd: fix null pointer dereference error in generate_encryptionkey
     - ksmbd: fix Preauh_HashValue race condition
     - ksmbd: fix corrupted mtime and ctime in smb2_open
     - ksmbd: limit repeated connections from clients with the same IP
       (CVE-2025-38501)
     - smb: server: Fix extension string in ksmbd_extract_shortname()
     - USB: serial: option: add Foxconn T99W709
     - PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state()
     - PCI/ASPM: Fix L1SS saving
     - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano
     - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
     - net: usbnet: Fix the wrong netif_carrier_on() call
     - [x86] sev: Evict cache lines during SNP memory validation (CVE-2024-36331)
     - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe()
     - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
     - ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx
     - ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx
     - ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26)
     - [adm64] platform/x86/intel/pmt: fix a crashlog NULL pointer access
     - [x86] fpu: Delay instruction pointer fixup until after warning
     - [s390x] mm: Remove possible false-positive warning in pte_free_defer()
     - [mips*] mm: tlb-r4k: Uniquify TLB entries on init
     - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
     - mm: swap: correctly use maxpages in swapon syscall to avoid potential
       deadloop
     - mm: swap: fix potential buffer overflow in setup_clusters()
     - perf/arm-ni: Set initial IRQ affinity
     - media: ti: j721e-csi2rx: fix list_del corruption
     - HID: apple: validate feature-report field count to prevent NULL pointer
       dereference
     - USB: gadget: f_hid: Fix memory leak in hidg_bind error path
     - usb: gadget : fix use-after-free in composite_dev_cleanup()
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.43
     - io_uring: don't use int for ABI
     - ALSA: usb-audio: Validate UAC3 power domain descriptors, too
     - ALSA: usb-audio: Validate UAC3 cluster segment descriptors
     - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X
     - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks
     - smb3: fix for slab out of bounds on mount to ksmbd
     - smb: client: remove redundant lstrp update in negotiate protocol
     - gpio: virtio: Fix config space reading.
     - gpio: mlxbf2: use platform_get_irq_optional()
     - Revert "gpio: mlxbf3: only get IRQ for device instance 0"
     - gpio: mlxbf3: use platform_get_irq_optional()
     - leds: flash: leds-qcom-flash: Fix registry access after re-bind
     - Revert "leds: trigger: netdev: Configure LED blink interval for HW
       offload"
     - netlink: avoid infinite retry looping in netlink_unicast()
       (Closes: #1111017)
     - net: phy: micrel: fix KSZ8081/KSZ8091 cable test
     - [armhf] net: ftgmac100: fix potential NULL pointer access in
       ftgmac100_phy_disconnect
     - [arm64] net: enetc: fix device and OF node leak at probe
     - [arm64] net: mtk_eth_soc: fix device leak at probe
     - [arm64] net: ti: icss-iep: fix device and OF node leaks at probe
     - net: usb: asix_devices: add phy_mask for ax88772 mdio bus
     - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
     - NFSD: detect mismatch of file handle and delegation stateid in OPEN op
     - NFS: Fix the setting of capabilities when automounting a new filesystem
     - PCI: Extend isolated function probing to LoongArch
     - [arm64] clk: samsung: exynos850: fix a comment
     - [arm64] clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD
     - [arm64] clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent
       clock
     - fscrypt: Don't use problematic non-inline crypto engines
     - fs: Prevent file descriptor table allocations exceeding INT_MAX
     - eventpoll: Fix semi-unbounded recursion (CVE-2025-38614)
     - Documentation: ACPI: Fix parent device references
     - ACPI: processor: perflib: Fix initial _PPC limit application
     - ACPI: processor: perflib: Move problematic pr->performance check
     - block: Make REQ_OP_ZONE_FINISH a write operation
     - mm/memory-tier: fix abstract distance calculation overflow
     - smb: client: let send_done() cleanup before calling
       smbd_disconnect_rdma_connection()
     - smb: client: don't wait for info->send_pending == 0 on error
     - [amd64] KVM: x86: Convert vcpu_run()'s immediate exit param into a generic
       bitmap
     - [amd64] KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN
       flag
     - [amd64] KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is
       supported
     - [amd64] KVM: VMX: Extract checking of guest's DEBUGCTL into helper
     - [amd64] KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter
     - [amd64] KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter
       APIs
     - [amd64] KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running
       the guest
     - [amd64] habanalabs: fix UAF in export_dmabuf()
     - mm/smaps: fix race between smaps_hugetlb_range and migration
     - udp: also consider secpath when evaluating ipsec use for checksumming
     - netfilter: ctnetlink: fix refcount leak on table dump
     - [arm64] net: ti: icssg-prueth: Fix emac link speed handling
     - [arm64] net: ti: icss-iep: Fix incorrect type for return value in
       extts_enable()
     - sctp: linearize cloned gso packets in sctp_rcv
     - [amd64] intel_idle: Allow loading ACPI tables for any family
     - cpuidle: governors: menu: Avoid using invalid recent intervals data
     - ptp: prevent possible ABBA deadlock in ptp_clock_freerun()
     - tls: handle data disappearing from under the TLS ULP (CVE-2025-38616)
     - net: kcm: Fix race condition in kcm_unattach()
     - hfs: fix general protection fault in hfs_find_init()
     - hfs: fix slab-out-of-bounds in hfs_bnode_read()
     - hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
     - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
     - hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
     - [arm64] Handle KCOV __init vs inline mismatches
     - smb/server: avoid deadlock when linking with ReplaceIfExists
     - nvme-pci: try function level reset on init failure
     - dm-stripe: limit chunk_sectors to the stripe size
     - md/raid10: set chunk_sectors limit
     - nvme-tcp: log TLS handshake failures at error level
     - gfs2: Validate i_depth for exhash directories
     - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops
     - loop: Avoid updating block size under exclusive owner
     - udf: Verify partition map count
     - drbd: add missing kref_get in handle_write_conflicts
     - hfs: fix not erasing deleted b-tree node issue
     - better lockdep annotations for simple_recursive_removal()
     - ata: ahci: Disallow LPM policy control if not supported
     - ata: ahci: Disable DIPM if host lacks support
     - ata: libata-sata: Disallow changing LPM state if not supported
     - fs/ntfs3: Add sanity check for file name
     - fs/ntfs3: correctly create symlink for relative path
     - pidfs: raise SB_I_NODEV and SB_I_NOEXEC
     - fix locking in efi_secret_unlink()
     - securityfs: don't pin dentries twice, once is enough...
     - tracefs: Add d_delete to remove negative dentries
     - usb: xhci: print xhci->xhc_state when queue_command failed
     - [amd64] platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list
     - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag
     - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default
     - usb: xhci: Avoid showing warnings for dying controller
     - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
     - usb: xhci: Avoid showing errors during surprise removal
     - [arm64] soc: qcom: rpmh-rsc: Add RSC version 4 support
     - ACPI: APEI: send SIGBUS to current task if synchronous memory error not
       recovered
     - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU
     - usb: typec: tcpm/tcpci_maxim: fix irq wake usage
     - pmdomain: ti: Select PM_GENERIC_DOMAINS
     - [arm64] gpio: wcd934x: check the return value of regmap_update_bits()
     - cpufreq: Exit governor when failed to start old governor
     - cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode
     - [armhf] rockchip: fix kernel hang during smp initialization
     - PM / devfreq: governor: Replace sscanf() with kstrtoul() in
       set_freq_store()
     - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was
       successed
     - [arm64] thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when
       required
     - iio: adc: ad_sigma_delta: don't overallocate scan buffer
     - [armhf] tegra: Use I/O memcpy to write to IRAM
     - ACPI: PRM: Reduce unnecessary printing to avoid user confusion
     - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
     - thermal: sysfs: Return ENODATA instead of EAGAIN for reads
     - PM: sleep: console: Fix the black screen issue
     - ACPI: processor: fix acpi_object initialization
     - [arm64] mmc: sdhci-msm: Ensure SD card power isn't ON when card removed
     - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
     - pps: clients: gpio: fix interrupt handling order in remove path
     - reset: brcmstb: Enable reset drivers for ARCH_BCM2835
     - char: misc: Fix improper and inaccurate error code returned by misc_init()
     - [amd64] mei: bus: Check for still connected devices in
       mei_cl_bus_dev_release()
     - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
     - [amd64,arm64] platform/chrome: cros_ec_sensorhub: Retries when a sensor is
       not ready
     - ALSA: hda: Handle the jack polling always via a work
     - ALSA: hda: Disable jack polling at shutdown
     - [amd64] x86/bugs: Avoid warning when overriding return thunk
     - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
     - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
     - ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode
     - tty: serial: fix print format specifiers
     - ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime()
     - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present
     - usb: core: usb_submit_urb: downgrade type check
     - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
     - [arm64] imx8m-blk-ctrl: set ISI panic write hurry level
     - [arm64] soc: qcom: mdt_loader: Actually use the e_phoff
     - [amd64] platform/x86: thinkpad_acpi: Handle KCOV __init vs inline
       mismatches
     - [amd64,arm64] platform/chrome: cros_ec_typec: Defer probe on missing EC
       parent
     - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
     - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop
     - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
     - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement
     - ASoC: codecs: rt5640: Retry DEVICE_ID verification
     - [arm64] ASoC: qcom: use drvdata instead of component to keep id
     - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps
     - [powerpc*] thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64
     - Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925
     - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie()
     - xen/netfront: Fix TX response spurious interrupts
     - wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn
     - net: usb: cdc-ncm: check for filtering capability
     - wifi: ath12k: Correct tid cleanup when tid setup fails
     - wifi: cfg80211: reject HTC bit for management frames
     - [s390x] time: Use monotonic clock in get_cycles()
     - be2net: Use correct byte order and format string for TCP seq and ack_seq
     - libbpf: Verify that arena map exists when adding arena relocations
     - idpf: preserve coalescing settings across resets
     - wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan
       mode
     - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB
     - et131x: Add missing check after DMA map
     - net: ag71xx: Add missing check after DMA map
     - net/mlx5e: Properly access RCU protected qdisc_sleeping variable
     - net: pcs: xpcs: mask readl() return value to 16 bits
     - [arm64] Mark kernel as tainted on SAE and SError panic
     - drm/amd/pm: fix null pointer access
     - rcu: Protect ->defer_qs_iw_pending from data race
     - drm/amd/display: limit clear_update_flags to dcn32 and above
     - net: mctp: Prevent duplicate binds
     - wifi: cfg80211: Fix interface type validation
     - wifi: mac80211: don't unreserve never reserved chanctx
     - net: ipv4: fix incorrect MTU in broadcast routes
     - [arm64] net: thunderx: Fix format-truncation warning in
       bgx_acpi_match_id()
     - net: phy: micrel: Add ksz9131_resume()
     - sched/deadline: Fix accounting after global limits change
     - bpf: Forget ranges when refining tnum after JSET
     - wifi: iwlwifi: mvm: set gtk id also in older FWs
     - wifi: iwlwifi: mvm: fix scan request validation
     - [s390x] stp: Remove udelay from stp_sync_clock()
     - net: phy: bcm54811: PHY initialization
     - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails
     - wifi: mac80211: don't complete management TX on SAE commit
     - wifi: mac80211: avoid weird state in error path
     - [s390x] early: Copy last breaking event address to pt_regs
     - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in
       __ipv6_dev_mc_inc().
     - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access
     - wifi: mac80211: fix rx link assignment for non-MLO stations
     - [arm64] drm/msm: use trylock for debugfs
     - [arm64] drm/msm: Add error handling for krealloc in metadata setup
     - [arm64] perf/arm: Add missing .suppress_bind_attrs
     - wifi: rtw89: Fix rtw89_mac_power_switch() for USB
     - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch
     - drm/xe/xe_query: Use separate iterator while filling GT list
     - [amd64] net: thunderbolt: Enable end-to-end flow control also in transmit
     - [amd64] net: thunderbolt: Fix the parameter passing of
       tb_xdomain_enable_paths()/tb_xdomain_disable_paths()
     - xfrm: Duplicate SPI Handling
     - net: atlantic: add set_power to fw_ops for atl2 to fix wol
     - ACPI: Suppress misleading SPCR console message when SPCR table is absent
     - net: ieee8021q: fix insufficient table-size assertion
     - net: fec: allow disable coalescing
     - drm/amd/display: Separate set_gsl from set_gsl_source_select
     - wifi: ath10k: shutdown driver when hardware is unreliable
     - wifi: ath12k: Add memset and update default rate value in wmi tx
       completion
     - wifi: ath12k: Fix station association with MBSSID Non-TX BSS
     - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
     - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
     - drm/amd/display: Fix 'failed to blank crtc!'
     - drm/amd/display: Initialize mode_select to 0
     - wifi: mac80211: update radar_required in channel context after channel
       switch
     - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`.
     - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0
     - wifi: ath12k: Decrement TID on RX peer frag setup error handling
     - [powerpc*] floppy: Add missing checks after DMA map
     - netmem: fix skb_frag_address_safe with unreadable skbs
     - [arm64] stacktrace: Check kretprobe_find_ret_addr() return value
     - wifi: iwlegacy: Check rate_idx range after addition
     - neighbour: add support for NUD_PERMANENT proxy entries
     - dpaa_eth: don't use fixed_phy_change_carrier
     - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to
       manual
     - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured
     - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
     - gve: Return error for unknown admin queue command
     - [armhf] net: dsa: b53: ensure BCM5325 PHYs are enabled
     - [armhf] net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
     - [armhf] net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
     - [armhf] net: dsa: b53: prevent DIS_LEARNING access on BCM5325
     - [armhf] net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
     - bpftool: Fix JSON writer resource leak in version command
     - ptp: Use ratelimite for freerun error message
     - wifi: rtw89: scan abort when assign/unassign_vif
     - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc()
     - ionic: clean dbpage in de-init
     - drm/xe: Make dma-fences compliant with the safe access rules
     - [armhf] net: ncsi: Fix buffer overflow in fetching version id
     - drm/ttm: Should to return the evict error
     - uapi: in6: restore visibility of most IPv6 socket options
     - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP
     - drm/amd/display: Update DMCUB loading sequence for DCN3.5
     - drm/amd/display: Avoid trying AUX transactions on disconnected ports
     - drm/ttm: Respect the shrinker core free target
     - rcu: Fix rcu_read_unlock() deadloop due to IRQ work
     - [armhf] net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
     - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page
     - vhost: fail early when __vhost_add_used() fails
     - drm/amd/display: Only finalize atomic_obj if it was initialized
     - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported
     - drm/amd/display: Disable dsc_power_gate for dcn314 by default
     - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race
       condition
     - cifs: Fix calling CIFSFindFirst() for root path without msearch
     - fbdev: fix potential buffer overflow in do_register_framebuffer()
     - crypto: hisilicon/hpre - fix dma unmap sequence
     - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
     - [arm64,armhf] clk: tegra: periph: Fix error handling and resolve unsigned
       compare warning
     - mfd: axp20x: Set explicit ID for AXP313 regulator
     - [arm64] phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal
     - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
     - fs/orangefs: use snprintf() instead of sprintf()
     - watchdog: dw_wdt: Fix default timeout
     - hwmon: (emc2305) Set initial PWM minimum value during probe based on
       thermal state
     - [mips*] vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free}
     - watchdog: iTCO_wdt: Report error if timeout configuration fails
     - scsi: bfa: Double-free fix
     - jfs: truncate good inode pages when hard link is 0
     - jfs: Regular file corruption check
     - jfs: upper bound check of tree index in dbAllocAG
     - media: hi556: Fix reset GPIO timings
     - RDMA/bnxt_re: Fix size of uverbs_copy_to() in
       BNXT_RE_METHOD_GET_TOGGLE_MEM
     - crypto: jitter - fix intermediary handling
     - [mips*] Don't crash in stack_top() for tasks without ABI or vDSO
     - [riscv64] clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED
     - media: ipu-bridge: Add _HID for OV5670
     - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ
       control
     - leds: leds-lp50xx: Handle reg to get correct multi_index
     - [armhf] dmaengine: stm32-dma: configure next sg only if there are more
       than 2 sgs
     - [amd64] RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()
     - RDMA/core: reduce stack using in nldev_stat_get_doit()
     - scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in
       dev_loss_tmo_callbk
     - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
     - power: supply: qcom_battmgr: Add lithium-polymer entry
     - scsi: mpt3sas: Correctly handle ATA device errors
     - scsi: mpi3mr: Correctly handle ATA device errors
     - [armhf] pinctrl: stm32: Manage irq affinity settings
     - media: usb: hdpvr: disable zero-length read messages
     - media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()
     - media: dvb-frontends: w7090p: fix null-ptr-deref in
       w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
     - media: uvcvideo: Add quirk for HP Webcam HD 2300
     - media: uvcvideo: Fix bandwidth issue for Alcor camera
     - [amd64] crypto: ccp - Add missing bootloader info reg for pspv6
     - [arm64] clk: renesas: rzg2l: Postpone updating priv->clks[]
     - soundwire: amd: serialize amd manager resume sequence during pm_prepare
     - soundwire: amd: cancel pending slave status handling workqueue during
       remove sequence
     - soundwire: Move handle_nested_irq outside of sdw_dev_lock
     - md: dm-zoned-target: Initialize return variable r to avoid uninitialized
       use
     - module: Prevent silent truncation of module name in delete_module(2)
     - i3c: add missing include to internal header
     - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
     - apparmor: shift ouid when mediating hard links in userns
     - i3c: don't fail if GETHDRCAP is unsupported
     - i3c: master: Initialize ret in i3c_i2c_notifier_call()
     - dm-mpath: don't print the "loaded" message if registering fails
     - dm-table: fix checking for rq stackable devices
     - apparmor: use the condition in AA_BUG_FMT even with debug disabled
     - apparmor: fix x_table_lookup when stacking is not the first entry
     - i2c: Force DLL0945 touchpad i2c freq to 100khz
     - exfat: add cluster chain loop check for dir
     - f2fs: check the generic conditions first
     - printk: nbcon: Allow reacquire during panic
     - vfio/type1: conditional rescheduling while pinning
     - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
     - scsi: target: core: Generate correct identifiers for PR OUT transport IDs
     - scsi: aacraid: Stop using PCI_IRQ_AFFINITY
     - vfio/mlx5: fix possible overflow in tracking max message size
     - ipmi: Use dev_warn_ratelimited() for incorrect message warnings
     - ipmi: Fix strcpy source and destination the same
     - tools/power turbostat: Handle non-root legacy-uncore sysfs permissions
     - tools/power turbostat: Fix build with musl
     - tools/power turbostat: Handle cap_get_proc() ENOSYS
     - smb: client: don't call init_waitqueue_head(&info->conn_wait) twice in
       _smbd_get_connection
     - lib/sbitmap: convert shallow_depth from one word to the whole sbitmap
     - ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table
     - net: phy: smsc: add proper reset flags for LAN8710A
     - [amd64] ASoC: Intel: avs: Fix uninitialized pointer error in probe()
     - block: avoid possible overflow for chunk_sectors check in
       blk_stack_limits()
     - pNFS: Fix stripe mapping in block/scsi layout
     - pNFS: Fix disk addr range check in block/scsi layout
     - pNFS: Handle RPC size limit for layoutcommits
     - pNFS: Fix uninited ptr deref in block/scsi layout
     - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
     - scsi: lpfc: Remove redundant assignment to avoid memory leak
     - [amd64,armhf] ASoC: fsl_sai: replace regmap_write with regmap_update_bits
     - cifs: Fix collect_sample() to handle any iterator type
     - drm/amdgpu: fix vram reservation issue
     - drm/amdgpu: fix incorrect vm flags to map bo
     - mm/damon/core: commit damos->target_nid
     - block: Introduce bio_needs_zone_write_plugging()
     - dm: Always split write BIOs to zoned device limits
     - cifs: reset iface weights when we cannot find a candidate
     - [amd64] iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes
     - [arm64] iommu/arm-smmu-qcom: Add SM6115 MDSS compatible
     - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range
     - iommufd: Prevent ALIGN() overflow
     - ext4: fix zombie groups in average fragment size lists
     - ext4: fix largest free orders lists corruption on mb_optimize_scan switch
     - ext4: initialize superblock fields in the kballoc-test.c kunit tests
     - usb: core: config: Prevent OOB read in SS endpoint companion parsing
     - misc: rtsx: usb: Ensure mmc child device is active when card is present
     - usb: typec: ucsi: Update power_supply on power role change
     - [amd64] comedi: fix race between polling and detaching
     - [amd64] thunderbolt: Fix copy+paste error in match_service_id()
     - cdc-acm: fix race between initial clearing halt and open
     - btrfs: zoned: use filesystem size not disk size for reclaim decision
     - btrfs: abort transaction during log replay if walk_log_tree() failed
     - btrfs: zoned: do not remove unwritten non-data block group
     - btrfs: qgroup: set quota enabled bit if quota disable fails flushing
       reservations
     - btrfs: don't ignore inode missing when replaying log tree
     - btrfs: fix ssd_spread overallocation
     - btrfs: populate otime when logging an inode item
     - btrfs: qgroup: fix qgroup create ioctl returning success after quotas
       disabled
     - btrfs: don't skip remaining extrefs if dir not found during log replay
     - btrfs: clear dirty status from extent buffer on error at insert_new_root()
     - btrfs: fix log tree replay failure due to file with 0 links and extents
     - btrfs: error on missing block group when unaccounting log tree extent
       buffers
     - btrfs: zoned: do not select metadata BG as finish target
     - btrfs: fix iteration bug in __qgroup_excl_accounting()
     - btrfs: do not allow relocation of partially dropped subvolumes
     - xfs: fix scrub trace with null pointer in quotacheck
     - userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry
     - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
     - net/sched: ets: use old 'nbands' while purging unused classes
     - [amd64,arm64] hv_netvsc: Fix panic during namespace deletion with VF
     - mm, slab: restore NUMA policy support for large kmalloc
     - mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd()
     - mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()
     - mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
     - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
     - media: venus: Fix OOB read due to missing payload bound check
     - media: uvcvideo: Do not mark valid metadata as invalid
     - media: v4l2: Add support for NV12M tiled variants to v4l2_format_info()
     - HID: magicmouse: avoid setting up battery timer when not needed
     - wifi: mac80211: check basic rates validity in sta_link_apply_parameters
     - HID: apple: avoid setting up battery timer for devices without battery
     - mfd: cros_ec: Separate charge-control probing from USB-PD
     - net: Add net_passive_inc() and net_passive_dec().
     - net: better track kernel sockets lifetime (CVE-2025-21884)
     - smb: client: fix netns refcount leak after net_passive changes
     - PCI: Store all PCIe Supported Link Speeds
     - PCI: Allow PCI bridges to go to D3Hot on all non-x86
     - PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports
     - [arm64] dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C
     - [arm64] dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C
     - ata: libata-sata: Add link_power_management_supported sysfs attribute
     - io_uring/rw: cast rw->flags assignment to rwf_t
     - drm/amd/display: Allow DCN301 to clear update flags
     - rcu: Fix racy re-initialization of irq_work causing hangs
     - dm: split write BIOs on zone boundaries when zone append is not emulated
     - PCI: Honor Max Link Speed when determining supported speeds
     - ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled
 .
   [ Bastian Blank ]
   * [amd64, arm64] Enable MANA_INFINIBAND.
 .
   [ Salvatore Bonaccorso ]
   * [amd64] udeb: kernel-image: Include SPI drivers
   * ext4: don't try to clear the orphan_present feature block device is r/o
     (Closes: #1108271)
   * alloc_fdtable(): change calling conventions.
   * net: ipv4: fix regression in local-broadcast route
 .
   [ Ben Hutchings ]
   * proc: fix missing pde_set_flags() for net proc files
linux (6.12.41-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.39
     - eventpoll: don't decrement ep refcount while still holding the ep mutex
       (CVE-2025-38349)
     - drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics
     - drm/amdgpu/ip_discovery: add missing ip_discovery fw
     - [s390x] crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2
     - drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid
       Priority Inversion in SRIOV (CVE-2025-38104)
     - [amd64] ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select
       SND_SOC_ACPI_INTEL_MATCH
     - [amd64] ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address
       struct
     - [amd64] ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43
       laptops
     - [amd64] ASoC: soc-acpi: add get_function_tplg_files ops
     - [amd64] ASoC: Intel: add sof_sdw_get_tplg_files ops
     - [amd64] ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files
       ops
     - [amd64] ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches
     - perf/core: Fix the WARN_ON_ONCE is out of lock protected region
     - irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ
     - sched/core: Fix migrate_swap() vs. hotplug
     - perf: Revert to requiring CAP_SYS_ADMIN for uprobes
     - ASoC: cs35l56: probe() should fail if the device ID is not recognized
     - Bluetooth: hci_sync: Fix not disabling advertising instance
     - Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected
     - pinctrl: amd: Clear GPIO debounce for suspend
     - fix proc_sys_compare() handling of in-lookup dentries
     - sched/deadline: Fix dl_server runtime calculation formula
     - bnxt_en: eliminate the compile warning in bnxt_request_irq due to
       CONFIG_RFS_ACCEL
     - [arm64] poe: Handle spurious Overlay faults
     - [arm64] net: phy: qcom: move the WoL function to shared library
     - [arm64] net: phy: qcom: qca808x: Fix WoL issue by utilizing
       at8031_set_wol()
     - netlink: Fix wraparounds of sk->sk_rmem_alloc.
     - vsock: fix `vsock_proto` declaration
     - tipc: Fix use-after-free in tipc_conn_close().
     - tcp: Correct signedness in skb remaining space calculation
     - vsock: Fix transport_{g2h,h2g} TOCTOU
     - vsock: Fix transport_* TOCTOU
     - vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local`
     - net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2
     - net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap
     - net: phy: smsc: Force predictable MDI-X state on LAN87xx
     - net: phy: smsc: Fix link failure in forced mode with Auto-MDIX
     - atm: clip: Fix potential null-ptr-deref in to_atmarpd().
     - atm: clip: Fix memory leak of struct clip_vcc.
     - atm: clip: Fix infinite recursive call of clip_push().
     - atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
     - [arm64] net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for
       skb_shared_info
     - net/sched: Abort __tc_modify_qdisc if parent class does not exist
     - rxrpc: Fix bug due to prealloc collision
     - rxrpc: Fix oops due to non-existence of prealloc backlog struct
     - ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
     - [amd64] x86/mce/amd: Add default names for MCA banks and blocks
     - [amd64] x86/mce/amd: Fix threshold limit reset
     - [amd64] x86/mce: Don't remove sysfs if thresholding sysfs init fails
     - [amd64] x86/mce: Ensure user polling settings are honored when restarting
       timer
     - [amd64] x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
     - [amd64] KVM: x86/xen: Allow 'out of range' event channel ports in IRQ
       routing table.
     - [amd64] KVM: SVM: Add missing member in SNP_LAUNCH_START command structure
     - [amd64] KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is
       in-flight
     - KVM: Allow CPU to reschedule while setting per-page memory attributes
     - ASoC: fsl_sai: Force a software reset when starting in consumer mode
     - gre: Fix IPv6 multicast route creation. (Closes: #1108430)
     - md/md-bitmap: fix GPF in bitmap_get_stats() (Closes: #1109734)
     - [arm64] pinctrl: qcom: msm: mark certain pins as invalid for interrupts
     - pwm: Fix invalid state detection
     - pwm: mediatek: Ensure to disable clocks in error path
     - wifi: prevent A-MSDU attacks in mesh networks (CVE-2025-27558)
     - wifi: mwifiex: discard erroneous disassoc frames on STA interface
     - wifi: mt76: mt7921: prevent decap offload config before STA initialization
     - wifi: mt76: mt7925: prevent NULL pointer dereference in
       mt7925_sta_set_decap_offload()
     - wifi: mt76: mt7925: fix the wrong config for tx interrupt
     - wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw
       scan
     - drm/imagination: Fix kernel crash when hard resetting the GPU
     - drm/amdkfd: Don't call mmput from MMU notifier callback
     - drm/gem: Acquire references on GEM handles for framebuffers
     - drm/sched: Increment job count before swapping tail spsc queue
     - drm/ttm: fix error handling in ttm_buffer_object_transfer
     - drm/gem: Fix race in drm_gem_handle_create_tail()
     - drm/xe/bmg: fix compressed VRAM handling
     - Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2"
     - usb: gadget: u_serial: Fix race condition in TTY wakeup
     - Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io"
     - drm/framebuffer: Acquire internal references on GEM handles
     - drm/xe: Allocate PF queue size on pow2 boundary
     - Revert "ACPI: battery: negate current when discharging" (Closes: #1109344)
     - Revert "PCI/ACPI: Fix allocated memory release on error in
       pci_acpi_scan_root()"
     - kallsyms: fix build without execinfo
     - maple_tree: fix mt_destroy_walk() on root leaf node
     - mm: fix the inaccurate memory statistics issue for users
     - mm/vmalloc: leave lazy MMU mode on PTE mapping error
     - lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users()
     - [amd64] x86/rdrand: Disable RDSEED on AMD Cyan Skillfish
     - [amd64] x86/mm: Disable hugetlb page table sharing on 32-bit
     - [arm64] clk: scmi: Handle case where child clocks are initialized before
       their parents
     - smb: server: make use of rdma_destroy_qp()
     - ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked()
     - erofs: fix to add missing tracepoint in erofs_read_folio()
     - erofs: address D-cache aliasing
     - [amd64] ASoC: Intel: sof-function-topology-lib: Print out the unsupported
       dmic count
     - netlink: Fix rmem check in netlink_broadcast_deliver().
     - netlink: make sure we allow at least one dump skb
     - netfs: Fix ref leak on inserted extra subreq in write retry
     - wifi: cfg80211: fix S1G beacon head validation in nl80211
     - wifi: zd1211rw: Fix potential NULL pointer dereference in
       zd_mac_tx_to_dev()
     - drm/tegra: nvdec: Fix dma_alloc_coherent error check
     - md/raid1: Fix stack memory use after return in raid1_reshape
     - raid10: cleanup memleak at raid10_make_request
     - wifi: mac80211: correctly identify S1G short beacon
     - wifi: mac80211: fix non-transmitted BSSID profile search
     - wifi: rt2x00: fix remove callback type mismatch
     - drm/nouveau/gsp: fix potential leak of memory used during acpi init
     - wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init()
     - nbd: fix uaf in nbd_genl_connect() error path
     - drm/xe/pf: Clear all LMTT pages on alloc
     - erofs: free pclusters if no cached folio is attached
     - erofs: get rid of `z_erofs_next_pcluster_t`
     - erofs: tidy up zdata.c
     - erofs: refine readahead tracepoint
     - erofs: fix to add missing tracepoint in erofs_readahead()
     - netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
     - net: appletalk: Fix device refcount leak in atrtr_create()
     - ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof
     - net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits
     - net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
     - drm/xe/pm: Correct comment of xe_pm_set_vram_threshold()
     - can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to
       debug level
     - net/mlx5e: Fix race between DIM disable and net_dim()
     - net/mlx5e: Add new prio for promiscuous mode
     - net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam()
     - bnxt_en: Fix DCB ETS validation
     - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
     - ublk: sanity check add_dev input for underflow
     - atm: idt77252: Add missing `dma_map_error()`
     - ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak.
     - [amd64] ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606
     - io_uring: make fallocate be hashed work
     - [amd64] ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic
     - ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100
     - ALSA: hda/realtek: Add quirks for some Clevo laptops
     - net: usb: qmi_wwan: add SIMCom 8230C composition
     - driver: bluetooth: hci_qca:fix unable to load the BT driver
     - HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2
     - net: mana: Record doorbell physical address in PF mode
     - btrfs: fix assertion when building free space tree
     - vt: add missing notification when switching back to text mode
     - bpf: Adjust free target to avoid global starvation of LRU map
     - [riscv64] vdso: Exclude .rodata from the PT_DYNAMIC segment
     - HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
     - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
     - HID: nintendo: avoid bluetooth suspend/resume stalls
     - erofs: fix rare pcluster memory leak after unmounting
     - net: wangxun: revert the adjustment of the IRQ vector sequence
     - kasan: remove kasan_find_vm_area() to prevent possible deadlock
     - ksmbd: fix potential use-after-free in oplock/lease break ack
     - [arm64] Filter out SME hwcaps when FEAT_SME isn't implemented
     - crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP()
       (CVE-2025-37984)
     - rseq: Fix segfault on registration when rseq_cs is non-zero
       (CVE-2025-38067)
     - [amd64] KVM: SVM: Set synthesized TSA CPUID flags
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.40
     - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
     - USB: serial: option: add Foxconn T99W640
     - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
     - usb: musb: fix gadget state on disconnect
     - [arm*] usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY
     - usb: gadget: configfs: Fix OOB read on empty string write
     - [armhf] i2c: stm32: fix the device used for the DMA map
     - [armhf] i2c: stm32f7: unmap DMA mapped buffer
     - [amd64] thunderbolt: Fix wake on connect at runtime
     - [amd64] thunderbolt: Fix bit masking in tb_dp_port_set_hops()
     - Revert "staging: vchiq_arm: Create keep-alive thread during probe"
     - nvmem: imx-ocotp: fix MAC address byte length
     - nvmem: layouts: u-boot-env: remove crc32 endianness conversion
     - Input: xpad - set correct controller type for Acer NGR200
     - pch_uart: Fix dma_sync_sg_for_device() nents value
     - spi: Add check for 8-bit transfer with 8 IO mode support
     - dm-bufio: fix sched in atomic context
     - HID: core: ensure the allocated report buffer can contain the reserved
       report ID
     - HID: core: ensure __hid_request reserves the report ID as the first byte
     - HID: core: do not bypass hid_hw_raw_request
     - tracing/probes: Avoid using params uninitialized in parse_btf_arg()
     - tracing: Add down_write(trace_event_sem) when adding trace event
     - tracing/osnoise: Fix crash in timerlat_dump_stack()
     - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume
     - drm/amdgpu: Increase reset counter only on success
     - drm/amd/display: Disable CRTC degamma LUT for DCN401
     - drm/amd/display: Free memory allocation
     - ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx
     - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS
     - io_uring/poll: fix POLLERR handling
     - mptcp: make fallback action and fallback decision atomic
     - mptcp: plug races between subflow fail and subflow creation
     - mptcp: reset fallback status gracefully at disconnect() time
     - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in
       pep_sock_accept()
     - net/mlx5: Update the list of the PCI supported devices
     - [arm64] dts: imx8mp-venice-gw74xx: fix TPM SPI frequency
     - [arm64] dts: add big-endian property back into watchdog node
     - [arm64] dts: freescale: imx8mm-verdin: Keep LDO5 always on
     - [arm64] dts: imx8mp-venice-gw71xx: fix TPM SPI frequency
     - [arm64] dts: imx8mp-venice-gw72xx: fix TPM SPI frequency
     - [arm64] dts: imx8mp-venice-gw73xx: fix TPM SPI frequency
     - [arm64] dts: rockchip: use cs-gpios for spi1 on ringneck
     - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
     - af_packet: fix soft lockup issue caused by tpacket_snd()
     - Bluetooth: btintel: Check if controller is ISO capable on
       btintel_classify_pkt_type
     - cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y
     - isofs: Verify inode mode when loading from disk
     - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
     - [arm*] mmc: bcm2835: Fix dma_unmap_sg() nents value
     - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based
       Positivo models
     - [arm64] mmc: sdhci_am654: Workaround for Errata i2312
     - [amd64] net: stmmac: intel: populate entire system_counterval_t in
       get_time_fn() callback
     - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
     - [s390x] bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
     - smb: client: fix use-after-free in crypt_message when using async crypto
     - [armhf] soc: aspeed: lpc-snoop: Cleanup resources in stack-order
     - [armhf] soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
     - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush
     - iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps
     - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
     - iio: adc: max1363: Reorder mode_list[] entries
     - iio: adc: stm32-adc: Fix race in installing chained IRQ handler
     - iio: backend: fix out-of-bound write
     - iio: common: st_sensors: Fix use of uninitialize device structs
     - [arm64] dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5
     - [arm64] dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B
     - [arm64] dts: imx95: Correct the DMA interrupter number of pcie0_ep
     - bpf: Reject %p% format string in bprintf-like helpers
     - cachefiles: Fix the incorrect return value in __cachefiles_write()
     - block: fix kobject leak in blk_unregister_queue
     - net/sched: sch_qfq: Fix race condition on qfq_aggregate
     - rpl: Fix use-after-free in rpl_do_srh_inline().
     - smb: client: fix use-after-free in cifs_oplock_break
     - fix a leak in fcntl_dirnotify()
     - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list()
     - nvme: fix endianness of command word prints in nvme_log_err_passthru()
     - smc: Fix various oops due to inet_sock type confusion.
     - net: phy: Don't register LEDs for genphy
     - nvme: fix misaccounting of nvme-mpath inflight I/O
     - nvmet-tcp: fix callback lock for TLS handshake
     - wifi: cfg80211: remove scan request n_channels counted_by
     - [amd64] hwmon: (corsair-cpro) Validate the size of the received input
       buffer
     - ice: add NULL check in eswitch lag check
     - ice: check correct pointer in fwlog debugfs
     - usb: net: sierra: check for no status endpoint
     - loop: use kiocb helpers to fix lockdep warning
     - [riscv64] Enable interrupt during exception handling
     - [riscv64] traps_misaligned: properly sign extend value in misaligned load
       handler
     - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
     - Bluetooth: hci_sync: fix connectable extended advertising when using
       static random address
     - Bluetooth: SMP: If an unallowed command is received consider it a failure
     - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
     - Bluetooth: hci_core: add missing braces when using macro parameters
     - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant
       without board ID
     - net/mlx5: Correctly set gso_size when LRO is used
     - ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
     - net: fix segmentation after TCP/UDP fraglist GRO
     - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
     - drm/xe/pf: Sanitize VF scratch registers on FLR
     - drm/xe/pf: Move VFs reprovisioning to worker
     - drm/xe/pf: Prepare to stop SR-IOV support prior GT reset
     - Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
     - [amd64,arm64] hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open
       to prevent IPv6 addrconf
     - virtio-net: fix recursived rtnl_lock() during probe()
     - tls: always refresh the queue when reading sock
     - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during
       runtime
     - net: bridge: Do not offload IGMP/MLD messages
     - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
     - rxrpc: Fix recv-recv race of completed call
     - rxrpc: Fix transmission of an abort in response to an abort
     - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen"
     - drm/mediatek: Add wait_event_timeout when disabling plane
     - drm/mediatek: only announce AFBC if really supported
     - libbpf: Fix handling of BPF arena relocations
     - efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths
     - sched: Change nr_uninterruptible type to unsigned long
     - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right
       userns
     - btrfs: fix block group refcount race in
       btrfs_create_pending_block_groups() (CVE-2025-22115)
     - usb: hub: fix detection of high tier USB3 devices behind suspended hubs
     - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime
       pm
     - usb: hub: Fix flushing of delayed work used for post resume purposes
     - usb: hub: Don't try to recover devices lost during warm reset.
     - [arm64] usb: dwc3: qcom: Don't leave BCR asserted
     - [arm64,armhf] i2c: omap: Add support for setting mux
     - [arm64,armhf] i2c: omap: Fix an error handling path in omap_i2c_probe()
     - [arm64,armhf] i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe()
     - [arm64,armhf] i2c: omap: fix deprecated of_property_read_bool() use
     - sched,freezer: Remove unnecessary warning in __thaw_task
     - drm/xe/mocs: Initialize MOCS index early
     - drm/xe: Move page fault init after topology init
     - smb: client: let smbd_post_send_iter() respect the peers max_send_size and
       transmit all data
     - [amd64] iommu/vt-d: Fix misplaced domain_attached assignment
       (Closes: #1109676)
     - [amd64] KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll
       hypercalls
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.41
     - [amd64] x86/traps: Initialize DR7 by writing its architectural reset value
     - Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT
       (CVE-2025-38335)
     - virtio_net: Enforce minimum TX ring size for reliability
     - virtio_ring: Fix error reporting in virtqueue_resize
     - regulator: core: fix NULL dereference on unbind due to stale coupling data
     - [amd64] platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo
       UX8406CA
     - RDMA/core: Rate limit GID cache warning messages
     - [arm64] interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1
       node
     - iio: adc: ad7949: use spi_is_bpw_supported()
     - regmap: fix potential memory leak of regmap_bus
     - [amd64] x86/hyperv: Fix usage of cpu_online_mask to get valid cpu
     - [amd64] platform/x86: Fix initialization order for
       firmware_attributes_class
     - [arm*] staging: vchiq_arm: Make vchiq_shutdown never fail
     - xfrm: state: initialize state_ptrs earlier in xfrm_state_find
     - xfrm: state: use a consistent pcpu_id in xfrm_state_find
     - xfrm: Set transport header to fix UDP GRO handling
     - xfrm: interface: fix use-after-free after changing collect_md xfrm
       interface
     - [arm64] net: ti: icssg-prueth: Fix buffer allocation for ICSSG
     - net/mlx5: Fix memory leak in cmd_exec()
     - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch
     - i40e: report VF tx_dropped with tx_errors instead of tx_discards
     - i40e: When removing VF MAC filters, only check PF-set MAC
     - net: appletalk: Fix use-after-free in AARP proxy probe
     - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in
       qfq_delete_class
     - can: netlink: can_changelink(): fix NULL pointer deref of struct
       can_priv::do_set_mode
     - [arm64] drm/bridge: ti-sn65dsi86: Remove extra semicolon in
       ti_sn_bridge_probe()
     - ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop
     - [s390x] ism: fix concurrency management in ism_cmd()
     - [arm64] net: hns3: fix concurrent setting vlan filter issue
     - [arm64] net: hns3: disable interrupt when ptp init failed
     - [arm64] net: hns3: fixed vf get max channels bug
     - [arm64] net: hns3: default enable tx bounce buffer when smmu enabled
     - [amd64] platform/x86: ideapad-laptop: Fix FnLock not remembered among
       boots
     - [amd64] platform/x86: ideapad-laptop: Fix kbd backlight not remembered
       among boots
     - drm/amdgpu: Reset the clear flag in buddy during resume
     - drm/sched: Remove optimization that causes hang when killing dependent
       jobs
     - mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show()
     - timekeeping: Zero initialize system_counterval when querying time from phc
       drivers
     - [arm64] i2c: qup: jump out of the loop in case of timeout
     - [arm64,armhf] i2c: tegra: Fix reset error handling with ACPI
     - i2c: virtio: Avoid hang by using interruptible completion wait
     - bus: fsl-mc: Fix potential double device reference in
       fsl_mc_get_endpoint()
     - sprintf.h requires stdarg.h
     - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx
     - ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx
     - [arm64] entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()
     - [arm64] dpaa2-eth: Fix device reference count leak in MAC endpoint
       handling
     - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set
     - e1000e: ignore uninitialized checksum word on tgp
     - gve: Fix stuck TX queue for DQ queue format
     - ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
     - nilfs2: reject invalid file types when reading inodes
     - resource: fix false warning in __request_region()
     - mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list
     - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
     - [amd64,arm64] usb: typec: tcpm: allow to use sink in accessory mode
     - [amd64,arm64] usb: typec: tcpm: allow switching to mode accessory to mux
       properly
     - [amd64,arm64] usb: typec: tcpm: apply vbus before data bringup in
       tcpm_src_attach
     - spi: cadence-quadspi: fix cleanup of rx_chan on failure paths
     - [amd64] x86/bugs: Fix use of possibly uninit value in
       amd_check_tsa_microcode()
     - jfs: reject on-disk inodes of an unsupported type (CVE-2025-37925)
     - [amd64] comedi: comedi_test: Fix possible deletion of uninitialized timers
     - [arm64] dts: qcom: x1e78100-t14s: mark l12b and l15b always-on
     - erofs: simplify z_erofs_load_compact_lcluster()
     - erofs: refine z_erofs_get_extent_compressedlen()
     - erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches
     - erofs: simplify tail inline pcluster handling
     - erofs: clean up header parsing for ztailpacking and fragments
     - erofs: fix large fragment handling
     - ext4: don't explicit update times in ext4_fallocate()
     - ext4: refactor ext4_punch_hole()
     - ext4: refactor ext4_zero_range()
     - ext4: refactor ext4_collapse_range()
     - ext4: refactor ext4_insert_range()
     - ext4: factor out ext4_do_fallocate()
     - ext4: move out inode_lock into ext4_fallocate()
     - ext4: move out common parts into ext4_fallocate()
     - ext4: fix incorrect punch max_end
     - ext4: correct the error handle in ext4_fallocate()
     - ext4: fix out of bounds punch offset
     - [amd64] KVM: x86: drop x86.h include from cpuid.h
     - [amd64] KVM: x86: Route non-canonical checks in emulator through
       emulate_ops
     - [amd64] KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical
       checks
     - [amd64] KVM: x86: model canonical checks more precisely
     - [amd64] KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush
       (CVE-2025-38351)
     - [amd64] x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap()
     - [arm64] dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage
     - Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO"
     - wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure
     - iio: hid-sensor-prox: Restore lost scale assignments
     - iio: hid-sensor-prox: Fix incorrect OFFSET calculation
     - [amd64,arm64] Drivers: hv: Make the sysfs node size for the ring buffer
       dynamic
     - ALSA: hda/tegra: Add Tegra264 support
     - ALSA: hda: Add missing NVIDIA HDA codec IDs
     - [amd64] drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x
     - Revert "drm/xe/gt: Update handling of xe_force_wake_get return"
       (Closes: #1109799)
     - Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling"
     - Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return"
     - Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()"
     - [amd64] KVM: x86: Free vCPUs before freeing VM state
     - mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma
 .
   [ Bastian Blank ]
   * Store build time signing key encrypted.
   * Enable CRYPTO_ECDSA.
 .
   [ Aurelien Jarno ]
   * Fix installation of DTB files
 .
   [ Tj ]
   * drivers/gpu/drm/nouveau: Enable DRM_NOUVEAU_GSP_DEFAULT (Closes: #1088522)
 .
   [ Uwe Kleine-König ]
   * [armhf] Add phy-gmii-sel module to nic-shared-modules udeb for
     ti/omap/am335x based machines (e.g. BeagleBone black).
 .
   [ Salvatore Bonaccorso ]
   * d/salsa-ci.yml: Update for trixie: Set RELEASE to trixie

linux-signed-amd64 (6.12.43+1) trixie; urgency=medium
 .
   * Sign kernel from linux 6.12.43-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.42
     - [amd64] ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx
     - ethernet: intel: fix building with large NR_CPUS
     - [amd64] ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx
     - ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX
     - [amd64] ASoC: Intel: fix SND_SOC_SOF dependencies
     - [amd64] ASoC: amd: yc: add DMI quirk for ASUS M6501RM
     - audit,module: restore audit logging in load failure case
     - parse_longname(): strrchr() expects NUL-terminated string
     - fs_context: fix parameter name in infofc() macro
     - fs/ntfs3: cancle set bad inode after removing name fails
     - ublk: use vmalloc for ublk_device's __queues
     - hfsplus: make splice write available again
     - hfs: make splice write available again
     - hfsplus: remove mutex_lock check in hfsplus_free_extents
     - Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
     - gfs2: No more self recovery
     - io_uring: fix breakage in EXPERT menu
     - ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask()
     - ASoC: ops: dynamically allocate struct snd_ctl_elem_value
     - ASoC: mediatek: use reserved memory or enable buffer pre-allocation
     - [arm64] dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV
     - [arm64] soc: qcom: QMI encoding/decoding for big endian
     - [arm64] dts: qcom: sdm845: Expand IMEM region
     - [arm64] dts: qcom: sc7180: Expand IMEM region
     - [arm64] dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes
     - [arm64] dts: qcom: sa8775p: Correct the interrupt for remoteproc
     - [arm64] dts: qcom: msm8976: Make blsp_dma controlled-remotely
     - usb: host: xhci-plat: fix incorrect type for of_match variable in
       xhci_plat_probe()
     - usb: misc: apple-mfi-fastcharge: Make power supply names unique
     - [arm64] dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports
     - [arm64] dts: ti: k3-am62p-j722s: fix pinctrl-single size
     - [arm64] firmware: arm_scmi: Fix up turbo frequencies selection
     - usb: typec: ucsi: yoga-c630: fix error and remove paths
     - mei: vsc: Destroy mutex after freeing the IRQ
     - mei: vsc: Event notifier fixes
     - mei: vsc: Unset the event callback on remove and probe errors
     - [armhf] spi: stm32: Check for cfg availability in stm32_spi_probe
     - vmci: Prevent the dispatching of uninitialized payloads
     - pps: fix poll support
     - Revert "vmci: Prevent the dispatching of uninitialized payloads"
     - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()
     - usb: early: xhci-dbc: Fix early_ioremap leak
     - [armhf] dts: ti: omap: Fixup pinheader typo
     - [arm64] dts: st: fix timer used for ticks
     - [arm64] dts: imx8mm-beacon: Fix HS400 USDHC clock speed
     - [arm64] dts: imx8mn-beacon: Fix HS400 USDHC clock speed
     - PM / devfreq: Check governor before using governor->name
     - PM / devfreq: Fix a index typo in trans_stat
     - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode
     - cpufreq: Initialize cpufreq-based frequency-invariance later
     - cpufreq: Init policy->rwsem before it may be possibly used
     - staging: greybus: gbphy: fix up const issue with the match callback
     - [arm64] soc: qcom: pmic_glink: fix OF node leak
     - [arm64] interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg
     - [arm64] interconnect: qcom: sc8180x: specify num_nodes
     - bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640
     - [arm64,armhf] drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed
     - [arm64,armhf] drm/panfrost: Fix panfrost device variable name in devfreq
     - drm/panthor: Add missing explicit padding in drm_panthor_gpu_info
     - bpf, sockmap: Fix psock incorrectly pointing to sk
     - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
     - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain
     - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel
     - drm/amdgpu: Remove nbiov7.9 replay count reporting
     - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
     - [powerpc*] pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add
     - wifi: rtw89: avoid NULL dereference when RX problematic packet on
       unsupported 6 GHz band
     - wifi: rtl818x: Kill URBs before clearing tx status queue
     - wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
     - iwlwifi: Add missing check for alloc_ordered_workqueue
     - wifi: ath11k: clear initialized flag for deinit-ed srng lists
     - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
     - net/mlx5: Check device memory pointer before usage
     - net: dst: annotate data-races around dst->input
     - net: dst: annotate data-races around dst->output
     - bpf: Ensure RCU lock is held around bpf_prog_ksym_find
     - [arm64] drm/msm/dpu: Fill in min_prefill_lines for SC8180X
     - refscale: Check that nreaders and loops multiplication doesn't overflow
     - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
     - sched/psi: Optimize psi_group_change() cpu_clock() usage
     - fbcon: Fix outdated registered_fb reference in comment
     - netfilter: nf_tables: Drop dead code from fill_*_info routines
     - netfilter: nf_tables: adjust lockdep assertions handling
     - [amd64] iommu/amd: Enable PASID and ATS capabilities in the correct order
     - net/sched: Restrict conditions for adding duplicating netems to qdisc tree
     - net_sched: act_ctinfo: use atomic64_t for three counters
     - RDMA/mlx5: Fix UMR modifying of mkey page size
     - xen: fix UAF in dmabuf_exp_from_pages()
     - xen/gntdev: remove struct gntdev_copy_batch from stack
     - tcp: call tcp_measure_rcv_mss() for ooo packets
     - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
     - wifi: rtw88: Fix macid assigned to TDLS station
     - mwl8k: Add missing check after DMA map
     - wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()
     - drm/amdgpu/gfx9: fix kiq locking in KCQ reset
     - drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset
     - drm/amdgpu/gfx10: fix kiq locking in KCQ reset
     - [amd64] iommu/amd: Fix geometry.aperture_end for V2 tables
     - rcu: Fix delayed execution of hurry callbacks
     - wifi: mac80211: reject TDLS operations when station is not associated
     - wifi: plfxlc: Fix error handling in usb driver probe
     - wifi: mac80211: Do not schedule stopped TXQs
     - wifi: mac80211: Don't call fq_flow_idx() for management frames
     - wifi: mac80211: Check 802.11 encaps offloading in
       ieee80211_tx_h_select_key()
     - Reapply "wifi: mac80211: Update skb's control block key in
       ieee80211_tx_dequeue()"
     - wifi: ath12k: fix endianness handling while accessing wmi service bit
     - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P
       IE
     - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon()
     - wifi: nl80211: Set num_sub_specs before looping through sub_specs
     - ring-buffer: Remove ring_buffer_read_prepare_sync()
     - memcg_slabinfo: Fix use of PG_slab
     - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'
     - Bluetooth: hci_event: Mask data status from LE ext adv reports
     - bpf: Disable migration in nf_hook_run_bpf().
     - can: peak_usb: fix USB FD devices potential malfunction
     - can: kvaser_pciefd: Store device channel index
     - can: kvaser_usb: Assign netdev.dev_port based on device channel index
     - netfilter: xt_nfacct: don't assume acct name is null-terminated
     - net/mlx5e: Clear Read-Only port buffer size in PBMC before update
     - net/mlx5e: Remove skb secpath if xfrm state is not found
     - stmmac: xsk: fix negative overflow of budget in zerocopy mode
     - vrf: Drop existing dst reference in vrf_ip6_input_dst
     - ipv6: prevent infinite loop in rt6_nlmsg_size()
     - ipv6: fix possible infinite loop in fib6_info_uses_dev()
     - ipv6: annotate data-races around rt->fib6_nsiblings
     - bpf/preload: Don't select USERMODE_DRIVER
     - [arm64] bpf, arm64: Fix fp initialization for exception boundary
     - fortify: Fix incorrect reporting of read buffer size
     - [arm64] PCI: rockchip-host: Fix "Unexpected Completion" log message
     - [arm64] clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv
       clocks
     - [arm64] crypto: sun8i-ce - fix nents passed to dma_unmap_sg()
     - [amd64] crypto: qat - use unmanaged allocation for dc_data
     - [arm64,armhf] crypto: marvell/cesa - Fix engine load inaccuracy
     - [amd64] crypto: qat - allow enabling VFs in the absence of IOMMU
     - [amd64] crypto: qat - fix state restore for banks with exceptions
     - mtd: fix possible integer overflow in erase_xfer()
     - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check
     - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name
     - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
     - [armhf] crypto: arm/aes-neonbs - work around gcc-15 warning
     - pinctrl: sunxi: Fix memory leak on krealloc failure
     - dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning
     - [arm64] phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers
     - fanotify: sanitize handle_type values when reporting fid
     - Fix dma_unmap_sg() nents value
     - perf tools: Fix use-after-free in help_unknown_cmd()
     - perf dso: Add missed dso__put to dso__load_kcore
     - mtd: spi-nor: spansion: Fixup params->set_4byte_addr_mode for SEMPER
     - perf sched: Make sure it frees the usage string
     - perf sched: Free thread->priv using priv_destructor
     - perf sched: Fix memory leaks in 'perf sched map'
     - perf sched: Fix memory leaks for evsel->priv in timehist
     - perf sched: Use RC_CHK_EQUAL() to compare pointers
     - perf sched: Fix memory leaks in 'perf sched latency'
     - [arm64] RDMA/hns: Fix double destruction of rsv_qp
     - [arm64] RDMA/hns: Fix HW configurations not cleared in error flow
     - [amd64] crypto: ccp - Fix locking on alloc failure handling
     - [arm64] crypto: inside-secure - Fix `dma_unmap_sg()` nents value
     - [amd64] crypto: ccp - Fix crash when rebind ccp device for ccp.ko
     - [arm64] RDMA/hns: Get message length of ack_req from FW
     - [arm64] RDMA/hns: Fix accessing uninitialized resources
     - [arm64] RDMA/hns: Drop GFP_NOWARN
     - [arm64] RDMA/hns: Fix -Wframe-larger-than issue
     - kernel: trace: preemptirq_delay_test: use offstack cpu mask
     - proc: use the same treatment to check proc_lseek as ones for
       proc_read_iter et.al
     - pinmux: fix race causing mux_owner NULL with active mux_usecount
     - perf tests bp_account: Fix leaked file descriptor
     - [riscv64] clk: thead: th1520-ap: Correctly refer the parent of osc_12m
     - [armhf] clk: sunxi-ng: v3s: Fix de clock definition
     - [ppc64el] scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
     - scsi: mvsas: Fix dma_unmap_sg() nents value
     - scsi: isci: Fix dma_unmap_sg() nents value
     - ext4: Make sure BH_New bit is cleared in ->write_end handler
     - [arm64] hwrng: mtk - handle devm_pm_runtime_enable errors
     - [amd64] crypto: qat - disable ZUC-256 capability for QAT GEN5
     - soundwire: stream: restore params when prepare ports fail
     - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute
     - remoteproc: xlnx: Disable unsupported features
     - fs/orangefs: Allow 2 more characters in do_c_string()
     - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
     - dmaengine: nbpfaxi: Add missing check after DMA map
     - perf tools: Remove libtraceevent in .gitignore
     - [amd64] crypto: qat - fix DMA direction for compression on GEN2 devices
     - [amd64] crypto: qat - fix seq_file position update in adf_ring_next()
     - fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref
     - jfs: fix metapage reference count leak in dbAllocCtl
     - drm/xe/vf: Disable CSC support on VF
     - perf record: Cache build-ID of hit DSOs only
     - vdpa/mlx5: Fix needs_teardown flag calculation
     - vhost-scsi: Fix log flooding with target does not exist errors
     - vdpa/mlx5: Fix release of uninitialized resources on error path
     - vdpa: Fix IDR memory leak in VDUSE module exit
     - vhost: Reintroduce kthread API and add mode selection
     - bpf: Check flow_dissector ctx accesses are aligned
     - bpf: Check netfilter ctx accesses are aligned
     - apparmor: ensure WB_HISTORY_SIZE value is a power of 2
     - apparmor: fix loop detection used in conflicting attachment resolution
     - apparmor: Fix unaligned memory accesses in KUnit test
     - module: Restore the moduleparam prefix length check
     - ucount: fix atomic_long_inc_below() argument type
     - rtc: ds1307: fix incorrect maximum clock rate handling
     - rtc: hym8563: fix incorrect maximum clock rate handling
     - rtc: nct3018y: fix incorrect maximum clock rate handling
     - rtc: pcf85063: fix incorrect maximum clock rate handling
     - rtc: pcf8563: fix incorrect maximum clock rate handling
     - rtc: rv3028: fix incorrect maximum clock rate handling
     - f2fs: turn off one_time when forcibly set to foreground GC
     - f2fs: fix bio memleak when committing super block
     - f2fs: fix KMSAN uninit-value in extent_info usage
     - f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent
     - f2fs: fix to check upper boundary for gc_valid_thresh_ratio
     - f2fs: fix to check upper boundary for gc_no_zoned_gc_percent
     - f2fs: doc: fix wrong quota mount option description
     - f2fs: fix to avoid UAF in f2fs_sync_inode_meta()
     - f2fs: fix to avoid panic in f2fs_evict_inode
     - f2fs: fix to avoid out-of-boundary access in devs.path
     - f2fs: vm_unmap_ram() may be called from an invalid context
     - f2fs: fix to update upper_p in __get_secs_required() correctly
     - f2fs: fix to calculate dirty data during has_not_enough_free_secs()
     - f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode
     - exfat: fdatasync flag should be same like generic_write_sync()
     - i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe()
     - vfio: Fix unbalanced vfio_df_close call in no-iommu mode
     - vfio: Prevent open_count decrement to negative
     - vfio/pds: Fix missing detach_ioas op
     - vfio/pci: Separate SR-IOV VF dev_set
     - scsi: mpt3sas: Fix a fw_event memory leak
     - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free"
     - scsi: ufs: core: Use link recovery when h8 exit fails during runtime
       resume
     - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately
     - kconfig: qconf: fix ConfigList::updateListAllforAll()
     - sched/psi: Fix psi_seq initialization
     - PCI: pnv_php: Clean up allocated IRQs on unplug
     - PCI: pnv_php: Work around switches with broken presence detection
     - [powerpc*] eeh: Export eeh_unfreeze_pe()
     - [powerpc*] eeh: Make EEH driver device hotplug safe
     - PCI: pnv_php: Fix surprise plug detection and recovery
     - pNFS/flexfiles: don't attempt pnfs on fatal DS errors
     - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up()
     - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate()
     - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
     - NFSv4.2: another fix for listxattr
     - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY
     - md/md-cluster: handle REMOVE message earlier
     - netpoll: prevent hanging NAPI when netcons gets enabled
     - phy: mscc: Fix parsing of unicast frames
     - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string()
     - pptp: ensure minimal skb length in pptp_xmit()
     - nvmet: initialize discovery subsys after debugfs is initialized
     - [s390x] ap: Unmask SLCF bit in card and queue ap functions sysfs
     - netlink: specs: ethtool: fix module EEPROM input/output arguments
     - block: Fix default IO priority if there is no IO context
     - block: ensure discard_granularity is zero when discard is not supported
     - ASoC: tas2781: Fix the wrong step for TLV on tas2781
     - [amd64] spi: cs42l43: Property entry should be a null-terminated array
     - net/mlx5: Correctly set gso_segs when LRO is used
     - ipv6: reject malicious packets in ipv6_gso_segment()
     - net: mdio: mdio-bcm-unimac: Correct rate fallback logic
     - net: drop UFO packets in udp_rcv_segment()
     - net/sched: taprio: enforce minimum value for picos_per_byte
     - sunrpc: fix client side handling of tls alerts
     - [x86] irq: Plug vector setup race
     - benet: fix BUG when creating VFs
     - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
     - [s390x] mm: Allocate page table with PAGE_SIZE granularity
     - eth: fbnic: remove the debugging trick of super high page bias
     - irqchip: Build IMX_MU_MSI only on ARM
     - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out()
     - smb: server: remove separate empty_recvmsg_queue
     - smb: server: make sure we call ib_dma_unmap_single() only if we called
       ib_dma_map_single already
     - smb: server: let recv_done() consistently call
       put_recvmsg/smb_direct_disconnect_rdma_connection
     - smb: server: let recv_done() avoid touching data_transfer after
       cleanup/move
     - smb: client: remove separate empty_packet_queue
     - smb: client: make sure we call ib_dma_unmap_single() only if we called
       ib_dma_map_single already
     - smb: client: let recv_done() cleanup before notifying the callers.
     - smb: client: let recv_done() avoid touching data_transfer after
       cleanup/move
     - nvmet: exit debugfs after discovery subsystem exits
     - pptp: fix pptp_xmit() error path
     - smb: client: return an error if rdma_connect does not return within 5
       seconds
     - sunrpc: fix handling of server side tls alerts
     - perf/core: Don't leak AUX buffer refcount on allocation failure
     - perf/core: Exit early on perf_mmap() fail
     - perf/core: Prevent VMA split of buffer mappings
     - selftests/perf_events: Add a mmap() correctness test
     - net/packet: fix a race in packet_set_ring() and packet_notifier()
     - vsock: Do not allow binding to VMADDR_PORT_ANY
     - [amd64] accel/ivpu: Fix reset_engine debugfs file logic
     - Revert "bcache: remove heap-related macros and switch to generic min_heap"
     - ice/ptp: fix crosstimestamp reporting
     - [amd64] drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return
       type
     - [amd64] drm/i915/hdmi: propagate errors from intel_hdmi_init_connector()
     - [amd64] drm/i915/hdmi: add error handling in g4x_hdmi_init()
     - [amd64] drm/i915/ddi: gracefully handle errors from
       intel_ddi_init_hdmi_connector()
     - [amd64] drm/i915/display: add intel_encoder_is_hdmi()
     - [amd64] drm/i915/ddi: only call shutdown hooks for valid encoders
     - ksmbd: fix null pointer dereference error in generate_encryptionkey
     - ksmbd: fix Preauh_HashValue race condition
     - ksmbd: fix corrupted mtime and ctime in smb2_open
     - ksmbd: limit repeated connections from clients with the same IP
       (CVE-2025-38501)
     - smb: server: Fix extension string in ksmbd_extract_shortname()
     - USB: serial: option: add Foxconn T99W709
     - PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state()
     - PCI/ASPM: Fix L1SS saving
     - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano
     - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
     - net: usbnet: Fix the wrong netif_carrier_on() call
     - [x86] sev: Evict cache lines during SNP memory validation (CVE-2024-36331)
     - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe()
     - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
     - ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx
     - ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx
     - ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26)
     - [adm64] platform/x86/intel/pmt: fix a crashlog NULL pointer access
     - [x86] fpu: Delay instruction pointer fixup until after warning
     - [s390x] mm: Remove possible false-positive warning in pte_free_defer()
     - [mips*] mm: tlb-r4k: Uniquify TLB entries on init
     - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
     - mm: swap: correctly use maxpages in swapon syscall to avoid potential
       deadloop
     - mm: swap: fix potential buffer overflow in setup_clusters()
     - perf/arm-ni: Set initial IRQ affinity
     - media: ti: j721e-csi2rx: fix list_del corruption
     - HID: apple: validate feature-report field count to prevent NULL pointer
       dereference
     - USB: gadget: f_hid: Fix memory leak in hidg_bind error path
     - usb: gadget : fix use-after-free in composite_dev_cleanup()
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.43
     - io_uring: don't use int for ABI
     - ALSA: usb-audio: Validate UAC3 power domain descriptors, too
     - ALSA: usb-audio: Validate UAC3 cluster segment descriptors
     - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X
     - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks
     - smb3: fix for slab out of bounds on mount to ksmbd
     - smb: client: remove redundant lstrp update in negotiate protocol
     - gpio: virtio: Fix config space reading.
     - gpio: mlxbf2: use platform_get_irq_optional()
     - Revert "gpio: mlxbf3: only get IRQ for device instance 0"
     - gpio: mlxbf3: use platform_get_irq_optional()
     - leds: flash: leds-qcom-flash: Fix registry access after re-bind
     - Revert "leds: trigger: netdev: Configure LED blink interval for HW
       offload"
     - netlink: avoid infinite retry looping in netlink_unicast()
       (Closes: #1111017)
     - net: phy: micrel: fix KSZ8081/KSZ8091 cable test
     - [armhf] net: ftgmac100: fix potential NULL pointer access in
       ftgmac100_phy_disconnect
     - [arm64] net: enetc: fix device and OF node leak at probe
     - [arm64] net: mtk_eth_soc: fix device leak at probe
     - [arm64] net: ti: icss-iep: fix device and OF node leaks at probe
     - net: usb: asix_devices: add phy_mask for ax88772 mdio bus
     - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
     - NFSD: detect mismatch of file handle and delegation stateid in OPEN op
     - NFS: Fix the setting of capabilities when automounting a new filesystem
     - PCI: Extend isolated function probing to LoongArch
     - [arm64] clk: samsung: exynos850: fix a comment
     - [arm64] clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD
     - [arm64] clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent
       clock
     - fscrypt: Don't use problematic non-inline crypto engines
     - fs: Prevent file descriptor table allocations exceeding INT_MAX
     - eventpoll: Fix semi-unbounded recursion (CVE-2025-38614)
     - Documentation: ACPI: Fix parent device references
     - ACPI: processor: perflib: Fix initial _PPC limit application
     - ACPI: processor: perflib: Move problematic pr->performance check
     - block: Make REQ_OP_ZONE_FINISH a write operation
     - mm/memory-tier: fix abstract distance calculation overflow
     - smb: client: let send_done() cleanup before calling
       smbd_disconnect_rdma_connection()
     - smb: client: don't wait for info->send_pending == 0 on error
     - [amd64] KVM: x86: Convert vcpu_run()'s immediate exit param into a generic
       bitmap
     - [amd64] KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN
       flag
     - [amd64] KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is
       supported
     - [amd64] KVM: VMX: Extract checking of guest's DEBUGCTL into helper
     - [amd64] KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter
     - [amd64] KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter
       APIs
     - [amd64] KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running
       the guest
     - [amd64] habanalabs: fix UAF in export_dmabuf()
     - mm/smaps: fix race between smaps_hugetlb_range and migration
     - udp: also consider secpath when evaluating ipsec use for checksumming
     - netfilter: ctnetlink: fix refcount leak on table dump
     - [arm64] net: ti: icssg-prueth: Fix emac link speed handling
     - [arm64] net: ti: icss-iep: Fix incorrect type for return value in
       extts_enable()
     - sctp: linearize cloned gso packets in sctp_rcv
     - [amd64] intel_idle: Allow loading ACPI tables for any family
     - cpuidle: governors: menu: Avoid using invalid recent intervals data
     - ptp: prevent possible ABBA deadlock in ptp_clock_freerun()
     - tls: handle data disappearing from under the TLS ULP (CVE-2025-38616)
     - net: kcm: Fix race condition in kcm_unattach()
     - hfs: fix general protection fault in hfs_find_init()
     - hfs: fix slab-out-of-bounds in hfs_bnode_read()
     - hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
     - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
     - hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
     - [arm64] Handle KCOV __init vs inline mismatches
     - smb/server: avoid deadlock when linking with ReplaceIfExists
     - nvme-pci: try function level reset on init failure
     - dm-stripe: limit chunk_sectors to the stripe size
     - md/raid10: set chunk_sectors limit
     - nvme-tcp: log TLS handshake failures at error level
     - gfs2: Validate i_depth for exhash directories
     - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops
     - loop: Avoid updating block size under exclusive owner
     - udf: Verify partition map count
     - drbd: add missing kref_get in handle_write_conflicts
     - hfs: fix not erasing deleted b-tree node issue
     - better lockdep annotations for simple_recursive_removal()
     - ata: ahci: Disallow LPM policy control if not supported
     - ata: ahci: Disable DIPM if host lacks support
     - ata: libata-sata: Disallow changing LPM state if not supported
     - fs/ntfs3: Add sanity check for file name
     - fs/ntfs3: correctly create symlink for relative path
     - pidfs: raise SB_I_NODEV and SB_I_NOEXEC
     - fix locking in efi_secret_unlink()
     - securityfs: don't pin dentries twice, once is enough...
     - tracefs: Add d_delete to remove negative dentries
     - usb: xhci: print xhci->xhc_state when queue_command failed
     - [amd64] platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list
     - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag
     - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default
     - usb: xhci: Avoid showing warnings for dying controller
     - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
     - usb: xhci: Avoid showing errors during surprise removal
     - [arm64] soc: qcom: rpmh-rsc: Add RSC version 4 support
     - ACPI: APEI: send SIGBUS to current task if synchronous memory error not
       recovered
     - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU
     - usb: typec: tcpm/tcpci_maxim: fix irq wake usage
     - pmdomain: ti: Select PM_GENERIC_DOMAINS
     - [arm64] gpio: wcd934x: check the return value of regmap_update_bits()
     - cpufreq: Exit governor when failed to start old governor
     - cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode
     - [armhf] rockchip: fix kernel hang during smp initialization
     - PM / devfreq: governor: Replace sscanf() with kstrtoul() in
       set_freq_store()
     - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was
       successed
     - [arm64] thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when
       required
     - iio: adc: ad_sigma_delta: don't overallocate scan buffer
     - [armhf] tegra: Use I/O memcpy to write to IRAM
     - ACPI: PRM: Reduce unnecessary printing to avoid user confusion
     - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
     - thermal: sysfs: Return ENODATA instead of EAGAIN for reads
     - PM: sleep: console: Fix the black screen issue
     - ACPI: processor: fix acpi_object initialization
     - [arm64] mmc: sdhci-msm: Ensure SD card power isn't ON when card removed
     - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
     - pps: clients: gpio: fix interrupt handling order in remove path
     - reset: brcmstb: Enable reset drivers for ARCH_BCM2835
     - char: misc: Fix improper and inaccurate error code returned by misc_init()
     - [amd64] mei: bus: Check for still connected devices in
       mei_cl_bus_dev_release()
     - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
     - [amd64,arm64] platform/chrome: cros_ec_sensorhub: Retries when a sensor is
       not ready
     - ALSA: hda: Handle the jack polling always via a work
     - ALSA: hda: Disable jack polling at shutdown
     - [amd64] x86/bugs: Avoid warning when overriding return thunk
     - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
     - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
     - ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode
     - tty: serial: fix print format specifiers
     - ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime()
     - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present
     - usb: core: usb_submit_urb: downgrade type check
     - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
     - [arm64] imx8m-blk-ctrl: set ISI panic write hurry level
     - [arm64] soc: qcom: mdt_loader: Actually use the e_phoff
     - [amd64] platform/x86: thinkpad_acpi: Handle KCOV __init vs inline
       mismatches
     - [amd64,arm64] platform/chrome: cros_ec_typec: Defer probe on missing EC
       parent
     - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
     - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop
     - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
     - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement
     - ASoC: codecs: rt5640: Retry DEVICE_ID verification
     - [arm64] ASoC: qcom: use drvdata instead of component to keep id
     - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps
     - [powerpc*] thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64
     - Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925
     - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie()
     - xen/netfront: Fix TX response spurious interrupts
     - wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn
     - net: usb: cdc-ncm: check for filtering capability
     - wifi: ath12k: Correct tid cleanup when tid setup fails
     - wifi: cfg80211: reject HTC bit for management frames
     - [s390x] time: Use monotonic clock in get_cycles()
     - be2net: Use correct byte order and format string for TCP seq and ack_seq
     - libbpf: Verify that arena map exists when adding arena relocations
     - idpf: preserve coalescing settings across resets
     - wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan
       mode
     - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB
     - et131x: Add missing check after DMA map
     - net: ag71xx: Add missing check after DMA map
     - net/mlx5e: Properly access RCU protected qdisc_sleeping variable
     - net: pcs: xpcs: mask readl() return value to 16 bits
     - [arm64] Mark kernel as tainted on SAE and SError panic
     - drm/amd/pm: fix null pointer access
     - rcu: Protect ->defer_qs_iw_pending from data race
     - drm/amd/display: limit clear_update_flags to dcn32 and above
     - net: mctp: Prevent duplicate binds
     - wifi: cfg80211: Fix interface type validation
     - wifi: mac80211: don't unreserve never reserved chanctx
     - net: ipv4: fix incorrect MTU in broadcast routes
     - [arm64] net: thunderx: Fix format-truncation warning in
       bgx_acpi_match_id()
     - net: phy: micrel: Add ksz9131_resume()
     - sched/deadline: Fix accounting after global limits change
     - bpf: Forget ranges when refining tnum after JSET
     - wifi: iwlwifi: mvm: set gtk id also in older FWs
     - wifi: iwlwifi: mvm: fix scan request validation
     - [s390x] stp: Remove udelay from stp_sync_clock()
     - net: phy: bcm54811: PHY initialization
     - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails
     - wifi: mac80211: don't complete management TX on SAE commit
     - wifi: mac80211: avoid weird state in error path
     - [s390x] early: Copy last breaking event address to pt_regs
     - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in
       __ipv6_dev_mc_inc().
     - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access
     - wifi: mac80211: fix rx link assignment for non-MLO stations
     - [arm64] drm/msm: use trylock for debugfs
     - [arm64] drm/msm: Add error handling for krealloc in metadata setup
     - [arm64] perf/arm: Add missing .suppress_bind_attrs
     - wifi: rtw89: Fix rtw89_mac_power_switch() for USB
     - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch
     - drm/xe/xe_query: Use separate iterator while filling GT list
     - [amd64] net: thunderbolt: Enable end-to-end flow control also in transmit
     - [amd64] net: thunderbolt: Fix the parameter passing of
       tb_xdomain_enable_paths()/tb_xdomain_disable_paths()
     - xfrm: Duplicate SPI Handling
     - net: atlantic: add set_power to fw_ops for atl2 to fix wol
     - ACPI: Suppress misleading SPCR console message when SPCR table is absent
     - net: ieee8021q: fix insufficient table-size assertion
     - net: fec: allow disable coalescing
     - drm/amd/display: Separate set_gsl from set_gsl_source_select
     - wifi: ath10k: shutdown driver when hardware is unreliable
     - wifi: ath12k: Add memset and update default rate value in wmi tx
       completion
     - wifi: ath12k: Fix station association with MBSSID Non-TX BSS
     - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
     - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
     - drm/amd/display: Fix 'failed to blank crtc!'
     - drm/amd/display: Initialize mode_select to 0
     - wifi: mac80211: update radar_required in channel context after channel
       switch
     - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`.
     - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0
     - wifi: ath12k: Decrement TID on RX peer frag setup error handling
     - [powerpc*] floppy: Add missing checks after DMA map
     - netmem: fix skb_frag_address_safe with unreadable skbs
     - [arm64] stacktrace: Check kretprobe_find_ret_addr() return value
     - wifi: iwlegacy: Check rate_idx range after addition
     - neighbour: add support for NUD_PERMANENT proxy entries
     - dpaa_eth: don't use fixed_phy_change_carrier
     - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to
       manual
     - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured
     - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
     - gve: Return error for unknown admin queue command
     - [armhf] net: dsa: b53: ensure BCM5325 PHYs are enabled
     - [armhf] net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
     - [armhf] net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
     - [armhf] net: dsa: b53: prevent DIS_LEARNING access on BCM5325
     - [armhf] net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
     - bpftool: Fix JSON writer resource leak in version command
     - ptp: Use ratelimite for freerun error message
     - wifi: rtw89: scan abort when assign/unassign_vif
     - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc()
     - ionic: clean dbpage in de-init
     - drm/xe: Make dma-fences compliant with the safe access rules
     - [armhf] net: ncsi: Fix buffer overflow in fetching version id
     - drm/ttm: Should to return the evict error
     - uapi: in6: restore visibility of most IPv6 socket options
     - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP
     - drm/amd/display: Update DMCUB loading sequence for DCN3.5
     - drm/amd/display: Avoid trying AUX transactions on disconnected ports
     - drm/ttm: Respect the shrinker core free target
     - rcu: Fix rcu_read_unlock() deadloop due to IRQ work
     - [armhf] net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
     - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page
     - vhost: fail early when __vhost_add_used() fails
     - drm/amd/display: Only finalize atomic_obj if it was initialized
     - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported
     - drm/amd/display: Disable dsc_power_gate for dcn314 by default
     - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race
       condition
     - cifs: Fix calling CIFSFindFirst() for root path without msearch
     - fbdev: fix potential buffer overflow in do_register_framebuffer()
     - crypto: hisilicon/hpre - fix dma unmap sequence
     - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
     - [arm64,armhf] clk: tegra: periph: Fix error handling and resolve unsigned
       compare warning
     - mfd: axp20x: Set explicit ID for AXP313 regulator
     - [arm64] phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal
     - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
     - fs/orangefs: use snprintf() instead of sprintf()
     - watchdog: dw_wdt: Fix default timeout
     - hwmon: (emc2305) Set initial PWM minimum value during probe based on
       thermal state
     - [mips*] vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free}
     - watchdog: iTCO_wdt: Report error if timeout configuration fails
     - scsi: bfa: Double-free fix
     - jfs: truncate good inode pages when hard link is 0
     - jfs: Regular file corruption check
     - jfs: upper bound check of tree index in dbAllocAG
     - media: hi556: Fix reset GPIO timings
     - RDMA/bnxt_re: Fix size of uverbs_copy_to() in
       BNXT_RE_METHOD_GET_TOGGLE_MEM
     - crypto: jitter - fix intermediary handling
     - [mips*] Don't crash in stack_top() for tasks without ABI or vDSO
     - [riscv64] clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED
     - media: ipu-bridge: Add _HID for OV5670
     - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ
       control
     - leds: leds-lp50xx: Handle reg to get correct multi_index
     - [armhf] dmaengine: stm32-dma: configure next sg only if there are more
       than 2 sgs
     - [amd64] RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()
     - RDMA/core: reduce stack using in nldev_stat_get_doit()
     - scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in
       dev_loss_tmo_callbk
     - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
     - power: supply: qcom_battmgr: Add lithium-polymer entry
     - scsi: mpt3sas: Correctly handle ATA device errors
     - scsi: mpi3mr: Correctly handle ATA device errors
     - [armhf] pinctrl: stm32: Manage irq affinity settings
     - media: usb: hdpvr: disable zero-length read messages
     - media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()
     - media: dvb-frontends: w7090p: fix null-ptr-deref in
       w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
     - media: uvcvideo: Add quirk for HP Webcam HD 2300
     - media: uvcvideo: Fix bandwidth issue for Alcor camera
     - [amd64] crypto: ccp - Add missing bootloader info reg for pspv6
     - [arm64] clk: renesas: rzg2l: Postpone updating priv->clks[]
     - soundwire: amd: serialize amd manager resume sequence during pm_prepare
     - soundwire: amd: cancel pending slave status handling workqueue during
       remove sequence
     - soundwire: Move handle_nested_irq outside of sdw_dev_lock
     - md: dm-zoned-target: Initialize return variable r to avoid uninitialized
       use
     - module: Prevent silent truncation of module name in delete_module(2)
     - i3c: add missing include to internal header
     - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
     - apparmor: shift ouid when mediating hard links in userns
     - i3c: don't fail if GETHDRCAP is unsupported
     - i3c: master: Initialize ret in i3c_i2c_notifier_call()
     - dm-mpath: don't print the "loaded" message if registering fails
     - dm-table: fix checking for rq stackable devices
     - apparmor: use the condition in AA_BUG_FMT even with debug disabled
     - apparmor: fix x_table_lookup when stacking is not the first entry
     - i2c: Force DLL0945 touchpad i2c freq to 100khz
     - exfat: add cluster chain loop check for dir
     - f2fs: check the generic conditions first
     - printk: nbcon: Allow reacquire during panic
     - vfio/type1: conditional rescheduling while pinning
     - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
     - scsi: target: core: Generate correct identifiers for PR OUT transport IDs
     - scsi: aacraid: Stop using PCI_IRQ_AFFINITY
     - vfio/mlx5: fix possible overflow in tracking max message size
     - ipmi: Use dev_warn_ratelimited() for incorrect message warnings
     - ipmi: Fix strcpy source and destination the same
     - tools/power turbostat: Handle non-root legacy-uncore sysfs permissions
     - tools/power turbostat: Fix build with musl
     - tools/power turbostat: Handle cap_get_proc() ENOSYS
     - smb: client: don't call init_waitqueue_head(&info->conn_wait) twice in
       _smbd_get_connection
     - lib/sbitmap: convert shallow_depth from one word to the whole sbitmap
     - ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table
     - net: phy: smsc: add proper reset flags for LAN8710A
     - [amd64] ASoC: Intel: avs: Fix uninitialized pointer error in probe()
     - block: avoid possible overflow for chunk_sectors check in
       blk_stack_limits()
     - pNFS: Fix stripe mapping in block/scsi layout
     - pNFS: Fix disk addr range check in block/scsi layout
     - pNFS: Handle RPC size limit for layoutcommits
     - pNFS: Fix uninited ptr deref in block/scsi layout
     - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
     - scsi: lpfc: Remove redundant assignment to avoid memory leak
     - [amd64,armhf] ASoC: fsl_sai: replace regmap_write with regmap_update_bits
     - cifs: Fix collect_sample() to handle any iterator type
     - drm/amdgpu: fix vram reservation issue
     - drm/amdgpu: fix incorrect vm flags to map bo
     - mm/damon/core: commit damos->target_nid
     - block: Introduce bio_needs_zone_write_plugging()
     - dm: Always split write BIOs to zoned device limits
     - cifs: reset iface weights when we cannot find a candidate
     - [amd64] iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes
     - [arm64] iommu/arm-smmu-qcom: Add SM6115 MDSS compatible
     - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range
     - iommufd: Prevent ALIGN() overflow
     - ext4: fix zombie groups in average fragment size lists
     - ext4: fix largest free orders lists corruption on mb_optimize_scan switch
     - ext4: initialize superblock fields in the kballoc-test.c kunit tests
     - usb: core: config: Prevent OOB read in SS endpoint companion parsing
     - misc: rtsx: usb: Ensure mmc child device is active when card is present
     - usb: typec: ucsi: Update power_supply on power role change
     - [amd64] comedi: fix race between polling and detaching
     - [amd64] thunderbolt: Fix copy+paste error in match_service_id()
     - cdc-acm: fix race between initial clearing halt and open
     - btrfs: zoned: use filesystem size not disk size for reclaim decision
     - btrfs: abort transaction during log replay if walk_log_tree() failed
     - btrfs: zoned: do not remove unwritten non-data block group
     - btrfs: qgroup: set quota enabled bit if quota disable fails flushing
       reservations
     - btrfs: don't ignore inode missing when replaying log tree
     - btrfs: fix ssd_spread overallocation
     - btrfs: populate otime when logging an inode item
     - btrfs: qgroup: fix qgroup create ioctl returning success after quotas
       disabled
     - btrfs: don't skip remaining extrefs if dir not found during log replay
     - btrfs: clear dirty status from extent buffer on error at insert_new_root()
     - btrfs: fix log tree replay failure due to file with 0 links and extents
     - btrfs: error on missing block group when unaccounting log tree extent
       buffers
     - btrfs: zoned: do not select metadata BG as finish target
     - btrfs: fix iteration bug in __qgroup_excl_accounting()
     - btrfs: do not allow relocation of partially dropped subvolumes
     - xfs: fix scrub trace with null pointer in quotacheck
     - userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry
     - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
     - net/sched: ets: use old 'nbands' while purging unused classes
     - [amd64,arm64] hv_netvsc: Fix panic during namespace deletion with VF
     - mm, slab: restore NUMA policy support for large kmalloc
     - mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd()
     - mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()
     - mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
     - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
     - media: venus: Fix OOB read due to missing payload bound check
     - media: uvcvideo: Do not mark valid metadata as invalid
     - media: v4l2: Add support for NV12M tiled variants to v4l2_format_info()
     - HID: magicmouse: avoid setting up battery timer when not needed
     - wifi: mac80211: check basic rates validity in sta_link_apply_parameters
     - HID: apple: avoid setting up battery timer for devices without battery
     - mfd: cros_ec: Separate charge-control probing from USB-PD
     - net: Add net_passive_inc() and net_passive_dec().
     - net: better track kernel sockets lifetime (CVE-2025-21884)
     - smb: client: fix netns refcount leak after net_passive changes
     - PCI: Store all PCIe Supported Link Speeds
     - PCI: Allow PCI bridges to go to D3Hot on all non-x86
     - PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports
     - [arm64] dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C
     - [arm64] dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C
     - ata: libata-sata: Add link_power_management_supported sysfs attribute
     - io_uring/rw: cast rw->flags assignment to rwf_t
     - drm/amd/display: Allow DCN301 to clear update flags
     - rcu: Fix racy re-initialization of irq_work causing hangs
     - dm: split write BIOs on zone boundaries when zone append is not emulated
     - PCI: Honor Max Link Speed when determining supported speeds
     - ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled
 .
   [ Bastian Blank ]
   * [amd64, arm64] Enable MANA_INFINIBAND.
 .
   [ Salvatore Bonaccorso ]
   * [amd64] udeb: kernel-image: Include SPI drivers
   * ext4: don't try to clear the orphan_present feature block device is r/o
     (Closes: #1108271)
   * alloc_fdtable(): change calling conventions.
   * net: ipv4: fix regression in local-broadcast route
 .
   [ Ben Hutchings ]
   * proc: fix missing pde_set_flags() for net proc files
linux-signed-amd64 (6.12.41+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.41-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.39
     - eventpoll: don't decrement ep refcount while still holding the ep mutex
       (CVE-2025-38349)
     - drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics
     - drm/amdgpu/ip_discovery: add missing ip_discovery fw
     - [s390x] crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2
     - drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid
       Priority Inversion in SRIOV (CVE-2025-38104)
     - [amd64] ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select
       SND_SOC_ACPI_INTEL_MATCH
     - [amd64] ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address
       struct
     - [amd64] ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43
       laptops
     - [amd64] ASoC: soc-acpi: add get_function_tplg_files ops
     - [amd64] ASoC: Intel: add sof_sdw_get_tplg_files ops
     - [amd64] ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files
       ops
     - [amd64] ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches
     - perf/core: Fix the WARN_ON_ONCE is out of lock protected region
     - irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ
     - sched/core: Fix migrate_swap() vs. hotplug
     - perf: Revert to requiring CAP_SYS_ADMIN for uprobes
     - ASoC: cs35l56: probe() should fail if the device ID is not recognized
     - Bluetooth: hci_sync: Fix not disabling advertising instance
     - Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected
     - pinctrl: amd: Clear GPIO debounce for suspend
     - fix proc_sys_compare() handling of in-lookup dentries
     - sched/deadline: Fix dl_server runtime calculation formula
     - bnxt_en: eliminate the compile warning in bnxt_request_irq due to
       CONFIG_RFS_ACCEL
     - [arm64] poe: Handle spurious Overlay faults
     - [arm64] net: phy: qcom: move the WoL function to shared library
     - [arm64] net: phy: qcom: qca808x: Fix WoL issue by utilizing
       at8031_set_wol()
     - netlink: Fix wraparounds of sk->sk_rmem_alloc.
     - vsock: fix `vsock_proto` declaration
     - tipc: Fix use-after-free in tipc_conn_close().
     - tcp: Correct signedness in skb remaining space calculation
     - vsock: Fix transport_{g2h,h2g} TOCTOU
     - vsock: Fix transport_* TOCTOU
     - vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local`
     - net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2
     - net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap
     - net: phy: smsc: Force predictable MDI-X state on LAN87xx
     - net: phy: smsc: Fix link failure in forced mode with Auto-MDIX
     - atm: clip: Fix potential null-ptr-deref in to_atmarpd().
     - atm: clip: Fix memory leak of struct clip_vcc.
     - atm: clip: Fix infinite recursive call of clip_push().
     - atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
     - [arm64] net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for
       skb_shared_info
     - net/sched: Abort __tc_modify_qdisc if parent class does not exist
     - rxrpc: Fix bug due to prealloc collision
     - rxrpc: Fix oops due to non-existence of prealloc backlog struct
     - ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
     - [amd64] x86/mce/amd: Add default names for MCA banks and blocks
     - [amd64] x86/mce/amd: Fix threshold limit reset
     - [amd64] x86/mce: Don't remove sysfs if thresholding sysfs init fails
     - [amd64] x86/mce: Ensure user polling settings are honored when restarting
       timer
     - [amd64] x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
     - [amd64] KVM: x86/xen: Allow 'out of range' event channel ports in IRQ
       routing table.
     - [amd64] KVM: SVM: Add missing member in SNP_LAUNCH_START command structure
     - [amd64] KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is
       in-flight
     - KVM: Allow CPU to reschedule while setting per-page memory attributes
     - ASoC: fsl_sai: Force a software reset when starting in consumer mode
     - gre: Fix IPv6 multicast route creation. (Closes: #1108430)
     - md/md-bitmap: fix GPF in bitmap_get_stats() (Closes: #1109734)
     - [arm64] pinctrl: qcom: msm: mark certain pins as invalid for interrupts
     - pwm: Fix invalid state detection
     - pwm: mediatek: Ensure to disable clocks in error path
     - wifi: prevent A-MSDU attacks in mesh networks (CVE-2025-27558)
     - wifi: mwifiex: discard erroneous disassoc frames on STA interface
     - wifi: mt76: mt7921: prevent decap offload config before STA initialization
     - wifi: mt76: mt7925: prevent NULL pointer dereference in
       mt7925_sta_set_decap_offload()
     - wifi: mt76: mt7925: fix the wrong config for tx interrupt
     - wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw
       scan
     - drm/imagination: Fix kernel crash when hard resetting the GPU
     - drm/amdkfd: Don't call mmput from MMU notifier callback
     - drm/gem: Acquire references on GEM handles for framebuffers
     - drm/sched: Increment job count before swapping tail spsc queue
     - drm/ttm: fix error handling in ttm_buffer_object_transfer
     - drm/gem: Fix race in drm_gem_handle_create_tail()
     - drm/xe/bmg: fix compressed VRAM handling
     - Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2"
     - usb: gadget: u_serial: Fix race condition in TTY wakeup
     - Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io"
     - drm/framebuffer: Acquire internal references on GEM handles
     - drm/xe: Allocate PF queue size on pow2 boundary
     - Revert "ACPI: battery: negate current when discharging" (Closes: #1109344)
     - Revert "PCI/ACPI: Fix allocated memory release on error in
       pci_acpi_scan_root()"
     - kallsyms: fix build without execinfo
     - maple_tree: fix mt_destroy_walk() on root leaf node
     - mm: fix the inaccurate memory statistics issue for users
     - mm/vmalloc: leave lazy MMU mode on PTE mapping error
     - lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users()
     - [amd64] x86/rdrand: Disable RDSEED on AMD Cyan Skillfish
     - [amd64] x86/mm: Disable hugetlb page table sharing on 32-bit
     - [arm64] clk: scmi: Handle case where child clocks are initialized before
       their parents
     - smb: server: make use of rdma_destroy_qp()
     - ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked()
     - erofs: fix to add missing tracepoint in erofs_read_folio()
     - erofs: address D-cache aliasing
     - [amd64] ASoC: Intel: sof-function-topology-lib: Print out the unsupported
       dmic count
     - netlink: Fix rmem check in netlink_broadcast_deliver().
     - netlink: make sure we allow at least one dump skb
     - netfs: Fix ref leak on inserted extra subreq in write retry
     - wifi: cfg80211: fix S1G beacon head validation in nl80211
     - wifi: zd1211rw: Fix potential NULL pointer dereference in
       zd_mac_tx_to_dev()
     - drm/tegra: nvdec: Fix dma_alloc_coherent error check
     - md/raid1: Fix stack memory use after return in raid1_reshape
     - raid10: cleanup memleak at raid10_make_request
     - wifi: mac80211: correctly identify S1G short beacon
     - wifi: mac80211: fix non-transmitted BSSID profile search
     - wifi: rt2x00: fix remove callback type mismatch
     - drm/nouveau/gsp: fix potential leak of memory used during acpi init
     - wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init()
     - nbd: fix uaf in nbd_genl_connect() error path
     - drm/xe/pf: Clear all LMTT pages on alloc
     - erofs: free pclusters if no cached folio is attached
     - erofs: get rid of `z_erofs_next_pcluster_t`
     - erofs: tidy up zdata.c
     - erofs: refine readahead tracepoint
     - erofs: fix to add missing tracepoint in erofs_readahead()
     - netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
     - net: appletalk: Fix device refcount leak in atrtr_create()
     - ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof
     - net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits
     - net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
     - drm/xe/pm: Correct comment of xe_pm_set_vram_threshold()
     - can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to
       debug level
     - net/mlx5e: Fix race between DIM disable and net_dim()
     - net/mlx5e: Add new prio for promiscuous mode
     - net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam()
     - bnxt_en: Fix DCB ETS validation
     - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
     - ublk: sanity check add_dev input for underflow
     - atm: idt77252: Add missing `dma_map_error()`
     - ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak.
     - [amd64] ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606
     - io_uring: make fallocate be hashed work
     - [amd64] ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic
     - ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100
     - ALSA: hda/realtek: Add quirks for some Clevo laptops
     - net: usb: qmi_wwan: add SIMCom 8230C composition
     - driver: bluetooth: hci_qca:fix unable to load the BT driver
     - HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2
     - net: mana: Record doorbell physical address in PF mode
     - btrfs: fix assertion when building free space tree
     - vt: add missing notification when switching back to text mode
     - bpf: Adjust free target to avoid global starvation of LRU map
     - [riscv64] vdso: Exclude .rodata from the PT_DYNAMIC segment
     - HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
     - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
     - HID: nintendo: avoid bluetooth suspend/resume stalls
     - erofs: fix rare pcluster memory leak after unmounting
     - net: wangxun: revert the adjustment of the IRQ vector sequence
     - kasan: remove kasan_find_vm_area() to prevent possible deadlock
     - ksmbd: fix potential use-after-free in oplock/lease break ack
     - [arm64] Filter out SME hwcaps when FEAT_SME isn't implemented
     - crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP()
       (CVE-2025-37984)
     - rseq: Fix segfault on registration when rseq_cs is non-zero
       (CVE-2025-38067)
     - [amd64] KVM: SVM: Set synthesized TSA CPUID flags
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.40
     - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
     - USB: serial: option: add Foxconn T99W640
     - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
     - usb: musb: fix gadget state on disconnect
     - [arm*] usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY
     - usb: gadget: configfs: Fix OOB read on empty string write
     - [armhf] i2c: stm32: fix the device used for the DMA map
     - [armhf] i2c: stm32f7: unmap DMA mapped buffer
     - [amd64] thunderbolt: Fix wake on connect at runtime
     - [amd64] thunderbolt: Fix bit masking in tb_dp_port_set_hops()
     - Revert "staging: vchiq_arm: Create keep-alive thread during probe"
     - nvmem: imx-ocotp: fix MAC address byte length
     - nvmem: layouts: u-boot-env: remove crc32 endianness conversion
     - Input: xpad - set correct controller type for Acer NGR200
     - pch_uart: Fix dma_sync_sg_for_device() nents value
     - spi: Add check for 8-bit transfer with 8 IO mode support
     - dm-bufio: fix sched in atomic context
     - HID: core: ensure the allocated report buffer can contain the reserved
       report ID
     - HID: core: ensure __hid_request reserves the report ID as the first byte
     - HID: core: do not bypass hid_hw_raw_request
     - tracing/probes: Avoid using params uninitialized in parse_btf_arg()
     - tracing: Add down_write(trace_event_sem) when adding trace event
     - tracing/osnoise: Fix crash in timerlat_dump_stack()
     - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume
     - drm/amdgpu: Increase reset counter only on success
     - drm/amd/display: Disable CRTC degamma LUT for DCN401
     - drm/amd/display: Free memory allocation
     - ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx
     - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS
     - io_uring/poll: fix POLLERR handling
     - mptcp: make fallback action and fallback decision atomic
     - mptcp: plug races between subflow fail and subflow creation
     - mptcp: reset fallback status gracefully at disconnect() time
     - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in
       pep_sock_accept()
     - net/mlx5: Update the list of the PCI supported devices
     - [arm64] dts: imx8mp-venice-gw74xx: fix TPM SPI frequency
     - [arm64] dts: add big-endian property back into watchdog node
     - [arm64] dts: freescale: imx8mm-verdin: Keep LDO5 always on
     - [arm64] dts: imx8mp-venice-gw71xx: fix TPM SPI frequency
     - [arm64] dts: imx8mp-venice-gw72xx: fix TPM SPI frequency
     - [arm64] dts: imx8mp-venice-gw73xx: fix TPM SPI frequency
     - [arm64] dts: rockchip: use cs-gpios for spi1 on ringneck
     - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
     - af_packet: fix soft lockup issue caused by tpacket_snd()
     - Bluetooth: btintel: Check if controller is ISO capable on
       btintel_classify_pkt_type
     - cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y
     - isofs: Verify inode mode when loading from disk
     - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
     - [arm*] mmc: bcm2835: Fix dma_unmap_sg() nents value
     - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based
       Positivo models
     - [arm64] mmc: sdhci_am654: Workaround for Errata i2312
     - [amd64] net: stmmac: intel: populate entire system_counterval_t in
       get_time_fn() callback
     - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
     - [s390x] bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
     - smb: client: fix use-after-free in crypt_message when using async crypto
     - [armhf] soc: aspeed: lpc-snoop: Cleanup resources in stack-order
     - [armhf] soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
     - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush
     - iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps
     - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
     - iio: adc: max1363: Reorder mode_list[] entries
     - iio: adc: stm32-adc: Fix race in installing chained IRQ handler
     - iio: backend: fix out-of-bound write
     - iio: common: st_sensors: Fix use of uninitialize device structs
     - [arm64] dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5
     - [arm64] dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B
     - [arm64] dts: imx95: Correct the DMA interrupter number of pcie0_ep
     - bpf: Reject %p% format string in bprintf-like helpers
     - cachefiles: Fix the incorrect return value in __cachefiles_write()
     - block: fix kobject leak in blk_unregister_queue
     - net/sched: sch_qfq: Fix race condition on qfq_aggregate
     - rpl: Fix use-after-free in rpl_do_srh_inline().
     - smb: client: fix use-after-free in cifs_oplock_break
     - fix a leak in fcntl_dirnotify()
     - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list()
     - nvme: fix endianness of command word prints in nvme_log_err_passthru()
     - smc: Fix various oops due to inet_sock type confusion.
     - net: phy: Don't register LEDs for genphy
     - nvme: fix misaccounting of nvme-mpath inflight I/O
     - nvmet-tcp: fix callback lock for TLS handshake
     - wifi: cfg80211: remove scan request n_channels counted_by
     - [amd64] hwmon: (corsair-cpro) Validate the size of the received input
       buffer
     - ice: add NULL check in eswitch lag check
     - ice: check correct pointer in fwlog debugfs
     - usb: net: sierra: check for no status endpoint
     - loop: use kiocb helpers to fix lockdep warning
     - [riscv64] Enable interrupt during exception handling
     - [riscv64] traps_misaligned: properly sign extend value in misaligned load
       handler
     - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
     - Bluetooth: hci_sync: fix connectable extended advertising when using
       static random address
     - Bluetooth: SMP: If an unallowed command is received consider it a failure
     - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
     - Bluetooth: hci_core: add missing braces when using macro parameters
     - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant
       without board ID
     - net/mlx5: Correctly set gso_size when LRO is used
     - ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
     - net: fix segmentation after TCP/UDP fraglist GRO
     - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
     - drm/xe/pf: Sanitize VF scratch registers on FLR
     - drm/xe/pf: Move VFs reprovisioning to worker
     - drm/xe/pf: Prepare to stop SR-IOV support prior GT reset
     - Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
     - [amd64,arm64] hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open
       to prevent IPv6 addrconf
     - virtio-net: fix recursived rtnl_lock() during probe()
     - tls: always refresh the queue when reading sock
     - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during
       runtime
     - net: bridge: Do not offload IGMP/MLD messages
     - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
     - rxrpc: Fix recv-recv race of completed call
     - rxrpc: Fix transmission of an abort in response to an abort
     - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen"
     - drm/mediatek: Add wait_event_timeout when disabling plane
     - drm/mediatek: only announce AFBC if really supported
     - libbpf: Fix handling of BPF arena relocations
     - efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths
     - sched: Change nr_uninterruptible type to unsigned long
     - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right
       userns
     - btrfs: fix block group refcount race in
       btrfs_create_pending_block_groups() (CVE-2025-22115)
     - usb: hub: fix detection of high tier USB3 devices behind suspended hubs
     - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime
       pm
     - usb: hub: Fix flushing of delayed work used for post resume purposes
     - usb: hub: Don't try to recover devices lost during warm reset.
     - [arm64] usb: dwc3: qcom: Don't leave BCR asserted
     - [arm64,armhf] i2c: omap: Add support for setting mux
     - [arm64,armhf] i2c: omap: Fix an error handling path in omap_i2c_probe()
     - [arm64,armhf] i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe()
     - [arm64,armhf] i2c: omap: fix deprecated of_property_read_bool() use
     - sched,freezer: Remove unnecessary warning in __thaw_task
     - drm/xe/mocs: Initialize MOCS index early
     - drm/xe: Move page fault init after topology init
     - smb: client: let smbd_post_send_iter() respect the peers max_send_size and
       transmit all data
     - [amd64] iommu/vt-d: Fix misplaced domain_attached assignment
       (Closes: #1109676)
     - [amd64] KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll
       hypercalls
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.41
     - [amd64] x86/traps: Initialize DR7 by writing its architectural reset value
     - Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT
       (CVE-2025-38335)
     - virtio_net: Enforce minimum TX ring size for reliability
     - virtio_ring: Fix error reporting in virtqueue_resize
     - regulator: core: fix NULL dereference on unbind due to stale coupling data
     - [amd64] platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo
       UX8406CA
     - RDMA/core: Rate limit GID cache warning messages
     - [arm64] interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1
       node
     - iio: adc: ad7949: use spi_is_bpw_supported()
     - regmap: fix potential memory leak of regmap_bus
     - [amd64] x86/hyperv: Fix usage of cpu_online_mask to get valid cpu
     - [amd64] platform/x86: Fix initialization order for
       firmware_attributes_class
     - [arm*] staging: vchiq_arm: Make vchiq_shutdown never fail
     - xfrm: state: initialize state_ptrs earlier in xfrm_state_find
     - xfrm: state: use a consistent pcpu_id in xfrm_state_find
     - xfrm: Set transport header to fix UDP GRO handling
     - xfrm: interface: fix use-after-free after changing collect_md xfrm
       interface
     - [arm64] net: ti: icssg-prueth: Fix buffer allocation for ICSSG
     - net/mlx5: Fix memory leak in cmd_exec()
     - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch
     - i40e: report VF tx_dropped with tx_errors instead of tx_discards
     - i40e: When removing VF MAC filters, only check PF-set MAC
     - net: appletalk: Fix use-after-free in AARP proxy probe
     - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in
       qfq_delete_class
     - can: netlink: can_changelink(): fix NULL pointer deref of struct
       can_priv::do_set_mode
     - [arm64] drm/bridge: ti-sn65dsi86: Remove extra semicolon in
       ti_sn_bridge_probe()
     - ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop
     - [s390x] ism: fix concurrency management in ism_cmd()
     - [arm64] net: hns3: fix concurrent setting vlan filter issue
     - [arm64] net: hns3: disable interrupt when ptp init failed
     - [arm64] net: hns3: fixed vf get max channels bug
     - [arm64] net: hns3: default enable tx bounce buffer when smmu enabled
     - [amd64] platform/x86: ideapad-laptop: Fix FnLock not remembered among
       boots
     - [amd64] platform/x86: ideapad-laptop: Fix kbd backlight not remembered
       among boots
     - drm/amdgpu: Reset the clear flag in buddy during resume
     - drm/sched: Remove optimization that causes hang when killing dependent
       jobs
     - mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show()
     - timekeeping: Zero initialize system_counterval when querying time from phc
       drivers
     - [arm64] i2c: qup: jump out of the loop in case of timeout
     - [arm64,armhf] i2c: tegra: Fix reset error handling with ACPI
     - i2c: virtio: Avoid hang by using interruptible completion wait
     - bus: fsl-mc: Fix potential double device reference in
       fsl_mc_get_endpoint()
     - sprintf.h requires stdarg.h
     - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx
     - ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx
     - [arm64] entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()
     - [arm64] dpaa2-eth: Fix device reference count leak in MAC endpoint
       handling
     - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set
     - e1000e: ignore uninitialized checksum word on tgp
     - gve: Fix stuck TX queue for DQ queue format
     - ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
     - nilfs2: reject invalid file types when reading inodes
     - resource: fix false warning in __request_region()
     - mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list
     - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
     - [amd64,arm64] usb: typec: tcpm: allow to use sink in accessory mode
     - [amd64,arm64] usb: typec: tcpm: allow switching to mode accessory to mux
       properly
     - [amd64,arm64] usb: typec: tcpm: apply vbus before data bringup in
       tcpm_src_attach
     - spi: cadence-quadspi: fix cleanup of rx_chan on failure paths
     - [amd64] x86/bugs: Fix use of possibly uninit value in
       amd_check_tsa_microcode()
     - jfs: reject on-disk inodes of an unsupported type (CVE-2025-37925)
     - [amd64] comedi: comedi_test: Fix possible deletion of uninitialized timers
     - [arm64] dts: qcom: x1e78100-t14s: mark l12b and l15b always-on
     - erofs: simplify z_erofs_load_compact_lcluster()
     - erofs: refine z_erofs_get_extent_compressedlen()
     - erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches
     - erofs: simplify tail inline pcluster handling
     - erofs: clean up header parsing for ztailpacking and fragments
     - erofs: fix large fragment handling
     - ext4: don't explicit update times in ext4_fallocate()
     - ext4: refactor ext4_punch_hole()
     - ext4: refactor ext4_zero_range()
     - ext4: refactor ext4_collapse_range()
     - ext4: refactor ext4_insert_range()
     - ext4: factor out ext4_do_fallocate()
     - ext4: move out inode_lock into ext4_fallocate()
     - ext4: move out common parts into ext4_fallocate()
     - ext4: fix incorrect punch max_end
     - ext4: correct the error handle in ext4_fallocate()
     - ext4: fix out of bounds punch offset
     - [amd64] KVM: x86: drop x86.h include from cpuid.h
     - [amd64] KVM: x86: Route non-canonical checks in emulator through
       emulate_ops
     - [amd64] KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical
       checks
     - [amd64] KVM: x86: model canonical checks more precisely
     - [amd64] KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush
       (CVE-2025-38351)
     - [amd64] x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap()
     - [arm64] dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage
     - Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO"
     - wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure
     - iio: hid-sensor-prox: Restore lost scale assignments
     - iio: hid-sensor-prox: Fix incorrect OFFSET calculation
     - [amd64,arm64] Drivers: hv: Make the sysfs node size for the ring buffer
       dynamic
     - ALSA: hda/tegra: Add Tegra264 support
     - ALSA: hda: Add missing NVIDIA HDA codec IDs
     - [amd64] drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x
     - Revert "drm/xe/gt: Update handling of xe_force_wake_get return"
       (Closes: #1109799)
     - Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling"
     - Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return"
     - Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()"
     - [amd64] KVM: x86: Free vCPUs before freeing VM state
     - mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma
 .
   [ Bastian Blank ]
   * Store build time signing key encrypted.
   * Enable CRYPTO_ECDSA.
 .
   [ Aurelien Jarno ]
   * Fix installation of DTB files
 .
   [ Tj ]
   * drivers/gpu/drm/nouveau: Enable DRM_NOUVEAU_GSP_DEFAULT (Closes: #1088522)
 .
   [ Uwe Kleine-König ]
   * [armhf] Add phy-gmii-sel module to nic-shared-modules udeb for
     ti/omap/am335x based machines (e.g. BeagleBone black).
 .
   [ Salvatore Bonaccorso ]
   * d/salsa-ci.yml: Update for trixie: Set RELEASE to trixie

linux-signed-arm64 (6.12.43+1) trixie; urgency=medium
 .
   * Sign kernel from linux 6.12.43-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.42
     - [amd64] ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx
     - ethernet: intel: fix building with large NR_CPUS
     - [amd64] ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx
     - ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX
     - [amd64] ASoC: Intel: fix SND_SOC_SOF dependencies
     - [amd64] ASoC: amd: yc: add DMI quirk for ASUS M6501RM
     - audit,module: restore audit logging in load failure case
     - parse_longname(): strrchr() expects NUL-terminated string
     - fs_context: fix parameter name in infofc() macro
     - fs/ntfs3: cancle set bad inode after removing name fails
     - ublk: use vmalloc for ublk_device's __queues
     - hfsplus: make splice write available again
     - hfs: make splice write available again
     - hfsplus: remove mutex_lock check in hfsplus_free_extents
     - Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
     - gfs2: No more self recovery
     - io_uring: fix breakage in EXPERT menu
     - ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask()
     - ASoC: ops: dynamically allocate struct snd_ctl_elem_value
     - ASoC: mediatek: use reserved memory or enable buffer pre-allocation
     - [arm64] dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV
     - [arm64] soc: qcom: QMI encoding/decoding for big endian
     - [arm64] dts: qcom: sdm845: Expand IMEM region
     - [arm64] dts: qcom: sc7180: Expand IMEM region
     - [arm64] dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes
     - [arm64] dts: qcom: sa8775p: Correct the interrupt for remoteproc
     - [arm64] dts: qcom: msm8976: Make blsp_dma controlled-remotely
     - usb: host: xhci-plat: fix incorrect type for of_match variable in
       xhci_plat_probe()
     - usb: misc: apple-mfi-fastcharge: Make power supply names unique
     - [arm64] dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports
     - [arm64] dts: ti: k3-am62p-j722s: fix pinctrl-single size
     - [arm64] firmware: arm_scmi: Fix up turbo frequencies selection
     - usb: typec: ucsi: yoga-c630: fix error and remove paths
     - mei: vsc: Destroy mutex after freeing the IRQ
     - mei: vsc: Event notifier fixes
     - mei: vsc: Unset the event callback on remove and probe errors
     - [armhf] spi: stm32: Check for cfg availability in stm32_spi_probe
     - vmci: Prevent the dispatching of uninitialized payloads
     - pps: fix poll support
     - Revert "vmci: Prevent the dispatching of uninitialized payloads"
     - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()
     - usb: early: xhci-dbc: Fix early_ioremap leak
     - [armhf] dts: ti: omap: Fixup pinheader typo
     - [arm64] dts: st: fix timer used for ticks
     - [arm64] dts: imx8mm-beacon: Fix HS400 USDHC clock speed
     - [arm64] dts: imx8mn-beacon: Fix HS400 USDHC clock speed
     - PM / devfreq: Check governor before using governor->name
     - PM / devfreq: Fix a index typo in trans_stat
     - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode
     - cpufreq: Initialize cpufreq-based frequency-invariance later
     - cpufreq: Init policy->rwsem before it may be possibly used
     - staging: greybus: gbphy: fix up const issue with the match callback
     - [arm64] soc: qcom: pmic_glink: fix OF node leak
     - [arm64] interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg
     - [arm64] interconnect: qcom: sc8180x: specify num_nodes
     - bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640
     - [arm64,armhf] drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed
     - [arm64,armhf] drm/panfrost: Fix panfrost device variable name in devfreq
     - drm/panthor: Add missing explicit padding in drm_panthor_gpu_info
     - bpf, sockmap: Fix psock incorrectly pointing to sk
     - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
     - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain
     - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel
     - drm/amdgpu: Remove nbiov7.9 replay count reporting
     - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
     - [powerpc*] pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add
     - wifi: rtw89: avoid NULL dereference when RX problematic packet on
       unsupported 6 GHz band
     - wifi: rtl818x: Kill URBs before clearing tx status queue
     - wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
     - iwlwifi: Add missing check for alloc_ordered_workqueue
     - wifi: ath11k: clear initialized flag for deinit-ed srng lists
     - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
     - net/mlx5: Check device memory pointer before usage
     - net: dst: annotate data-races around dst->input
     - net: dst: annotate data-races around dst->output
     - bpf: Ensure RCU lock is held around bpf_prog_ksym_find
     - [arm64] drm/msm/dpu: Fill in min_prefill_lines for SC8180X
     - refscale: Check that nreaders and loops multiplication doesn't overflow
     - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
     - sched/psi: Optimize psi_group_change() cpu_clock() usage
     - fbcon: Fix outdated registered_fb reference in comment
     - netfilter: nf_tables: Drop dead code from fill_*_info routines
     - netfilter: nf_tables: adjust lockdep assertions handling
     - [amd64] iommu/amd: Enable PASID and ATS capabilities in the correct order
     - net/sched: Restrict conditions for adding duplicating netems to qdisc tree
     - net_sched: act_ctinfo: use atomic64_t for three counters
     - RDMA/mlx5: Fix UMR modifying of mkey page size
     - xen: fix UAF in dmabuf_exp_from_pages()
     - xen/gntdev: remove struct gntdev_copy_batch from stack
     - tcp: call tcp_measure_rcv_mss() for ooo packets
     - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
     - wifi: rtw88: Fix macid assigned to TDLS station
     - mwl8k: Add missing check after DMA map
     - wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()
     - drm/amdgpu/gfx9: fix kiq locking in KCQ reset
     - drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset
     - drm/amdgpu/gfx10: fix kiq locking in KCQ reset
     - [amd64] iommu/amd: Fix geometry.aperture_end for V2 tables
     - rcu: Fix delayed execution of hurry callbacks
     - wifi: mac80211: reject TDLS operations when station is not associated
     - wifi: plfxlc: Fix error handling in usb driver probe
     - wifi: mac80211: Do not schedule stopped TXQs
     - wifi: mac80211: Don't call fq_flow_idx() for management frames
     - wifi: mac80211: Check 802.11 encaps offloading in
       ieee80211_tx_h_select_key()
     - Reapply "wifi: mac80211: Update skb's control block key in
       ieee80211_tx_dequeue()"
     - wifi: ath12k: fix endianness handling while accessing wmi service bit
     - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P
       IE
     - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon()
     - wifi: nl80211: Set num_sub_specs before looping through sub_specs
     - ring-buffer: Remove ring_buffer_read_prepare_sync()
     - memcg_slabinfo: Fix use of PG_slab
     - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'
     - Bluetooth: hci_event: Mask data status from LE ext adv reports
     - bpf: Disable migration in nf_hook_run_bpf().
     - can: peak_usb: fix USB FD devices potential malfunction
     - can: kvaser_pciefd: Store device channel index
     - can: kvaser_usb: Assign netdev.dev_port based on device channel index
     - netfilter: xt_nfacct: don't assume acct name is null-terminated
     - net/mlx5e: Clear Read-Only port buffer size in PBMC before update
     - net/mlx5e: Remove skb secpath if xfrm state is not found
     - stmmac: xsk: fix negative overflow of budget in zerocopy mode
     - vrf: Drop existing dst reference in vrf_ip6_input_dst
     - ipv6: prevent infinite loop in rt6_nlmsg_size()
     - ipv6: fix possible infinite loop in fib6_info_uses_dev()
     - ipv6: annotate data-races around rt->fib6_nsiblings
     - bpf/preload: Don't select USERMODE_DRIVER
     - [arm64] bpf, arm64: Fix fp initialization for exception boundary
     - fortify: Fix incorrect reporting of read buffer size
     - [arm64] PCI: rockchip-host: Fix "Unexpected Completion" log message
     - [arm64] clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv
       clocks
     - [arm64] crypto: sun8i-ce - fix nents passed to dma_unmap_sg()
     - [amd64] crypto: qat - use unmanaged allocation for dc_data
     - [arm64,armhf] crypto: marvell/cesa - Fix engine load inaccuracy
     - [amd64] crypto: qat - allow enabling VFs in the absence of IOMMU
     - [amd64] crypto: qat - fix state restore for banks with exceptions
     - mtd: fix possible integer overflow in erase_xfer()
     - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check
     - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name
     - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
     - [armhf] crypto: arm/aes-neonbs - work around gcc-15 warning
     - pinctrl: sunxi: Fix memory leak on krealloc failure
     - dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning
     - [arm64] phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers
     - fanotify: sanitize handle_type values when reporting fid
     - Fix dma_unmap_sg() nents value
     - perf tools: Fix use-after-free in help_unknown_cmd()
     - perf dso: Add missed dso__put to dso__load_kcore
     - mtd: spi-nor: spansion: Fixup params->set_4byte_addr_mode for SEMPER
     - perf sched: Make sure it frees the usage string
     - perf sched: Free thread->priv using priv_destructor
     - perf sched: Fix memory leaks in 'perf sched map'
     - perf sched: Fix memory leaks for evsel->priv in timehist
     - perf sched: Use RC_CHK_EQUAL() to compare pointers
     - perf sched: Fix memory leaks in 'perf sched latency'
     - [arm64] RDMA/hns: Fix double destruction of rsv_qp
     - [arm64] RDMA/hns: Fix HW configurations not cleared in error flow
     - [amd64] crypto: ccp - Fix locking on alloc failure handling
     - [arm64] crypto: inside-secure - Fix `dma_unmap_sg()` nents value
     - [amd64] crypto: ccp - Fix crash when rebind ccp device for ccp.ko
     - [arm64] RDMA/hns: Get message length of ack_req from FW
     - [arm64] RDMA/hns: Fix accessing uninitialized resources
     - [arm64] RDMA/hns: Drop GFP_NOWARN
     - [arm64] RDMA/hns: Fix -Wframe-larger-than issue
     - kernel: trace: preemptirq_delay_test: use offstack cpu mask
     - proc: use the same treatment to check proc_lseek as ones for
       proc_read_iter et.al
     - pinmux: fix race causing mux_owner NULL with active mux_usecount
     - perf tests bp_account: Fix leaked file descriptor
     - [riscv64] clk: thead: th1520-ap: Correctly refer the parent of osc_12m
     - [armhf] clk: sunxi-ng: v3s: Fix de clock definition
     - [ppc64el] scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
     - scsi: mvsas: Fix dma_unmap_sg() nents value
     - scsi: isci: Fix dma_unmap_sg() nents value
     - ext4: Make sure BH_New bit is cleared in ->write_end handler
     - [arm64] hwrng: mtk - handle devm_pm_runtime_enable errors
     - [amd64] crypto: qat - disable ZUC-256 capability for QAT GEN5
     - soundwire: stream: restore params when prepare ports fail
     - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute
     - remoteproc: xlnx: Disable unsupported features
     - fs/orangefs: Allow 2 more characters in do_c_string()
     - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
     - dmaengine: nbpfaxi: Add missing check after DMA map
     - perf tools: Remove libtraceevent in .gitignore
     - [amd64] crypto: qat - fix DMA direction for compression on GEN2 devices
     - [amd64] crypto: qat - fix seq_file position update in adf_ring_next()
     - fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref
     - jfs: fix metapage reference count leak in dbAllocCtl
     - drm/xe/vf: Disable CSC support on VF
     - perf record: Cache build-ID of hit DSOs only
     - vdpa/mlx5: Fix needs_teardown flag calculation
     - vhost-scsi: Fix log flooding with target does not exist errors
     - vdpa/mlx5: Fix release of uninitialized resources on error path
     - vdpa: Fix IDR memory leak in VDUSE module exit
     - vhost: Reintroduce kthread API and add mode selection
     - bpf: Check flow_dissector ctx accesses are aligned
     - bpf: Check netfilter ctx accesses are aligned
     - apparmor: ensure WB_HISTORY_SIZE value is a power of 2
     - apparmor: fix loop detection used in conflicting attachment resolution
     - apparmor: Fix unaligned memory accesses in KUnit test
     - module: Restore the moduleparam prefix length check
     - ucount: fix atomic_long_inc_below() argument type
     - rtc: ds1307: fix incorrect maximum clock rate handling
     - rtc: hym8563: fix incorrect maximum clock rate handling
     - rtc: nct3018y: fix incorrect maximum clock rate handling
     - rtc: pcf85063: fix incorrect maximum clock rate handling
     - rtc: pcf8563: fix incorrect maximum clock rate handling
     - rtc: rv3028: fix incorrect maximum clock rate handling
     - f2fs: turn off one_time when forcibly set to foreground GC
     - f2fs: fix bio memleak when committing super block
     - f2fs: fix KMSAN uninit-value in extent_info usage
     - f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent
     - f2fs: fix to check upper boundary for gc_valid_thresh_ratio
     - f2fs: fix to check upper boundary for gc_no_zoned_gc_percent
     - f2fs: doc: fix wrong quota mount option description
     - f2fs: fix to avoid UAF in f2fs_sync_inode_meta()
     - f2fs: fix to avoid panic in f2fs_evict_inode
     - f2fs: fix to avoid out-of-boundary access in devs.path
     - f2fs: vm_unmap_ram() may be called from an invalid context
     - f2fs: fix to update upper_p in __get_secs_required() correctly
     - f2fs: fix to calculate dirty data during has_not_enough_free_secs()
     - f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode
     - exfat: fdatasync flag should be same like generic_write_sync()
     - i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe()
     - vfio: Fix unbalanced vfio_df_close call in no-iommu mode
     - vfio: Prevent open_count decrement to negative
     - vfio/pds: Fix missing detach_ioas op
     - vfio/pci: Separate SR-IOV VF dev_set
     - scsi: mpt3sas: Fix a fw_event memory leak
     - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free"
     - scsi: ufs: core: Use link recovery when h8 exit fails during runtime
       resume
     - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately
     - kconfig: qconf: fix ConfigList::updateListAllforAll()
     - sched/psi: Fix psi_seq initialization
     - PCI: pnv_php: Clean up allocated IRQs on unplug
     - PCI: pnv_php: Work around switches with broken presence detection
     - [powerpc*] eeh: Export eeh_unfreeze_pe()
     - [powerpc*] eeh: Make EEH driver device hotplug safe
     - PCI: pnv_php: Fix surprise plug detection and recovery
     - pNFS/flexfiles: don't attempt pnfs on fatal DS errors
     - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up()
     - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate()
     - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
     - NFSv4.2: another fix for listxattr
     - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY
     - md/md-cluster: handle REMOVE message earlier
     - netpoll: prevent hanging NAPI when netcons gets enabled
     - phy: mscc: Fix parsing of unicast frames
     - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string()
     - pptp: ensure minimal skb length in pptp_xmit()
     - nvmet: initialize discovery subsys after debugfs is initialized
     - [s390x] ap: Unmask SLCF bit in card and queue ap functions sysfs
     - netlink: specs: ethtool: fix module EEPROM input/output arguments
     - block: Fix default IO priority if there is no IO context
     - block: ensure discard_granularity is zero when discard is not supported
     - ASoC: tas2781: Fix the wrong step for TLV on tas2781
     - [amd64] spi: cs42l43: Property entry should be a null-terminated array
     - net/mlx5: Correctly set gso_segs when LRO is used
     - ipv6: reject malicious packets in ipv6_gso_segment()
     - net: mdio: mdio-bcm-unimac: Correct rate fallback logic
     - net: drop UFO packets in udp_rcv_segment()
     - net/sched: taprio: enforce minimum value for picos_per_byte
     - sunrpc: fix client side handling of tls alerts
     - [x86] irq: Plug vector setup race
     - benet: fix BUG when creating VFs
     - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
     - [s390x] mm: Allocate page table with PAGE_SIZE granularity
     - eth: fbnic: remove the debugging trick of super high page bias
     - irqchip: Build IMX_MU_MSI only on ARM
     - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out()
     - smb: server: remove separate empty_recvmsg_queue
     - smb: server: make sure we call ib_dma_unmap_single() only if we called
       ib_dma_map_single already
     - smb: server: let recv_done() consistently call
       put_recvmsg/smb_direct_disconnect_rdma_connection
     - smb: server: let recv_done() avoid touching data_transfer after
       cleanup/move
     - smb: client: remove separate empty_packet_queue
     - smb: client: make sure we call ib_dma_unmap_single() only if we called
       ib_dma_map_single already
     - smb: client: let recv_done() cleanup before notifying the callers.
     - smb: client: let recv_done() avoid touching data_transfer after
       cleanup/move
     - nvmet: exit debugfs after discovery subsystem exits
     - pptp: fix pptp_xmit() error path
     - smb: client: return an error if rdma_connect does not return within 5
       seconds
     - sunrpc: fix handling of server side tls alerts
     - perf/core: Don't leak AUX buffer refcount on allocation failure
     - perf/core: Exit early on perf_mmap() fail
     - perf/core: Prevent VMA split of buffer mappings
     - selftests/perf_events: Add a mmap() correctness test
     - net/packet: fix a race in packet_set_ring() and packet_notifier()
     - vsock: Do not allow binding to VMADDR_PORT_ANY
     - [amd64] accel/ivpu: Fix reset_engine debugfs file logic
     - Revert "bcache: remove heap-related macros and switch to generic min_heap"
     - ice/ptp: fix crosstimestamp reporting
     - [amd64] drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return
       type
     - [amd64] drm/i915/hdmi: propagate errors from intel_hdmi_init_connector()
     - [amd64] drm/i915/hdmi: add error handling in g4x_hdmi_init()
     - [amd64] drm/i915/ddi: gracefully handle errors from
       intel_ddi_init_hdmi_connector()
     - [amd64] drm/i915/display: add intel_encoder_is_hdmi()
     - [amd64] drm/i915/ddi: only call shutdown hooks for valid encoders
     - ksmbd: fix null pointer dereference error in generate_encryptionkey
     - ksmbd: fix Preauh_HashValue race condition
     - ksmbd: fix corrupted mtime and ctime in smb2_open
     - ksmbd: limit repeated connections from clients with the same IP
       (CVE-2025-38501)
     - smb: server: Fix extension string in ksmbd_extract_shortname()
     - USB: serial: option: add Foxconn T99W709
     - PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state()
     - PCI/ASPM: Fix L1SS saving
     - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano
     - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
     - net: usbnet: Fix the wrong netif_carrier_on() call
     - [x86] sev: Evict cache lines during SNP memory validation (CVE-2024-36331)
     - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe()
     - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
     - ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx
     - ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx
     - ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26)
     - [adm64] platform/x86/intel/pmt: fix a crashlog NULL pointer access
     - [x86] fpu: Delay instruction pointer fixup until after warning
     - [s390x] mm: Remove possible false-positive warning in pte_free_defer()
     - [mips*] mm: tlb-r4k: Uniquify TLB entries on init
     - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
     - mm: swap: correctly use maxpages in swapon syscall to avoid potential
       deadloop
     - mm: swap: fix potential buffer overflow in setup_clusters()
     - perf/arm-ni: Set initial IRQ affinity
     - media: ti: j721e-csi2rx: fix list_del corruption
     - HID: apple: validate feature-report field count to prevent NULL pointer
       dereference
     - USB: gadget: f_hid: Fix memory leak in hidg_bind error path
     - usb: gadget : fix use-after-free in composite_dev_cleanup()
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.43
     - io_uring: don't use int for ABI
     - ALSA: usb-audio: Validate UAC3 power domain descriptors, too
     - ALSA: usb-audio: Validate UAC3 cluster segment descriptors
     - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X
     - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks
     - smb3: fix for slab out of bounds on mount to ksmbd
     - smb: client: remove redundant lstrp update in negotiate protocol
     - gpio: virtio: Fix config space reading.
     - gpio: mlxbf2: use platform_get_irq_optional()
     - Revert "gpio: mlxbf3: only get IRQ for device instance 0"
     - gpio: mlxbf3: use platform_get_irq_optional()
     - leds: flash: leds-qcom-flash: Fix registry access after re-bind
     - Revert "leds: trigger: netdev: Configure LED blink interval for HW
       offload"
     - netlink: avoid infinite retry looping in netlink_unicast()
       (Closes: #1111017)
     - net: phy: micrel: fix KSZ8081/KSZ8091 cable test
     - [armhf] net: ftgmac100: fix potential NULL pointer access in
       ftgmac100_phy_disconnect
     - [arm64] net: enetc: fix device and OF node leak at probe
     - [arm64] net: mtk_eth_soc: fix device leak at probe
     - [arm64] net: ti: icss-iep: fix device and OF node leaks at probe
     - net: usb: asix_devices: add phy_mask for ax88772 mdio bus
     - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
     - NFSD: detect mismatch of file handle and delegation stateid in OPEN op
     - NFS: Fix the setting of capabilities when automounting a new filesystem
     - PCI: Extend isolated function probing to LoongArch
     - [arm64] clk: samsung: exynos850: fix a comment
     - [arm64] clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD
     - [arm64] clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent
       clock
     - fscrypt: Don't use problematic non-inline crypto engines
     - fs: Prevent file descriptor table allocations exceeding INT_MAX
     - eventpoll: Fix semi-unbounded recursion (CVE-2025-38614)
     - Documentation: ACPI: Fix parent device references
     - ACPI: processor: perflib: Fix initial _PPC limit application
     - ACPI: processor: perflib: Move problematic pr->performance check
     - block: Make REQ_OP_ZONE_FINISH a write operation
     - mm/memory-tier: fix abstract distance calculation overflow
     - smb: client: let send_done() cleanup before calling
       smbd_disconnect_rdma_connection()
     - smb: client: don't wait for info->send_pending == 0 on error
     - [amd64] KVM: x86: Convert vcpu_run()'s immediate exit param into a generic
       bitmap
     - [amd64] KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN
       flag
     - [amd64] KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is
       supported
     - [amd64] KVM: VMX: Extract checking of guest's DEBUGCTL into helper
     - [amd64] KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter
     - [amd64] KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter
       APIs
     - [amd64] KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running
       the guest
     - [amd64] habanalabs: fix UAF in export_dmabuf()
     - mm/smaps: fix race between smaps_hugetlb_range and migration
     - udp: also consider secpath when evaluating ipsec use for checksumming
     - netfilter: ctnetlink: fix refcount leak on table dump
     - [arm64] net: ti: icssg-prueth: Fix emac link speed handling
     - [arm64] net: ti: icss-iep: Fix incorrect type for return value in
       extts_enable()
     - sctp: linearize cloned gso packets in sctp_rcv
     - [amd64] intel_idle: Allow loading ACPI tables for any family
     - cpuidle: governors: menu: Avoid using invalid recent intervals data
     - ptp: prevent possible ABBA deadlock in ptp_clock_freerun()
     - tls: handle data disappearing from under the TLS ULP (CVE-2025-38616)
     - net: kcm: Fix race condition in kcm_unattach()
     - hfs: fix general protection fault in hfs_find_init()
     - hfs: fix slab-out-of-bounds in hfs_bnode_read()
     - hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
     - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
     - hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
     - [arm64] Handle KCOV __init vs inline mismatches
     - smb/server: avoid deadlock when linking with ReplaceIfExists
     - nvme-pci: try function level reset on init failure
     - dm-stripe: limit chunk_sectors to the stripe size
     - md/raid10: set chunk_sectors limit
     - nvme-tcp: log TLS handshake failures at error level
     - gfs2: Validate i_depth for exhash directories
     - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops
     - loop: Avoid updating block size under exclusive owner
     - udf: Verify partition map count
     - drbd: add missing kref_get in handle_write_conflicts
     - hfs: fix not erasing deleted b-tree node issue
     - better lockdep annotations for simple_recursive_removal()
     - ata: ahci: Disallow LPM policy control if not supported
     - ata: ahci: Disable DIPM if host lacks support
     - ata: libata-sata: Disallow changing LPM state if not supported
     - fs/ntfs3: Add sanity check for file name
     - fs/ntfs3: correctly create symlink for relative path
     - pidfs: raise SB_I_NODEV and SB_I_NOEXEC
     - fix locking in efi_secret_unlink()
     - securityfs: don't pin dentries twice, once is enough...
     - tracefs: Add d_delete to remove negative dentries
     - usb: xhci: print xhci->xhc_state when queue_command failed
     - [amd64] platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list
     - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag
     - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default
     - usb: xhci: Avoid showing warnings for dying controller
     - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
     - usb: xhci: Avoid showing errors during surprise removal
     - [arm64] soc: qcom: rpmh-rsc: Add RSC version 4 support
     - ACPI: APEI: send SIGBUS to current task if synchronous memory error not
       recovered
     - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU
     - usb: typec: tcpm/tcpci_maxim: fix irq wake usage
     - pmdomain: ti: Select PM_GENERIC_DOMAINS
     - [arm64] gpio: wcd934x: check the return value of regmap_update_bits()
     - cpufreq: Exit governor when failed to start old governor
     - cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode
     - [armhf] rockchip: fix kernel hang during smp initialization
     - PM / devfreq: governor: Replace sscanf() with kstrtoul() in
       set_freq_store()
     - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was
       successed
     - [arm64] thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when
       required
     - iio: adc: ad_sigma_delta: don't overallocate scan buffer
     - [armhf] tegra: Use I/O memcpy to write to IRAM
     - ACPI: PRM: Reduce unnecessary printing to avoid user confusion
     - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
     - thermal: sysfs: Return ENODATA instead of EAGAIN for reads
     - PM: sleep: console: Fix the black screen issue
     - ACPI: processor: fix acpi_object initialization
     - [arm64] mmc: sdhci-msm: Ensure SD card power isn't ON when card removed
     - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
     - pps: clients: gpio: fix interrupt handling order in remove path
     - reset: brcmstb: Enable reset drivers for ARCH_BCM2835
     - char: misc: Fix improper and inaccurate error code returned by misc_init()
     - [amd64] mei: bus: Check for still connected devices in
       mei_cl_bus_dev_release()
     - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
     - [amd64,arm64] platform/chrome: cros_ec_sensorhub: Retries when a sensor is
       not ready
     - ALSA: hda: Handle the jack polling always via a work
     - ALSA: hda: Disable jack polling at shutdown
     - [amd64] x86/bugs: Avoid warning when overriding return thunk
     - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
     - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
     - ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode
     - tty: serial: fix print format specifiers
     - ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime()
     - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present
     - usb: core: usb_submit_urb: downgrade type check
     - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
     - [arm64] imx8m-blk-ctrl: set ISI panic write hurry level
     - [arm64] soc: qcom: mdt_loader: Actually use the e_phoff
     - [amd64] platform/x86: thinkpad_acpi: Handle KCOV __init vs inline
       mismatches
     - [amd64,arm64] platform/chrome: cros_ec_typec: Defer probe on missing EC
       parent
     - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
     - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop
     - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
     - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement
     - ASoC: codecs: rt5640: Retry DEVICE_ID verification
     - [arm64] ASoC: qcom: use drvdata instead of component to keep id
     - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps
     - [powerpc*] thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64
     - Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925
     - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie()
     - xen/netfront: Fix TX response spurious interrupts
     - wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn
     - net: usb: cdc-ncm: check for filtering capability
     - wifi: ath12k: Correct tid cleanup when tid setup fails
     - wifi: cfg80211: reject HTC bit for management frames
     - [s390x] time: Use monotonic clock in get_cycles()
     - be2net: Use correct byte order and format string for TCP seq and ack_seq
     - libbpf: Verify that arena map exists when adding arena relocations
     - idpf: preserve coalescing settings across resets
     - wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan
       mode
     - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB
     - et131x: Add missing check after DMA map
     - net: ag71xx: Add missing check after DMA map
     - net/mlx5e: Properly access RCU protected qdisc_sleeping variable
     - net: pcs: xpcs: mask readl() return value to 16 bits
     - [arm64] Mark kernel as tainted on SAE and SError panic
     - drm/amd/pm: fix null pointer access
     - rcu: Protect ->defer_qs_iw_pending from data race
     - drm/amd/display: limit clear_update_flags to dcn32 and above
     - net: mctp: Prevent duplicate binds
     - wifi: cfg80211: Fix interface type validation
     - wifi: mac80211: don't unreserve never reserved chanctx
     - net: ipv4: fix incorrect MTU in broadcast routes
     - [arm64] net: thunderx: Fix format-truncation warning in
       bgx_acpi_match_id()
     - net: phy: micrel: Add ksz9131_resume()
     - sched/deadline: Fix accounting after global limits change
     - bpf: Forget ranges when refining tnum after JSET
     - wifi: iwlwifi: mvm: set gtk id also in older FWs
     - wifi: iwlwifi: mvm: fix scan request validation
     - [s390x] stp: Remove udelay from stp_sync_clock()
     - net: phy: bcm54811: PHY initialization
     - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails
     - wifi: mac80211: don't complete management TX on SAE commit
     - wifi: mac80211: avoid weird state in error path
     - [s390x] early: Copy last breaking event address to pt_regs
     - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in
       __ipv6_dev_mc_inc().
     - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access
     - wifi: mac80211: fix rx link assignment for non-MLO stations
     - [arm64] drm/msm: use trylock for debugfs
     - [arm64] drm/msm: Add error handling for krealloc in metadata setup
     - [arm64] perf/arm: Add missing .suppress_bind_attrs
     - wifi: rtw89: Fix rtw89_mac_power_switch() for USB
     - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch
     - drm/xe/xe_query: Use separate iterator while filling GT list
     - [amd64] net: thunderbolt: Enable end-to-end flow control also in transmit
     - [amd64] net: thunderbolt: Fix the parameter passing of
       tb_xdomain_enable_paths()/tb_xdomain_disable_paths()
     - xfrm: Duplicate SPI Handling
     - net: atlantic: add set_power to fw_ops for atl2 to fix wol
     - ACPI: Suppress misleading SPCR console message when SPCR table is absent
     - net: ieee8021q: fix insufficient table-size assertion
     - net: fec: allow disable coalescing
     - drm/amd/display: Separate set_gsl from set_gsl_source_select
     - wifi: ath10k: shutdown driver when hardware is unreliable
     - wifi: ath12k: Add memset and update default rate value in wmi tx
       completion
     - wifi: ath12k: Fix station association with MBSSID Non-TX BSS
     - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
     - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
     - drm/amd/display: Fix 'failed to blank crtc!'
     - drm/amd/display: Initialize mode_select to 0
     - wifi: mac80211: update radar_required in channel context after channel
       switch
     - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`.
     - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0
     - wifi: ath12k: Decrement TID on RX peer frag setup error handling
     - [powerpc*] floppy: Add missing checks after DMA map
     - netmem: fix skb_frag_address_safe with unreadable skbs
     - [arm64] stacktrace: Check kretprobe_find_ret_addr() return value
     - wifi: iwlegacy: Check rate_idx range after addition
     - neighbour: add support for NUD_PERMANENT proxy entries
     - dpaa_eth: don't use fixed_phy_change_carrier
     - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to
       manual
     - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured
     - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
     - gve: Return error for unknown admin queue command
     - [armhf] net: dsa: b53: ensure BCM5325 PHYs are enabled
     - [armhf] net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
     - [armhf] net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
     - [armhf] net: dsa: b53: prevent DIS_LEARNING access on BCM5325
     - [armhf] net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
     - bpftool: Fix JSON writer resource leak in version command
     - ptp: Use ratelimite for freerun error message
     - wifi: rtw89: scan abort when assign/unassign_vif
     - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc()
     - ionic: clean dbpage in de-init
     - drm/xe: Make dma-fences compliant with the safe access rules
     - [armhf] net: ncsi: Fix buffer overflow in fetching version id
     - drm/ttm: Should to return the evict error
     - uapi: in6: restore visibility of most IPv6 socket options
     - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP
     - drm/amd/display: Update DMCUB loading sequence for DCN3.5
     - drm/amd/display: Avoid trying AUX transactions on disconnected ports
     - drm/ttm: Respect the shrinker core free target
     - rcu: Fix rcu_read_unlock() deadloop due to IRQ work
     - [armhf] net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
     - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page
     - vhost: fail early when __vhost_add_used() fails
     - drm/amd/display: Only finalize atomic_obj if it was initialized
     - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported
     - drm/amd/display: Disable dsc_power_gate for dcn314 by default
     - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race
       condition
     - cifs: Fix calling CIFSFindFirst() for root path without msearch
     - fbdev: fix potential buffer overflow in do_register_framebuffer()
     - crypto: hisilicon/hpre - fix dma unmap sequence
     - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
     - [arm64,armhf] clk: tegra: periph: Fix error handling and resolve unsigned
       compare warning
     - mfd: axp20x: Set explicit ID for AXP313 regulator
     - [arm64] phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal
     - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
     - fs/orangefs: use snprintf() instead of sprintf()
     - watchdog: dw_wdt: Fix default timeout
     - hwmon: (emc2305) Set initial PWM minimum value during probe based on
       thermal state
     - [mips*] vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free}
     - watchdog: iTCO_wdt: Report error if timeout configuration fails
     - scsi: bfa: Double-free fix
     - jfs: truncate good inode pages when hard link is 0
     - jfs: Regular file corruption check
     - jfs: upper bound check of tree index in dbAllocAG
     - media: hi556: Fix reset GPIO timings
     - RDMA/bnxt_re: Fix size of uverbs_copy_to() in
       BNXT_RE_METHOD_GET_TOGGLE_MEM
     - crypto: jitter - fix intermediary handling
     - [mips*] Don't crash in stack_top() for tasks without ABI or vDSO
     - [riscv64] clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED
     - media: ipu-bridge: Add _HID for OV5670
     - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ
       control
     - leds: leds-lp50xx: Handle reg to get correct multi_index
     - [armhf] dmaengine: stm32-dma: configure next sg only if there are more
       than 2 sgs
     - [amd64] RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()
     - RDMA/core: reduce stack using in nldev_stat_get_doit()
     - scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in
       dev_loss_tmo_callbk
     - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
     - power: supply: qcom_battmgr: Add lithium-polymer entry
     - scsi: mpt3sas: Correctly handle ATA device errors
     - scsi: mpi3mr: Correctly handle ATA device errors
     - [armhf] pinctrl: stm32: Manage irq affinity settings
     - media: usb: hdpvr: disable zero-length read messages
     - media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()
     - media: dvb-frontends: w7090p: fix null-ptr-deref in
       w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
     - media: uvcvideo: Add quirk for HP Webcam HD 2300
     - media: uvcvideo: Fix bandwidth issue for Alcor camera
     - [amd64] crypto: ccp - Add missing bootloader info reg for pspv6
     - [arm64] clk: renesas: rzg2l: Postpone updating priv->clks[]
     - soundwire: amd: serialize amd manager resume sequence during pm_prepare
     - soundwire: amd: cancel pending slave status handling workqueue during
       remove sequence
     - soundwire: Move handle_nested_irq outside of sdw_dev_lock
     - md: dm-zoned-target: Initialize return variable r to avoid uninitialized
       use
     - module: Prevent silent truncation of module name in delete_module(2)
     - i3c: add missing include to internal header
     - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
     - apparmor: shift ouid when mediating hard links in userns
     - i3c: don't fail if GETHDRCAP is unsupported
     - i3c: master: Initialize ret in i3c_i2c_notifier_call()
     - dm-mpath: don't print the "loaded" message if registering fails
     - dm-table: fix checking for rq stackable devices
     - apparmor: use the condition in AA_BUG_FMT even with debug disabled
     - apparmor: fix x_table_lookup when stacking is not the first entry
     - i2c: Force DLL0945 touchpad i2c freq to 100khz
     - exfat: add cluster chain loop check for dir
     - f2fs: check the generic conditions first
     - printk: nbcon: Allow reacquire during panic
     - vfio/type1: conditional rescheduling while pinning
     - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
     - scsi: target: core: Generate correct identifiers for PR OUT transport IDs
     - scsi: aacraid: Stop using PCI_IRQ_AFFINITY
     - vfio/mlx5: fix possible overflow in tracking max message size
     - ipmi: Use dev_warn_ratelimited() for incorrect message warnings
     - ipmi: Fix strcpy source and destination the same
     - tools/power turbostat: Handle non-root legacy-uncore sysfs permissions
     - tools/power turbostat: Fix build with musl
     - tools/power turbostat: Handle cap_get_proc() ENOSYS
     - smb: client: don't call init_waitqueue_head(&info->conn_wait) twice in
       _smbd_get_connection
     - lib/sbitmap: convert shallow_depth from one word to the whole sbitmap
     - ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table
     - net: phy: smsc: add proper reset flags for LAN8710A
     - [amd64] ASoC: Intel: avs: Fix uninitialized pointer error in probe()
     - block: avoid possible overflow for chunk_sectors check in
       blk_stack_limits()
     - pNFS: Fix stripe mapping in block/scsi layout
     - pNFS: Fix disk addr range check in block/scsi layout
     - pNFS: Handle RPC size limit for layoutcommits
     - pNFS: Fix uninited ptr deref in block/scsi layout
     - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
     - scsi: lpfc: Remove redundant assignment to avoid memory leak
     - [amd64,armhf] ASoC: fsl_sai: replace regmap_write with regmap_update_bits
     - cifs: Fix collect_sample() to handle any iterator type
     - drm/amdgpu: fix vram reservation issue
     - drm/amdgpu: fix incorrect vm flags to map bo
     - mm/damon/core: commit damos->target_nid
     - block: Introduce bio_needs_zone_write_plugging()
     - dm: Always split write BIOs to zoned device limits
     - cifs: reset iface weights when we cannot find a candidate
     - [amd64] iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes
     - [arm64] iommu/arm-smmu-qcom: Add SM6115 MDSS compatible
     - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range
     - iommufd: Prevent ALIGN() overflow
     - ext4: fix zombie groups in average fragment size lists
     - ext4: fix largest free orders lists corruption on mb_optimize_scan switch
     - ext4: initialize superblock fields in the kballoc-test.c kunit tests
     - usb: core: config: Prevent OOB read in SS endpoint companion parsing
     - misc: rtsx: usb: Ensure mmc child device is active when card is present
     - usb: typec: ucsi: Update power_supply on power role change
     - [amd64] comedi: fix race between polling and detaching
     - [amd64] thunderbolt: Fix copy+paste error in match_service_id()
     - cdc-acm: fix race between initial clearing halt and open
     - btrfs: zoned: use filesystem size not disk size for reclaim decision
     - btrfs: abort transaction during log replay if walk_log_tree() failed
     - btrfs: zoned: do not remove unwritten non-data block group
     - btrfs: qgroup: set quota enabled bit if quota disable fails flushing
       reservations
     - btrfs: don't ignore inode missing when replaying log tree
     - btrfs: fix ssd_spread overallocation
     - btrfs: populate otime when logging an inode item
     - btrfs: qgroup: fix qgroup create ioctl returning success after quotas
       disabled
     - btrfs: don't skip remaining extrefs if dir not found during log replay
     - btrfs: clear dirty status from extent buffer on error at insert_new_root()
     - btrfs: fix log tree replay failure due to file with 0 links and extents
     - btrfs: error on missing block group when unaccounting log tree extent
       buffers
     - btrfs: zoned: do not select metadata BG as finish target
     - btrfs: fix iteration bug in __qgroup_excl_accounting()
     - btrfs: do not allow relocation of partially dropped subvolumes
     - xfs: fix scrub trace with null pointer in quotacheck
     - userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry
     - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
     - net/sched: ets: use old 'nbands' while purging unused classes
     - [amd64,arm64] hv_netvsc: Fix panic during namespace deletion with VF
     - mm, slab: restore NUMA policy support for large kmalloc
     - mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd()
     - mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()
     - mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
     - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
     - media: venus: Fix OOB read due to missing payload bound check
     - media: uvcvideo: Do not mark valid metadata as invalid
     - media: v4l2: Add support for NV12M tiled variants to v4l2_format_info()
     - HID: magicmouse: avoid setting up battery timer when not needed
     - wifi: mac80211: check basic rates validity in sta_link_apply_parameters
     - HID: apple: avoid setting up battery timer for devices without battery
     - mfd: cros_ec: Separate charge-control probing from USB-PD
     - net: Add net_passive_inc() and net_passive_dec().
     - net: better track kernel sockets lifetime (CVE-2025-21884)
     - smb: client: fix netns refcount leak after net_passive changes
     - PCI: Store all PCIe Supported Link Speeds
     - PCI: Allow PCI bridges to go to D3Hot on all non-x86
     - PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports
     - [arm64] dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C
     - [arm64] dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C
     - ata: libata-sata: Add link_power_management_supported sysfs attribute
     - io_uring/rw: cast rw->flags assignment to rwf_t
     - drm/amd/display: Allow DCN301 to clear update flags
     - rcu: Fix racy re-initialization of irq_work causing hangs
     - dm: split write BIOs on zone boundaries when zone append is not emulated
     - PCI: Honor Max Link Speed when determining supported speeds
     - ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled
 .
   [ Bastian Blank ]
   * [amd64, arm64] Enable MANA_INFINIBAND.
 .
   [ Salvatore Bonaccorso ]
   * [amd64] udeb: kernel-image: Include SPI drivers
   * ext4: don't try to clear the orphan_present feature block device is r/o
     (Closes: #1108271)
   * alloc_fdtable(): change calling conventions.
   * net: ipv4: fix regression in local-broadcast route
 .
   [ Ben Hutchings ]
   * proc: fix missing pde_set_flags() for net proc files
linux-signed-arm64 (6.12.41+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.41-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.39
     - eventpoll: don't decrement ep refcount while still holding the ep mutex
       (CVE-2025-38349)
     - drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics
     - drm/amdgpu/ip_discovery: add missing ip_discovery fw
     - [s390x] crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2
     - drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid
       Priority Inversion in SRIOV (CVE-2025-38104)
     - [amd64] ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select
       SND_SOC_ACPI_INTEL_MATCH
     - [amd64] ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address
       struct
     - [amd64] ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43
       laptops
     - [amd64] ASoC: soc-acpi: add get_function_tplg_files ops
     - [amd64] ASoC: Intel: add sof_sdw_get_tplg_files ops
     - [amd64] ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files
       ops
     - [amd64] ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches
     - perf/core: Fix the WARN_ON_ONCE is out of lock protected region
     - irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ
     - sched/core: Fix migrate_swap() vs. hotplug
     - perf: Revert to requiring CAP_SYS_ADMIN for uprobes
     - ASoC: cs35l56: probe() should fail if the device ID is not recognized
     - Bluetooth: hci_sync: Fix not disabling advertising instance
     - Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected
     - pinctrl: amd: Clear GPIO debounce for suspend
     - fix proc_sys_compare() handling of in-lookup dentries
     - sched/deadline: Fix dl_server runtime calculation formula
     - bnxt_en: eliminate the compile warning in bnxt_request_irq due to
       CONFIG_RFS_ACCEL
     - [arm64] poe: Handle spurious Overlay faults
     - [arm64] net: phy: qcom: move the WoL function to shared library
     - [arm64] net: phy: qcom: qca808x: Fix WoL issue by utilizing
       at8031_set_wol()
     - netlink: Fix wraparounds of sk->sk_rmem_alloc.
     - vsock: fix `vsock_proto` declaration
     - tipc: Fix use-after-free in tipc_conn_close().
     - tcp: Correct signedness in skb remaining space calculation
     - vsock: Fix transport_{g2h,h2g} TOCTOU
     - vsock: Fix transport_* TOCTOU
     - vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local`
     - net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2
     - net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap
     - net: phy: smsc: Force predictable MDI-X state on LAN87xx
     - net: phy: smsc: Fix link failure in forced mode with Auto-MDIX
     - atm: clip: Fix potential null-ptr-deref in to_atmarpd().
     - atm: clip: Fix memory leak of struct clip_vcc.
     - atm: clip: Fix infinite recursive call of clip_push().
     - atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
     - [arm64] net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for
       skb_shared_info
     - net/sched: Abort __tc_modify_qdisc if parent class does not exist
     - rxrpc: Fix bug due to prealloc collision
     - rxrpc: Fix oops due to non-existence of prealloc backlog struct
     - ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
     - [amd64] x86/mce/amd: Add default names for MCA banks and blocks
     - [amd64] x86/mce/amd: Fix threshold limit reset
     - [amd64] x86/mce: Don't remove sysfs if thresholding sysfs init fails
     - [amd64] x86/mce: Ensure user polling settings are honored when restarting
       timer
     - [amd64] x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
     - [amd64] KVM: x86/xen: Allow 'out of range' event channel ports in IRQ
       routing table.
     - [amd64] KVM: SVM: Add missing member in SNP_LAUNCH_START command structure
     - [amd64] KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is
       in-flight
     - KVM: Allow CPU to reschedule while setting per-page memory attributes
     - ASoC: fsl_sai: Force a software reset when starting in consumer mode
     - gre: Fix IPv6 multicast route creation. (Closes: #1108430)
     - md/md-bitmap: fix GPF in bitmap_get_stats() (Closes: #1109734)
     - [arm64] pinctrl: qcom: msm: mark certain pins as invalid for interrupts
     - pwm: Fix invalid state detection
     - pwm: mediatek: Ensure to disable clocks in error path
     - wifi: prevent A-MSDU attacks in mesh networks (CVE-2025-27558)
     - wifi: mwifiex: discard erroneous disassoc frames on STA interface
     - wifi: mt76: mt7921: prevent decap offload config before STA initialization
     - wifi: mt76: mt7925: prevent NULL pointer dereference in
       mt7925_sta_set_decap_offload()
     - wifi: mt76: mt7925: fix the wrong config for tx interrupt
     - wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw
       scan
     - drm/imagination: Fix kernel crash when hard resetting the GPU
     - drm/amdkfd: Don't call mmput from MMU notifier callback
     - drm/gem: Acquire references on GEM handles for framebuffers
     - drm/sched: Increment job count before swapping tail spsc queue
     - drm/ttm: fix error handling in ttm_buffer_object_transfer
     - drm/gem: Fix race in drm_gem_handle_create_tail()
     - drm/xe/bmg: fix compressed VRAM handling
     - Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2"
     - usb: gadget: u_serial: Fix race condition in TTY wakeup
     - Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io"
     - drm/framebuffer: Acquire internal references on GEM handles
     - drm/xe: Allocate PF queue size on pow2 boundary
     - Revert "ACPI: battery: negate current when discharging" (Closes: #1109344)
     - Revert "PCI/ACPI: Fix allocated memory release on error in
       pci_acpi_scan_root()"
     - kallsyms: fix build without execinfo
     - maple_tree: fix mt_destroy_walk() on root leaf node
     - mm: fix the inaccurate memory statistics issue for users
     - mm/vmalloc: leave lazy MMU mode on PTE mapping error
     - lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users()
     - [amd64] x86/rdrand: Disable RDSEED on AMD Cyan Skillfish
     - [amd64] x86/mm: Disable hugetlb page table sharing on 32-bit
     - [arm64] clk: scmi: Handle case where child clocks are initialized before
       their parents
     - smb: server: make use of rdma_destroy_qp()
     - ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked()
     - erofs: fix to add missing tracepoint in erofs_read_folio()
     - erofs: address D-cache aliasing
     - [amd64] ASoC: Intel: sof-function-topology-lib: Print out the unsupported
       dmic count
     - netlink: Fix rmem check in netlink_broadcast_deliver().
     - netlink: make sure we allow at least one dump skb
     - netfs: Fix ref leak on inserted extra subreq in write retry
     - wifi: cfg80211: fix S1G beacon head validation in nl80211
     - wifi: zd1211rw: Fix potential NULL pointer dereference in
       zd_mac_tx_to_dev()
     - drm/tegra: nvdec: Fix dma_alloc_coherent error check
     - md/raid1: Fix stack memory use after return in raid1_reshape
     - raid10: cleanup memleak at raid10_make_request
     - wifi: mac80211: correctly identify S1G short beacon
     - wifi: mac80211: fix non-transmitted BSSID profile search
     - wifi: rt2x00: fix remove callback type mismatch
     - drm/nouveau/gsp: fix potential leak of memory used during acpi init
     - wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init()
     - nbd: fix uaf in nbd_genl_connect() error path
     - drm/xe/pf: Clear all LMTT pages on alloc
     - erofs: free pclusters if no cached folio is attached
     - erofs: get rid of `z_erofs_next_pcluster_t`
     - erofs: tidy up zdata.c
     - erofs: refine readahead tracepoint
     - erofs: fix to add missing tracepoint in erofs_readahead()
     - netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
     - net: appletalk: Fix device refcount leak in atrtr_create()
     - ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof
     - net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits
     - net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
     - drm/xe/pm: Correct comment of xe_pm_set_vram_threshold()
     - can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to
       debug level
     - net/mlx5e: Fix race between DIM disable and net_dim()
     - net/mlx5e: Add new prio for promiscuous mode
     - net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam()
     - bnxt_en: Fix DCB ETS validation
     - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
     - ublk: sanity check add_dev input for underflow
     - atm: idt77252: Add missing `dma_map_error()`
     - ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak.
     - [amd64] ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606
     - io_uring: make fallocate be hashed work
     - [amd64] ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic
     - ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100
     - ALSA: hda/realtek: Add quirks for some Clevo laptops
     - net: usb: qmi_wwan: add SIMCom 8230C composition
     - driver: bluetooth: hci_qca:fix unable to load the BT driver
     - HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2
     - net: mana: Record doorbell physical address in PF mode
     - btrfs: fix assertion when building free space tree
     - vt: add missing notification when switching back to text mode
     - bpf: Adjust free target to avoid global starvation of LRU map
     - [riscv64] vdso: Exclude .rodata from the PT_DYNAMIC segment
     - HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
     - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
     - HID: nintendo: avoid bluetooth suspend/resume stalls
     - erofs: fix rare pcluster memory leak after unmounting
     - net: wangxun: revert the adjustment of the IRQ vector sequence
     - kasan: remove kasan_find_vm_area() to prevent possible deadlock
     - ksmbd: fix potential use-after-free in oplock/lease break ack
     - [arm64] Filter out SME hwcaps when FEAT_SME isn't implemented
     - crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP()
       (CVE-2025-37984)
     - rseq: Fix segfault on registration when rseq_cs is non-zero
       (CVE-2025-38067)
     - [amd64] KVM: SVM: Set synthesized TSA CPUID flags
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.40
     - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
     - USB: serial: option: add Foxconn T99W640
     - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
     - usb: musb: fix gadget state on disconnect
     - [arm*] usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY
     - usb: gadget: configfs: Fix OOB read on empty string write
     - [armhf] i2c: stm32: fix the device used for the DMA map
     - [armhf] i2c: stm32f7: unmap DMA mapped buffer
     - [amd64] thunderbolt: Fix wake on connect at runtime
     - [amd64] thunderbolt: Fix bit masking in tb_dp_port_set_hops()
     - Revert "staging: vchiq_arm: Create keep-alive thread during probe"
     - nvmem: imx-ocotp: fix MAC address byte length
     - nvmem: layouts: u-boot-env: remove crc32 endianness conversion
     - Input: xpad - set correct controller type for Acer NGR200
     - pch_uart: Fix dma_sync_sg_for_device() nents value
     - spi: Add check for 8-bit transfer with 8 IO mode support
     - dm-bufio: fix sched in atomic context
     - HID: core: ensure the allocated report buffer can contain the reserved
       report ID
     - HID: core: ensure __hid_request reserves the report ID as the first byte
     - HID: core: do not bypass hid_hw_raw_request
     - tracing/probes: Avoid using params uninitialized in parse_btf_arg()
     - tracing: Add down_write(trace_event_sem) when adding trace event
     - tracing/osnoise: Fix crash in timerlat_dump_stack()
     - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume
     - drm/amdgpu: Increase reset counter only on success
     - drm/amd/display: Disable CRTC degamma LUT for DCN401
     - drm/amd/display: Free memory allocation
     - ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx
     - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS
     - io_uring/poll: fix POLLERR handling
     - mptcp: make fallback action and fallback decision atomic
     - mptcp: plug races between subflow fail and subflow creation
     - mptcp: reset fallback status gracefully at disconnect() time
     - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in
       pep_sock_accept()
     - net/mlx5: Update the list of the PCI supported devices
     - [arm64] dts: imx8mp-venice-gw74xx: fix TPM SPI frequency
     - [arm64] dts: add big-endian property back into watchdog node
     - [arm64] dts: freescale: imx8mm-verdin: Keep LDO5 always on
     - [arm64] dts: imx8mp-venice-gw71xx: fix TPM SPI frequency
     - [arm64] dts: imx8mp-venice-gw72xx: fix TPM SPI frequency
     - [arm64] dts: imx8mp-venice-gw73xx: fix TPM SPI frequency
     - [arm64] dts: rockchip: use cs-gpios for spi1 on ringneck
     - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
     - af_packet: fix soft lockup issue caused by tpacket_snd()
     - Bluetooth: btintel: Check if controller is ISO capable on
       btintel_classify_pkt_type
     - cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y
     - isofs: Verify inode mode when loading from disk
     - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
     - [arm*] mmc: bcm2835: Fix dma_unmap_sg() nents value
     - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based
       Positivo models
     - [arm64] mmc: sdhci_am654: Workaround for Errata i2312
     - [amd64] net: stmmac: intel: populate entire system_counterval_t in
       get_time_fn() callback
     - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
     - [s390x] bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
     - smb: client: fix use-after-free in crypt_message when using async crypto
     - [armhf] soc: aspeed: lpc-snoop: Cleanup resources in stack-order
     - [armhf] soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
     - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush
     - iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps
     - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
     - iio: adc: max1363: Reorder mode_list[] entries
     - iio: adc: stm32-adc: Fix race in installing chained IRQ handler
     - iio: backend: fix out-of-bound write
     - iio: common: st_sensors: Fix use of uninitialize device structs
     - [arm64] dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5
     - [arm64] dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B
     - [arm64] dts: imx95: Correct the DMA interrupter number of pcie0_ep
     - bpf: Reject %p% format string in bprintf-like helpers
     - cachefiles: Fix the incorrect return value in __cachefiles_write()
     - block: fix kobject leak in blk_unregister_queue
     - net/sched: sch_qfq: Fix race condition on qfq_aggregate
     - rpl: Fix use-after-free in rpl_do_srh_inline().
     - smb: client: fix use-after-free in cifs_oplock_break
     - fix a leak in fcntl_dirnotify()
     - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list()
     - nvme: fix endianness of command word prints in nvme_log_err_passthru()
     - smc: Fix various oops due to inet_sock type confusion.
     - net: phy: Don't register LEDs for genphy
     - nvme: fix misaccounting of nvme-mpath inflight I/O
     - nvmet-tcp: fix callback lock for TLS handshake
     - wifi: cfg80211: remove scan request n_channels counted_by
     - [amd64] hwmon: (corsair-cpro) Validate the size of the received input
       buffer
     - ice: add NULL check in eswitch lag check
     - ice: check correct pointer in fwlog debugfs
     - usb: net: sierra: check for no status endpoint
     - loop: use kiocb helpers to fix lockdep warning
     - [riscv64] Enable interrupt during exception handling
     - [riscv64] traps_misaligned: properly sign extend value in misaligned load
       handler
     - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
     - Bluetooth: hci_sync: fix connectable extended advertising when using
       static random address
     - Bluetooth: SMP: If an unallowed command is received consider it a failure
     - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
     - Bluetooth: hci_core: add missing braces when using macro parameters
     - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant
       without board ID
     - net/mlx5: Correctly set gso_size when LRO is used
     - ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
     - net: fix segmentation after TCP/UDP fraglist GRO
     - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
     - drm/xe/pf: Sanitize VF scratch registers on FLR
     - drm/xe/pf: Move VFs reprovisioning to worker
     - drm/xe/pf: Prepare to stop SR-IOV support prior GT reset
     - Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
     - [amd64,arm64] hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open
       to prevent IPv6 addrconf
     - virtio-net: fix recursived rtnl_lock() during probe()
     - tls: always refresh the queue when reading sock
     - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during
       runtime
     - net: bridge: Do not offload IGMP/MLD messages
     - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
     - rxrpc: Fix recv-recv race of completed call
     - rxrpc: Fix transmission of an abort in response to an abort
     - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen"
     - drm/mediatek: Add wait_event_timeout when disabling plane
     - drm/mediatek: only announce AFBC if really supported
     - libbpf: Fix handling of BPF arena relocations
     - efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths
     - sched: Change nr_uninterruptible type to unsigned long
     - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right
       userns
     - btrfs: fix block group refcount race in
       btrfs_create_pending_block_groups() (CVE-2025-22115)
     - usb: hub: fix detection of high tier USB3 devices behind suspended hubs
     - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime
       pm
     - usb: hub: Fix flushing of delayed work used for post resume purposes
     - usb: hub: Don't try to recover devices lost during warm reset.
     - [arm64] usb: dwc3: qcom: Don't leave BCR asserted
     - [arm64,armhf] i2c: omap: Add support for setting mux
     - [arm64,armhf] i2c: omap: Fix an error handling path in omap_i2c_probe()
     - [arm64,armhf] i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe()
     - [arm64,armhf] i2c: omap: fix deprecated of_property_read_bool() use
     - sched,freezer: Remove unnecessary warning in __thaw_task
     - drm/xe/mocs: Initialize MOCS index early
     - drm/xe: Move page fault init after topology init
     - smb: client: let smbd_post_send_iter() respect the peers max_send_size and
       transmit all data
     - [amd64] iommu/vt-d: Fix misplaced domain_attached assignment
       (Closes: #1109676)
     - [amd64] KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll
       hypercalls
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.41
     - [amd64] x86/traps: Initialize DR7 by writing its architectural reset value
     - Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT
       (CVE-2025-38335)
     - virtio_net: Enforce minimum TX ring size for reliability
     - virtio_ring: Fix error reporting in virtqueue_resize
     - regulator: core: fix NULL dereference on unbind due to stale coupling data
     - [amd64] platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo
       UX8406CA
     - RDMA/core: Rate limit GID cache warning messages
     - [arm64] interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1
       node
     - iio: adc: ad7949: use spi_is_bpw_supported()
     - regmap: fix potential memory leak of regmap_bus
     - [amd64] x86/hyperv: Fix usage of cpu_online_mask to get valid cpu
     - [amd64] platform/x86: Fix initialization order for
       firmware_attributes_class
     - [arm*] staging: vchiq_arm: Make vchiq_shutdown never fail
     - xfrm: state: initialize state_ptrs earlier in xfrm_state_find
     - xfrm: state: use a consistent pcpu_id in xfrm_state_find
     - xfrm: Set transport header to fix UDP GRO handling
     - xfrm: interface: fix use-after-free after changing collect_md xfrm
       interface
     - [arm64] net: ti: icssg-prueth: Fix buffer allocation for ICSSG
     - net/mlx5: Fix memory leak in cmd_exec()
     - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch
     - i40e: report VF tx_dropped with tx_errors instead of tx_discards
     - i40e: When removing VF MAC filters, only check PF-set MAC
     - net: appletalk: Fix use-after-free in AARP proxy probe
     - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in
       qfq_delete_class
     - can: netlink: can_changelink(): fix NULL pointer deref of struct
       can_priv::do_set_mode
     - [arm64] drm/bridge: ti-sn65dsi86: Remove extra semicolon in
       ti_sn_bridge_probe()
     - ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop
     - [s390x] ism: fix concurrency management in ism_cmd()
     - [arm64] net: hns3: fix concurrent setting vlan filter issue
     - [arm64] net: hns3: disable interrupt when ptp init failed
     - [arm64] net: hns3: fixed vf get max channels bug
     - [arm64] net: hns3: default enable tx bounce buffer when smmu enabled
     - [amd64] platform/x86: ideapad-laptop: Fix FnLock not remembered among
       boots
     - [amd64] platform/x86: ideapad-laptop: Fix kbd backlight not remembered
       among boots
     - drm/amdgpu: Reset the clear flag in buddy during resume
     - drm/sched: Remove optimization that causes hang when killing dependent
       jobs
     - mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show()
     - timekeeping: Zero initialize system_counterval when querying time from phc
       drivers
     - [arm64] i2c: qup: jump out of the loop in case of timeout
     - [arm64,armhf] i2c: tegra: Fix reset error handling with ACPI
     - i2c: virtio: Avoid hang by using interruptible completion wait
     - bus: fsl-mc: Fix potential double device reference in
       fsl_mc_get_endpoint()
     - sprintf.h requires stdarg.h
     - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx
     - ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx
     - [arm64] entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()
     - [arm64] dpaa2-eth: Fix device reference count leak in MAC endpoint
       handling
     - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set
     - e1000e: ignore uninitialized checksum word on tgp
     - gve: Fix stuck TX queue for DQ queue format
     - ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
     - nilfs2: reject invalid file types when reading inodes
     - resource: fix false warning in __request_region()
     - mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list
     - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
     - [amd64,arm64] usb: typec: tcpm: allow to use sink in accessory mode
     - [amd64,arm64] usb: typec: tcpm: allow switching to mode accessory to mux
       properly
     - [amd64,arm64] usb: typec: tcpm: apply vbus before data bringup in
       tcpm_src_attach
     - spi: cadence-quadspi: fix cleanup of rx_chan on failure paths
     - [amd64] x86/bugs: Fix use of possibly uninit value in
       amd_check_tsa_microcode()
     - jfs: reject on-disk inodes of an unsupported type (CVE-2025-37925)
     - [amd64] comedi: comedi_test: Fix possible deletion of uninitialized timers
     - [arm64] dts: qcom: x1e78100-t14s: mark l12b and l15b always-on
     - erofs: simplify z_erofs_load_compact_lcluster()
     - erofs: refine z_erofs_get_extent_compressedlen()
     - erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches
     - erofs: simplify tail inline pcluster handling
     - erofs: clean up header parsing for ztailpacking and fragments
     - erofs: fix large fragment handling
     - ext4: don't explicit update times in ext4_fallocate()
     - ext4: refactor ext4_punch_hole()
     - ext4: refactor ext4_zero_range()
     - ext4: refactor ext4_collapse_range()
     - ext4: refactor ext4_insert_range()
     - ext4: factor out ext4_do_fallocate()
     - ext4: move out inode_lock into ext4_fallocate()
     - ext4: move out common parts into ext4_fallocate()
     - ext4: fix incorrect punch max_end
     - ext4: correct the error handle in ext4_fallocate()
     - ext4: fix out of bounds punch offset
     - [amd64] KVM: x86: drop x86.h include from cpuid.h
     - [amd64] KVM: x86: Route non-canonical checks in emulator through
       emulate_ops
     - [amd64] KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical
       checks
     - [amd64] KVM: x86: model canonical checks more precisely
     - [amd64] KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush
       (CVE-2025-38351)
     - [amd64] x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap()
     - [arm64] dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage
     - Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO"
     - wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure
     - iio: hid-sensor-prox: Restore lost scale assignments
     - iio: hid-sensor-prox: Fix incorrect OFFSET calculation
     - [amd64,arm64] Drivers: hv: Make the sysfs node size for the ring buffer
       dynamic
     - ALSA: hda/tegra: Add Tegra264 support
     - ALSA: hda: Add missing NVIDIA HDA codec IDs
     - [amd64] drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x
     - Revert "drm/xe/gt: Update handling of xe_force_wake_get return"
       (Closes: #1109799)
     - Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling"
     - Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return"
     - Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()"
     - [amd64] KVM: x86: Free vCPUs before freeing VM state
     - mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma
 .
   [ Bastian Blank ]
   * Store build time signing key encrypted.
   * Enable CRYPTO_ECDSA.
 .
   [ Aurelien Jarno ]
   * Fix installation of DTB files
 .
   [ Tj ]
   * drivers/gpu/drm/nouveau: Enable DRM_NOUVEAU_GSP_DEFAULT (Closes: #1088522)
 .
   [ Uwe Kleine-König ]
   * [armhf] Add phy-gmii-sel module to nic-shared-modules udeb for
     ti/omap/am335x based machines (e.g. BeagleBone black).
 .
   [ Salvatore Bonaccorso ]
   * d/salsa-ci.yml: Update for trixie: Set RELEASE to trixie

live-boot (1:20250815~deb13u1) trixie; urgency=medium
 .
   * Upload to trixie
 .
 live-boot (1:20250815) unstable; urgency=medium
 .
   [ Roland Clobus ]
   * Don't verify with all checksum files
 .
   [ Luca Boccassi ]
   * Remove live-build's os-release on removal (Closes: #1111039)

live-build (1:20250505+deb13u1) trixie; urgency=medium
 .
   * Remove os-release diversions once rootfs creation is finished
     (Closes: #1111039)
   * Install live-specific os-release only with --system live

mame (0.276+dfsg.1-1+deb13u1) trixie; urgency=medium
 .
   * Build translations explicitly in the -build-indep target.
     Translations have been missing since the build was split
     (closes: #1109978).

mariadb (1:11.8.3-0+deb13u1) trixie; urgency=medium
 .
   * New upstream maintenance release 11.8.3. For details about fixes please see
     https://mariadb.com/kb/en/mariadb-11-8-3-release-notes/
   * Drop Hurd patches that are now included upstream
   * Update configuration traces to include new upstream system variables:
     - analyze-max-length (default: 4294967295)
     - innodb-linux-aio (default: auto)
   * Suppress new native AIO warning introduced in upstream a87bb96 to avoid
     mariadb-test-run failing on something that isn't a real issue
   * New upstream release includes fix for MDEV-36815 that yielded "ERROR 1267
     (HY000): Illegal mix of collations" on some systems when restarting the
     MariaDB service in Debian (Closes: #1104533)
   * Remove obsolete cleanup as upstream moved pam_mariadb_mtr.so in c05b1fe
   * Salsa CI: Remove Buster upgrades and ignore missing Trixie ones
   * Start branch debian/13-trixie for stable updates

mate-sensors-applet (1.26.0-1+deb13u1) trixie; urgency=medium
 .
   [ A Mennucc1 ]
   * NMU to  fix: "Crashes on Trixie", thanks to Gleb Golubitsky
     (Closes: #1100414).

mmdebstrap (1.5.7-1+deb13u1) trixie; urgency=medium
 .
   [ Jochen Sprickerhof ]
   * Support numeric UID in /etc/sub[ug]id
 .
   [ Johannes Schauer Marin Rodrigues ]
   * add test for numeric UID in /etc/sub[ug]id

modemmanager (1.24.0-1+deb13u1) trixie; urgency=medium
 .
   * d/gbp.conf: target stable branch
   * d/patches: backport upstream fix for Fibocom FM350-GL (Closes: #1110197)

mozjs128 (128.14.0-1~deb13u1) trixie; urgency=medium
 .
   * New upstream release (Closes: #1111591)
     - CVE-2025-9181: Uninitialized memory in the JavaScript Engine
       component
     - CVE-2025-9185: Memory safety bugs
   * Branch for trixie

network-manager-openvpn (1.12.3-1~deb13u1) trixie; urgency=medium
 .
   * Switch debian-branch to debian/trixie
   * Rebuild for trixie
network-manager-openvpn (1.12.2-2) unstable; urgency=medium
 .
   * Rename debian-branch to debian/latest as per DEP-14
network-manager-openvpn (1.12.2-1) unstable; urgency=medium
 .
   * New upstream version 1.12.2
   * Bump Standards-Version to 4.7.2

nginx (1.26.3-3+deb13u1) trixie; urgency=medium
 .
   * d/p/CVE-2025-53859.patch add, fix potential information leak
     in ngx_mail_smtp_module (CVE-2025-53859).

node-cipher-base (1.0.4-6+deb13u1) trixie-security; urgency=medium
 .
   * Team upload
   * Add patch to return valid values on multi-byte-wide TypedArray input
     (Closes: #1111772: node-cipher-base: CVE-2025-9287)
node-cipher-base (1.0.4-6+deb12u1) bookworm-security; urgency=medium
 .
   * Team upload
   * Add patch to return valid values on multi-byte-wide TypedArray input
     (Closes: #1111772: node-cipher-base: CVE-2025-9287)

node-tmp (0.2.2+dfsg+~0.2.3-1.1~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie.
 .
 node-tmp (0.2.2+dfsg+~0.2.3-1.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2025-54798: Arbitrary file write (Closes: #1110532)
node-tmp (0.2.2+dfsg+~0.2.3-1.1~deb12u1) bookworm; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for bookworm.
 .
 node-tmp (0.2.2+dfsg+~0.2.3-1.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2025-54798: Arbitrary file write (Closes: #1110532)

open-iscsi (2.1.11-1+deb13u1) trixie; urgency=medium
 .
   * [f3d17cf] initramfs: ensure that /var/lib exists.
     Thanks to Leon Blakey <code@leonblakey.com> (Closes: #1103644)

openjpeg2 (2.5.3-2.1~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie.
 .
 openjpeg2 (2.5.3-2.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * CVE-2025-54874: Out-of-bounds write in opj_jp2_read_header()
     (Closes: #1110443)

orca (48.1-1+deb13u1) trixie; urgency=medium
 .
   * control: Add python3-setproctitle and python3-psutil dependencies.

orphan-sysvinit-scripts (0.21+deb13u1) trixie; urgency=high
 .
   * Make mdadm scripts trigger on mdmonitor.service, mdmon@.service, since
     mdadm.service got removed (Closes: #1110746)

pcre2 (10.46-1~deb13u1) trixie; urgency=high
 .
   * New upstream release to fix CVE-2025-58050 (Closes: #1112278)

postfix (3.10.4-1~deb13u1) trixie; urgency=medium
 .
   * New upstream stable/bugfix version 3.10.4, with a handful of fixes.
     From the upstream release notes:
     - Fixes for postscreen(8):
       * Bugfix (defect introduced: Postfix 2.2, date 20050203): after
         detecting a lookup table change, and after starting a new
         postscreen process, the old postscreen process logged an ENOTSOCK
         error while attempting to accept a connection on a socket that
         it was no longer listening on. This error was introduced first
         in the multi_server skeleton code, and was five years later
         duplicated in the event_server skeleton that was created for
         postscreen. Problem reported by Florian Piekert.
       * Bugfix (defect introduced: Postfix 2.8, date 20101230):
         after detecting a cache table change and before starting a new
         postscreen process, the old postscreen process did not close the
         postscreen_cache_map, and therefore kept an exclusive lock that
         could prevent a new postscreen process from starting. Problem
         reported by Florian Piekert.
     - Fixes for tlsproxy(8):
       * Bugfix (defect introduced: Postfix 3.7): incorrect backwards
         compatible support for the legacy configuration parameters
         tlsproxy_client_level and tlsproxy_client_policy. This
         disabled the tlsproxy TLS client role when a legacy parameter
         was set (instead of the newer tlsproxy_client_security_level
         or tlsproxy_client_policy_maps). Reported by John Doe,
         diagnosed by Viktor Dukhovni.
       * Bugfix (defect introduced: Postfix 3.4): with the TLS client role
         disabled by configuration, the tlsproxy daemon dereferenced a
         null pointer while handling a tlsproxy client request. Reported by
         John Doe.
     - Reducing process churn: Postfix daemons no longer automatically
       restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file
       modification time change, when they opened that table for writing.
     - Portability: deleted an <openssl/engine.h> build dependency,
       because the feature is being removed from OpenSSL, and Postfix
       no longer needs it.
     - Cleanup: with "tls_required_enable = yes", the Postfix SMTP client
       will no longer maintain TLSRPT statistics for messages that contain
       a "TLS-Required: no" header. This can prevent TLSRPT notifications
       for TLSRPT notifications.
     - Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS
       client code logged "Untrusted TLS connection" (wrong) instead of
       "Trusted TLS connection" (right), for a new or resumed TLS session,
       when a server offered a trusted (valid PKI trust chain) certificate
       that did not match the expected server name pattern. Fix by Viktor
       Dukhovni.
   * d/gbp.conf: debian-branch=debian/trixie
   * configure-instance.in: fix typo
   * configure-instance.in: limit maxdepth=1 in /etc/ssl/certs dirs
   * configure-instance.in: use home-grown file copy procedure to sync chroot
     There are a few issues with using cp(1) to update files in chroot, -
     a file should be copied even if the source date is *less* than the
     target date (eg, if a package has been downgraded), which is not done
     by `cp -u` (#1110704), a file should be copied atomically (copy+rename,
     not truncate+copy), and care should be taken with extra attributes
     (#1100100).  Use a simple perl-based script (using just perl-base)
     to update files instead, which fixes all this stuff.
     (Closes: #1100100, #1110704)
postfix (3.10.3-3) unstable; urgency=medium
 .
   * configure-instance.in: fix typo
   * configure-instance.in: limit maxdepth=1 in /etc/ssl/certs dirs
   * configure-instance.in: use home-grown file copy procedure to sync chroot
     There are a few issues with using cp(1) to update files in chroot, -
     a file should be copied even if the source date is *less* than the
     target date (eg, if a package has been downgraded), which is not done
     by `cp -u` (#1110704), a file should be copied atomically (copy+rename,
     not truncate+copy), and care should be taken with extra attributes
     (#1100100).  Use a simple perl-based script (using just perl-base)
     to update files instead, which fixes all this stuff.
     (Closes: #1100100, #1110704)

postgresql-17 (17.6-0+deb13u1) trixie; urgency=medium
 .
   * New upstream version 17.6.
 .
     + Tighten security checks in planner estimation functions (Dean Rasheed)
 .
       The fix for CVE-2017-7484, plus followup fixes, intended to prevent
       leaky functions from being applied to statistics data for columns that
       the calling user does not have permission to read.  Two gaps in that
       protection have been found.  One gap applies to partitioning and
       inheritance hierarchies where RLS policies on the tables should restrict
       access to statistics data, but did not.
 .
       The other gap applies to cases where the query accesses a table via a
       view, and the view owner has permissions to read the underlying table
       but the calling user does not have permissions on the view. The view
       owner's permissions satisfied the security checks, and the leaky
       function would get applied to the underlying table's statistics before
       we check the calling user's permissions on the view.  This has been
       fixed by making security checks on views occur at the start of planning.
       That might cause permissions failures to occur earlier than before.
 .
       The PostgreSQL Project thanks Dean Rasheed for reporting this problem.
       (CVE-2025-8713)
 .
     + Prevent pg_dump scripts from being used to attack the user running the
       restore (Nathan Bossart)
 .
       Since dump/restore operations typically involve running SQL commands as
       superuser, the target database installation must trust the source
       server.  However, it does not follow that the operating system user who
       executes psql to perform the restore should have to trust the source
       server.  The risk here is that an attacker who has gained
       superuser-level control over the source server might be able to cause it
       to emit text that would be interpreted as psql meta-commands. That would
       provide shell-level access to the restoring user's own account,
       independently of access to the target database.
 .
       To provide a positive guarantee that this can't happen, extend psql with
       a \restrict command that prevents execution of further meta-commands,
       and teach pg_dump to issue that before any data coming from the source
       server.
 .
       The PostgreSQL Project thanks Martin Rakhmanov, Matthieu Denais, and
       RyotaK for reporting this problem. (CVE-2025-8714)
 .
     + Convert newlines to spaces in names included in comments in pg_dump
       output (Noah Misch)
 .
       Object names containing newlines offered the ability to inject arbitrary
       SQL commands into the output script.  (Without the preceding fix,
       injection of psql meta-commands would also be possible this way.)
       CVE-2012-0868 fixed this class of problem at the time, but later work
       reintroduced several cases.
 .
       The PostgreSQL Project thanks Noah Misch for reporting this problem.
       (CVE-2025-8715)
 .
   * Add Turkish debconf translation by Atila KOÇ, thanks! (Closes: #1107984)
   * Drop hurd-iovec patch, implemented upstream.

ptyxis (48.5-1~deb13u1) trixie; urgency=medium
 .
   * Team upload
   * d/control, d/gbp.conf: Set branches for trixie stable updates
 .
 ptyxis (48.5-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream bugfix release
     - When saving tab state, if the terminal does not have a title, save the
       tab's initial title instead
       (ptyxis#428 upstream)
     - Use the same code for menu -> Show Open Tabs -> New Tab that was already
       used for Menu -> New Tab, fixing propagation of zoom settings to the
       newly created tab
       (ptyxis#435 upstream)
     - Don't try to chdir() to a working directory that does not have +x
       permission
     - Use g_set_str() for less error-prone property setting
     - Ensure that interface-style action isn't freed prematurely, and
       explicitly remove it when the window is destroyed, fixing a
       possible use-after-free when switching between dark and light modes
       (ptyxis#440 upstream)
   * Standards-Version: 4.7.2 (no changes required)

pyraf (2.2.2-4~deb13u1) trixie; urgency=medium
 .
   * Fix graphical init for work with Python 3.13. Closes: #1110708
   * Upload to stable

qemu (1:10.0.3+ds-0+deb13u1) trixie; urgency=medium
 .
   * new upstream stable/bugfix release:
    - Update version for 10.0.3 release
    - hvf: arm: Emulate ICC_RPR_EL1 accesses properly
    - target/arm: Correct encoding of Debug Communications Channel registers
      https://gitlab.com/qemu-project/qemu/-/issues/2986
    - ui: fix setting client_endian field defaults
    - hw/net/npcm_gmac.c: Send the right data for second packet in a row
    - target/i386: do not expose ARCH_CAPABILITIES on AMD CPU
    - i386/cpu: Honor maximum value for CPUID.8000001DH.EAX[25:14]
    - i386/cpu: Fix overflow of cache topology fields in CPUID.04H
    - i386/cpu: Fix cpu number overflow in CPUID.01H.EBX[23:16]
    - ui/vnc: Do not copy z_stream
    - vhost: Fix used memslot tracking when destroying a vhost device
    - roms: re-remove execute bit from hppa-firmware*
    - file-posix: Fix aio=reads performance regression after enablign FUA
      https://issues.redhat.com/browse/RHEL-96854
    - amd_iommu: Fix truncation of oldval in amdvi_writeq
    - amd_iommu: Remove duplicated definitions
    - amd_iommu: Fix the calculation for Device Table size
    - amd_iommu: Fix mask to retrieve Interrupt Table Root Pointer from DTE
    - amd_iommu: Fix masks for various IOMMU MMIO Registers
    - amd_iommu: Update bitmasks representing DTE reserved fields
    - amd_iommu: Fix Device ID decoding for INVALIDATE_IOTLB_PAGES command
    - amd_iommu: Fix Miscellaneous Information Register 0 encoding
    - virtio-net: Add queues for RSS during migration
    - net: fix buffer overflow in af_xdp_umem_create()
    - accel/kvm: Adjust the note about the minimum required kernel version
    - linux-user: Use qemu_set_cloexec() to mark pidfd as FD_CLOEXEC
    - migration: Don't sync volatile memory after migration completes
    - linux-user: Hold the fd-trans lock across fork
      https://gitlab.com/qemu-project/qemu/-/issues/2846
    - linux-user: Check for EFAULT failure in nanosleep
    - linux-user: Implement fchmodat2 syscall
      https://gitlab.com/qemu-project/qemu/-/issues/3019
    - hw/arm/fsl-imx8mp: Wire VIRQ and VFIQ
    - target/arm: Don't enforce NSE,NS check for EL3->EL3 returns
      https://gitlab.com/qemu-project/qemu/-/issues/3016
    - target/i386: fix TB exit logic in gen_movl_seg() when writing to SS
      https://gitlab.com/qemu-project/qemu/-/issues/2987
    - target/arm: Fix bfdotadd_ebf vs nan selection
    - target/arm: Fix f16_dotadd vs nan selection
    - target/arm: Fix PSEL size operands to tcg_gen_gvec_ands
    - target/arm: Fix 128-bit element ZIP, UZP, TRN
    - target/arm: Fix sve_access_check for SME
    - target/arm: Fix SME vs AdvSIMD exception priority
    - hw/s390x/ccw-device: Fix memory leak in loadparm setter
    - virtio-gpu: support context init multiple timeline
    - target/arm: Correct KVM & HVF dtb_compatible value
    - target/arm: Make RETA[AB] UNDEF when pauth is not implemented
    - tcg: Fix constant propagation in tcg_reg_alloc_dup
      https://gitlab.com/qemu-project/qemu/-/issues/3002
    - target/loongarch: fix vldi/xvldi raise wrong error
    - target/loongarch: add check for fcond
    - linux-user/arm: Fix return value of SYS_cacheflush
    - hw/arm/mps2: Configure the AN500 CPU with 16 MPU regions
    - qemu-options.hx: Fix reversed description of icount sleep behavior
    - hw/arm/virt: Check bypass iommu is not set for iommu-map DT property
    - hw/loongarch/virt: Fix big endian support with MCFG table
    - hw/core/qdev-properties-system: Add missing return in set_drive_helper()
    - iotests: fix 240
    - target/i386: Remove FRED dependency on WRMSRNS
    - hw/audio/asc: fix SIGSEGV in asc_realize()
    - audio: fix size calculation in AUD_get_buffer_size_out()
    - audio: fix SIGSEGV in AUD_get_buffer_size_out()
    - hw/i386/amd_iommu: Fix xtsup when vcpus < 255
    - hw/i386/amd_iommu: Fix device setup failure when PT is on.
    - hw/i386/pc_piix: Fix RTC ISA IRQ wiring of isapc machine
    - vhost: Don't set vring call if guest notifier is unused
    - hw/arm: Add missing psci_conduit to NPCM8XX SoC boot info
    - ui/vnc: fix tight palette pixel encoding for 8/16-bpp formats
    - ui/vnc: take account of client byte order in pixman format
    - ui/vnc.c: replace big endian flag with byte order value
    - ui/sdl: Consider scaling in mouse event handling
    - ui/gtk: Update scales in fixed-scale mode when rendering GL area
    - gtk/ui: Introduce helper gd_update_scale
    - ui/gtk: Use consistent naming for variables in different coordinates
    - ui/gtk: Document scale and coordinate handling
    - hw/arm/aspeed_ast27x0: Fix RAM size detection failure on BE hosts
    - hw/misc/aspeed_hace: Ensure HASH_IRQ is always set
      to prevent firmware hang
   * d/control.mk: 10.0.3+ds
   * d/gbp.conf: switch to debian/trixie branch
   * d/watch: switch to 10.0.x branch
   * qemu-img-options.patch: adjust help text for "convert" subcommand
     This patch has been accepted upstrem but without the new option, -
     do not mention it in help so debian users don't get used to it
     (the option is accepted still)
   * d/rules: fix typo in comment (it is qemu-system-data, not qemu-user-data)
   * d/qemu-user.postinst: trigger /usr/lib/binfmt.d (Closes: #1110982)
qemu (1:10.0.2+ds-2+deb13u1) trixie-security; urgency=medium
 .
   * d/binfmt-install: stop using C (Credentials) flag for binfmt_misc
     registration.  qemu-user binaries were never meant to be used in
     suid/sgid scenarios, but was used in debian since late 2009.  Any
     foreign suid/sgid binary accessible to the users, in presence of
     qemu-user binfmt, is trivially exploitable to gain elevated privileges.
     This change might break existing setups since for many years people
     relied on qemu-user binfmt working with suid binaries, but this is
     a situation where it is definitely better be safe than sorry.
   * pcie_sriov-Fix-configuration-and-state-synchronizati.patch
     (Closes: #1109989, CVE-2025-54566, CVE-2025-54567)
qemu (1:10.0.2+ds-2+deb13u1~bpo12+1) bookworm-backports; urgency=medium
 .
   * Rebuild for bookworm-backports:
     - disable libblkio
     - realize pkg.qemu.use-upstream-vdso build profile
     - disable capstone for qemu-user on arm64 (fails to link)

rabbitmq-server (4.0.5-6+deb13u1) trixie; urgency=medium
 .
   * Fix rabbitmq-server broken plugin versions by applying patch from the BTS.
     Thanks to Stefan Bühler <stefan.buehler@tik.uni-stuttgart.de> for it
     (Closes: #1110519).
 .
   [ Andreas Hasenack ]
   * Add many autopkgtest.

remind (05.03.07-1+deb13u1) trixie; urgency=medium
 .
   * fixes buffer overflow in DUMPVARS (Closes: #1111581)

renpy (8.3.4+dfsg-2+deb13u1) trixie; urgency=medium
 .
   * Fix fonts-roboto -> fonts-robot-hinted breakage (Closes: #1111365)

resource-agents (1:4.16.0-3+deb13u1) trixie; urgency=medium
 .
   * debian/patches: fix to avoid duplicate route issues (Closes: #1109925)

rkward (0.8.0-4.1~deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload.
   * Rebuild for trixie.
 .
 rkward (0.8.0-4.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * Backport upstream fixes for R 4.5. (Closes: #1103204)
 .
 rkward (0.8.0-4) unstable; urgency=medium
 .
   * Team upload.
   * Bump Standards-Version to 4.7.2, no changes required.
   * Simplify GPL license text in debian/copyright.
   * Use the system version of kdsingleapplication:
     - backport upstream commit 997c8a7280fe0f99a29465f67b56fd001cdac4e1; patch
       upstream_Make-it-possible-to-build-against-system-kdsingleapp.patch
     - add the libkdsingleapplication-qt6-dev build dependency
rkward (0.8.0-4) unstable; urgency=medium
 .
   * Team upload.
   * Bump Standards-Version to 4.7.2, no changes required.
   * Simplify GPL license text in debian/copyright.
   * Use the system version of kdsingleapplication:
     - backport upstream commit 997c8a7280fe0f99a29465f67b56fd001cdac4e1; patch
       upstream_Make-it-possible-to-build-against-system-kdsingleapp.patch
     - add the libkdsingleapplication-qt6-dev build dependency

samba (2:4.22.4+dfsg-1~deb13u1) trixie; urgency=medium
 .
   * new upstream stable/bugfix release:
    - https://bugzilla.samba.org/show_bug.cgi?id=14981:
      netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with SysvolReady=0
    - https://bugzilla.samba.org/show_bug.cgi?id=15663:
      Apparently there is a conflict between shadow_copy2 module
      and virusfilter (action quarantine)
    - https://bugzilla.samba.org/show_bug.cgi?id=15816:
      vfs_streams_depot fstatat broken
    - https://bugzilla.samba.org/show_bug.cgi?id=15840:
      kinit command is failing with Missing cache Error
    - https://bugzilla.samba.org/show_bug.cgi?id=15844:
      getpwuid does not shift to new DC when current DC is down
    - https://bugzilla.samba.org/show_bug.cgi?id=15876:
      Windows security hardening locks out schannel'ed
      netlogon dc calls like netr_DsRGetDCName
    - https://bugzilla.samba.org/show_bug.cgi?id=15877:
      Fix handling of empty GPO link
    - https://bugzilla.samba.org/show_bug.cgi?id=15880:
      SMB ACL inheritance doesn't work for files created
    - https://bugzilla.samba.org/show_bug.cgi?id=15881:
      Unresponsive second DC can cause idmapping failure when using idmap_ad
      (was libads-fix-get_kdc_ip_string.patch)
    - https://bugzilla.samba.org/show_bug.cgi?id=15891:
      Figuring out the DC name from IP address fails
      and breaks fork_domain_child()
    - https://bugzilla.samba.org/show_bug.cgi?id=15892:
      Delayed leader broadcast can block ctdb forever
   * libads-fix-get_kdc_ip_string.patch: remove, included upstream
   * d/gbp.conf: debian-branch=debian/4.22

sbuild (0.89.3+deb13u1) trixie; urgency=medium
 .
   [ Richard Lewis ]
   * man/sbuild.1.in: fix typo in markup
 .
   [ Hiraku Toyooka ]
   * Allow BUILD_PATH being empty also in command line options
 .
   [ Jochen Sprickerhof ]
   * Fix typo in help string
   * Support UID in /etc/sub(u|g)id (Closes: #1110876)
   * Fix build path permissions when building as root
   * Always append newline in binNMU changelog.
     Thanks to mjt (Closes: #1111776)

shaarli (0.14.0+dfsg-2) trixie; urgency=medium
 .
   * Add patch to fix CVE-2025-55291 (Closes: #1111589)

sound-theme-freedesktop (0.8-6~deb13u1) trixie; urgency=medium
 .
   * Team upload
   * d/control, d/gbp.conf: Branch for trixie
   * Rebuild for trixie
sound-theme-freedesktop (0.8-5) experimental; urgency=medium
 .
   * debian/sound-theme-freedesktop.links:
     - Link front-center sample to audio-channel-mono so that testing a mono
       bluetooth speaker plays a real sound rather than just white noise.
       (LP #1703946)

strongswan (6.0.1-6+deb13u1) trixie; urgency=medium
 .
   * d/patches: add patches to fix OpenSSL 3.5.1 support (Closes: #1109942)

systemd (257.8-1~deb13u1) trixie; urgency=medium
 .
   * ukify: recommend sbsigntool | pesign for signing (Closes: #1108803)
   * Move bootctl zsh completion file too to new package
   * systemd-boot-tools: change architecture to linux-any. The tool can be
     used for cross-building, and it's available on all architectures, not
     just EFI ones
   * systemd-boot: fix initramfs post-update hook for uncompressed kernels
     (Closes: #1109098)
   * systemd-boot: register interest in systemd-boot-signed trigger
     (Closes: #1109984)
   * NEWS: fix typo (Closes: #1109979)
   * systemd-boot: fix registering/removing uncompressed kernels
   * d/t/control: prefer systemd-boot-tools if available
   * Update upstream source from tag 'upstream/257.8' Update to upstream
     version '257.8' with Debian dir
     7153da4dd3bde82b88c5f48d704826e431373076

systemd-boot-efi-amd64-signed (257.8+1~deb13u1) trixie; urgency=high
 .
   * Sign EFI binaries from systemd-boot-efi 257.8-1~deb13u1
 .
   * ukify: recommend sbsigntool | pesign for signing (Closes: #1108803)
   * Move bootctl zsh completion file too to new package
   * systemd-boot-tools: change architecture to linux-any. The tool can be
     used for cross-building, and it's available on all architectures, not
     just EFI ones
   * systemd-boot: fix initramfs post-update hook for uncompressed kernels
     (Closes: #1109098)
   * systemd-boot: register interest in systemd-boot-signed trigger
     (Closes: #1109984)
   * NEWS: fix typo (Closes: #1109979)
   * systemd-boot: fix registering/removing uncompressed kernels
   * d/t/control: prefer systemd-boot-tools if available
   * Update upstream source from tag 'upstream/257.8' Update to upstream
     version '257.8' with Debian dir
     7153da4dd3bde82b88c5f48d704826e431373076

systemd-boot-efi-arm64-signed (257.8+1~deb13u1) trixie; urgency=high
 .
   * Sign EFI binaries from systemd-boot-efi 257.8-1~deb13u1
 .
   * ukify: recommend sbsigntool | pesign for signing (Closes: #1108803)
   * Move bootctl zsh completion file too to new package
   * systemd-boot-tools: change architecture to linux-any. The tool can be
     used for cross-building, and it's available on all architectures, not
     just EFI ones
   * systemd-boot: fix initramfs post-update hook for uncompressed kernels
     (Closes: #1109098)
   * systemd-boot: register interest in systemd-boot-signed trigger
     (Closes: #1109984)
   * NEWS: fix typo (Closes: #1109979)
   * systemd-boot: fix registering/removing uncompressed kernels
   * d/t/control: prefer systemd-boot-tools if available
   * Update upstream source from tag 'upstream/257.8' Update to upstream
     version '257.8' with Debian dir
     7153da4dd3bde82b88c5f48d704826e431373076

thunar (4.20.2-1+deb13u1) trixie; urgency=medium
 .
   * d/patches: add fix to always warn users before permanente deletion
     (Closes: #1110905)

thunderbird (1:128.14.0esr-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security
thunderbird (1:128.14.0esr-1~deb12u1) bookworm-security; urgency=medium
 .
   * Rebuild for bookworm-security

timescaledb (2.19.3+dfsg-1+deb13u1) trixie; urgency=medium
 .
   * Disable append test, fails with PG 17.6. (Closes: #1112190)

transmission (4.1.0~beta2+dfsg-3+deb13u1) trixie; urgency=medium
 .
   * fix GTK app crash when LANG=fr (Closes: #1108194, #1110257)

tzdata (2025b-4+deb13u1) trixie; urgency=medium
 .
   * Backport leap second update from upstream

udisks2 (2.10.1-12.1+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * udiskslinuxmanager: Add lower bounds check to fd_index (CVE-2025-8067)

webkit2gtk (2.48.5-1~deb13u1) trixie-security; urgency=medium
 .
   * Rebuild for trixie-security.
webkit2gtk (2.48.5-1~deb12u1) bookworm-security; urgency=medium
 .
   * Rebuild for bookworm-security.
   * Disable sysprof profiling integration to avoid new dependencies:
     - debian/control.in: Don't depend on libsysprof-capture-4-dev.
     - debian/rules: Build with -DUSE_SYSPROF_CAPTURE=OFF.
   * Disable JPEG XL to avoid adding new dependencies.
     - debian/control.in: Remove build dependency on libjxl-dev.
     - debian/rules: Build with -DUSE_JPEGXL=OFF.
   * debian/rules:
     - Enable ENABLE_SOUP2 and USE_OLD_PKG_NAMES to keep using the old
       package names.
   * debian/control-common.in:
     - Make the -dev packages depend on the gir packages.
   * debian/control.in:
     - Build depend on ccache.
   * Use clang-16 instead of clang.

wolfssl (5.7.2-0.1+deb13u1) trixie; urgency=medium
 .
   * Fix CVE-2025-7394: weak/predictable random numbers. (Closes: #1109549)
=========================================================================
[Date: Sat, 06 Sep 2025 08:59:27 -0000] [ftpmaster: Archive Administrator]
Removed the following packages from stable:

      guix |    1.4.0-9 | source, amd64, arm64, armhf, i386, ppc64el, riscv64
Closed bugs: 1112248

------------------- Reason -------------------
RoM; unsupportable; security issues
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 06 Sep 2025 09:13:06 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

btrfs-modules-6.12.41+deb13-s390x-di |  6.12.41-1 | s390x
cdrom-core-modules-6.12.41+deb13-s390x-di |  6.12.41-1 | s390x
crypto-dm-modules-6.12.41+deb13-s390x-di |  6.12.41-1 | s390x
crypto-modules-6.12.41+deb13-s390x-di |  6.12.41-1 | s390x
dasd-extra-modules-6.12.41+deb13-s390x-di |  6.12.41-1 | s390x
dasd-modules-6.12.41+deb13-s390x-di |  6.12.41-1 | s390x
ext4-modules-6.12.41+deb13-s390x-di |  6.12.41-1 | s390x
f2fs-modules-6.12.41+deb13-s390x-di |  6.12.41-1 | s390x
fat-modules-6.12.41+deb13-s390x-di |  6.12.41-1 | s390x
isofs-modules-6.12.41+deb13-s390x-di |  6.12.41-1 | s390x
kernel-image-6.12.41+deb13-s390x-di |  6.12.41-1 | s390x
linux-headers-6.12.41+deb13-s390x |  6.12.41-1 | s390x
linux-image-6.12.41+deb13-s390x |  6.12.41-1 | s390x
linux-image-6.12.41+deb13-s390x-dbg |  6.12.41-1 | s390x
loop-modules-6.12.41+deb13-s390x-di |  6.12.41-1 | s390x
md-modules-6.12.41+deb13-s390x-di |  6.12.41-1 | s390x
mtd-core-modules-6.12.41+deb13-s390x-di |  6.12.41-1 | s390x
multipath-modules-6.12.41+deb13-s390x-di |  6.12.41-1 | s390x
nbd-modules-6.12.41+deb13-s390x-di |  6.12.41-1 | s390x
nic-modules-6.12.41+deb13-s390x-di |  6.12.41-1 | s390x
scsi-core-modules-6.12.41+deb13-s390x-di |  6.12.41-1 | s390x
scsi-modules-6.12.41+deb13-s390x-di |  6.12.41-1 | s390x
udf-modules-6.12.41+deb13-s390x-di |  6.12.41-1 | s390x
xfs-modules-6.12.41+deb13-s390x-di |  6.12.41-1 | s390x

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 06 Sep 2025 09:13:19 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

ata-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
btrfs-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
cdrom-core-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
crypto-dm-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
crypto-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
drm-core-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
ext4-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
f2fs-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
fat-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
fb-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
input-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
isofs-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
jfs-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
kernel-image-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
linux-headers-6.12.41+deb13-riscv64 |  6.12.41-1 | riscv64
linux-image-6.12.41+deb13-riscv64 |  6.12.41-1 | riscv64
linux-image-6.12.41+deb13-riscv64-dbg |  6.12.41-1 | riscv64
loop-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
md-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
mmc-core-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
mmc-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
mtd-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
multipath-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
nbd-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
nic-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
nic-shared-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
nic-usb-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
nic-wireless-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
pata-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
ppp-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
sata-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
scsi-core-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
scsi-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
scsi-nic-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
squashfs-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
udf-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
usb-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
usb-serial-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
usb-storage-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64
xfs-modules-6.12.41+deb13-riscv64-di |  6.12.41-1 | riscv64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 06 Sep 2025 09:13:45 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

linux-headers-6.12.41+deb13-amd64 |  6.12.41-1 | amd64
linux-headers-6.12.41+deb13-cloud-amd64 |  6.12.41-1 | amd64
linux-headers-6.12.41+deb13-rt-amd64 |  6.12.41-1 | amd64
linux-image-6.12.41+deb13-amd64-dbg |  6.12.41-1 | amd64
linux-image-6.12.41+deb13-amd64-unsigned |  6.12.41-1 | amd64
linux-image-6.12.41+deb13-cloud-amd64-dbg |  6.12.41-1 | amd64
linux-image-6.12.41+deb13-cloud-amd64-unsigned |  6.12.41-1 | amd64
linux-image-6.12.41+deb13-rt-amd64-dbg |  6.12.41-1 | amd64
linux-image-6.12.41+deb13-rt-amd64-unsigned |  6.12.41-1 | amd64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 06 Sep 2025 09:14:18 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

linux-kbuild-6.12.41+deb13 |  6.12.41-1 | amd64, arm64, armel, armhf, i386, ppc64el, riscv64, s390x

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 06 Sep 2025 09:14:36 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

linux-headers-6.12.41+deb13-arm64 |  6.12.41-1 | arm64
linux-headers-6.12.41+deb13-arm64-16k |  6.12.41-1 | arm64
linux-headers-6.12.41+deb13-cloud-arm64 |  6.12.41-1 | arm64
linux-headers-6.12.41+deb13-rt-arm64 |  6.12.41-1 | arm64
linux-image-6.12.41+deb13-arm64-16k-dbg |  6.12.41-1 | arm64
linux-image-6.12.41+deb13-arm64-16k-unsigned |  6.12.41-1 | arm64
linux-image-6.12.41+deb13-arm64-dbg |  6.12.41-1 | arm64
linux-image-6.12.41+deb13-arm64-unsigned |  6.12.41-1 | arm64
linux-image-6.12.41+deb13-cloud-arm64-dbg |  6.12.41-1 | arm64
linux-image-6.12.41+deb13-cloud-arm64-unsigned |  6.12.41-1 | arm64
linux-image-6.12.41+deb13-rt-arm64-dbg |  6.12.41-1 | arm64
linux-image-6.12.41+deb13-rt-arm64-unsigned |  6.12.41-1 | arm64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 06 Sep 2025 09:14:50 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

linux-headers-6.12.41+deb13-rpi |  6.12.41-1 | armel
linux-image-6.12.41+deb13-rpi |  6.12.41-1 | armel
linux-image-6.12.41+deb13-rpi-dbg |  6.12.41-1 | armel

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 06 Sep 2025 09:15:02 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

ata-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
btrfs-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
cdrom-core-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
crypto-dm-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
crypto-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
drm-core-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
ext4-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
f2fs-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
fat-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
fb-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
input-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
isofs-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
jfs-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
kernel-image-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
linux-headers-6.12.41+deb13-armmp |  6.12.41-1 | armhf
linux-headers-6.12.41+deb13-armmp-lpae |  6.12.41-1 | armhf
linux-headers-6.12.41+deb13-rt-armmp |  6.12.41-1 | armhf
linux-image-6.12.41+deb13-armmp |  6.12.41-1 | armhf
linux-image-6.12.41+deb13-armmp-dbg |  6.12.41-1 | armhf
linux-image-6.12.41+deb13-armmp-lpae |  6.12.41-1 | armhf
linux-image-6.12.41+deb13-armmp-lpae-dbg |  6.12.41-1 | armhf
linux-image-6.12.41+deb13-rt-armmp |  6.12.41-1 | armhf
linux-image-6.12.41+deb13-rt-armmp-dbg |  6.12.41-1 | armhf
loop-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
md-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
mmc-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
mtd-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
multipath-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
nbd-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
nic-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
nic-shared-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
nic-usb-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
nic-wireless-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
pata-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
ppp-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
sata-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
scsi-core-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
scsi-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
scsi-nic-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
sound-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
speakup-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
squashfs-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
udf-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
uinput-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
usb-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
usb-serial-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf
usb-storage-modules-6.12.41+deb13-armmp-di |  6.12.41-1 | armhf

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 06 Sep 2025 09:15:17 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

ata-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
btrfs-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
cdrom-core-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
crypto-dm-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
crypto-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
drm-core-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
ext4-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
f2fs-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
fat-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
fb-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
firewire-core-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
hypervisor-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
input-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
isofs-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
jfs-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
kernel-image-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
linux-headers-6.12.41+deb13-powerpc64le |  6.12.41-1 | ppc64el
linux-headers-6.12.41+deb13-powerpc64le-64k |  6.12.41-1 | ppc64el
linux-image-6.12.41+deb13-powerpc64le |  6.12.41-1 | ppc64el
linux-image-6.12.41+deb13-powerpc64le-64k |  6.12.41-1 | ppc64el
linux-image-6.12.41+deb13-powerpc64le-64k-dbg |  6.12.41-1 | ppc64el
linux-image-6.12.41+deb13-powerpc64le-dbg |  6.12.41-1 | ppc64el
loop-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
md-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
mtd-core-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
multipath-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
nbd-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
nic-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
nic-shared-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
nic-usb-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
nic-wireless-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
ppp-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
sata-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
scsi-core-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
scsi-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
scsi-nic-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
serial-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
squashfs-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
udf-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
uinput-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
usb-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
usb-serial-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
usb-storage-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el
xfs-modules-6.12.41+deb13-powerpc64le-di |  6.12.41-1 | ppc64el

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 06 Sep 2025 09:15:33 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

ata-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
btrfs-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
cdrom-core-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
crypto-dm-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
crypto-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
drm-core-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
ext4-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
f2fs-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
fat-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
fb-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
firewire-core-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
input-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
isofs-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
jfs-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
kernel-image-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
linux-image-6.12.41+deb13-amd64 |  6.12.41-1 | amd64
linux-image-6.12.41+deb13-cloud-amd64 |  6.12.41-1 | amd64
linux-image-6.12.41+deb13-rt-amd64 |  6.12.41-1 | amd64
loop-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
md-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
mmc-core-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
mmc-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
mtd-core-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
multipath-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
nbd-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
nic-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
nic-pcmcia-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
nic-shared-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
nic-usb-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
nic-wireless-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
pata-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
pcmcia-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
pcmcia-storage-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
ppp-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
rfkill-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
sata-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
scsi-core-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
scsi-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
scsi-nic-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
serial-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
sound-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
speakup-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
squashfs-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
udf-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
uinput-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
usb-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
usb-serial-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
usb-storage-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64
xfs-modules-6.12.41+deb13-amd64-di |  6.12.41-1 | amd64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux-signed-amd64)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 06 Sep 2025 09:15:46 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

ata-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
btrfs-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
cdrom-core-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
crypto-dm-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
crypto-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
ext4-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
f2fs-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
fat-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
fb-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
input-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
isofs-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
jfs-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
kernel-image-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
linux-image-6.12.41+deb13-arm64 |  6.12.41-1 | arm64
linux-image-6.12.41+deb13-arm64-16k |  6.12.41-1 | arm64
linux-image-6.12.41+deb13-cloud-arm64 |  6.12.41-1 | arm64
linux-image-6.12.41+deb13-rt-arm64 |  6.12.41-1 | arm64
loop-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
md-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
mmc-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
multipath-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
nbd-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
nic-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
nic-shared-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
nic-usb-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
nic-wireless-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
ppp-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
sata-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
scsi-core-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
scsi-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
scsi-nic-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
sound-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
speakup-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
squashfs-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
udf-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
uinput-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
usb-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
usb-serial-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
usb-storage-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64
xfs-modules-6.12.41+deb13-arm64-di |  6.12.41-1 | arm64

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux-signed-arm64)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 06 Sep 2025 09:16:14 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

linux-headers-6.12.41+deb13-common |  6.12.41-1 | all
linux-headers-6.12.41+deb13-common-rt |  6.12.41-1 | all
linux-support-6.12.41+deb13 |  6.12.41-1 | all

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by linux - based on source metadata)
----------------------------------------------
=========================================================================
=========================================================================
[Date: Sat, 06 Sep 2025 09:18:47 -0000] [ftpmaster: Joerg Jaspert]
Removed the following packages from stable:

debian-installer-13-netboot-mips64el |   20250515 | all

------------------- Reason -------------------
[auto-cruft] NBS (no longer built by debian-installer-netboot-images - based on source metadata)
----------------------------------------------
=========================================================================
=======================================
Sat, 09 Aug 2025 - Debian 13.0 released
=======================================