Linux kernel.

f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer()

• Linux kernel

drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()

• Linux kernel

drm/amdgpu: avoid force-completing uninitialized UVD rings

• Linux kernel

drm/panthor: harden firmware build-info bounds checks

• Linux kernel

drm/panthor: fix firmware control interface bounds checks

• Linux kernel

drm/panel-edp: fix i2c adapter leak on probe failure

• Linux kernel

drm: fix race between partial drm_dev_register() failure and ioctl

• Linux kernel

drm/i915: Guard against NULL driver_data in i915_pci_probe()

• Linux kernel

drm/amd/display: avoid divide-by-zero in __is_lut_linear()

• Linux kernel

drm/amd/display: fix dc_lock leak on GPU reset error paths

• Linux kernel

drm/amd/display: validate plane degamma LUT size for private color prop

• Linux kernel

drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check

• Linux kernel

drm/gud: NUL-terminate TV mode names read from the device

• Linux kernel

drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used

• Linux kernel

drm/ttm: Drop tt->restore after successful restore

• Linux kernel

drm/amdgpu: clamp the isolation index for rings outside a partition

• Linux kernel

drm/amdgpu: force complete the KIQ ring fences on reset

• Linux kernel

drm/amdgpu: force complete the MES ring fences on reset

• Linux kernel

drm/amdkfd: Add TLB flush after MES queue eviction/suspension

• Linux kernel

drm/amdkfd: Fix error path at svm_migrate_copy_to_ram

• Linux kernel

drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds

• Linux kernel

drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram

• Linux kernel

drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore

• Linux kernel

drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation

• Linux kernel

drm/pagemap: Fix folio allocation fallback and use-after-put

• Linux kernel

drm/nouveau/dmem: fix mismatched DMA unmap size for large folios

• Linux kernel

drm/nouveau: unsubscribe the channel-kill event before the fence context

• Linux kernel

drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op

• Linux kernel

drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE

• Linux kernel

drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE

• Linux kernel

bpf: Disable preemption in bpf_get_stackid

• Linux kernel

rpcrdma: arm rn_done before publishing the notification

• Linux kernel

power: supply: ab8500_fg: fix use-after-free on remove

• Linux kernel

mm/damon/core: avoid infinite kdamond_merge_regions() internal loop

• Linux kernel

PCI: Allow per function PCI slots to fix slot reset on s390

• Linux kernel

ksmbd: zero pipe read compound padding

• Linux kernel

ublk: clear VM_MAYWRITE on read-only ublk char device mmap

• Linux kernel

ksmbd: prevent out-of-bounds reads in share config responses

• Linux kernel

perf: Fix use-after-free when perf mmap() revival races with the last munmap()

• Linux kernel

ipv6: avoid divide by zero in rt6_multipath_rebalance

• Linux kernel

gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free

• Linux kernel

ksmbd: fix tree connection use-after-free in smb2_tree_connect()

• Linux kernel

ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()

• Linux kernel

ext4: fix out-of-bounds read in ext4_read_inline_dir()

• Linux kernel

fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init

• Linux kernel

SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6

• Linux kernel

xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full

• Linux kernel

fs/ntfs3: reject restart table growth beyond U16_MAX entries

• Linux kernel

fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()

• Linux kernel

net: qualcomm: rmnet: restore skb->dev on deaggregated frames

• Linux kernel

fs/ntfs3: validate ef->size covers the record's name and value

• Linux kernel

isofs: fix out-of-bounds page array access on empty zisofs block

• Linux kernel

vfio/pci: clear vdev->msi_perm after freeing it on init failure

• Linux kernel

vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes

• Linux kernel

KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation

• Linux kernel

Bluetooth: SCO: hold sk properly in sco_conn_ready

• Linux kernel

drm/amd/display: Skip Update HDCP Config In Transition State

• Linux kernel

btrfs: write-protect folios during data writeback

• Linux kernel

ring-buffer: Fix subbuf resize race with ring buffer readers

• Linux kernel

iomap: don't free integrity payload that doesn't exist

• Linux kernel