-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 24 Aug 2026 22:05:50 +0200 Source: linux Binary: bpftool bpftool-dbgsym libcpupower-dev libcpupower1 libcpupower1-dbgsym linux-config-6.12 linux-cpupower linux-cpupower-dbgsym linux-headers-6.12.105+deb13-rpi linux-headers-rpi linux-image-6.12.105+deb13-rpi linux-image-6.12.105+deb13-rpi-dbg linux-image-rpi linux-image-rpi-dbg linux-kbuild-6.12.105+deb13 linux-kbuild-6.12.105+deb13-dbgsym linux-perf linux-perf-dbgsym usbip usbip-dbgsym Architecture: armel Version: 6.12.105-1 Distribution: trixie-security Urgency: high Maintainer: armel Build Daemon (arm-ubc-03) Changed-By: Salvatore Bonaccorso Description: bpftool - Inspection and simple manipulation of BPF programs and maps libcpupower-dev - CPU frequency and voltage scaling tools for Linux (development fi libcpupower1 - CPU frequency and voltage scaling tools for Linux (libraries) linux-config-6.12 - Debian kernel configurations for Linux 6.12 linux-cpupower - CPU power management tools for Linux linux-headers-6.12.105+deb13-rpi - Header files for Linux 6.12.105+deb13-rpi linux-headers-rpi - Header files for Linux rpi configuration (meta-package) linux-image-6.12.105+deb13-rpi - Linux 6.12 for Raspberry Pi Zero, Zero W and 1 linux-image-6.12.105+deb13-rpi-dbg - Debug symbols for linux-image-6.12.105+deb13-rpi linux-image-rpi - Linux for Raspberry Pi Zero, Zero W and 1 (meta-package) linux-image-rpi-dbg - Debugging symbols for Linux rpi configuration (meta-package) linux-kbuild-6.12.105+deb13 - Kbuild infrastructure for Linux 6.12.105+deb13 linux-perf - Performance analysis tools for Linux usbip - USB device sharing system over IP network Closes: 1142912 1143545 Changes: linux (6.12.105-1) trixie-security; urgency=high . * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.102 - [amd64] x86/bugs: Make Safe-RET robust against interrupt injection (CVE-2026-68480) https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.103 - netfilter: nf_conntrack_expect: restore helper propagation via expectation - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() - net: mpls: initialize rtm_tos in mpls_getroute() - HID: logitech-dj: Standardise hid_report_enum variable nomenclature - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report - bpf: Reset register bounds before narrowing retval range in check_mem_access() - netconsole: avoid OOB reads, msg is not nul-terminated (CVE-2026-43197) - [amd64] thunderbolt: Prevent XDomain delayed work use-after-free on disconnect - [arm64] pinctrl: qcom: Unconditionally mark gpio as wakeup enable - [arm64] pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA - [amd64] dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() - gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() - ata: sata_mv: accept 1 or 2 resources in platform probe - ata: libahci_platform: support non-consecutive port numbers - ahci: Introduce ahci_ignore_port() helper - ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup - of: reserved_mem: Add code to dynamically allocate reserved_mem array - of: reserved_mem: prevent OOB when too many dynamic regions are defined - btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag - btrfs: zoned: fix deadlock between metadata writeback and transaction commit - [arm64] phy-zynqmp: Postpone getting clock rate until actually needed - [arm64] phy: zynqmp: fix clock error handling in xpsgtr_phy_init() - [arm64] phy: zynqmp: fix runtime PM leak on probe allocation failure - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() - [arm64] drm/mediatek: Check CRTC state before freeing - Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation - KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type - keys: fix out-of-bounds read in keyring_get_key_chunk() - keys: make keyring key-chunk byte order agree with keyring_diff_objects() - assoc_array: trim the final shortcut word using the current chunk end - netfilter: nf_tables: make nft_object rhltable per table - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH - ipvs: fix the checksum validations - ipvs: fix places with wrong packet offsets - ipvs: do not mangle ICMP replies for non-first fragments - netfilter: nft_payload: fix mask build for partial field offload - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (CVE-2026-68322) - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() - [amd64,arm64] pinctrl-amd: Don't clear S4 wake bits at probe - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race - smb: client: fix buffer leaks in SMB1 read and write - spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 - spi: spi-cadence: Move TX FIFO full busy-wait into FIFO - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 - hwmon: (ina2xx) Add support for has_alerts configuration flag - hwmon: (ina2xx) Add support for INA260 - hwmon: (ina226) Add support for SY24655 - hwmon: (ina2xx) Make it easier to add more devices - hwmon: (ina2xx) Add support for INA234 - hwmon: (ina2xx) Shift INA234 shunt and current registers - hwmon: (ina2xx) Fix various overflow issues - hwmon: (ltc4282) Fix reading the minimum alarm voltage - hwmon: (sht3x) Fix unaligned accesses - hwmon: (lm90) Only report alarms if driver is ready - hwmon: (nzxt-smart2) DMA-align output buffer - net: do not send ICMP/NDISC Redirects when peer allocation fails - hwmon: (nct6775-core) Prevent access to unsupported weight registers - net: bridge: mrp: fix Option TLV length in MRP_Test frames - forcedeth: fix UAF of txrx_stats in nv_remove - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors - hwmon: (adt7470) Fix cache updated before hardware write on I2C error - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks - hwmon: (adt7470) Use cached PWM frequency value - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read - hwmon: (adt7470) Fix PWM auto temp state array and bounds check - rtase: fix double free of multi-frag skb on DMA map failure - [powerpc*] boot: Fix simpleboot CPU node lookup check - [powerpc*] boot: Fix treeboot-currituck CPU node lookup check - [powerpc*] boot: Fix treeboot-akebono CPU node lookup check - net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() - wifi: mac80211: validate individual TWT params before driver setup - net: ethernet: mtk_eth_soc: support named IRQs - net: ethernet: mtk_eth_soc: add consts for irq index - net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() - [amd64,arm64] idpf: adjust TxQ ring count minimum - [amd64,arm64] idpf: Fix mailbox IRQ name leak on request failure - Bluetooth: ISO: clear iso_data always when detaching conn from hcon - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos - Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() - Bluetooth: ISO: fix leaking sk after socket release - Bluetooth: ISO: avoid deadlocks in iso_sock_timeout - Bluetooth: btintel: Validate length before parsing diagnostics TLV - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() - Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync - net: phylink: put link_gpio if phylink_create fails - scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE - scsi: ufs: core: Cancel RTC work in active-active suspend - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req - scsi: target: Clear cmd_cnt when initial counter enrollment fails - net: sxgbe: free TX rings on RX allocation failure - net: sxgbe: check descriptor ring allocation failures - can: isotp: check register_netdevice_notifier() error in module init - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() - tracing: Remove TRACE_EVENT_FL_FILTERED logic - tracing/mmiotrace: Remove reference to unused per CPU data pointer - tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions - [riscv64] mm: Fix out-of-bounds page-table walk during memory hot-remove - [arm64] net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend - [arm64] net: dsa: mt7530: error out on failed reads in MT7531 PHY polling - net: libwx: fix FDIR ATR queue mismatch for software VLAN packets - [arm64] octeontx2-pf: Set correct sequence for carrier off and tx queue stop - sched/deadline: Use revised wakeup rule only for running dl_server - qede: sync udp_tunnel ports outside qede_lock in the recovery path - ksmbd: return success for deferred final close - ksmbd: fix use-after-free in __close_file_table_ids() - pinctrl: devicetree: don't free uninitialized dev_name on error path - erofs: cap LZMA stream pool size - pinctrl: bm1880: add missing select GENERIC_PINCONF - fortify: Disable -Wstringop-overread in tests - mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE - fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() - mm/hugetlb: fix list corruption in allocate_file_region_entries() - mm/vmstat: fold stranded per-cpu node stats when a node comes online - tracing/probes: Reject $arg0 in meta argument expansion - [amd64] KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active - [s390x] KVM: s390: pci: Reject adapter interrupt forwarding if already enabled - [s390x] KVM: s390: pci: Fix NULL dereference on AIBV allocation failure - [s390x] KVM: s390: pci: Validate AIBV and AISB before pinning guest pages - sctp: validate Adaptation Indication parameter length - audit: fix potential integer overflow in audit_log_n_string() - audit: fix potential use-after-free in audit_del_rule() - Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() - Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() - Bluetooth: mgmt: fix pending command UAF in EIR updates - Bluetooth: mgmt: fix UAF in pair command cancellation - Bluetooth: hci_sync: Fix advertising data UAFs - Bluetooth: HIDP: reject frames without a transaction header - Bluetooth: HIDP: validate numbered report payloads - bpf: lwt: Fix dst reference leak on reroute failure - ALSA: 6fire: Fix UAF at error handling during probe - ALSA: lx6464es: fix period byte count for 16-bit streams - ALSA: pcm: wake linked drain waiters on unlink - ALSA: seq: Fix division by zero in initialize_timer() - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes - ALSA: ump: fix double free of out_cvts on rawmidi error - ASoC: tas2562: fix DVC coefficient write order - ASoC: tas2562: fix broken entries in the volume lookup table - ata: libata-eh: Increase STANDBY IMMEDIATE timeout - ata: libata-sata: fix ata_scsi_lpm_supported() iteration - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() - ALSA: usb-audio: fix stack info leak in RME Digiface status - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set - ALSA: usb-audio: Clamp frame size in implicit-feedback mode - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ - e1000: fix memory leak in e1000_probe() - igbvf: Fix leak in TX DMA error cleanup - ipvs: do not propagate one-packet flag to synced conns - net/smc: fix socket use-after-free during link group termination - netfilter: ipset: do not update comments from kernel-side hash adds - tipc: avoid use-after-free in poll trace queue dumps - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames - binfmt_misc: reject a flag character as the field delimiter - binfmt_misc: don't let an 'F' entry pin its own instance - mm/page_reporting: use system_freezable_wq to fix UAF during suspend - mm: memcg: initialize *locked in memcg1_oom_prepare() stub - net: bridge: stop fast-leave after deleting a port group - net: ipv6: clear suppressed fib6 rule result - [powerpc*] ps3: Fix map failure path in dma_ioc0_map_pages() - veth: convert frag_list skbs before running XDP - vxlan: re-fetch eth header after route_shortcircuit() - vxlan: unclone skb head before modifying eth header in route_shortcircuit() - vxlan: use neigh_ha_snapshot() in route_shortcircuit() - vxlan: use pskb_network_may_pull() in route_shortcircuit() - ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() - tracing: Check return value of __register_event() in trace_module_add_events() - tracing/filters: Fix false positive match in regex_match_full() - spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write - sctp: reject stale cookies with mismatched verification tags - sctp: prevent peer transport count overflow - hwmon: (npcm750-pwm-fan): stop fan timer on device detach - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client - i2c: amd-mp2: Unregister callback on adapter add failure - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() - cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized - power: supply: bq25890: fix the -10 C NTC lookup entry - power: supply: max17040: handle missing status supplier - [s390x] pci: Fix s390_pci_mmio_write syscall error return without MIO - [s390x] qeth: Check CAP_NET_ADMIN for private ioctls - [s390x] dasd: Fix potential NULL pointer dereference - [s390x] dasd: Fix undersized format-check buffer - [s390x] zcrypt: Fix wrong domain value verification with EP11 CPRBs - [s390x] zcrypt: Validate length for CCA AES cipher key requests - [s390x] zcrypt: Validate length for CCA ECC private key requests - [arm64] phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask - [arm64] phy: zynqmp: use read-modify-write for SERDES scrambler bypass - [arm64] phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB - net: openvswitch: fix potential UAF on meter attach failure - net: openvswitch: fix skb leak on flow key update failure during recirculation - net: openvswitch: fix skb leak on flow key update failure during ct - ice: wait for reset completion in ice_resume() - ice: fix memory leak in ice_lbtest_prepare_rings() - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock - i2c: iproc: reset bus after timeout if START_BUSY is stuck - i2c: imx: Fix slave registration race and error handling - i2c: imx: Cancel hrtimer before clearing slave pointer - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured - can: ems_usb: validate CPC message lengths - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents - can: softing: fw_parse(): validate firmware record spans - can: peak_usb: add bounds check for USB channel index - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error - can: peak_usb: validate uCAN receive record lengths - can: ctucanfd: add missing MODULE_DEVICE_TABLE() - can: ctucanfd: use self-test mode for PRESUME_ACK - can: ctucanfd: unmap BAR0 using base address - can: ctucanfd: handle bus error interrupts - can: ctucanfd: mark error-active controller status valid - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs - [arm*] drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size - [arm*] drm/vc4: Zero the tile state data array before each BIN job - [arm64] drm/panthor: reject firmware sections with oversized data - [arm64] drm/panthor: validate firmware interface structure sizes - [arm64] drm/mediatek: ovl_adaptor: balance component registrations - drm/amdgpu: restore UMD profile pstate after runtime resume - drm/amdgpu: cap GTT size to physical RAM on APUs - drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames - drm/amd/display: use proper context for logging - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE - drm/amdkfd: fix QID bit leak in pqm_create_queue() - drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment - drm/amdkfd: Handle invalid event type in CRIU event restore - drm/amdkfd: hold event_mutex while checkpointing CRIU events - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size - drm/vmwgfx: reject DX_BIND_QUERY without a DX context - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division - drm/vmwgfx: bound DMA command body size against suffix pointer - drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure - drm/vmwgfx: use check_add_overflow for shader size+offset bound - drm/vmwgfx: validate external BO copy bounds for both stride paths - spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX - HID: logitech-dj: Fix maxfield check in DJ short report validation - ata: libahci_platform: Do not set mask_port_map when not needed - ata: ahci: Make ahci_ignore_port() handle empty mask_port_map - of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting - drm/xe: Introduce xe_gt_dbg_printer() - drm/xe: Apply whitelist to engine save-restore - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CVE-2026-68267) - drm/xe/rtp: Maintain OA whitelists separately - drm/xe/rtp: Keep track of non-OA nonpriv slots - drm/xe/rtp: Generalize whitelist_apply_to_hwe - drm/xe/rtp: Save OA nonpriv registers to register save/restore lists - drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs - drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt - drm/xe/oa: (De-)whitelist OA registers on OA stream open/release - drm/xe/rtp: Ensure locking/ref counting for OA whitelists - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() - fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios - lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled() - mm/slab: prevent unbounded recursion in free path with new kmalloc type - gpio: pch: use raw_spinlock_t for the register lock - usb: gadget: f_tcm: synchronize delayed set_alt with teardown (CVE-2026-68367) - usb: typec: ucsi: split connector lock classes - usb: typec: ucsi: Fix race condition and ordering in port unregistration - media: i2c: imx219: Rename VTS to FRM_LENGTH - media: imx219: Fix maximum frame length in lines - media: chips-media: wave5: Support CBP profile - media: uapi: rkisp: Correct name version enum - wifi: brcmfmac: drain bus_reset work on device removal (CVE-2026-64586) - wifi: ath6kl: fix use-after-free in aggr_reset_state() (CVE-2026-68198) - wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) - wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change - mptcp: pm: avoid code duplication to lookup endp - mptcp: add mptcp_userspace_pm_lookup_addr helper - mptcp: pm: use addr entry for get_local_id - mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169) - drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions - drm/amdgpu: Fix context pstate override handling (CVE-2026-68273) - drm/sched: Store the drm client_id in drm_sched_fence - drm/amdgpu: give each kernel job a unique id - drm/amdgpu/gfx: fix cleaner shader IB buffer overflow (CVE-2026-68276) - drm/fb-helper: Allocate and release fb_info in single place - drm/tegra: fbdev: Remove offset into framebuffer memory - drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse] - drm/xe: Wait on external BO kernel fences in exec IOCTL - [arm64] drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() - [arm64] drm/i915/vrr: require valid min/max vfreq for VRR (CVE-2026-68254) - drm/xe: Rename ___xe_bo_create_locked() - drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266) - [arm64] drm/i915/hdcp: Move to using intel_display in intel_hdcp - [arm64] drm/i915/hdcp: require monotonically increasing seq_num_v - [arm64] drm/i915/hdcp: Skip inactive MST connectors when building stream list - [arm64] drm/i915/hdcp: check streams[] bounds before overflow (CVE-2026-68253) - drm/xe: Stub out new pagefault layer - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264) - rxrpc: Generate rtt_min - rxrpc: Adjust the rxrpc_rtt_rx tracepoint - rxrpc: Fix the calculation and use of RTO - rxrpc: Manage RTT per-call rather than per-peer - rxrpc: Fix irq-disabled in local_bh_enable() (CVE-2025-38525) - can: use skb hash instead of private variable in headroom - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering - usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path - drm/fb-helper: Fix a locking bug in an error path - [arm64,armhf] drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.104 - mount: honour SB_NOUSER in the new mount API - drm/amd/display: Add AV mute wait frames to dce110_set_avmute - drm/amd/display: Check for tg ops in dce110_set_avmute - [s390x] zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call - [arm64] dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer - drm/bridge: ps8640: propagate AUX transfer register errors - [arm64] net: hns3: fix speed configuration residue after driver reload - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor - enic: fix tx_hang_reset use-after-free on device removal - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock - pds_core: keep the health thread stopped during reset - pds_core: cancel pending PCI reset work on AER recovery - netfilter: ipset: switch ext_size to atomic64_t - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp - ipvs: return the csum validation for forward hook - watchdog: bd96801_wdt: Fix timeout for enabled WDG - btrfs: fix memory leak in btrfs_do_encoded_write() - bpf: Preserve pointer state for commuted arithmetic - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() - net/sched: cls_route: fix fastmap use-after-free on filter - [arm64] net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete - devlink: fix net namespace reference leak in reload - net/mlx5: fw_tracer, return NULL on create error - counter: microchip-tcb-capture: Fix DT channel validation - bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch - bpf: tcp: Make sure iter->batch always contains a full bucket snapshot - bpf: tcp: Get rid of st_bucket_done - bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items - bpf: tcp: Avoid socket skips and repeats during iteration - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() - vhost/vdpa: reject overflowing PA map page counts on 32-bit - vdpa/mlx5: Fix buffer length in create_direct_keys() - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() - xsk: require at least 16 bytes of TX metadata - udp: fix potential use-after-free in tunnel segmentation - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter - net/openvswitch: check Ethernet header length in key_extract() - net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers - hwmon: (nzxt-smart2) Check return value of init_device() in probe - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations - bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss() - bnxt_en: Determine and store default RX ring in vnic structure - bnxt_en: Refresh VNIC default ring on queue restart if needed - bnxt_en: Fix PTP PPS setting bug - sctp: fix addip_serial increment on ASCONF_ACK allocation failure - tcp: fix TFO max_qlen accounting across reuseport migration - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length - net: prestera: validate firmware header length - net: remove WARN_ON_ONCE() from sk_mc_loop() - net/smc: fix TOCTOU race between smc_listen_out() and listener close - [amd64] net: thunderbolt: Tear down DMA paths before stopping the rings - ata: pata_sl82c105: fix bridge revision use-after-free - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() - sctp: clear control chunk transport if it is being removed - tls: don't abort the connection on signal-interrupted sends - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination - hwmon: (ads7828) Fix external VREF regulator handling - hwmon: (ltc4282) Avoid overflow in maximum power calculation - hwmon: (ltc4282) Clamp negative current limits - hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt - mm/vmscan: wake up flushers conditionally to avoid cgroup OOM (Closes: #1143545) - net: fec: do not release NULL pages when RX buffer allocation fails - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers - mtd: spinand: fix direct mapping creation sizes - mtd: spinand: try a regular dirmap if creating a dirmap for continuous reading fails - mtd: spinand: repeat reading in regular mode if continuous reading fails - swapfile: call cond_resched() before locking si->lock - Input: evdev - sanitize event type index when fetching event masks - ALSA: usb-audio: fix OOB write on Type II inbound URBs - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() - [amd64] thunderbolt: icm: Preserve USB4 proxy data-valid bit - usb: cdnsp: fix incorrect endian conversions for APB timeout register - usb: gadget: f_ncm: Use unsigned int for ndp_index - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() - net: usb: ipheth: fix carrier_work UAF on disconnect - vt: add permission check for KDSKBMETA ioctl - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get - Input: evdev - fix information leak in evdev_pass_values() - ima: fix out-of-bounds read in xattr_verify() - ipvs: stop estimator after disabled calc phase - ipvs: add totalconns for dest - ipvs: properly update the overload flag on dest edit - ipvs: clear IPv4 options after rebasing tunnel ICMP errors - packet: use consistent hard_header_len in non-ring send paths - packet: use consistent hard_header_len in TX_RING send path - net/packet: reset the MAC header on the packet-socket transmit path - packet: synchronize pressure clearing with ring reconfiguration - net: fix skb length accounting after generic XDP frag adjustment - net: openvswitch: reallocate update replies for mismatched IDs - net/sched: reject overly deep qdisc hierarchies - net: octeontx2-pf: Fix UB in shift operation - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header - mac802154: fix netdev use-after-free in beacon worker - netfilter: ebt_nflog: pin the NFLOG backend - net: bridge: mrp: fix uninitialised bytes on the wire - [s390x] KVM: s390: pci: Fix memory accounting for pinned/unpinned pages (CVE-2026-74514) - [s390x] KVM: s390: pci: Fix missing error codes and memory unaccounting - [s390x] KVM: s390: pci: Fix resource leak on IRQ registration failure - [s390x] KVM: s390: pci: Fix aisb calculation - block: Reorder the request allocation code in blk_mq_submit_bio() - blk-mq: pop cached request if it is usable (CVE-2026-64017) - blk-mq: reinsert cached request to the list - dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk - [amd64] crypto: ccp - Add new SEV/SNP platform shutdown API - [amd64] KVM: SVM: Add support to initialize SEV/SNP functionality in KVM - [amd64] crypto: ccp - Fix checks for SNP_VLEK_LOAD input buffer length - [amd64] crypto: ccp - Abort doing SEV INIT if SNP INIT fails - futex: Prevent robust futex exit race some more - kunit/fortify: Replace "volatile" with OPTIMIZER_HIDE_VAR() - kunit/fortify: Add back "volatile" for sizeof() constants - pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops - ipv4: fix use-after-free in fib_nhc_update_mtu() - mei: pull kvfree out of spinlock - nvmem: layouts: Add fixed-layout driver - serial: qcom-geni: fix TX DMA buffer flush - serial: 8250_dma: Clear stale RX state on shutdown - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() - staging: rtl8723bs: fix OOB read in WMM_param_handler() - staging: rtl8723bs: fix missing shared-key auth challenge length check - staging: rtl8723bs: validate monitor transmit frame lengths - misc: fastrpc: fix channel ctx ref leak when session alloc fails - misc: fastrpc: Remove buffer from list prior to unmap operation - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free - ring-buffer: Fix crash passing ERR_PTR to kthread_stop() - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs - ALSA: usx2y: bound the hwdep mmap fault offset - tracing: Fix race between update_event_fields and, event_define_fields - fbdev: bitblit: bound-check glyph index in bit_cursor() - ring-buffer: Prevent subbuf order change when resizing is disabled - mm/huge_memory: fix huge_zero_pfn race - net: smc: fix splice entry lifetime imbalance in smc_rx_splice - ipv6: prevent in6_dev_get() from resurrecting inet6_dev - netfilter: bridge: release template ct on non-IP path - netfilter: nf_conntrack: defer invalid log until after unlock - net: atlantic: free stranded TX buffers on ring deinit - net: atlantic: free RX pages of consumed but not refilled buffers - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet - net/sched: act_gact, act_police: range check the fallback control action - ovl: don't warn when the mount is completed from another user namespace - binfmt_misc: don't warn when the mount is completed from another user namespace - Revert "drm/amdgpu: fix aperture mapping leak" - xdp: reject clones that overrun skb_shared_info tailroom - vxlan: do not arm the ageing timer on a device that is down - vsock/virtio: read virtqueues under worker locks - vsock/virtio: avoid refilling the RX queue after teardown - veth: fix skb length accounting after XDP frag adjustment - vhost: reset the vring metadata cache on vring reconfiguration - tls: don't leave a full plaintext sk_msg ring unpushed - tipc: read le->link under the node lock in tipc_node_link_down() - smb: client: Fix use-after-free in cifs_try_adding_channels() - [amd64] KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page - eventfs: Fix use-after-free in eventfs_remove_rec() - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" - ptp: ocp: Fix board ID over-read - ipv6: fix Route Information option length validation - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() - ima: Instantiate file_truncate and path_truncate hooks - fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions - fsverity: Fix silent truncation in bpf_get_fsverity_digest() - bpf, sockmap: Fix sk_redir use-after-free in send verdict - scsi: scsi_debug: Negate wrapped memcmp() result - sctp: keep chunk->transport in step with the list it is queued on - sctp: fix use-after-free of cached ASCONF chunk - sctp: clear new_transport when removing a peer - [amd64] thunderbolt: Bound the DROM dual link port number before indexing sw->ports - [amd64] thunderbolt: Fix bandwidth group reservation indexing - bpf: tcp: fix double sock release on batch realloc https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.105 - block: stop the timeout timer when releasing a never added disk - bpf: Fix linked reg delta tracking when src_reg == dst_reg (CVE-2026-53092) - bpf: Clear delta when clearing reg id for non-{add,sub} ops - f2fs: fix UAF issue in f2fs_merge_page_bio() (CVE-2025-40054) - mtd: ubi: skip programming unused bits in ubi headers - ubi: fastmap: fix ubi->fm memory leak - mm/damon/ops-common: putback folios on invalid migrate nid (CVE-2026-74644) - mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD} - igc: fix netdev not re-attached after resume if interface is down - ipvs: separate destination availability state - net: mana: Fix EQ leak in mana_remove on NULL port - [amd64] crypto: ccp: Add external API interface for PSP module initialization - [amd64] KVM: SVM: Ensure PSP module is initialized if KVM module is built-in - selinux: require every boolean value to be defined - selinux: reject a class permission count below its inherited common - selinux: do not cancel a policy conversion that never started - selinux: reject an unclaimed class value in security_get_classes() - mptcp: avoid combining some incoming suboptions - mptcp: options: reset DSS fields in case of unexpected size - mptcp: fastopen: only mark MPTFO subflows with SYN data - [s390x] qeth: validate user buffer length in SNMP and ARP query ioctls - [amd64] ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() - fbdev: core: Fix pointer desynchronization in fb_io_read() - drm/panthor: skip zero-sized firmware sections - drm/amdgpu: reject oversized IBs with per-ring packet limits - drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 - drm/amdgpu: fix aperture iounmap skipped on device removal - [amd64] ASoC: SOF: topology: Use acpi mach from the machine driver - Input: xpad - add support for ZENAIM LEVERLESS - Input: cs40l50-vibra - validate custom data from user space - [powerpc*] pseries: pci - logic bug - Input: synaptics-rmi4 - fix F55 transmitter electrode count typo - Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet - Input: psxpad-spi - set driver data before use - Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard - Input: iforce - validate input packet lengths - [powerpc*] pseries: lparcfg - fix kbuf[] underflow - Input: synaptics-rmi4 - zero report size on F54 work error - Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer - Input: synaptics-rmi4 - block s_input when F54 queue is busy - Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue - Input: hynitron_cstxxx - validate touch count and finger IDs - [arm64] crypto: qce - fix error path in devm_qce_register_algs - gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind - [arm64] pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state 0 - libceph: fix multiple unsafe decodes in decode_locker() - ftrace: Protect direct_functions in ftrace_find_rec_direct - ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() - Input: sur40 - fix input device registration ordering - Input: sur40 - fix V4L error path cleanup - libceph: Avoid using invalid osd indices from primary_temp - ceph: fix MDS random selection readiness predicate - libceph: tolerate addrvecs with multiple entries of the same type - [armhf] mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit - mmc: sdhci: unmap the bounce buffer before device release - mmc: sdhci: make tuning_err a signed int - drm/connector/hdmi: Fix out of bounds memory read - drm/xe: Order ring writes before ring tail updates - drm/radeon: fix autosuspend cleanup during teardown - [s390x] vfio_ccw: Free all memory if cp_init() fails - [s390x] vfio_ccw: Limit the number of channel program segments - [s390x] vfio_ccw: Cancel existing workqueues - [s390x] vfio_ccw: Ensure index for read/write regions are within range - [s390x] vfio_ccw: Ensure first IDAW remains constant - [s390x] vfio_ccw: Fix out of bounds check on CCW array - [s390x] vfio_ccw: Move cp cleanup out of not operational - [s390x] vfio_ccw: Selectively expand io_mutex - [s390x] vfio_ccw: Calculate idal length based on idaw type - [s390x] vfio_ccw: Implement a crw lock - drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix - drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE - drm/amdgpu: Reject UVD message with invalid number of h265 refs - drm/amdgpu: fix nbif 6.3.1 l1 low power not functional - drm/amdgpu: check ASPM on the dGPU host link - drm/amdgpu: validate GEM_CREATE domain combinations - drm/amdgpu: Reject UVD message with dimensions above 4096 - drm/amdgpu: Implement insert_end for VCE 3 - drm/amdgpu: Fix UVD min buffer sizes - drm/amdgpu: Fix UVD dpb min size calculation for H264 - drm/amdgpu: Fix UVD decode image min size calculation - drm/amdgpu: disallow multiple FENCE chunks in one submit - xfs: clear zapped attr fork state when bmap repair finds no attr fork - xfs: zero i_nlink before repair puts inode on unlinked list - xfs: only check mergeability of bnobt records - xfs: don't double-lock when deleting a self-referential directory - xfs: set the prev pointer when reinserting an inode on the unlinked list - xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers - xfs: nlink scrub must take IOLOCK before determining ILOCK state - xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev - xfs: fix ilock leak on error in xfs_dq_get_next_id - xfs: don't zap the attr fork on repair when there are queued pptr updates - xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair - xfs: fix allocated inodes that show up in the unlinked list - xfs: fix another iunlink infinite loop bug in online fsck - xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers - xfs: avoid UAF on sc->tempip in xrep_tempfile_create - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN - xfs: don't swallow dquot recovery verification errors - xfs: check xfarray iteration errors when committing unlinked inode lists - xfs: check v5 superblock features early - ceph: Remove ceph_writepage() - ceph: Use a folio in ceph_page_mkwrite() - ceph: Convert ceph_find_incompatible() to take a folio - ceph: Convert writepage_nounlock() to write_folio_nounlock() - ceph: fix writeback_count leak in write_folio_nounlock() - ceph: avoid fs reclaim while using current->journal_info - ceph: fix hanging __ceph_get_caps() with stale mds_wanted - libceph: Amend checking to fix `make W=1` build breakage - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CVE-2026-68159) - mm/khugepaged: guard is_zero_pfn() calls with pte_present() - userfaultfd: prevent registration of special VMAs (CVE-2026-68166) - libceph: fix two unsafe bare decodes in decode_lockers() (CVE-2026-68082) - net/sched: serialize qdisc_rtab_list against concurrent get/put (CVE-2026-68138) - super: remove pointless s_root checks - super: skip dying superblocks early - super: use a common iterator (Part 1) - super: use common iterator (Part 2) - fs/super: fix emergency thaw double-unlock of s_umount - super: fix emergency thaw deadlock on frozen block devices (CVE-2026-68132) - smb: move smb_version_values to common/smbglob.h - smb: move get_rfc1002_len() to common/smbglob.h - smb/server: rename include guard in smb_common.h - ksmbd: rename smb2_get_msg to smb_get_msg - smb/server: fix minimum SMB1 PDU size - smb/server: fix minimum SMB2 PDU size - ksmbd: validate minimum PDU size for transform requests (CVE-2026-68431) - eventpoll: pin files while checking reverse paths - tcp: Pass flags to __tcp_send_ack - tcp: fast path functions later - tcp: reorganize tcp_sock_write_txrx group for variables later - tcp: challenge ACK for non-exact RST in SYN-RECEIVED (CVE-2026-68118) - iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace - btrfs: add debug build only WARN - btrfs: add space_info argument to btrfs_chunk_alloc() - btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg() - btrfs: zoned: fix missing chunk metadata reservation - [amd64] KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs (CVE-2026-74517) - [arm64] ASoC: tas2562: Validate values for volume writes - ata: libata-scsi: terminate deferred commands on time out - igc: remove napi_synchronize() in igc_down() - ksmbd: conn lock to serialize smb2 negotiate - ksmbd: reject repeated SMB2 NEGOTIATE requests (CVE-2026-74494) - net: pktgen: fix code style (WARNING: Block comments) - net: pktgen: fix proc entry use-after-free (CVE-2026-74479) - binfmt_misc: don't leak the user namespace when the mount fails (CVE-2026-74483) - fsnotify, lsm: Decouple fsnotify from lsm - fsnotify: opt-in for permission events at file open time - fs: don't block write during exec on pre-content watched files - binfmt_misc: restore write access when removing an entry (CVE-2026-74487) - vrf: Make pcpu_dstats update functions available to other modules. - vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS. - vxlan: use pskb_network_may_pull() for transmit path header pulls (CVE-2026-74474) - ice: fix VF interrupts cleanup - include/linux/fs.h: add inode_lock_killable() - smb: client: fix race with fallocate(2) and AIO+DIO - cifs: add fscache_resize_cookie() to cifs_setsize() - can: rcar_canfd: change the initializing flow for clocks and resets - drm/amd/pm: Use same metric table for APU - drm/amd/pm: Use macro to initialize metrics table - drm/amd/pm: fix torn gpu metrics reads - drm/amdgpu: remove unused function parameter - drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini - drm/amd/pm: adjust the visibility of pp_table sysfs node - drm/amd/pm: fix pptable use-after-free (CVE-2026-74450) - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (CVE-2026-74684) - drm/vmwgfx: take fman->lock around fence list mutation in fifo_down - ring-buffer: Simplify functions with __free(kfree) to free allocations - ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() (CVE-2026-74602) - mm/pagewalk: split walk_page_range_novma() into kernel/user parts - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF (CVE-2026-74672) - mm/ptdump: always stabilise against page table freeing using init_mm (CVE-2026-74599) - KVM: SVM: Serialize accesses to the owner and mirror list with separate lock (CVE-2026-74607) - ring-buffer: Simplify ring_buffer_read_page() with guard() - ring-buffer: Make ring_buffer_{un}map() simpler with guard(mutex) - ring-buffer: Prevent resizing of persistent ring buffer - [amd64] x86/mce: Remove __mcheck_cpu_init_early() - [amd64] x86/mce: Set CR4.MCE last during init - [amd64] x86/mce: Set up the polling timer before CMCI discovery - [amd64] ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup - net/x25: fix use-after-free of the socket by its timers (CVE-2026-74628) - [arm64] tegra: Add EL2 virtual timer interrupt for Tegra194 - crypto: ccm - Set rfc4309 maxauthsize from child - netfilter: ipset: fix refcount race between list:set GC and swap - netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path - netfilter: flowtable: publish GC-visible tuple last - netfilter: ipset: fix list type element drift bug - netfilter: ipset: let destroy callbacks adjust ext mem size - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev - macvlan: inherit needed_headroom and needed_tailroom from lowerdev - veth: fix queue index used to wake the peer txq in veth_poll - tcp: fix icsk_ack.ato bitfield overflow - net: packet: fix wrong transport_header when sending VLAN-tagged frame - net/tls: Fail tls_sw_splice_read() after a failed async decrypt - af_packet: Don't send zero-byte data in tpacket_snd(). - net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain - net/sched: cls_u32: skip hash tables in u32_bind_class() - net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG - net/sched: cls_bpf: reject dev-bound programs bound to a different device - drm/xe/oa: Fix sync entry leak on OA config emit failure - erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms - perf: Unify perf_event_free_task() / perf_event_exit_task_context() - perf/core: Fix group leader use-after-free after sibling detach (CVE-2026-74637) - fs: unlock the superblock during iterate_supers_type - binfmt_misc: use exe_file_deny_write_access() for the interpreter clone - net: harmonize tstats and dstats - ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() - ring-buffer: Use current_context for safe per-CPU buffer swap (CVE-2026-74601) - ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r - net: ethernet: mtk_eth_soc: only use legacy mode on missing IRQ name - net: ethernet: mtk_eth_soc: improve support for named interrupts . [ Salvatore Bonaccorso ] * drivers/mmc/host: Enable MMC_ALCOR as module (Closes: #1142912) * drivers/misc/cardreader: Enable MISC_ALCOR_PCI as module (Closes: #1142912) Checksums-Sha1: 6131c1ad413fea2557d6966b64248a950a962af6 942736 bpftool-dbgsym_7.5.0+6.12.105-1_armel.deb d5679a296ec92916069562be9f6ad639500009a5 1609764 bpftool_7.5.0+6.12.105-1_armel.deb 13f193115a522b7505698dbbfe45a746fc05591f 1363612 libcpupower-dev_6.12.105-1_armel.deb 529c249b1fd7e64a2aa4e98f138767e83a8a1fe0 32776 libcpupower1-dbgsym_6.12.105-1_armel.deb d9d9d3f10c9ace3d59513c0559ab133660a224c8 1369812 libcpupower1_6.12.105-1_armel.deb ac8e134310dadefbd61bcff28eebe1a98d0177ab 1404776 linux-config-6.12_6.12.105-1_armel.deb 65db981f5c6820f94208166468452da488da73fd 66088 linux-cpupower-dbgsym_6.12.105-1_armel.deb 82beec7cba882d4543000797e13eed122882d180 1407700 linux-cpupower_6.12.105-1_armel.deb 4e4104679a7eec1ab711501b2e60c99775337a65 1765344 linux-headers-6.12.105+deb13-rpi_6.12.105-1_armel.deb f2f87a65744764b1cb3039816dff3822c0345bfb 1152 linux-headers-rpi_6.12.105-1_armel.deb c58d5b8818fcf1981a94675171e8824eab422423 412783628 linux-image-6.12.105+deb13-rpi-dbg_6.12.105-1_armel.deb 883990adaaeae949041f23019eac004b52f5bf81 33428716 linux-image-6.12.105+deb13-rpi_6.12.105-1_armel.deb ba55606870cc7a6ec6e782d10a0f6d79d3e3d83c 1164 linux-image-rpi-dbg_6.12.105-1_armel.deb c8c0c5ad837e95554cd2ee87c5087d57062034b3 1444 linux-image-rpi_6.12.105-1_armel.deb aad57aeb6d843e94159ef8dd44637c0a08237fac 1891168 linux-kbuild-6.12.105+deb13-dbgsym_6.12.105-1_armel.deb 78d03ebb5a85d07abb0dce20bc4be027ee0c5baf 1740692 linux-kbuild-6.12.105+deb13_6.12.105-1_armel.deb a26d3c41e91b0bd052016b35d090aaf4701dbd60 11974804 linux-perf-dbgsym_6.12.105-1_armel.deb c18b2b7939804419ec2a4ec1bece7ffe3837093a 3224444 linux-perf_6.12.105-1_armel.deb 84462ec3d9b2fe23b5b1accb571c255e2fc855e3 16813 linux_6.12.105-1_armel-buildd.buildinfo 4aafd63ff7f024b7c7394b2b8748a8984f37ab02 151480 usbip-dbgsym_2.0+6.12.105-1_armel.deb c9484bf1a5d231efe30314bac02e49a829e846d5 1399728 usbip_2.0+6.12.105-1_armel.deb Checksums-Sha256: e8ce49a432c2d9da1e15f988b108802e509082eadd6855cd330f89af4761d977 942736 bpftool-dbgsym_7.5.0+6.12.105-1_armel.deb 3e91e8e00ec3b7276485f74afc638584645dc591d903d0cef0b79e126fc7dedc 1609764 bpftool_7.5.0+6.12.105-1_armel.deb 58e5af5c3faf1bdabb076b9195db33ac7cdeed79f9b986777b49334afbdc7b32 1363612 libcpupower-dev_6.12.105-1_armel.deb 46520efdc7a8b4f113e3dce4c9d37392b8a5490843540bbe999c01525c0f85cf 32776 libcpupower1-dbgsym_6.12.105-1_armel.deb 802200aee5f3b1af69f88de96e1d87db63c51e44f32b4728b719a4cecff2aaa3 1369812 libcpupower1_6.12.105-1_armel.deb 96f52e585c9e1d6d301e22ae3fbbdd46b0a9d5d69c1fcc6094a1e7f2b1c18aa6 1404776 linux-config-6.12_6.12.105-1_armel.deb 577b994810b2cc9e3d9db95414c7dfe8121da6ba50d7b4bc9821748e4065ba59 66088 linux-cpupower-dbgsym_6.12.105-1_armel.deb 6f24a84806b4563753d08321eab9346a7102d6eeab02c71e910f08494d535356 1407700 linux-cpupower_6.12.105-1_armel.deb f5c5202c71c9f896af4bc125d2b38f85cf0bdd4a7aaa9a35dbf08ec9b359ecfc 1765344 linux-headers-6.12.105+deb13-rpi_6.12.105-1_armel.deb d3273027197cb4c6b431f8184562fb6a107ace0c0c5131e7e41556305cfe766a 1152 linux-headers-rpi_6.12.105-1_armel.deb fcfe6f78a82744a17f1e159a9944bec2985903f964f704f225891ca16e80c9d7 412783628 linux-image-6.12.105+deb13-rpi-dbg_6.12.105-1_armel.deb 361d2c319dbfda4692170b177d6b63b4b55f0f3b9ba6a03e5d81cc421d1d72ee 33428716 linux-image-6.12.105+deb13-rpi_6.12.105-1_armel.deb bd70b48bd05c020a8e78e22b5e2ff1d1baa167cf92f110c11cab27480015874a 1164 linux-image-rpi-dbg_6.12.105-1_armel.deb 35bf956198ee44dd6d8869cf033dbe1df0955b8f804e8c18093bc5dab7b1bb9e 1444 linux-image-rpi_6.12.105-1_armel.deb 83893f19e7f9bd9c07d719bf1f6b9c35acbda666602ccd6a54d7fb86184f8b36 1891168 linux-kbuild-6.12.105+deb13-dbgsym_6.12.105-1_armel.deb 751b12d05e33b4896669798a691ba326530f03ca8e700f3a2024e56d95753df2 1740692 linux-kbuild-6.12.105+deb13_6.12.105-1_armel.deb 31a5bacd703a48369d8598c428eb7cd272ff5575db7e02833aa2c180b6ec02a6 11974804 linux-perf-dbgsym_6.12.105-1_armel.deb 69889a3b51c2354959a315ac95f44df3cf065863e3c6523ea23b30a65cda351a 3224444 linux-perf_6.12.105-1_armel.deb a43aa69b32f5e6a86a05f4ca2fd430d5ac8a3e1b87b069a47e3eaed1d2021a85 16813 linux_6.12.105-1_armel-buildd.buildinfo 528bcbb81d2c7d14a1e175f0bcef26f6d1f018034309d85d0c27b47ce4ee0cbc 151480 usbip-dbgsym_2.0+6.12.105-1_armel.deb 2a50008a1b02cbc22ed011d3cb3affb5478309f97a4fb8de85aa78c0a2a2cbf1 1399728 usbip_2.0+6.12.105-1_armel.deb Files: fdcefd01a9174e801103d4524ded9f7c 942736 debug optional bpftool-dbgsym_7.5.0+6.12.105-1_armel.deb d7cd84233b96c25d82cd706e71faed66 1609764 devel optional bpftool_7.5.0+6.12.105-1_armel.deb 12a37e8ab1d81b77d8c6bfce8b7210ac 1363612 libdevel optional libcpupower-dev_6.12.105-1_armel.deb ad45d0d1c0d98a5bee479431aa5fcdab 32776 debug optional libcpupower1-dbgsym_6.12.105-1_armel.deb 44b3e09f020234fbf9451daf312d5b87 1369812 libs optional libcpupower1_6.12.105-1_armel.deb 9b05780ab23e6a15c047b21bc492aa96 1404776 kernel optional linux-config-6.12_6.12.105-1_armel.deb 1ee10aa211c1f8daab822eb640d1b4f8 66088 debug optional linux-cpupower-dbgsym_6.12.105-1_armel.deb bf8e910e9e756d18e64087b8aa920db4 1407700 admin optional linux-cpupower_6.12.105-1_armel.deb e8632dc82cbb869abd1b8ae669b23d5f 1765344 kernel optional linux-headers-6.12.105+deb13-rpi_6.12.105-1_armel.deb 48c07ca12aff18bdde90925f6f0c2e87 1152 kernel optional linux-headers-rpi_6.12.105-1_armel.deb 5a0b9af95389e4d093332b34f2077936 412783628 debug optional linux-image-6.12.105+deb13-rpi-dbg_6.12.105-1_armel.deb 25e063f0d2de902f1e09765d0feb55b6 33428716 kernel optional linux-image-6.12.105+deb13-rpi_6.12.105-1_armel.deb fef17b6e26afd8a8f3b892e908d61c83 1164 kernel optional linux-image-rpi-dbg_6.12.105-1_armel.deb 5609e4000e2961e1c4b899bc382cf074 1444 kernel optional linux-image-rpi_6.12.105-1_armel.deb 981ea39ffc3e522803ab78c37a369322 1891168 debug optional linux-kbuild-6.12.105+deb13-dbgsym_6.12.105-1_armel.deb 807673f6da54222bb1a28448d181d05e 1740692 kernel optional linux-kbuild-6.12.105+deb13_6.12.105-1_armel.deb c5dd77a25be53a97c03b0d4f02b7d81b 11974804 debug optional linux-perf-dbgsym_6.12.105-1_armel.deb 0f04e359493aafc4f53a24b47c8cf9b9 3224444 devel optional linux-perf_6.12.105-1_armel.deb 24f01393f2e092046089af18be142125 16813 kernel optional linux_6.12.105-1_armel-buildd.buildinfo fe6e1ce344204ef5fa558c95e598e6b1 151480 debug optional usbip-dbgsym_2.0+6.12.105-1_armel.deb 2b72feb302f5223a562b5f1ed39439f1 1399728 admin optional usbip_2.0+6.12.105-1_armel.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE2kd8oHy+LXk/nybqvzDqKQSGl8UFAmqNQ98ACgkQvzDqKQSG l8WsOxAAxTIrtqccoAs1TxUy1ilhAm+ymkUffUGI4dTbyv20tWvqDX+DH7h3clvL qZ1Pf7LY1IcqmnG6DG8YkX/dAY/yckpuV1SkP/WkndADngm49rNyBo9/MDBtZTFM s/lnp4iD7fIKrsAEzp1kvD3O4anQOq+dl0aFsiQNpB5G2LcFdyvWsjv1gMws6Inc DAXmCOuuHymSkBVBU/bmAoCjYAWvKopJKQvqmyB5TDS2mcInqashMRKQeu97qPo8 LGM2H8wPk6+MB7njltJE6gewr3hlG6f9tVKdwTGi5OWWJDTF3lzIKx50xe8g9izS HNQsndPkIHHq3aHCBIHnwawey4Fn8u6abWl+L9/EyeSqxrCXXSsasxt/ndKebnNY s3S+63cI4ioIvD0VXn46oY5iuE/0+3n50ZGdvJCWG5uWJaOSMLNyse/f/LHXW0/q /I2SxrFHD/R0i44f5qQZZnI3ZkB8z1Tqrm19VGv6b69+nTRlSX8lJdO/ccQf6aYM TZ2yT1fwoQr7IGB/dkxwCqTjYi9AkemvxtIN2xaSTBGga+WfmH6WB58wvUwQUiV4 LRHVHphim87Clv6PNLP5+Gqq0mNIe7Nqg80nWbOI1hwrePB/UYvO8aqYZr661pGi ZXWK3L/xDWLUWmiTIfezM73U0Htb8lefFL/6dIORPrjVn3zS/C4= =tniv -----END PGP SIGNATURE-----