[
{
"Commit": "1810350b04ef38b375c64304e142de96d90404e1",
"Fixed-by": "29fb415a6a72c9207d118dd0a7a37184a14a3680",
"subsystem": "btrfs",
"problem_description": "Memory leak of stripe_uptodate_bitmap in btrfs_raid_bio due to missing deallocation."
},
{
"Commit": "6be09580df5cf87e601c1ec56b9a0c891d3a0bc8",
"Fixed-by": "67b3da8d3051fba7e1523b3afce4f71c658f15f8",
"subsystem": "smb",
"problem_description": "The SendReceive() function fails to free the response buffer when cifs_send_recv() returns an error."
},
{
"Commit": "e255612b5ed9f179abe8196df7c2ba09dd227900",
"Fixed-by": "e3a43633023e3cacaca60d4b8972d084a2b06236",
"subsystem": "smb/client",
"problem_description": "Memory is leaked because the response buffer from a failed SMB2_open call is not freed before retrying the operation."
},
{
"Commit": "b168ed458ddecc176f3b9a1f4bcd83d7a4541c14",
"Fixed-by": "99a2ef500906138ba58093b9893972a5c303c734",
"subsystem": "cgroup",
"problem_description": "A use-after-free occurs in dmem pools because they are freed immediately upon region unregistration even if still referenced by active charges."
},
{
"Commit": "b168ed458ddecc176f3b9a1f4bcd83d7a4541c14",
"Fixed-by": "592a68212c5664bcaa88f24ed80bf791282790fe",
"subsystem": "cgroup",
"problem_description": "suspicious RCU usage warning in dmem_cgroup_unregister_region() due to use of list_for_each_rcu() without RCU read lock"
},
{
"Commit": "b168ed458ddecc176f3b9a1f4bcd83d7a4541c14",
"Fixed-by": "43151f812886be1855d2cba059f9c93e4729460b",
"subsystem": "cgroup",
"problem_description": "NULL pointer dereference when writing to dmem.max without specifying a limit value"
},
{
"Commit": "778b8ebe5192e7a7f00563a7456517dfa63e1d90",
"Fixed-by": "8e24994872361212531a952c93adb01c485148f1",
"subsystem": "kbuild",
"problem_description": "building external modules with W= specified fails because kernel-doc.py cannot import the kdoc module"
},
{
"Commit": "90942f9fac05702065ff82ed0bade0d08168d4ea",
"Fixed-by": "76ed27608f7dd235b727ebbb12163438c2fbb617",
"subsystem": "perf",
"problem_description": "perf crashes with a NULL pointer dereference when profiling an exiting user task that has cleared its `mm` field."
},
{
"Commit": "a110a81c52a9de73e2e57e826dd3bf0fd4c22226",
"Fixed-by": "115135422562e2f791e98a6f55ec57b2da3b3a95",
"subsystem": "sched",
"problem_description": "The dl_server gets stuck because dl_defer_running is not cleared when the CBS wakeup rules demand a replenish."
},
{
"Commit": "7926ba2143d8fef40bb940232818c7363e33598c",
"Fixed-by": "8a44241b0b83a6047c5448da1fff03fcc29496b5",
"subsystem": "drm/xe",
"problem_description": "Double-free of nvm memory when auxiliary_device_add fails because both the error path and the device release callback attempt to free it"
},
{
"Commit": "c28bfb107daca4e9ba2e567a412e885933057282",
"Fixed-by": "2da8fbb8f1c17129a08c1e0e42c71eabdca76062",
"subsystem": "drm/xe",
"problem_description": "The auxiliary NVM device is not cleaned up on probe failure, leading to duplicate sysfs entry warnings on subsequent probe attempts."
},
{
"Commit": "4ab5efcc2829a38a3adcfdd9cd0c0e0eb6fb6939",
"Fixed-by": "bdde21d3e77da55121885fd2ef42bc6a15ac2f0c",
"subsystem": "lsm",
"problem_description": "The /proc/sys/vm/mmap_min_addr sysctl entry is not created when CONFIG_SECURITY is disabled."
},
{
"Commit": "b3e9bfd86658b562a33b1ee8563d59a593327aaf",
"Fixed-by": "3eb46fbb601f9a0b4df8eba79252a0a85e983044",
"subsystem": "drm/amdgpu",
"problem_description": "Unnecessary reinitialization and remapping of kernel gfx queues after a reset causes queue reset failures on APUs."
},
{
"Commit": "2674f1ef29f46ae81464d0ac44b7824deb9de85c",
"Fixed-by": "c1ed856c09d0d730c2f63bbb757cb6011db148f9",
"subsystem": "drm/xe",
"problem_description": "pci_dev pointer is used in pci_dbg() after its reference is released by pci_dev_put() in is_bound()"
},
{
"Commit": "9fd1ff5d2ac7181844735806b0a703c942365291",
"Fixed-by": "426ca15c7f6cb6562a081341ca88893a50c59fa2",
"subsystem": "net",
"problem_description": "skb_segment_list incorrectly processes GRO packets containing a frag_list that have been modified by XLAT, as XLAT only translates the head SKB leaving frag_list entries untranslated."
},
{
"Commit": "811f67c51636d43791995bf483c5c1904900b531",
"Fixed-by": "008bec8ffe6e7746588d1e12c5b3865fa478fc91",
"subsystem": "platform/x86/intel",
"problem_description": "The debugfs status file is created with read-only permissions, preventing the use of its write callback."
},
{
"Commit": "a34fc329b1895fc8a6eb12099adc47009421ba6a",
"Fixed-by": "6222883af286e2feb3c9ff2bf9fd8fdf4220c55a",
"subsystem": "platform/x86",
"problem_description": "The hp-bioscfg driver attempts to register kobjects with empty names if a BIOS attribute name decodes to an empty string."
},
{
"Commit": "702e80470a3359ce02b3f846f48f6db4ac7fd837",
"Fixed-by": "1eab33aa63c993685dd341e03bd5b267dd7403fa",
"subsystem": "mac80211",
"problem_description": "The TTLM element parser incorrectly reads the link mapping presence byte when the default mapping is indicated, causing a buffer overread."
},
{
"Commit": "9420139f516d7fbc248ce17f35275cb005ed98ea",
"Fixed-by": "56c430c7f06d838fe3b2077dbbc4cc0bf992312b",
"subsystem": "dma",
"problem_description": "dma_alloc_from_pool() unconditionally warns on allocation failure, ignoring __GFP_NOWARN and failing to distinguish between exhausted pools and missing pools."
},
{
"Commit": "06d0e3723647610936660c3c2a144c6243367c3c",
"Fixed-by": "0ea05c4f7527a98f5946f96c829733788934311d",
"subsystem": "riscv",
"problem_description": "COMPAT_UTS_MACHINE was incorrectly defined as \"riscv\" instead of \"riscv32\"."
},
{
"Commit": "d4c81bbb8600257fd3076d0196cb08bd2e5bdf24",
"Fixed-by": "c5d5ecf21fdd9ce91e6116feb3aa83cee73352cc",
"subsystem": "selftests",
"problem_description": "the mptcp_join.sh selftest incorrectly expects 2 MP_JOIN ACKs instead of 3 on older kernels"
},
{
"Commit": "15cc10453398c22f78f6c2b897119ecce5e5dd89",
"Fixed-by": "2ef9e3a3845d0a20b62b01f5b731debd0364688d",
"subsystem": "mptcp",
"problem_description": "subflow closed events do not contain an error field when a subflow is closed with an error"
},
{
"Commit": "15cc10453398c22f78f6c2b897119ecce5e5dd89",
"Fixed-by": "dccf46179ddd6c04c14be8ed584dc54665f53f0e",
"subsystem": "mptcp",
"problem_description": "sock_error() clears subflow errors unconditionally even when not propagated, resulting in missing error codes for later events."
},
{
"Commit": "d82809b6c5f2676b382f77a5cbeb1a5d91ed2235",
"Fixed-by": "8467458dfa61b37e259e3485a5d3e415d08193c1",
"subsystem": "mptcp",
"problem_description": "subflow closed events are re-sent with less info when the initial subflow is disconnected after an error"
},
{
"Commit": "d82809b6c5f2676b382f77a5cbeb1a5d91ed2235",
"Fixed-by": "280d654324e33f8e6e3641f76764694c7b64c5db",
"subsystem": "mptcp",
"problem_description": "duplicate SUB_CLOSED events are sent for a disconnected subflow because the event suppression flag is cleared during context reset"
},
{
"Commit": "a5e400a985df8041ed4659ed1462aa9134318130",
"Fixed-by": "011be342dd24b5168a5dcf408b14c3babe503341",
"subsystem": "net/mlx5e",
"problem_description": "ESN replay window setup logic intended only for packet offload is incorrectly executed for IPsec crypto offload, triggering a WARN_ON for unsupported window sizes"
},
{
"Commit": "dd3dd7263cdeac601d0ecc5f04d87eee0a8277aa",
"Fixed-by": "a8f930b7be7be3f18f14446df461e17137400407",
"subsystem": "net/mlx5",
"problem_description": "Reading the vhca_id debugfs file before HCA capabilities are initialized causes a NULL pointer dereference."
},
{
"Commit": "3c9c34c32bc653a8992fef7d525889254d90b307",
"Fixed-by": "2610a3d65691a1301ab10c92ff6ebab0bedf9199",
"subsystem": "net/mlx5",
"problem_description": "the reset_root_to_default capability check in mlx5_fs_cmd_set_tx_flow_table_root is inverted, causing the function to incorrectly return -EOPNOTSUPP when the capability is supported"
},
{
"Commit": "25c6a5ab151fb9c886552bf5aa7cbf2a5c6e96af",
"Fixed-by": "2aa1545ba8d4801fba5be83a404e28014b80196a",
"subsystem": "net",
"problem_description": "A clock warning occurs during driver removal because the clock is disabled twice: once by the driver manually and once by the devm subsystem."
},
{
"Commit": "e5a1861a298eb386bf22c2cfc95b147f65c6071c",
"Fixed-by": "a62f7d62d2b115e67c7224e36ace4ef12a9650b4",
"subsystem": "net/mlx5e",
"problem_description": "mlx5e_psp_handle_tx_skb incorrectly assumes that all GSO skbs are IPv6, leading to incorrect TCP checksum calculation for IPv4 packets."
},
{
"Commit": "971502d77faa50a37c89bc6d172450294ad9a5fd",
"Fixed-by": "cc0cf10fdaeadf5542d64a55b5b4120d3df90b7d",
"subsystem": "net",
"problem_description": "The static key check for netfilter hooks used the undefined macro HAVE_JUMP_LABEL instead of CONFIG_JUMP_LABEL."
},
{
"Commit": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
"Fixed-by": "d2492688bb9fed6ab6e313682c387ae71a66ebae",
"subsystem": "nfc",
"problem_description": "The command workqueue is destroyed before unregistering from rfkill, leading to a race where nci_close_device accesses the freed workqueue."
},
{
"Commit": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
"Fixed-by": "4da7c5c3ec34d839bba6e035c3d05c447a2f9d4f",
"subsystem": "bcache",
"problem_description": "Discard requests on a detached bcache device fail to end I/O accounting, resulting in 100% disk utilization reported by iostat."
},
{
"Commit": "8a6e02d0c00e7b62e6acb74146878bb91e9e7e31",
"Fixed-by": "0fd17e5983337231dc655e9ca0095d2ca3f47405",
"subsystem": "of",
"problem_description": "The device tree default CMA region is reserved even when overridden by the cma= kernel parameter."
},
{
"Commit": "b5725cfa4120a4d234ab112aad151d731531d093",
"Fixed-by": "20e01bba2ae4898ce65cdcacd1bd6bec5111abd9",
"subsystem": "firewire",
"problem_description": "accessing the transaction list without holding the card lock during AT request completion causes a race condition with concurrent AR response processing"
},
{
"Commit": "c68cbbfd54c68485ac67b5a04c06feacdce15fec",
"Fixed-by": "b1defcdc4457649db236415ee618a7151e28788c",
"subsystem": "drm/amdgpu",
"problem_description": "A hang occurs during queue reset on gfx11 APUs because the EXEC_COUNT field in the conditional execution packet is not patched during gfx shadow handling."
},
{
"Commit": "f0887e2a52d4ef3f246e508bd1d947dc13988643",
"Fixed-by": "a54afbc8a2138f8c2490510cf26cde188d480c43",
"subsystem": "nvme",
"problem_description": "The sg_list and sge parameters were swapped in the call to nvme_free_sgls(), causing incorrect DMA unmapping and potential data corruption."
},
{
"Commit": "efa03dab7ce4ed786b131f412440e2fd45fba11f",
"Fixed-by": "5815d9303c67cef5f47cd01e73b671e6b9c40ef3",
"subsystem": "iommu",
"problem_description": "Unmap operations suffer from performance degradation due to unnecessary cache flushing of unmodified memory ranges."
},
{
"Commit": "39cfd5b12160be4f57df1c3ba60139741c827616",
"Fixed-by": "6d60354ea2f90352b22039ed8371c4f4321df90e",
"subsystem": "kbuild",
"problem_description": "modules.builtin.modinfo is incorrectly created with executable permissions (0755) instead of 0644 because objcopy inherits attributes from the source ELF file vmlinux.unstripped"
},
{
"Commit": "a7c699d090a1f3795c3271c2b399230e182db06e",
"Fixed-by": "62089b804895e845f82e132ea9d46a1fc53ed5a7",
"subsystem": "kbuild",
"problem_description": "Module signatures are stripped during RPM package generation, preventing modules from loading when lockdown is enabled."
},
{
"Commit": "fcbc51e54d2aa9d402206601f4894251049e5d77",
"Fixed-by": "e535c23513c63f02f67e3e09e0787907029efeaf",
"subsystem": "drm/imx",
"problem_description": "The reference to the DDC I2C adapter acquired during probe is leaked on probe failure or driver unbind."
},
{
"Commit": "7b61212f2a07a5afd213c8876e52b5c9946441e2",
"Fixed-by": "b2cf569ed81e7574d4287eaf3b2c38690a934d34",
"subsystem": "gpio",
"problem_description": "The brcmstb driver failed to map hwirq to bank correctly because it relied on the downward GPIO numbering which was replaced by upward numbering."
},
{
"Commit": "a479a27f4da4d1f8a9b7540a800f80253ed1bad0",
"Fixed-by": "a040afa3bca415019d96a586b96b5f17b1f55a90",
"subsystem": "gve",
"problem_description": "The driver probe fails and renders the device unusable if the clock initialization fails."
},
{
"Commit": "f62b8bb8f2d30582f30f51e85a8c0e1260125d7e",
"Fixed-by": "476681f10cc1e0e56e26856684e75d4678b072b2",
"subsystem": "net/mlx5e",
"problem_description": "The ndo_get_stats64 callback fails to report generic netdev statistics, causing network stack errors to be invisible."
},
{
"Commit": "9be6c21fdcf8a7ec48262bb76f78c17ac2761ac6",
"Fixed-by": "f67666938ae626cbda63fbf5176b3583c07e7124",
"subsystem": "net/mlx5e",
"problem_description": "NULL pointer dereference occurs during TC flow deletion because the driver iterates over all possible ports instead of only existing devcom peers."
},
{
"Commit": "7a9fb35e8c3a67145fca262c304de65cb2f83abf",
"Fixed-by": "2ae8c7edea87f54609bda30963a099cd3c64b0bb",
"subsystem": "net/mlx5",
"problem_description": "Unbinding the uplink ETH driver while the E-Switch is in switchdev mode leads to netdevice reference counting issues."
},
{
"Commit": "6ee27ee27ba8b2e725886951ba2d2d87f113bece",
"Fixed-by": "ee8d07cd5730038e33bf5e551448190bbd480eb8",
"subsystem": "drm/amd/pm",
"problem_description": "A race condition occurs in `amdgpu_dpm_set_powergating_by_smu` because the power state check is performed before acquiring the mutex."
},
{
"Commit": "dd299441654fd8209056c7985ddf2373ebaba6ed",
"Fixed-by": "8b1ecc9377bc641533cd9e76dfa3aee3cd04a007",
"subsystem": "drm/amdgpu",
"problem_description": "NULL pointer dereference in amdgpu_gmc_filter_faults_remove on APUs due to unconditional access to the uninitialized ih1 interrupt ring."
},
{
"Commit": "4f1fe43c920b92ac41c34f151fe452d46936b79d",
"Fixed-by": "05faf2c0a76581d0a7fdbb8ec46477ba183df95b",
"subsystem": "ice",
"problem_description": "UDP checksum mismatches are incorrectly counted as interface receive errors."
},
{
"Commit": "2a5dc090b92cfa5270e20056074241c6db5c9cdd",
"Fixed-by": "9bb30be4d89ff9a8d7ab1aa0eb2edaca83431f85",
"subsystem": "ice",
"problem_description": "NULL pointer dereference in ice_vsi_set_napi_queues during resume from suspend when rings or q_vectors are NULL"
},
{
"Commit": "29cb3b8d95c76a1d509029701435ed6b9e96a732",
"Fixed-by": "100cf7b4ca6ed770ec4287f3789b1da2e340a05a",
"subsystem": "ixgbe",
"problem_description": "The ixgbe_recovery_probe function incorrectly re-initializes the already initialized hw->aci.lock mutex and erroneously destroys it on failure."
},
{
"Commit": "29cb3b8d95c76a1d509029701435ed6b9e96a732",
"Fixed-by": "638344712aefeba97b6e0d90f560815fd88abd0f",
"subsystem": "ixgbe",
"problem_description": "Memory leaks occur when ixgbe_recovery_probe() fails because it does not free resources (like io_addr and mac_table) allocated in ixgbe_probe()."
},
{
"Commit": "91581c4b3f29e2e22aeb1a62e842d529ca638b2d",
"Fixed-by": "53ad4a948a4586359b841d607c08fb16c5503230",
"subsystem": "gpio",
"problem_description": "mutex_unlock is called on freed memory in the configfs release path because the device is freed before the mutex guard releases the lock."
},
{
"Commit": "2c4d00cb8fc5e01004eb2e84d13c09a2d9ecab0f",
"Fixed-by": "c0ae43d303e45764918fa8c1dc13d6a5db59c479",
"subsystem": "gpio",
"problem_description": "Using the BIT() macro on 32-bit architectures resulted in undefined behavior for GPIO indices 32 and above due to the 32-bit limit of unsigned long."
},
{
"Commit": "24ebfcd65a871df4555b98c49c9ed9a92f146113",
"Fixed-by": "78c268f3781e4b9706103def0cc011505e0c4332",
"subsystem": "livepatch",
"problem_description": "klp-build module link fails when CONFIG_MODULE_SRCVERSION_ALL is enabled because the source file referenced in the copied .cmd file is not present."
},
{
"Commit": "dd590d4d57ebeeb826823c288741f2ed20f452af",
"Fixed-by": "f2dba60339a6299e181671e95293efe312237e2d",
"subsystem": "objtool",
"problem_description": "klp-diff fails when diffing functions that use WARN() because it cannot properly handle section-based references to bug table entries"
},
{
"Commit": "2c05ca02621837af7cd8fab6ae7421b9cd5dff6e",
"Fixed-by": "d107b3265aa5e61a1e326b2815a767526ddb12ac",
"subsystem": "objtool",
"problem_description": "The ALIGN_UP_POW2 macro causes undefined behavior when the input is 1 due to __builtin_clz(0), leading to an incorrect number of relocations being allocated when adding the first relocation."
},
{
"Commit": "5d859dff266f7e57664dc6bcf80ef2c66547c58a",
"Fixed-by": "fd4eeb30b9e30ca1118a618be0755287bcbb2da9",
"subsystem": "objtool",
"problem_description": "The build fails when cross-compiling on a 32-bit host for a 64-bit target because the '%lx' format specifier is incompatible with the 'unsigned long long' type of 'bfd_vma'."
},
{
"Commit": "1b1f04d8271e7ba70fbbb13754b1e869f70aa785",
"Fixed-by": "ba5c657141ea29261e893c46faff29a101f4496a",
"subsystem": "bus",
"problem_description": "The ls-extirq interrupt controller fails to retrieve its parent IRQ."
},
{
"Commit": "1b1f04d8271e7ba70fbbb13754b1e869f70aa785",
"Fixed-by": "05cd654829dd2717e86a5a3f9ff301447fc28c93",
"subsystem": "irqchip",
"problem_description": "The ls-extirq driver fails to determine its interrupt parent because of_irq_init no longer searches for a parent if the interrupts property is missing."
},
{
"Commit": "9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e",
"Fixed-by": "e9acda52fd2ee0cdca332f996da7a95c5fd25294",
"subsystem": "bonding",
"problem_description": "use-after-free when enslavement fails after the slave has been added to the bonding slave array"
},
{
"Commit": "6e1ff1459e0086312e61c2d1ff8b74395a082fcb",
"Fixed-by": "213c4e51267fd825cd21a08a055450cac7e0b7fb",
"subsystem": "sound",
"problem_description": "The headphone GPIO was incorrectly set to the same value as the speaker enable signal, causing audio to play through both speakers and headphones simultaneously."
},
{
"Commit": "c1c9641a04e839604612eac99c827f8f3e0c4f06",
"Fixed-by": "f58442788fdac580c49e0c42379fd32438cff6d7",
"subsystem": "pinctrl",
"problem_description": "The pin group 'usb32_drvvbus0' was incorrectly renamed to 'usb32_drvvbus' during the conversion of bindings to DT schema, causing a mismatch with the driver."
},
{
"Commit": "6e261d1090d6db0e9dd22978b6f38a2c58558a3f",
"Fixed-by": "4f0d22ec60cee420125f4055af76caa0f373a3fe",
"subsystem": "pinctrl",
"problem_description": "The LPASS LPI driver is missing the .get_direction() callback, which prevents GPIOLIB from correctly determining the current direction of a pin."
},
{
"Commit": "20cf2aed89ac6d78a0122e31c875228e15247194",
"Fixed-by": "7ca497be00163610afb663867db24ac408752f13",
"subsystem": "gpio",
"problem_description": "Marking the controller as sleeping causes warnings when .get and .set are called in atomic context."
},
{
"Commit": "58f5d39d5ed8f2e43f230389ea0d59791afdcd55",
"Fixed-by": "7e3debb4c72fe840d60014192cf93950871fb3be",
"subsystem": "cpufreq",
"problem_description": "Missing sentinel in qcom_cpufreq_ipq806x_match_list of_device_id table causes out-of-bound access during traversal."
},
{
"Commit": "94f418a206648c9be6fd84d6681d6956b8f8b106",
"Fixed-by": "165c34fb6068ff153e3fc99a932a80a9d5755709",
"subsystem": "nfc",
"problem_description": "A race condition between nfc_llcp_send_ui_frame() and local_cleanup() causes a memory leak when an skb is queued to the transmission queue after it has already been purged."
},
{
"Commit": "bfec6d7f2001c7470c3cd261ae65a3ba8737f226",
"Fixed-by": "2c84959167d6493dbdac88965c7389b8ab88bf4e",
"subsystem": "net",
"problem_description": "Reading statistics times out when the link is down because the PHY stops the reference clock."
},
{
"Commit": "141694df6573b49aa4143c92556544b4b0bbda72",
"Fixed-by": "e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d",
"subsystem": "mptcp",
"problem_description": "A race condition in mptcp_pm_nl_flush_addrs_doit causes crashes because list_splice_init is used on an RCU-protected list without RCU safety."
},
{
"Commit": "e420114eef4a3a5025a243b89b0dc343101e3d3c",
"Fixed-by": "8d7ba71e46216b8657a82ca2ec118bc93812a4d0",
"subsystem": "rocker",
"problem_description": "Memory leak in rocker_world_port_post_fini() where rocker_port->wpriv is not freed if the port_post_fini callback is NULL."
},
{
"Commit": "3fa805c37dd4d3e72ae5c58800f3f46ab3ca1f70",
"Fixed-by": "bd58782995a2e6a07fd07255f3cc319f40b131c9",
"subsystem": "vmcoreinfo",
"problem_description": "The hwerr_data symbol is lost when the kernel is built with LTO because it is declared as static."
},
{
"Commit": "d245f9b4ab806733a77e51a218ca7b8bc3135cd9",
"Fixed-by": "12b2285bf3d14372238d36215b73af02ac3bdfc1",
"subsystem": "mm",
"problem_description": "Large zone device private folios may contain invalid pgmap fields and flags due to a lack of metadata reinitialization, leading to corrupt folios and kernel crashes."
},
{
"Commit": "3acb913c9d5bd8dcf61677ccba96d349e7681cf8",
"Fixed-by": "cbbbf7795fc35a740e1d09f3a55aba543b72a8d3",
"subsystem": "mm",
"problem_description": "deferred_init_memmap_chunk() incorrectly calls cond_resched() inside a spinlock critical section on PREEMPT_RT kernels where interrupts are not disabled, resulting in a sleeping-in-atomic bug."
},
{
"Commit": "0ce20dd840897b12ae70869c69f1ba34d6d16965",
"Fixed-by": "870ff19251bf3910dda7a7245da826924045fedd",
"subsystem": "mm",
"problem_description": "KFENCE allocation patterns are predictable due to deterministic freelist initialization."
},
{
"Commit": "fc33e4b44b2717feba2f6f07ce7943a96499c9ec",
"Fixed-by": "e86436ad0ad2a9aaf88802d69b68f02cbd1f04a9",
"subsystem": "kho",
"problem_description": "Allocation tags are not initialized when restoring pages from reserved memory, causing accounting mismatches and warnings."
},
{
"Commit": "b3749f174d686627f702234e64bad976dc432dbc",
"Fixed-by": "c657c5dc1360fa1ed1b090aedb5883d9cf9f0a0f",
"subsystem": "mm",
"problem_description": "serialization metadata is not freed if memfd file allocation fails"
},
{
"Commit": "b3749f174d686627f702234e64bad976dc432dbc",
"Fixed-by": "02e117b8ca58928f193e5b4df48d6763232f5e91",
"subsystem": "mm",
"problem_description": "Restored memfds fail writes larger than 2GiB and pread/pwrite operations, and lack proper security label initialization."
},
{
"Commit": "a91befde350375b1ff954635acdde14dc92cd9a8",
"Fixed-by": "dd9e2f5b38f1fdd49b1ab6d3a85f81c14369eacc",
"subsystem": "flex_proportions",
"problem_description": "A deadlock can occur if fprop_new_period is interrupted by a hardirq that attempts to read the same sequence counter."
},
{
"Commit": "18f41fa616ee4d66c67033eb46b951bf6e1b4a12",
"Fixed-by": "a148a2040191b12b45b82cb29c281cb3036baf90",
"subsystem": "mm",
"problem_description": "Per-node memory failure statistics are not updated when a newly poisoned subpage is found in an already poisoned hugetlb folio."
},
{
"Commit": "8b47299a411a178d572aaac31ff7ab33a8bd27e2",
"Fixed-by": "a0f3c0845a4ff68d403c568266d17e9cc553e561",
"subsystem": "mm",
"problem_description": "Marking the swap address space as read-only leads to a kernel panic when arch_prepare_to_swap fails under memory pressure, because the error handling path attempts to write to the read-only address space."
},
{
"Commit": "d699440f58ce9bd71103cc7b692e3ab76a20bfcd",
"Fixed-by": "9b47d4eea3f7c1f620e95bda1d6221660bde7d7b",
"subsystem": "mm",
"problem_description": "vrealloc() triggers a KASAN warning when the requested size is not aligned to KASAN_GRANULE_SIZE."
},
{
"Commit": "809bc86517cc408b5b8cb8e08e69096639432bc8",
"Fixed-by": "8a1968bd997f45a9b11aefeabdd1232e1b6c7184",
"subsystem": "mm",
"problem_description": "A race condition between shmem truncation and swap entry splitting allows shmem_free_swap to use an incorrect swap entry order, causing kernel panics or hangs."
},
{
"Commit": "9d16b482b059d784137881f3ec4bb121c5a2e6ee",
"Fixed-by": "39e9c376ac42705af4ed4ae39eec028e8bced9b4",
"subsystem": "platform/x86",
"problem_description": "The PSS telemetry info parsing incorrectly applies TELEM_INFO_SRAMEVTS_MASK instead of TELEM_INFO_NENABLES_MASK when extracting event register count, causing misdetection of hardware capabilities."
},
{
"Commit": "87bee290998d062937eecf40ad409480e7281b0e",
"Fixed-by": "25e9e322d2ab5c03602eff4fbf4f7c40019d8de2",
"subsystem": "platform/x86",
"problem_description": "The debugfs interface for Intel telemetry incorrectly swaps the LTR blocking statistics and S0ix wakeup event counters when displaying PSS states."
},
{
"Commit": "23d0ba0c908ac10139f0351023c64198d7fc1409",
"Fixed-by": "128497456756e1b952bd5a912cd073836465109d",
"subsystem": "platform/x86",
"problem_description": "Memory leaks occur in the add and remove routines of the toshiba_haps driver because the allocated object is not freed."
},
{
"Commit": "1e12dbae9d726b1e4ada1e5e101ccf6bb7a8c8aa",
"Fixed-by": "ca8dcfedac480e424b8860e3d1394afdcdc550fe",
"subsystem": "drm/xe",
"problem_description": "the MEM_COPY capability was redundantly set in platform descriptors instead of being derived from the graphics version"
},
{
"Commit": "ca33cd271ef9b27acddf96742eef136d0f4caaa5",
"Fixed-by": "051be49133971076717846e2a04c746ab3476282",
"subsystem": "drm/xe",
"problem_description": "Workaround Wa_18022495364 incorrectly writes to the CS_DEBUG_MODE1 register instead of CS_DEBUG_MODE2 due to a typo."
},
{
"Commit": "dd08ebf6c3525a7ea2186e636df064ea47281987",
"Fixed-by": "c73a8917b31e8ddbd53cc248e17410cec27f8f58",
"subsystem": "drm/xe",
"problem_description": "Sync-only parallel executions fail with -EFAULT because the driver attempts to copy batch buffer addresses from userspace even when none are provided."
},
{
"Commit": "53096728b8910c6916ecc6c46a5abc5c678b58d9",
"Fixed-by": "12f15d52d38ac53f7c70ea3d4b3d76afed04e064",
"subsystem": "drm",
"problem_description": "Userspace can trigger a kernel warning in drm_gem_change_handle_ioctl by passing a new handle larger than INT_MAX, because the underlying idr_alloc function operates on signed integers."
},
{
"Commit": "ffe450cb6bce16eb15f6bf90b85b7e5f9bfbc1e3",
"Fixed-by": "403a0591be681eebc0c4825f8b42afe7fd13ee7f",
"subsystem": "sound",
"problem_description": "The name_prefix for the rt1320_2_group2_adr device is incorrectly set to 'rt1320-1' instead of 'rt1320-2'."
},
{
"Commit": "818d78ba1b3f88d2bfee249f25020211488a26c3",
"Fixed-by": "ba89709a3610ba27a2eef2e127f3f4fc5b64d5f7",
"subsystem": "riscv",
"problem_description": "Sparse warnings were introduced due to missing static qualifiers for arch_ext_list and nr_arch_exts, and an incorrect cast removing the __user address space annotation."
},
{
"Commit": "d7659acca7a390b5830f0b67f3aa4a5f9929ab79",
"Fixed-by": "e440bc5c190cd0e5f148b2892aeb1f4bbbf54507",
"subsystem": "scripts",
"problem_description": "rust-analyzer fails to resolve `#[pin_data]` annotated structs due to a missing dependency on the `pin_init` crate"
},
{
"Commit": "cf4fd52e323604ccfa8390917593e1fb965653ee",
"Fixed-by": "b0581f6ab952ffd135ca4402d2ee3da641538d6b",
"subsystem": "drm/tyr",
"problem_description": "The Tyr driver fails to build without `CONFIG_COMMON_CLK` due to unresolved imports of `Clk` and `OptionalClk`."
},
{
"Commit": "84c6d36bcaf98a8c0533cd334a624d536d20879b",
"Fixed-by": "bd36f6e2abf7f85644f7ea8deb1de4040b03bbc1",
"subsystem": "rust",
"problem_description": "Running `rusttest` on a 64-bit host for a 32-bit target causes a panic due to a size mismatch between `isize` and `isize_atomic_repr`."
},
{
"Commit": "186623f4aa724c46cbb4dbd5235cf6942215f5b5",
"Fixed-by": "709bbb015538dfd5c97308b77c950d41a4d95cd3",
"subsystem": "net",
"problem_description": "the MIB counter wraparound detection logic is broken, preventing correct 64-bit statistics accumulation"
},
{
"Commit": "1baf30426553efb3ac518b0e9d5c1c3f8ed7762a",
"Fixed-by": "ca12c4a155ebf84e9ef29b05ce979bc89364290f",
"subsystem": "net/mlx5",
"problem_description": "The function mlx5_esw_vport_vhca_id declared to return bool incorrectly returns a negative integer error code."
},
{
"Commit": "d642b012df70a76dd5723f2d426b40bffe83ac49",
"Fixed-by": "f0813bcd2d9d97fdbdf2efb9532ab03ae92e99e6",
"subsystem": "net/wwan",
"problem_description": "Potential buffer overflow in skb fragments array in t7xx_dpmaif_set_frag_to_skb() due to missing check for MAX_SKB_FRAGS."
},
{
"Commit": "1b70d792cf6775fb5d0737524387893daeb5374a",
"Fixed-by": "03cbcdf93866e61beb0063392e6dbb701f03aea2",
"subsystem": "ipv6",
"problem_description": "ICMPv6 echo replies to localhost addresses incorrectly use the physical device index instead of the loopback interface, causing local pings to fail."
},
{
"Commit": "f4f1ba18195dfb10838b4a221a942a2a7d218ca9",
"Fixed-by": "09f979d1f312627b31d2ee1e46f9692e442610cd",
"subsystem": "net",
"problem_description": "memory allocated for ethtool_rule is not freed if the flow type conversion fails in mvpp2_ethtool_cls_rule_ins"
},
{
"Commit": "040cef30b5e67271e3193e0206f82b206fc97095",
"Fixed-by": "944c614b0a7afa5b87612c3fb557b95a50ad654c",
"subsystem": "sfc",
"problem_description": "A deadlock occurs in the sfc driver during RSS configuration reads because it attempts to acquire the rss_lock that is already held by the ethtool core."
},
{
"Commit": "6e9722e9a7bfe1bbad649937c811076acf86e1fd",
"Fixed-by": "6342969dafbc63597cfc221aa13c3b123c2800c5",
"subsystem": "keys",
"problem_description": "TPM2 unseal fails because the parent key handle is incorrectly passed to tpm_buf_append_name instead of the blob handle."
},
{
"Commit": "b48fe9af1e60360baf09ca6b7a3cd6541f16e611",
"Fixed-by": "1aaedafb21f38cb872d44f7608b4828a1e14e795",
"subsystem": "ALSA",
"problem_description": "The previous quirk entry failed to enable headset microphone detection on TongFang X6AR55xU devices."
},
{
"Commit": "769b8b2ffded4cd880669edd83e2952efeeb27f7",
"Fixed-by": "0444568edbf87c1da76b61c798ce0f1c1e478467",
"subsystem": "ufs",
"problem_description": "PHY initialization is performed before the host controller is enabled, causing potential timing issues."
},
{
"Commit": "a511ce3397803558a3591e55423f3ae6aa28c9db",
"Fixed-by": "b2d6b1d443009ed4da2d69f5423ab38e5780505a",
"subsystem": "scsi",
"problem_description": "The sbp_make_tpg() function silently truncates TPGT values to 16 bits because it validates the input against UINT_MAX instead of the 16-bit limit."
},
{
"Commit": "50a4b824be9e4a01f3b87790865e26b1546fcbb8",
"Fixed-by": "4747bafaa50115d9667ece446b1d2d4aba83dc7f",
"subsystem": "scsi",
"problem_description": "Memory leak in beiscsi_boot_get_sinfo() when nonemb_cmd->va allocation fails"
},
{
"Commit": "84318a9f01ce13650ea23eb6362066bb95ccc9fe",
"Fixed-by": "56bd3c0f749f45793d1eae1d0ddde4255c749bf6",
"subsystem": "scsi",
"problem_description": "dma_free_coherent() uses incorrect size SFP_DEV_SIZE instead of the actual allocation size in the error path."
},
{
"Commit": "5e7665b5e484b32872bc1f44263940f094ccd814",
"Fixed-by": "dedb897f11c5d7e32c0e0a0eff7cec23a8047167",
"subsystem": "drm/msm",
"problem_description": "The A690 hardware clock gating sequence includes two bogus GMU register writes that trigger faults and break boot on affected devices."
},
{
"Commit": "d7659acca7a390b5830f0b67f3aa4a5f9929ab79",
"Fixed-by": "a44bfed9df8a514962e2cb076d9c0b594caeff36",
"subsystem": "kbuild",
"problem_description": "make mrproper fails to remove the generated libpin_init_internal.so and libpin_init_internal.dylib files"
},
{
"Commit": "f5b2b966f032f22d3a289045a5afd4afa09f09c6",
"Fixed-by": "f6c3665b6dc53c3ab7d31b585446a953a74340ef",
"subsystem": "bonding",
"problem_description": "Data races occur when accessing slave->last_rx and slave->target_last_arp_rx locklessly."
},
{
"Commit": "577f0d1b1c5f3282fa2011177b0af692a7c21aee",
"Fixed-by": "8016dc5ee19a77678c264f8ba368b1e873fa705b",
"subsystem": "octeon_ep",
"problem_description": "Memory leak in octep_device_setup() when octep_ctrl_net_init() fails due to returning directly without performing necessary resource cleanup."
},
{
"Commit": "490cb412007de593e07c1d3e2b1ec4233886707c",
"Fixed-by": "6de4436bf369e1444606445e4cd5df5bcfc74b48",
"subsystem": "net",
"problem_description": "Fixed PHY link is not deregistered when bcmasp_interface_create fails."
},
{
"Commit": "e30f8e61e2518a837837daa26cda3c8cc30f3226",
"Fixed-by": "361eb853c655288f3b5c8020f6cd95d69ffe6479",
"subsystem": "tracing",
"problem_description": "memory leak in add_string() when realloc() fails"
},
{
"Commit": "f83ac7544fbf7ba3f77c122e16ab5319f75bbdfd",
"Fixed-by": "c9703d17d2c86eda38fe4917ca70c27ec9dbe162",
"subsystem": "function_graph",
"problem_description": "print_graph_retval() passes a mismatched args pointer to print_function_args() when both funcgraph-args and funcgraph-retaddr are enabled, causing invalid parameters to be displayed."
},
{
"Commit": "00cf3d672a9dd409418647e9f98784c339c3ff63",
"Fixed-by": "90f9f5d64cae4e72defd96a2a22760173cb3c9ec",
"subsystem": "tracing",
"problem_description": "kernel crash occurs when a new synthetic event uses a stacktrace field from an existing synthetic event"
},
{
"Commit": "79a6d1bfe1148bc921b8d7f3371a7fbce44e30f7",
"Fixed-by": "494fc029f662c331e06b7c2031deff3c64200eed",
"subsystem": "can",
"problem_description": "uses an uninitialized netdev pointer and logs the incorrect error code when usb_submit_urb fails in gs_usb_receive_bulk_callback"
},
{
"Commit": "bfc467db60b76c30ca1f7f02088a219b6d5b6e8c",
"Fixed-by": "32f37e57583f869140cff445feedeea8a5fea986",
"subsystem": "serial",
"problem_description": "User-space can open the console immediately after registration but before the TTY port is linked to the driver, resulting in a race condition that triggers a kernel warning or crash."
},
{
"Commit": "5d74781ebc86c5fa9e9d6934024c505412de9b52",
"Fixed-by": "61ceaf236115f20f4fdd7cf60f883ada1063349a",
"subsystem": "vfio",
"problem_description": "Pinned DMABUF importers, which cannot handle invalidation, are not prevented from attaching to VFIO DMABUFs."
},
{
"Commit": "e837456fdca81899a3c8e47b3fd39e30eae6e291",
"Fixed-by": "15257cc2f905dbf5813c0bfdd3c15885f28093c4",
"subsystem": "sched",
"problem_description": "Aggressive preemption logic bypasses slice protection and run_to_parity when a waker becomes ineligible, leading to excessive rescheduling and unintended task selection."
},
{
"Commit": "158a3b72118a4dab7e7bf2d89afbab9b96eddc1c",
"Fixed-by": "4c4e62321a41747390bc167f9c581408f6e0d322",
"subsystem": "rust",
"problem_description": "The proc-macro2 crate is not rebuilt when the Rust compiler version changes, causing build errors due to version incompatibility."
},
{
"Commit": "07bab9502641dff9c3c864162270d12c6dd0e834",
"Fixed-by": "108948f723b13874b7ebf6b3f1cc598a7de38622",
"subsystem": "net/mlx5",
"problem_description": "Memory leak in esw_acl_ingress_lgcy_setup() where the previously created counter is not released if esw_acl_table_create() fails."
},
{
"Commit": "bdce162f2e57a969803e5e9375999a3e0546905f",
"Fixed-by": "841e47d56cef9b96fd2314220e3d0f1d92c719f4",
"subsystem": "riscv",
"problem_description": "A build warning 'cast to pointer from integer of different size' occurs on 32-bit RISC-V when casting a 64-bit temporary variable directly to a pointer."
},
{
"Commit": "ca4c6a9858c23b4f330113f391f2eadc983e780f",
"Fixed-by": "614da1d3d4cdbd6e41aea06bc97ec15aacff6daf",
"subsystem": "x86",
"problem_description": "interrupts may remain enabled when returning from kernel address page faults"
},
{
"Commit": "1ead2213dd7d14fecad7414e9dbeb2161cfcf8c3",
"Fixed-by": "8e50cd059ca8fd0376c53f703fca721fbcb5372e",
"subsystem": "smb/server",
"problem_description": "The kernel-doc comment incorrectly refers to the function as ksmbd_vfs_kern_path_start_remove instead of ksmbd_vfs_kern_path_start_removing."
},
{
"Commit": "0626e6641f6b467447c81dd7678a69c66f7746cf",
"Fixed-by": "98e3e2b561bc88f4dd218d1c05890672874692f6",
"subsystem": "ksmbd",
"problem_description": "dma_unmap_sg() is called with the return value of dma_map_sg() instead of the original number of entries."
},
{
"Commit": "302a1f674c00dd5581ab8e493ef44767c5101aab",
"Fixed-by": "1b9c17fd0a7fdcbe69ec5d6fe8e50bc5ed7f01f2",
"subsystem": "Bluetooth",
"problem_description": "Memory leak of mgmt_pending_cmd structures in set_ssp_complete and set_advertising_complete because they are not freed after being removed from the pending list."
},
{
"Commit": "5df5dafc171b90d0b8d51547a82657cd5a1986c7",
"Fixed-by": "0c3cd7a0b862c37acbee6d9502107146cc944398",
"subsystem": "Bluetooth",
"problem_description": "NULL pointer dereference in hci_uart_write_work due to a race condition where the HCI_UART_PROTO_INIT flag is set before the protocol's private data is initialized."
},
{
"Commit": "337b1b566db087347194e4543ddfdfa5645275cc",
"Fixed-by": "5528fd38f230c906fcebb202cc94fbb8ed8f122a",
"subsystem": "pci",
"problem_description": "During BAR resize rollback, restoring the BAR address before the BAR size causes address restoration to fail due to read-only bit collisions."
},
{
"Commit": "337b1b566db087347194e4543ddfdfa5645275cc",
"Fixed-by": "08d9eae76b85263173f8c833800e3cc409ee1be4",
"subsystem": "pci",
"problem_description": "The error code in `ret` is overwritten by the return value of `pci_claim_resource` during the BAR resize rollback path, causing the function to incorrectly return success."
},
{
"Commit": "997814491cee7b19c162ad82439818e555f99ad9",
"Fixed-by": "4a3dba48188208e4f66822800e042686784d29d1",
"subsystem": "octeontx2-af",
"problem_description": "Kernel panic occurs due to NULL pointer dereference of fwdata on boards booted without a MAC block."
},
{
"Commit": "9431063ad323ac864750aeba4d304389bc42ca4e",
"Fixed-by": "f3ddbaaaaf4d0633b40482f471753f9c71294a4a",
"subsystem": "dpll",
"problem_description": "Duplicate pin registrations are silently accepted, causing warnings during unregistration."
},
{
"Commit": "295a6e06d21e1f469c9f38b00125a13b60ad4e7c",
"Fixed-by": "27880b0b0d35ad1c98863d09788254e36f874968",
"subsystem": "net/sched",
"problem_description": "The function tcf_ife_encode fails to check if ife_encode returns NULL, leading to a potential NULL pointer dereference."
},
{
"Commit": "17fcb3dc12bbee8ec3e32ca1f60898f252e06b2d",
"Fixed-by": "fb2bb2a1ebf7b9514c32b03bb5c3be5d518d437b",
"subsystem": "hinic3",
"problem_description": "The netif_queue_set_napi function is called with the interrupt number instead of the queue index, and a redundant netif_stop_subqueue call is performed."
},
{
"Commit": "3ecc09856afb83a02c4079db595f9dcc8122b3be",
"Fixed-by": "0baa4d3170d72a2a8dc93bf729d6d04ad113dc72",
"subsystem": "can",
"problem_description": "Memory leak of net_device structure in at91_can_probe() if devm_phy_optional_get() fails."
},
{
"Commit": "06a8fc78367d070720af960dcecec917d3ae5f3b",
"Fixed-by": "8ee784fdf006cbe8739cfa093f54d326cbf54037",
"subsystem": "virtio/vsock",
"problem_description": "A malicious peer can force excessive memory allocation by advertising a large receive buffer because TX credit is not capped by local buffer size limits."
},
{
"Commit": "5c338112e48ab1937f99e4a8990a82c999fda126",
"Fixed-by": "0a98de80136968bab7db37b16282b37f044694d3",
"subsystem": "vsock",
"problem_description": "The seqpacket message bounds test hangs because the sender fills the TX buffer before waking up the receiver."
},
{
"Commit": "06a8fc78367d070720af960dcecec917d3ae5f3b",
"Fixed-by": "3ef3d52a1a9860d094395c7a3e593f3aa26ff012",
"subsystem": "virtio/vsock",
"problem_description": "Unsigned arithmetic underflow in credit calculation allows excessive data queuing if the peer shrinks its advertised buffer."
},
{
"Commit": "53280e398471f0bddbb17b798a63d41264651325",
"Fixed-by": "3ef825dfd4e487d6f92b23ee2df2455814583ef4",
"subsystem": "bcache",
"problem_description": "Hijacking the bi_end_io and bi_private fields of the incoming bio is fragile and breaks if the bio is processed by other layers."
},
{
"Commit": "f22ecf9c14c12918e30f2179ef516e99eb8b2e49",
"Fixed-by": "046be7e5967ef80547f7fd8a399e932f5338d5d4",
"subsystem": "blk-mq",
"problem_description": "aggressive spinning in blk_hctx_poll prevents the completion task from running causing a lockup"
},
{
"Commit": "3e86e4d74c0490e5fc5a7f8de8f29e7579c9ffe5",
"Fixed-by": "ddc6cbef3ef10359b5640b4ee810a520edc73586",
"subsystem": "s390",
"problem_description": "The .modinfo section is incorrectly placed after the SecureBoot trailer in bzImage, breaking SecureBoot verification."
},
{
"Commit": "5ea558473fa31f4eeb5c76d58277a7ab68fd501d",
"Fixed-by": "e351836a54e3b0b4483f896abcd6a0dc71097693",
"subsystem": "i2c",
"problem_description": "Using IRQF_ONESHOT without a threaded interrupt handler triggers a kernel warning."
},
{
"Commit": "32b2633219d3509d8174737bb0a8afa060e55655",
"Fixed-by": "5cfc828502cbd0c827113bdb5694c2658af2c37c",
"subsystem": "mmc",
"problem_description": "The Eswin EIC7700 controller ignores the 128MB DMA boundary limitation because the adma_write_desc callback is missing."
},
{
"Commit": "32b2633219d3509d8174737bb0a8afa060e55655",
"Fixed-by": "fd9809ec6704db0c162b4510b11f877ec7b72065",
"subsystem": "mmc",
"problem_description": "The AXI clock is not enabled during initialization, preventing access to High-Speed registers."
},
{
"Commit": "62b5bb7be7bc3dcf87a2ab6ceced88164a626397",
"Fixed-by": "ca1bb3fedf26a08ed31974131bc0064d4fe33649",
"subsystem": "net",
"problem_description": "valid VLAN-tagged frames are incorrectly rejected as oversized because the 4-byte VLAN header was not accounted for in the maximum frame length calculation"
},
{
"Commit": "1933ea365aa7a48ce26bea2ea09c9f7cc48cc668",
"Fixed-by": "cc4816bdb08639e5cd9acb295a02d6f0f09736b4",
"subsystem": "openvswitch",
"problem_description": "Upcall statistics are accumulated directly inside the u64_stats_fetch_retry loop, leading to double-counting if a concurrent update forces a retry."
},
{
"Commit": "85ed24dad2904f7c141911d91b7807ab02694b5e",
"Fixed-by": "d2907cbe9ea0a54cbe078076f9d089240ee1e2d9",
"subsystem": "arm64",
"problem_description": "Restoring SVE signal context can lead to out-of-bounds memory reads or SIGKILL if streaming mode is enabled, and fails to disable streaming mode if it was previously active."
},
{
"Commit": "39782210eb7e87634d96cacb6ece370bc59d74ba",
"Fixed-by": "ea8ccfddbce0bee6310da4f3fc560ad520f5e6b4",
"subsystem": "arm64",
"problem_description": "restore_za_context() sets TIF_SME without allocating sve_state, causing a NULL pointer dereference in sve_save_state."
},
{
"Commit": "9f8bf718f29230e38a048d08fc3063e316cd60c1",
"Fixed-by": "128a7494a9f15aad60cc6b7e3546bf481ac54a13",
"subsystem": "arm64",
"problem_description": "TIF_SVE is not set when writing SVE registers via ptrace on systems without SME support"
},
{
"Commit": "9e978741488261e117bb50e5dfcf8e4080990958",
"Fixed-by": "bdcdf968be314b6fc8835b99fb4519e7619671e6",
"subsystem": "drm/xe",
"problem_description": "xe userptr support is implicitly disabled on kernels without CONFIG_DEVICE_PRIVATE set"
},
{
"Commit": "ef105316819d448630b83044fa83ba12905d9086",
"Fixed-by": "0a095b64fa5b4b1edfeb2e9b1751e044230c5d73",
"subsystem": "drm/i915",
"problem_description": "Memory leak in intel_color_pipeline_plane_init() where allocated enum name strings are not freed."
},
{
"Commit": "c1e578bd08da79f3bd877faa82e9197ccd3ecd57",
"Fixed-by": "cce30b8311e8a342f97cee60a72c2d921605adbd",
"subsystem": "drm/vkms",
"problem_description": "Memory leak of the color pipeline enum name string allocated in vkms_initialize_color_pipeline."
},
{
"Commit": "9ba25915efbaafc8a0794cc332aa517c76875178",
"Fixed-by": "7d8257fe2590fea9fef8071507f3b8a052c5e3d1",
"subsystem": "drm/amd/display",
"problem_description": "Memory leak of color pipeline enum names in dm_plane_init_colorops where strings allocated by kasprintf are not freed after use."
},
{
"Commit": "65db7a1f9cf772d733358de032fee60ad770c1e8",
"Fixed-by": "7261305d22a729fb7f8a3187414c145a492787d4",
"subsystem": "drm/i915",
"problem_description": "The 3D LUT block was incorrectly positioned before the CSC (Color Space Conversion) block in the plane color pipeline."
},
{
"Commit": "746ea74241fa04f7a8c3146adc08b618d88681e2",
"Fixed-by": "19e4175e997a5b85eab97d522f00cc99abd1873c",
"subsystem": "octeontx2-af",
"problem_description": "Partially attached resources are not cleaned up if an error occurs during resource provisioning."
},
{
"Commit": "a003c38d9bbbacd26b2354795bddb8d25631b0b5",
"Fixed-by": "e8ca461f7d19464b47c64fe4cf2f83162421bcc0",
"subsystem": "net",
"problem_description": "The driver incorrectly reports that in-band status negotiation is not supported for the 2500Base-X interface mode."
},
{
"Commit": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b",
"Fixed-by": "5d5fe8bcd331f1e34e0943ec7c18432edfcf0e8b",
"subsystem": "rxrpc",
"problem_description": "Data race and potential load/store tearing occur on 32-bit architectures when accessing the 64-bit last_tx_at timestamp locklessly."
},
{
"Commit": "3f9bb0301d50ce27421eff4b710c2bbe58111a83",
"Fixed-by": "dfca045cd4d0ea07ff4198ba392be3e718acaddc",
"subsystem": "net: dsa",
"problem_description": "An off-by-one error in the bridge ID range check prevents the use of the highest valid bridge ID."
},
{
"Commit": "e9f31435ee7d1dd350f5efaf9de7b0db3ad4bbfe",
"Fixed-by": "bbb11b8d758d17a4ce34b8ed0b49de150568265b",
"subsystem": "net",
"problem_description": "Network filter wake configuration uses an incorrect output channel for asp-3.0 devices."
},
{
"Commit": "58deb77cc52da9360d20676e68dd215742cbe473",
"Fixed-by": "5f9b329096596b7e53e07d041d7fca4cbe1be752",
"subsystem": "bonding",
"problem_description": "Passing a NULL network namespace pointer to __skb_flow_dissect() causes a kernel warning."
},
{
"Commit": "c08e8baea78e472383d6b295bb8db2132068c358",
"Fixed-by": "04708606fd7bdc34b69089a4ff848ff36d7088f9",
"subsystem": "selftests",
"problem_description": "AMT tests fail because packets are sent before the tunnel connection is established or the listener socket is ready."
},
{
"Commit": "95046b927a54f461766f83a212c6a93bc5fd2e67",
"Fixed-by": "8215794403d264739cc676668087512950b2ff31",
"subsystem": "be2net",
"problem_description": "NULL pointer dereference in be_cmd_get_mac_from_list when called with a NULL pmac_id pointer while pmac_id_valid is false"
},
{
"Commit": "eeecf5d3a3a484cedfa3f2f87e6d51a7390ed960",
"Fixed-by": "2030c4358bd8451583f2e010108607de5cdac5dc",
"subsystem": "net",
"problem_description": "MHI WWAN devices fail to connect to the internet."
},
{
"Commit": "8b7d92cad9532b8227daf64e13739d22eb910c15",
"Fixed-by": "d0bd10792d6cc3725ddee43f03fd6ee234f24844",
"subsystem": "drm/nouveau",
"problem_description": "Missing DCB connector types caused initialization failures and unknown connectors triggered a kernel warning."
},
{
"Commit": "8b7d92cad9532b8227daf64e13739d22eb910c15",
"Fixed-by": "3036b4ce4b209af690fa776e4616925892caba4c",
"subsystem": "drm/nouveau",
"problem_description": "Kernel warnings occur on devices with certain display connectors because the driver logic rewrite failed to account for all DCB connector types."
},
{
"Commit": "77cc0da39c7ce203cd3ce6bc5696421947a979d7",
"Fixed-by": "095ca815174e51fc0049771712d5455cabd7231e",
"subsystem": "drm/amdgpu",
"problem_description": "The end_wptr parameter in amdgpu_ring_backup_unprocessed_command was incorrectly typed as u32 instead of u64."
},
{
"Commit": "841686df9f7d2942cfd94d024b8591fa3f74ef7c",
"Fixed-by": "764a90eb02268a23b1bb98be5f4a13671346804a",
"subsystem": "drm/amd/pm",
"problem_description": "Powertune aggressively throttles Radeon 430 and 520 GPUs, preventing them from reaching their maximum SCLK."
},
{
"Commit": "841686df9f7d2942cfd94d024b8591fa3f74ef7c",
"Fixed-by": "d5077426e1a76d269e518e048bde2e9fc49b32ad",
"subsystem": "drm/amd/pm",
"problem_description": "The SMC table is incorrectly cleared and power limits are unnecessarily recalculated when setting the power limit."
},
{
"Commit": "841686df9f7d2942cfd94d024b8591fa3f74ef7c",
"Fixed-by": "4ca284c6d15dda481f714e3687a1d5fb70b3bf5c",
"subsystem": "drm/amd/pm",
"problem_description": "The mmCG_THERMAL_INT register is incorrectly accessed using WREG32_SMC instead of WREG32, which is required for this direct access register."
},
{
"Commit": "436326bc525d467e38db1da576139ec5f28268c5",
"Fixed-by": "3f2de814c0597c97d5abe09a1635d8c4e2fddaf2",
"subsystem": "objtool",
"problem_description": "Undefined reference errors occur when linking static libopcodes because the feature check does not verify or link against required dependencies like libbfd."
},
{
"Commit": "aa60fe12b4f49f49fc73e5023f8675e2df1f7805",
"Fixed-by": "0d0f1314e8f86f5205f71f9e31e272a1d008e40b",
"subsystem": "btrfs",
"problem_description": "folios are leaked in the zlib S390 hardware acceleration path because the code fails to release them using folio_put"
},
{
"Commit": "17e3e88ed0b6318fde0d1c14df1a804711cab1b5",
"Fixed-by": "98c88dc8a1ace642d9021b103b28cba7b51e3abc",
"subsystem": "sched",
"problem_description": "The PELT clock was updated too early in pick_next_task_fair(), before the previous scheduling class could update its signals, leading to incorrect util_avg for RT runqueues."
},
{
"Commit": "448f97fba9013ffa13f5dd82febd18836b189499",
"Fixed-by": "d06bf78e55d5159c1b00072e606ab924ffbbad35",
"subsystem": "perf",
"problem_description": "The conversion to refcount_t triggers a use-after-free warning when refcount_inc is called on a zero mmap_count in perf_mmap_rb, which occurs when an event aliases another event's ring buffer."
},
{
"Commit": "190f4c2c863af7cc5bb354b70e0805f06419c038",
"Fixed-by": "0fcee2cfc4b2e16e62ff8e0cc2cd8dd24efad65e",
"subsystem": "nvmet",
"problem_description": "race condition leading to NULL pointer dereference due to bio_uninit being called on a bio that is being re-submitted"
},
{
"Commit": "6aecda00b7d1e187c31e702d607d2b51bbcddbcc",
"Fixed-by": "e7e1cc18f120a415646be12470169a978a1adcd9",
"subsystem": "selftests/ublk",
"problem_description": "The event file descriptor defaults to stdin causing garbage output, and a debug message has an invalid format string."
},
{
"Commit": "6aecda00b7d1e187c31e702d607d2b51bbcddbcc",
"Fixed-by": "23e62cf75518825aac12e9a22bdc40f062428898",
"subsystem": "ublk",
"problem_description": "Device deletion may hang due to uncancelled inflight commands and threads are not properly cleaned up if ublk_start_daemon fails."
},
{
"Commit": "6aecda00b7d1e187c31e702d607d2b51bbcddbcc",
"Fixed-by": "75aad5ffe099a1b1a342257236dc260493917ed2",
"subsystem": "selftests/ublk",
"problem_description": "The IO thread may exit before all FETCH commands are completed, which can cause device deletion to hang."
},
{
"Commit": "0bf0e2e4666822b62d7ad6473dc37fd6b377b5f1",
"Fixed-by": "f5f2bad67a45cd1ef6f5b727da104694a81b3666",
"subsystem": "block",
"problem_description": "The UAPI constants BLK_ZONE_COND_ACTIVE and BLK_ZONE_REP_CACHED are defined only as enums, preventing userspace from using preprocessor directives to discover if they are supported by the installed system headers."
},
{
"Commit": "c2c8089f325ed703fd5123b39e2dece1dd605904",
"Fixed-by": "47bdf1d29caec7207b7f112230055db36602dfc0",
"subsystem": "ublk",
"problem_description": "PID validation fails when the ublk server runs in a PID namespace because the driver compares the global kernel PID against the namespaced userspace PID."
},
{
"Commit": "6b8ef44cc0a952549a6773a0233cee853f807a79",
"Fixed-by": "f262015b9797effdec15e8a81c81b2158ede9578",
"subsystem": "drm/xe",
"problem_description": "The driver's internal wedged mode state is updated without verifying if the corresponding GuC reset policy update succeeded, leading to a potential mismatch between the reported state and the actual hardware reset behavior."
},
{
"Commit": "dba89840a920ffcab7a722299510f89d7800d79b",
"Fixed-by": "772157f626d0e1a7c6d49dffb0bbe4b2343a1d44",
"subsystem": "drm/xe",
"problem_description": "The migrate job lock assertion incorrectly checks the migrate VM instead of the user VM."
},
{
"Commit": "dd08ebf6c3525a7ea2186e636df064ea47281987",
"Fixed-by": "6f4b7aed61817624250e590ba0ef304146d34614",
"subsystem": "drm/xe",
"problem_description": "Sharing a bind queue across multiple VMs is broken due to unsafe assumptions about user VM lock acquisition."
},
{
"Commit": "a060b8c511abb0997381b397e52149a5e3e5259a",
"Fixed-by": "4918cc05137cb347686462923ab3fd249ef7899d",
"subsystem": "gpio",
"problem_description": "The shared GPIO implementation manually marked descriptors as requested instead of calling the commit function, failing to propagate configuration to pinctrl."
},
{
"Commit": "af92793e52c3a99b828ed4bdd277fd3e11c18d08",
"Fixed-by": "99a3e3a1cfc93b8fe318c0a3a5cfb01f1d4ad53c",
"subsystem": "slab",
"problem_description": "kmalloc_nolock() triggers a sleeping in atomic bug on PREEMPT_RT kernels when called with preemption disabled."
},
{
"Commit": "4ac1dd3245b9067f929ab30141bb0475e9e32fc5",
"Fixed-by": "c06343be0b4e03fe319910dd7a5d5b9929e1c0cb",
"subsystem": "clocksource",
"problem_description": "The watchdog readout delay limit was too large, causing stable clocksources to be incorrectly marked as unstable."
},
{
"Commit": "ef5749ef8b307bf8717945701b1b79d036af0a15",
"Fixed-by": "70b4db7d258118a7464f039112a74ddb49a95b06",
"subsystem": "ALSA",
"problem_description": "The fix for OOB access used an incorrect limit (max_urb_frames) instead of the actual buffer size, causing choppy sound regressions on some devices."
},
{
"Commit": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"Fixed-by": "ba1096c315283ee3292765f6aea4cca15816c4f7",
"subsystem": "netrom",
"problem_description": "Double-free of skb in nr_route_frame() when nr_neigh->ax25 is NULL."
},
{
"Commit": "efabce29015189cb5cd8066cf29eb1d754de6c3c",
"Fixed-by": "cdf8de9c6bfe94508d251cb290ee66e34e6f3368",
"subsystem": "octeontx2-pf",
"problem_description": "verification of XDP_REDIRECT and zero-copy features failed because the driver is not setting the corresponding feature flags"
},
{
"Commit": "f77f0aee4da4beff5042b49913e856539f23adff",
"Fixed-by": "c7159e960f1472a5493ac99aff0086ab1d683594",
"subsystem": "usbnet",
"problem_description": "The driver fails to limit net->max_mtu to the device's hard_mtu, allowing userspace to configure an MTU larger than the hardware can handle which causes silent packet drops."
},
{
"Commit": "c4f3f114e73c331f02c7188af650901ee3bad2c1",
"Fixed-by": "f6cc7f1c11a776fd2ebc2016be42e7581063dc6e",
"subsystem": "drm/amd/display",
"problem_description": "Polling was incorrectly enabled for non-HPD connectors such as eDP and LVDS, causing issues with the seamless boot process."
},
{
"Commit": "db36632ea51e8b02dd637d291c755899b20a5a31",
"Fixed-by": "82a401ceffba9120fae937e0a504dbe7e5d63003",
"subsystem": "drm/amdgpu",
"problem_description": "Memory leak of allocated amdgpu_fence struct in amdgpu_ib_schedule() when amdgpu_fence_emit() fails."
},
{
"Commit": "db36632ea51e8b02dd637d291c755899b20a5a31",
"Fixed-by": "8e96b36d9bfd841e14ee8f9e1b77145e52fff3a3",
"subsystem": "drm/amdgpu",
"problem_description": "The hw_vm_fence structure is leaked if drm_sched_job_init fails within amdgpu_job_alloc."
},
{
"Commit": "49b99da2c9ce13ffcd93fe3a0f5670791c1d76f7",
"Fixed-by": "9a063f96d87efc3a6cc667f8de096a3d38d74bb5",
"subsystem": "ipv6",
"problem_description": "A data race occurs in ndisc_router_discovery() when accessing in6_dev->ra_mtu without holding a lock."
},
{
"Commit": "1b2b03f8e514e4f68e293846ba511a948b80243c",
"Fixed-by": "8175dbf174d487afab81e936a862a8d9b8a1ccb6",
"subsystem": "mISDN",
"problem_description": "A data race occurs on dev->work in timerdev.c because it is accessed locklessly in mISDN_read() and mISDN_poll() without READ_ONCE/WRITE_ONCE annotations."
},
{
"Commit": "d84a3ff9aae815c51c40b9b61e1bf26b7256eebf",
"Fixed-by": "3d778e65b4f44c6af4901d83020bb8a0a010f39e",
"subsystem": "net",
"problem_description": "The txgbe driver fails to probe with OEM firmware because it unnecessarily attempts to read return data from firmware mailbox commands."
},
{
"Commit": "117328680288b55d5eb43f4c697d841fb4abf67a",
"Fixed-by": "f87e034d16e43af984380a95c32c25201b7759a7",
"subsystem": "net",
"problem_description": "The flow director next key field is incorrectly set using the counter ID instead of the next input key."
},
{
"Commit": "117328680288b55d5eb43f4c697d841fb4abf67a",
"Fixed-by": "d57c67c956a1bad15115eba6e59d77a6dfeba01d",
"subsystem": "net",
"problem_description": "The macro HCLGE_FD_AD_COUNTER_NUM_M was incorrectly defined using GENMASK(20, 13), causing it to overlap with the HCLGE_FD_AD_NXT_STEP_B bit located at bit 20."
},
{
"Commit": "c2837423cb54551302f037106830ee607b4563e0",
"Fixed-by": "5228e9faaed4e55f6291e1bd138bffea90252fbd",
"subsystem": "stmmac",
"problem_description": "The TSO header descriptor incorrectly has the last segment bit set, causing transmit DMA stalls and watchdog timeouts."
},
{
"Commit": "209477704187472d6055e83bbd0fd9b51b79fa15",
"Fixed-by": "302e5b481caa7b3d11ec0e058434c1fc95195e50",
"subsystem": "be2net",
"problem_description": "Accumulated statistics are corrupted when a u64 stats fetch retry occurs because the accumulator is updated inside the retry loop."
},
{
"Commit": "c2d548cad1508d334517bcbd7cd5c915cc831fc0",
"Fixed-by": "5fbe395cd1fdbc883584e7f38369e4ba5ca778d2",
"subsystem": "idpf",
"problem_description": "statistics in idpf_net_dim are accumulated incorrectly if a u64_stats_fetch_retry event occurs"
},
{
"Commit": "b20d7fe51e0de28982e115b8ec0647066d73d206",
"Fixed-by": "748a81c8ceda1fdbdcd0af595947422e810442aa",
"subsystem": "net",
"problem_description": "Ring statistics in hns3_fetch_stats are accumulated directly into the output buffer inside the u64_stats_sync retry loop, leading to potential double-counting if a retry occurs."
},
{
"Commit": "1758af47b98c17da464cb45f476875150955dd48",
"Fixed-by": "79912b256e14054e6ba177d7e7e631485ce23dbe",
"subsystem": "net",
"problem_description": "The reference count of the 'leds' device node is leaked when the node exists, because the pointer returned by of_get_child_by_name() is not released with of_node_put()."
},
{
"Commit": "5cb8805d2366b20ee4d7afff586d8acf17649330",
"Fixed-by": "bdfc7b55adcd04834ccc1b6b13e55e3fd7eaa789",
"subsystem": "idpf",
"problem_description": "PCIe writes may get buffered in the PCIe fabric and posted to the device after the system post-timestamp is taken."
},
{
"Commit": "4da71a77fc3be1fcb680c8d78e1a1fb8017905ad",
"Fixed-by": "d3f867e7a04678640ebcbfb81893c59f4af48586",
"subsystem": "ice",
"problem_description": "a page fault occurs when reading orphaned hwmon sysfs attributes after a devlink reload because the hwmon instance is not properly deinitialized"
},
{
"Commit": "1390b8b3d2bef9bfbb852fc735430798bfca36e7",
"Fixed-by": "42fb5f3deb582cb96440e4683745017dbabb83d6",
"subsystem": "ice",
"problem_description": "devlink reload fails and driver removal causes a NULL pointer dereference due to missing hardware de-initialization in the reinit down path"
},
{
"Commit": "b66a972abb6b4a2fe8e0444ba2a2d3718c79d5ad",
"Fixed-by": "f406220eb8e227ca344eef1a6d30aff53706b196",
"subsystem": "ice",
"problem_description": "The function ice_get_rxfh fails with -EINVAL when called without a key buffer (e.g. by ethtool_get_rxfh_indir) because it unconditionally attempts to retrieve the RSS key."
},
{
"Commit": "2b7226af730cc9a8818ff3b39aabcd76861913dd",
"Fixed-by": "16aca2c98a6fdf071e5a1a765a295995d7c7e346",
"subsystem": "mm",
"problem_description": "The memory.reclaim interface silently fails to reclaim memory on !CONFIG_NUMA configurations."
},
{
"Commit": "ce2bba89566bef9d4a0ff2122ee75739a72a92be",
"Fixed-by": "9bc9ccbf4c935852e4916081dbce4c25a585ec7d",
"subsystem": "mm/kfence",
"problem_description": "The reboot notifier deadlocks when cancel_delayed_work_sync() waits for the kfence timer work which is blocked waiting for allocations that stop occurring during shutdown."
},
{
"Commit": "ebdf9ad4ca9897768bcb7dad6581369693c81fe0",
"Fixed-by": "cb7d761bf5d4b1600564efdd42653b821eb2ec8e",
"subsystem": "mm",
"problem_description": "The documentation failed to mention that /proc/sys/vm/mem_profiling is read-only when CONFIG_MEM_ALLOC_PROFILING_DEBUG=y to prevent debug warnings."
},
{
"Commit": "ab04b530e7e8bd5cf9fb0c1ad20e0deee8f569ec",
"Fixed-by": "35e247032606f06c2f19d90a6562bc315206b7a7",
"subsystem": "mm",
"problem_description": "page tables are unnecessarily copied during fork when VM_UFFD_WP is set on the source VMA but not propagated to the destination VMA"
},
{
"Commit": "1013af4f585fccc4d3e5c5824d174de2257f7d6d",
"Fixed-by": "8ce720d5bd91e9dc16db3604aa4b1bf76770a9a1",
"subsystem": "mm",
"problem_description": "Excessive IPI broadcasts occur when unsharing multiple hugetlb PMD tables during operations like exit or munmap, causing severe performance regressions."
},
{
"Commit": "59d9094df3d79443937add8700b2ef1a866b1081",
"Fixed-by": "a8682d500f691b6dfaa16ae1502d990aeb86e8be",
"subsystem": "mm",
"problem_description": "Stale comments in mm/rmap.c incorrectly referred to dropping the PMD page refcount instead of the newly introduced independent page table shared count."
},
{
"Commit": "59d9094df3d79443937add8700b2ef1a866b1081",
"Fixed-by": "3937027caecb4f8251e82dd857ba1d749bb5a428",
"subsystem": "mm",
"problem_description": "Comments referring to the use of page counts for shared PMD detection became outdated and incorrect after the introduction of an independent PMD page table shared count."
},
{
"Commit": "59d9094df3d79443937add8700b2ef1a866b1081",
"Fixed-by": "ca1a47cd3f5f4c46ca188b1c9a27af87d1ab2216",
"subsystem": "mm",
"problem_description": "hugetlb_pmd_shared() fails to detect shared PMD tables because it checks the page refcount instead of the new independent shared count."
},
{
"Commit": "2ab7f1bbafc927c69374d45578011c814c26ae2f",
"Fixed-by": "90888b4ae103e65e5dfd438adb8d7d7ece91afd2",
"subsystem": "mm",
"problem_description": "The mmap_assert_locked assertion in zap_pud_range incorrectly triggers when splitting huge PUDs under the VMA lock."
},
{
"Commit": "3318f7b5cefbff96b1bb49584ac38d2c9997a830",
"Fixed-by": "374e7af67d9d9d6103c2cfc8eb32abfecf3a2fd8",
"subsystem": "iommu",
"problem_description": "Returning the negative error code -ENOENT as an unsigned size_t results in a huge positive value that causes an IOVA address overflow and triggers a BUG_ON."
},
{
"Commit": "31d3ad832948c75139b0e5b653912f7898a1d5d5",
"Fixed-by": "b97d5eedf4976cc94321243be83b39efe81a0e15",
"subsystem": "netdevsim",
"problem_description": "concurrent operations on the bpf_bound_progs list can lead to list corruption and a kernel crash due to missing locking protection"
},
{
"Commit": "1c56ab991903dce60e905a08f431c0e6f79b9b9e",
"Fixed-by": "1d8f69f453c2e8a2d99b158e58e02ed65031fa6d",
"subsystem": "btrfs",
"problem_description": "Extent root and csum root are not backed up in the superblock when the BLOCK_GROUP_TREE feature is enabled."
},
{
"Commit": "d23a22a74fded23a12434c9463fe66cec2b0afcd",
"Fixed-by": "d1883cefd31752f0504b94c3bcfa1f6d511d6e87",
"subsystem": "leds",
"problem_description": "An uninitialized work item can be queued because the LED is added to the global list before being fully initialized by led_init_core()."
},
{
"Commit": "3070c05b7afdf3da2d88d255a421fffca86f1f63",
"Fixed-by": "5d54aa40c7b7e9dee5746cca99e9ddbcca13e895",
"subsystem": "vsock",
"problem_description": "The test suite fails to detect available vsock transports because it strictly filters for symbols of type 'd' in /proc/kallsyms."
},
{
"Commit": "d8e8362b09d31b0a343c0414015d93fbb250d57d",
"Fixed-by": "4b11f2336e23d5c55b76591bd8ac39b059f68ad0",
"subsystem": "platform/x86",
"problem_description": "The function acer_toggle_turbo does not verify if the ACER_CAP_TURBO_FAN capability is enabled before attempting to set the fan mode, potentially accessing unsupported features."
},
{
"Commit": "f5fc40734b0fcd356eabb8ab5abd57b80c286da6",
"Fixed-by": "01f31c2fffae7550ec3bd392256b2566f9233834",
"subsystem": "platform/x86",
"problem_description": "The GA403WM model entry was added after GA403WR, breaking the alphabetical order of the power_limits array."
},
{
"Commit": "a22d893f490d9cd517dbf02549701add2318594c",
"Fixed-by": "43098a53939e98e6c8191db4bac3c7ef9eed503c",
"subsystem": "platform/x86",
"problem_description": "The ppt_pl3_fppt_def and ppt_pl3_fppt_max power limit values for the FA608UM laptop model were incorrect."
},
{
"Commit": "5f94f181ca25d8c5b77beb2da0cb466ddb6ece29",
"Fixed-by": "467d4afc6caa64b84a6db1634f8091e931f4a7cb",
"subsystem": "platform/x86",
"problem_description": "The hp-bioscfg module fails to automatically load because the WMI GUIDs in the device table contain lowercase characters that do not match the modalias."
},
{
"Commit": "5f94f181ca25d8c5b77beb2da0cb466ddb6ece29",
"Fixed-by": "25150715e0b049b99df664daf05dab12f41c3e13",
"subsystem": "platform/x86",
"problem_description": "Fixes a kernel panic caused by an off-by-one loop error and a missing NULL pointer check in the GET_INSTANCE_ID macro when accessing sysfs attributes."
},
{
"Commit": "86eecc3a9c2e06462f6a273fcd24150b6da787de",
"Fixed-by": "1a0f69e3c28477b97d3609569b7e8feb4b6162e8",
"subsystem": "drm/bridge",
"problem_description": "Fixes missing return check for drm_bridge_attach, missing aux unregistration on error paths, and incorrect error code return for platform_get_irq in dw_dp_bind."
},
{
"Commit": "d4c53ae8e4948f7f733f24cd863da31c8e9379a7",
"Fixed-by": "3317785a8803db629efc759d811d0f589d3a0b2d",
"subsystem": "s390/ap",
"problem_description": "The AP queue depth was miscalculated because the driver interpreted the 0-indexed hardware queue size field as a 1-indexed count, causing the queue to be underutilized by one slot and reported incorrectly in sysfs."
},
{
"Commit": "aa736700f42fa0813e286ca2f9274ffaa25163b9",
"Fixed-by": "9210f5ff6318163835d9e42ee68006be4da0f531",
"subsystem": "ASoC",
"problem_description": "forcing I2S slot width to the physical sample width results in undefined data in unused bits or audio artifacts when using fixed-width slots"
},
{
"Commit": "6639b6c2367f884ca172b78d69f7da17bfab2e5e",
"Fixed-by": "930e69757b74c3ae083b0c3c7419bfe7f0edc7b2",
"subsystem": "ALSA",
"problem_description": "A use-after-free occurs in snd_usb_mixer_free() when mixer creation fails because mixer controls still reference the freed id_elems memory."
},
{
"Commit": "ff984e57d36e8ac468849a144a36f1c11f88b61c",
"Fixed-by": "122610220134b32c742cc056eaf64f7017ac8cd9",
"subsystem": "mmc",
"problem_description": "The rtsx_pci_sdmmc driver lacks a card_busy callback, causing kernel warnings when verifying signal voltage switches."
},
{
"Commit": "7b9b77a8bba9c1fd7bad3310dbf2cf382e1f8c25",
"Fixed-by": "8a8c942cad4cd12f739a8bb60cac77fd173c4e07",
"subsystem": "gpio",
"problem_description": "The line state workqueue and character device are leaked on error paths in gpiolib_cdev_register()."
},
{
"Commit": "775f71ebedd382da390dc16a4c28cffa5b937f79",
"Fixed-by": "e806f7dde8ba28bc72a7a0898589cac79f6362ac",
"subsystem": "timekeeping",
"problem_description": "The function __do_adjtimex incorrectly updates the core timekeeper's leap state instead of the intended auxiliary timekeeper, causing potential data corruption and lock debugging warnings."
},
{
"Commit": "dcd6a011a8d523a114af2360a8753de5bd60c139",
"Fixed-by": "98d5110f90ae0dbc5f2f13f033e06f6d57009e0d",
"subsystem": "iommu",
"problem_description": "Older gcc and clang compilers fail to build due to a false positive compile-time assertion in FIELD_PREP."
},
{
"Commit": "cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e",
"Fixed-by": "8d76a7d89c12d08382b66e2f21f20d0627d14859",
"subsystem": "irqchip",
"problem_description": "Physical memory addresses above 4GB are truncated on 32-bit LPAE systems because the driver incorrectly stores them in 32-bit unsigned long variables instead of phys_addr_t."
},
{
"Commit": "6d543b34dbcf6ec30064ae62a88faf60dbff4f8a",
"Fixed-by": "aebc29dec67aa998a9ea6d34aacba7b5c6a74d33",
"subsystem": "mac80211",
"problem_description": "mac80211 failed to properly track the active state of an advertised TID to Link Mapping (TTLM), resulting in links failing to enable when they became available."
},
{
"Commit": "ddf82e752f8a3253e03fe4c0a957792701f8b2e6",
"Fixed-by": "5dc6975566f5d142ec53eb7e97af688c45dd314d",
"subsystem": "mac80211",
"problem_description": "S1G beacons are incorrectly dropped because an unconditional broadcast destination address check fails for them as they lack that field."
},
{
"Commit": "d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64",
"Fixed-by": "70b3c280533167749a8f740acaa8ef720f78f984",
"subsystem": "gpio",
"problem_description": "file reference is leaked if memory allocation fails in lineinfo_changed_notify"
},
{
"Commit": "20bddcb40b2b6d6028fb4224fab4aadb7d7b2674",
"Fixed-by": "faff6846474e99295a139997f93ef6db222b5cee",
"subsystem": "gpio",
"problem_description": "The function incorrectly returns -ENODEV instead of -ENOMEM when memory allocation fails."
},
{
"Commit": "104880a6b470958ddc30e139c41aa4f6ed3a5234",
"Fixed-by": "2397e9264676be7794f8f7f1e9763d90bd3c7335",
"subsystem": "crypto",
"problem_description": "authencesn triggers a NULL pointer dereference and kernel panic when processing Associated Authenticated Data (AAD) shorter than 8 bytes"
},
{
"Commit": "a48c0cbf28c03f6c590a14ceb31bf6e619c2f6da",
"Fixed-by": "b994ace83a2bc7699420f6a4c6b860c8da133159",
"subsystem": "io_uring",
"problem_description": "accessing iw->head without proper acquire/release semantics triggers KCSAN warnings"
},
{
"Commit": "1dc0da6e9ec0f8d735756374697912cd50f402cf",
"Fixed-by": "b505f1944535f83d369ae68813e7634d11b990d3",
"subsystem": "x86/kfence",
"problem_description": "KFENCE writes L1TF-vulnerable non-present PTEs, causing Xen PV guests to trigger expensive shadow paging."
},
{
"Commit": "ab04945f91bcad1668af57bbb575771e794aea8d",
"Fixed-by": "605f6586ecf78395f0185ab24c368fb46a06e434",
"subsystem": "mm",
"problem_description": "A memory leak occurs when the mmap_prepare hook replaces the file because the kernel unconditionally increments the reference count of the new file."
},
{
"Commit": "336bf30eb76580b579dc711ded5d599d905c0217",
"Fixed-by": "b7880cb166ab62c2409046b2347261abf701530e",
"subsystem": "mm",
"problem_description": "Deadlock during file-backed hugetlb migration due to remove_migration_ptes attempting to acquire i_mmap_rwsem while holding the folio lock."
},
{
"Commit": "ee13240cd78b68430eb50af4721b3f18dd08af29",
"Fixed-by": "90f3c123247e9564f2ecf861946ec41ceaf5e198",
"subsystem": "panic",
"problem_description": "The deprecation warning for panic_print is incorrectly triggered on read access, causing spurious warnings when querying system state."
},
{
"Commit": "0c58a97f919c24fe4245015f4375a39ff05665b6",
"Fixed-by": "f9a49aa302a05e91ca01f69031cb79a0ea33031f",
"subsystem": "fuse",
"problem_description": "wait_sb_inodes() hangs indefinitely when waiting for writeback from an unresponsive FUSE server."
},
{
"Commit": "af7f588d8f7355bc4298dd1962d7826358fc95f0",
"Fixed-by": "be31340a4cc259340044b7fc4f7e97f58c74ee8e",
"subsystem": "mm",
"problem_description": "Static definitions of init_mm and efi_mm lack space for mm_cid cpumasks, leading to potential out-of-bounds accesses."
},
{
"Commit": "af7f588d8f7355bc4298dd1962d7826358fc95f0",
"Fixed-by": "6ac433f8b2590b09ca00863d218665729ac985f7",
"subsystem": "mm",
"problem_description": "Static mm_struct definitions (init_mm, efi_mm) lack allocated space for the per-memory-map concurrency ID (mm_cid) data, leading to memory corruption."
},
{
"Commit": "8cea569ca785060b8c5cc7800713ddc3b1548a94",
"Fixed-by": "12a6ddfc76bb8a6d4508171d806c8632cf50a74a",
"subsystem": "mm",
"problem_description": "The init_mm struct is missing a static initializer for the mm_cid.lock member."
},
{
"Commit": "462dbc9101acd38e92eda93c0726857517a24bbd",
"Fixed-by": "d837fbee92453fbb829f950c8e7cf76207d73f33",
"subsystem": "net/sched",
"problem_description": "Relying on the child qdisc's qlen to determine class activation allows possible exploits employing child qlen manipulations."
},
{
"Commit": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"Fixed-by": "50da4b9d07a7a463e2cfb738f3ad4cff6b2c9c3b",
"subsystem": "net/sched",
"problem_description": "Using the teql qdisc as a non-root qdisc leads to a use-after-free."
},
{
"Commit": "57d00d4364f314485092667d2a48718985515deb",
"Fixed-by": "ab9b218a1521133a4410722907fa7189566be9bc",
"subsystem": "net/marvell/octeontx2",
"problem_description": "The RX flowid programming overwrites the TCAM mask initialization instead of clearing specific bits with a bitwise AND, discarding the intended initial state."
},
{
"Commit": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
"Fixed-by": "2c28769a51deb6022d7fbd499987e237a01dd63a",
"subsystem": "rxrpc",
"problem_description": "rxrpc_recvmsg() corrupts the recvmsg queue by unconditionally requeueing a call when the user mutex is contended, and incorrectly triggers socket notifications during MSG_PEEK."
},
{
"Commit": "bba4322e3f303b2d656e748be758320b567f046f",
"Fixed-by": "07a1bc5c14c9ef6401b21c1873c6c087075ff292",
"subsystem": "block",
"problem_description": "The queue limits lock is not released in an error path in disk_update_zone_resources."
},
{
"Commit": "8230819494b3bf284ca7262ac5f877333147b937",
"Fixed-by": "d3ba32162488283c0a4c5bedd8817aec91748802",
"subsystem": "ipvlan",
"problem_description": "The per-device spinlock causes race conditions on the shared per-port address hash table, and the lock was erroneously omitted in ipvlan_open and ipvlan_close."
},
{
"Commit": "d00fa9adc528c1b0e64d532556764852df8bd7b9",
"Fixed-by": "7a29f6bf60f2590fe5e9c4decb451e19afad2bcf",
"subsystem": "l2tp",
"problem_description": "A data race occurs in l2tp_tunnel_del_work() when reading sk->sk_socket for sockets that are being concurrently released."
},
{
"Commit": "d93a75d94b79ba3e664f7236ee05790e8b1d0e4b",
"Fixed-by": "63faf32666e03a78cc985bcbae196418cf7d7938",
"subsystem": "pwm",
"problem_description": "The .sizeof_wfhw field in max7360_pwm_ops was not initialized, potentially leading to stack corruption if the waveform structure size increases."
},
{
"Commit": "9c06f26ba5f5da14bcac405c7a652dcf578a785d",
"Fixed-by": "c198b7773ca5bc3bdfb15b85e414fb9a99a5e5ba",
"subsystem": "pwm",
"problem_description": "ioctl returns positive remaining bytes instead of -EFAULT when copy_to_user fails"
},
{
"Commit": "12d821bd13d42e6de3ecb1c13918b1f06a3ee213",
"Fixed-by": "e3b76494d675e49fa032ec47f58487875a1de70a",
"subsystem": "regulator",
"problem_description": "Missing check for devm_kzalloc failure in fp9931_probe causes potential null pointer dereference."
},
{
"Commit": "cc1aeedb98ad347c06ff59e991b2f94dfb4c565d",
"Fixed-by": "812062e74a3945b575dce89d330b67cb50054a77",
"subsystem": "drm/imagination",
"problem_description": "firmware trace might not be available immediately after update because the driver does not wait for the asynchronous log update command to complete"
},
{
"Commit": "2d82e6227ea189c0589e7383a36616ac2a2d248c",
"Fixed-by": "4b22ec1685ce1fc0d862dcda3225d852fb107995",
"subsystem": "efivarfs",
"problem_description": "efivar_entry_get() always returns success even when __efivar_entry_get() fails, potentially leaking uninitialized memory to userspace."
},
{
"Commit": "be9f6d56381d995f600524ad99fa8a9cc5bd5c49",
"Fixed-by": "1fbe3abb449c5ef2178e1c3e3e8b9a43a7a410ac",
"subsystem": "pinctrl",
"problem_description": "The SM8350 LPASS driver incorrectly listed GPIO12 twice in i2s2_data_groups instead of including GPIO13, and unnecessarily included GPIO5 in swr_tx_data_groups."
},
{
"Commit": "6ac730951104a437bf828683bcf9ba66336c4fa7",
"Fixed-by": "28f24068387169722b508bba6b5257cb68b86e74",
"subsystem": "pinctrl",
"problem_description": "The Meson GPIO controller is incorrectly marked as non-sleeping, causing sleeping function calls in atomic context due to the use of mutex-protected pinctrl helpers."
},
{
"Commit": "0992284b4fe443ffc76448d431b62760dc0fe7bf",
"Fixed-by": "9b54a32c7c6aa4687db4d278c0174d5a318efeaa",
"subsystem": "drm/mediatek",
"problem_description": "Switching to drm_fbdev_dma caused UBSAN warnings because the driver used a custom GEM object structure instead of the expected drm_gem_dma_object."
},
{
"Commit": "4c932840db1de4ea9639eceaaf6d59415b8a7d59",
"Fixed-by": "21465e73400dc69a5f732ae7bcc2a58bad673cd1",
"subsystem": "drm/mediatek",
"problem_description": "The DPI driver fails to probe because the next bridge lookup is performed in the attach callback where probe deferral is not supported."
},
{
"Commit": "bb38f35b35f9de0cebc4d62ea73482454e38cef3",
"Fixed-by": "d6ff6e870077ae0f01a6f860ca1e4a5a825dc032",
"subsystem": "rust",
"problem_description": "The `Refcount::new` function causes a build error if not inlined because the compiler fails to optimize out the `build_assert!` error path."
},
{
"Commit": "cc84ef3b88f407e8bd5a5f7b6906d1e69851c856",
"Fixed-by": "09c3c9112d71c44146419c87c55c710e68335741",
"subsystem": "rust",
"problem_description": "build errors may occur because the error path of build_assert! is not optimized out if the compiler chooses not to inline the function"
},
{
"Commit": "f4daa80d6be7d3c55ca72a8e560afc4e21f886aa",
"Fixed-by": "ac3c50b9a24e9ebeb585679078d6c47922034bb6",
"subsystem": "scripts",
"problem_description": "rust-analyzer configuration uses the incorrect edition for sysroot crates other than core when using Rust 1.87+"
},
{
"Commit": "88de91cc1ce7b3069ccabc1a5fbe16d41c663093",
"Fixed-by": "bc83834c157676e7cca62b876b5e3da1bee06285",
"subsystem": "scripts",
"problem_description": "The generated rust-analyzer configuration for the quote crate incorrectly uses the default Rust edition instead of edition 2018."
},
{
"Commit": "88de91cc1ce7b3069ccabc1a5fbe16d41c663093",
"Fixed-by": "3a50257e560043bf8968f807af65f32c98d7dbf9",
"subsystem": "scripts",
"problem_description": "The generate_rust_analyzer.py script omitted core and std dependencies for the quote crate, resulting in incomplete IDE support from rust-analyzer."
},
{
"Commit": "737401751ace2d806de6854aee52c176141d10e2",
"Fixed-by": "87417cc95b0f1096cc27011ec750d9f988a63e83",
"subsystem": "scripts",
"problem_description": "The generate_rust_analyzer.py script failed to list std as a dependency for the syn crate, causing rust-analyzer to not infer standard library types correctly."
},
{
"Commit": "fe992163575b187405899c5abaad8ef6fb828ff6",
"Fixed-by": "1b83ef9f7ad4635c913b80ef5e718f95f48e85af",
"subsystem": "scripts",
"problem_description": "The generate_rust_analyzer.py script fails on NixOS because it incorrectly asserts that the Rust source directory must be located inside the compiler sysroot."
},
{
"Commit": "2f7ab1267dc9b2d1f29695aff3211c87483480f3",
"Fixed-by": "af20ae33e7dd949f2e770198e74ac8f058cb299d",
"subsystem": "rust",
"problem_description": "rustfmt fails to find the configuration file when building with an external output directory, causing parsing errors for newer syntax."
},
{
"Commit": "57295e835408d8d425bef58da5253465db3d6888",
"Fixed-by": "d250bdf531d9cd4096fedbb9f172bb2ca660c868",
"subsystem": "ext4",
"problem_description": "buffer head iloc.bh is leaked in the error path of ext4_xattr_inode_update_ref"
},
{
"Commit": "962e8a01eab95597bb571672f59ab2ec9fec342a",
"Fixed-by": "0ef7ef422730b8585214a2825735838d664ce1be",
"subsystem": "ext4",
"problem_description": "The function mext_move_extent() fails to acquire i_data_sem locks before calling ext4_swap_extents() in the error recovery path, triggering a BUG_ON."
},
{
"Commit": "04a91570ac67760301e5458d65eaf1342ecca314",
"Fixed-by": "cd16edba1c6a24af138e1a5ded2711231fffa99f",
"subsystem": "ext4",
"problem_description": "The struct ext4_tune_sb_params has architecture-specific size differences due to implicit padding."
},
{
"Commit": "617d824c5323b8474b3665ae6c410c98b839e0b0",
"Fixed-by": "b886aa65eafe3098bbd691f0ca4a9abce03f9d03",
"subsystem": "drm/xe",
"problem_description": "The timestamp workaround fails on VFs due to inaccessible MMIO registers, causing incorrect LRC timestamp readings that confuse TDR."
},
{
"Commit": "0131514f97890c4699a4d7ca14b720dafefdbc71",
"Fixed-by": "47bf28e22a121b807a9a9680c4209846a78a98a6",
"subsystem": "drm/xe",
"problem_description": "kernel-doc warning due to incorrect function name in the comment for xe_vm_validation_exec"
},
{
"Commit": "45832bf9c10f309b579f81b05bacc44fbb4d81b4",
"Fixed-by": "dc1d0ffee09740088eb190af84a2c470d279bad9",
"subsystem": "drm/xe",
"problem_description": "kernel-doc produces warnings for enum xe_late_bind_fw_id due to incorrect comment syntax and missing member descriptions"
},
{
"Commit": "e1d2e2d878bf8a61481173c49e8fbe2cd57fe0bb",
"Fixed-by": "a009bbb9586119047a071971a48b093fcc65f33d",
"subsystem": "drm/xe",
"problem_description": "Kernel-doc generates warnings for struct xe_gt_sriov_vf_migration due to missing 'struct' keyword and incorrect member description."
},
{
"Commit": "60df57e496e4f92f5efc1610ecf32d30b281b19b",
"Fixed-by": "6f287b1c8d0e255e94e54116ebbe126515f5c911",
"subsystem": "drm/xe",
"problem_description": "The WQ_MEM_RECLAIM flag was mistakenly passed as the max_active argument instead of the flags argument to alloc_workqueue(), causing the workqueue to be created without the intended memory reclaim semantics."
},
{
"Commit": "ce3d39fae3d35fc9f09a7d65bffc218fbdebd002",
"Fixed-by": "ca9e5115e870b9a531deb02752055a8a587904e3",
"subsystem": "drm/xe",
"problem_description": "Page count tracepoints are not updated when the shrinker reclaims pages."
},
{
"Commit": "19e5cc156cbc32421eb8237615f246c08eea8284",
"Fixed-by": "3222b6de5145272c43a90cb8667377d676635ea0",
"subsystem": "iommu/amd",
"problem_description": "The error path in amd_iommu_probe_device() accesses potentially uninitialized dev_data if iommu_init_device() fails."
},
{
"Commit": "0d7605e75ac2d8620929148f932cde54746c485f",
"Fixed-by": "cd4a3ced4d1cdb14ffe905657b98a91e9d239dfb",
"subsystem": "irqchip",
"problem_description": "Spurious interrupts occur during s2idle resume for the PMIC RTC TINT interrupt due to a glitch caused by unnecessary enabling/disabling of the TINT enable bit."
},
{
"Commit": "068648aab72c9ba7b0597354ef4d81ffaac7b979",
"Fixed-by": "f40ddcc0c0ca1a0122a7f4440b429f97d5832bdf",
"subsystem": "nfc",
"problem_description": "Valid NFC packets containing NUL-bytes are incorrectly rejected due to an inappropriate string length check."
},
{
"Commit": "5fe6e56776ba6979844f9ef5361f43852a7b16a2",
"Fixed-by": "b47adaab8b3d443868096bac08fdbb3d403194ba",
"subsystem": "veth",
"problem_description": "Statistics in veth_get_ethtool_stats are double-counted if a u64_stats read retry occurs because they are accumulated directly into the output buffer inside the retry loop."
},
{
"Commit": "23461551c00628c3f3fe9cf837bf53cf8f212b63",
"Fixed-by": "7a9bc9e3f42391e4c187e099263cf7a1c4b69ff5",
"subsystem": "fou",
"problem_description": "Setting FOU_ATTR_IPPROTO to 0 causes a memory leak because the socket buffer is neither freed nor resubmitted."
},
{
"Commit": "be5bea1cc0bf663aa0a45a2c0021dfcfb6cca976",
"Fixed-by": "68578370f9b3a2aba5964b273312d51c581b6aad",
"subsystem": "tools/ynl",
"problem_description": "ynl-regen.sh fails if grep.lineNumber is enabled in the global git configuration."
},
{
"Commit": "37dd0247797b168ad1cc7f5dbec825a1ee66535b",
"Fixed-by": "9a56796ad258786d3624eef5aefba394fc9bdded",
"subsystem": "net",
"problem_description": "Memory leak in GUE packet reception where packets with an inner protocol of 0 are not properly dropped or resubmitted."
},
{
"Commit": "c5aa9e3b815645e3aad08444c91ca6b237eeea01",
"Fixed-by": "c158f985cf6c2c36c99c4f67af2ff3f5ebe09f8f",
"subsystem": "amd-xgbe",
"problem_description": "The driver floods the kernel log with misleading error messages for every packet damaged by an Rx FIFO overflow."
},
{
"Commit": "caa2da34fd25a37e9fd43343b6966fb9d730a6d5",
"Fixed-by": "d998b0e5afffa90d0f03770bad31083767079858",
"subsystem": "octeontx2",
"problem_description": "The function otx2_dma_map_page() incorrectly returns 0 instead of DMA_MAPPING_ERROR on failure, preventing callers from detecting DMA mapping errors."
},
{
"Commit": "730fc3d05cd4ba4c9ce2de91f3d43349e95dbbf5",
"Fixed-by": "a80c9d945aef55b23b54838334345f20251dad83",
"subsystem": "sctp",
"problem_description": "A null pointer dereference occurs in the SCTP transmit path if shared key generation fails during INIT_ACK processing, allowing authenticated DATA chunks to be queued without a valid key."
},
{
"Commit": "3db835dd8f9a78e9709cb48b77d89b41792e9281",
"Fixed-by": "2ccb5e8dbcd2dedf13e0270165ac48bd79b7f673",
"subsystem": "ntb",
"problem_description": "The mutex link_event_lock was introduced and used without being initialized, triggering kernel warnings."
},
{
"Commit": "611cad720148c899db5a383c1c676fd820df7023",
"Fixed-by": "81122fba08fa3ccafab6ed272a5c6f2203923a7e",
"subsystem": "of",
"problem_description": "Reference count leak in of_alias_scan() when kstrtoint() or dt_alloc() fails."
},
{
"Commit": "c0087d807ae86cc82cc356e366d2dccf0e3bb225",
"Fixed-by": "d045e166d3c51b7aec069669bb243e057d80d04f",
"subsystem": "selftests",
"problem_description": "The s390 vDSO selftest fails to compile because the include path refers to the old `vdso64` directory instead of the renamed `vdso` directory."
},
{
"Commit": "e6fbd1759c9ece5044d3470f30a5e2166dc9de89",
"Fixed-by": "d9b40d7262a227442bf402ea0708dc94f438bb52",
"subsystem": "selftests/x86",
"problem_description": "x86 selftests fail to compile because the Makefile overwrites CFLAGS, causing the include path for kselftest.h to be lost."
},
{
"Commit": "ac34df733d2dfe3b553897a1e9e1a44414f09834",
"Fixed-by": "6f5c69f72e50d51be3a8c028ae7eda42c82902cb",
"subsystem": "ALSA",
"problem_description": "buffer overflow in scarlett2_usb_get_config() when count > 1 due to incorrect size check during endianness conversion"
},
{
"Commit": "80acefff3bc7bd53d46c16c683ab66c0ece20810",
"Fixed-by": "6b971191fcfc9e3c2c0143eea22534f1f48dbb62",
"subsystem": "ALSA: usb-audio",
"problem_description": "The volume range sanity check triggers false positive warnings on valid devices with ranges larger than 384."
},
{
"Commit": "875386b98857822b77ac7f95bdf367b70af5b78c",
"Fixed-by": "19bc5f2a6962dfaa0e32d0e0bc2271993d85d414",
"subsystem": "scsi",
"problem_description": "buffer overflow in qla2xxx driver when copying firmware packets larger than 64 bytes into a fixed-size iocb member"
},
{
"Commit": "6eb045e092efefafc6687409a6fa6d1dabf0fb69",
"Fixed-by": "fe2f8ad6f0999db3b318359a01ee0108c703a8c3",
"subsystem": "scsi",
"problem_description": "Race conditions when checking host busy counts can prevent the SCSI error handler from waking up, leaving I/O stuck."
},
{
"Commit": "89ae7d709357df3a60e81c57613859d91d093ace",
"Fixed-by": "9eacec5d18f98f89be520eeeef4b377acee3e4b8",
"subsystem": "scsi",
"problem_description": "The storvsc driver does not properly handle the unsupported MODE_SENSE_10 command on Hyper-V hosts."
},
{
"Commit": "30a5532a32066233a2e9a4751989276e91c82210",
"Fixed-by": "762cf75bec2ad9d17899087899a34336b1757238",
"subsystem": "LoongArch",
"problem_description": "dtbs_check warnings occur because sideband interrupts on PCI devices are described using the interrupts property instead of interrupts-extended"
},
{
"Commit": "b37042b2bb7cd751f03b73afb90364a418d870f4",
"Fixed-by": "a91f86e27087f250a5d9c89bb4a427b9c30fd815",
"subsystem": "loongarch",
"problem_description": "Hardware PMU counters are incorrectly allocated for software events during group validation, causing spurious allocation failures."
},
{
"Commit": "3aa0582fdb824139630298880fbf78d4ac774d3c",
"Fixed-by": "48e6a9c4a20870e09f85ff1a3628275d6bce31c0",
"subsystem": "drivers/of",
"problem_description": "Grandchild nodes under /firmware (e.g. simple-mfd) are not populated because of_platform_populate is called without a match table."
},
{
"Commit": "0024d8ad1639e32d717445c69ca813fd19c2a91c",
"Fixed-by": "f7a980b3b8f80fe367f679da376cf76e800f9480",
"subsystem": "can",
"problem_description": "URB memory leak in usb_8dev_read_bulk_callback due to missing re-anchoring before resubmission"
},
{
"Commit": "51f3baad7de943780ce0c17bd7975df567dd6e14",
"Fixed-by": "710a7529fb13c5a470258ff5508ed3c498d54729",
"subsystem": "can",
"problem_description": "URB memory leak in mcba_usb_read_bulk_callback because the URB is not re-anchored and thus not freed by usb_kill_anchored_urbs."
},
{
"Commit": "080f40a6fa28dab299da7a652e444b1e2d9231e7",
"Fixed-by": "248e8e1a125fa875158df521b30f2cc7e27eeeaa",
"subsystem": "can",
"problem_description": "URB memory leak occurs because URBs are not re-anchored to the rx_submitted anchor before resubmission in the read completion callback, preventing them from being freed during removal."
},
{
"Commit": "96d8e90382dc336b5de401164597edfdc2e8d9f1",
"Fixed-by": "5a4391bdc6c8357242f62f22069c865b792406b3",
"subsystem": "can",
"problem_description": "URB memory leak occurs in esd_usb_read_bulk_callback because URBs are not re-anchored."
},
{
"Commit": "702171adeed3607ee9603ec30ce081411e36ae42",
"Fixed-by": "0ce73a0eb5a27070957b67fd74059b6da89cc516",
"subsystem": "can",
"problem_description": "URB memory is leaked because URBs are not re-anchored in the `ems_usb_read_bulk_callback` function before resubmission, preventing proper cleanup during device close."
},
{
"Commit": "ab84ad5973869a660ca3ad0c54a2b84d975d47c4",
"Fixed-by": "1e2c1af1beb395841743e240a59ab37edc9a7d33",
"subsystem": "fuse",
"problem_description": "Stale dentries with positive reference counts are not evicted by the periodic invalidation work queue."
},
{
"Commit": "ab84ad5973869a660ca3ad0c54a2b84d975d47c4",
"Fixed-by": "cb8d2bdcb8241b66ca4ac4868f20e12cd6881ebc",
"subsystem": "fuse",
"problem_description": "A race condition in fuse_dentry_tree_work() allows a dentry to be evicted before d_dispose_if_unused(), resulting in a use-after-free."
},
{
"Commit": "7352e1d5932a0e777e39fa4b619801191f57e603",
"Fixed-by": "79a6d1bfe1148bc921b8d7f3371a7fbce44e30f7",
"subsystem": "can",
"problem_description": "usb_kill_anchored_urbs loops infinitely if usb_submit_urb fails because the URB remains anchored"
},
{
"Commit": "166e87329ce6f1eaa3475ba2d14ed30e54727c0d",
"Fixed-by": "375629c92fd842bc2a229bb34c4453f62e097169",
"subsystem": "can",
"problem_description": "CAN frames are rejected after interface up because device capabilities are not initialized unless the control mode is explicitly changed."
},
{
"Commit": "3c501880ac4436ad2db5feed6e7d7548e13d539f",
"Fixed-by": "e03b29b55f2b7c345a919a6ee36633b06bf3fb56",
"subsystem": "comedi",
"problem_description": "The interrupt service routine inadvertently resets the register page selection bits, interfering with concurrent digital I/O register access."
},
{
"Commit": "a0a927d06d79d59c55ae7ac0b2fd7f3c0ea3c14c",
"Fixed-by": "06d5a7afe1d0b47102936d8fba568572c2b4b941",
"subsystem": "mei",
"problem_description": "Trace events used a raw pointer for the register name parameter instead of copying the string into the trace buffer, which is unsafe and forbidden."
},
{
"Commit": "3397c3cd859a2c51962ad032dcf97961d42f9db2",
"Fixed-by": "054e1c0e6114aaf08672c5ad25d796362bc7e76b",
"subsystem": "uio",
"problem_description": "A logical error in the device validity check causes a NULL pointer dereference when the device pointer is NULL."
},
{
"Commit": "015d239ac0142ad0e26567fd890ef8d171f13709",
"Fixed-by": "26c08dabe5475d99a13f353d8dd70e518de45663",
"subsystem": "uacce",
"problem_description": "Concurrent execution of uacce_fops_release and uacce_remove can cause a NULL pointer dereference in uacce_put_queue."
},
{
"Commit": "015d239ac0142ad0e26567fd890ef8d171f13709",
"Fixed-by": "02695347be532b628f22488300d40c4eba48b9b7",
"subsystem": "uacce",
"problem_description": "The default mremap handler duplicates VMA private data, leading to a double free of the queue file region structure when both the original and remapped areas are unmapped."
},
{
"Commit": "e3e289fbc0b520cf469469e8cdba84a50424eb65",
"Fixed-by": "98eec349259b1fd876f350b1c600403bcef8f85d",
"subsystem": "uacce",
"problem_description": "System crash when accessing the isolate_strategy sysfs file if the driver only implements either the read or write callback."
},
{
"Commit": "015d239ac0142ad0e26567fd890ef8d171f13709",
"Fixed-by": "a3bece3678f6c88db1f44c602b2a63e84b4040ac",
"subsystem": "uacce",
"problem_description": "If cdev_device_add fails, it internally releases the cdev memory, causing a hang when cdev_device_del is subsequently executed in the cleanup path."
},
{
"Commit": "e0772de8a48b69d39624cdf99fac8f4a3fcc387b",
"Fixed-by": "7831f710553dcda6a67b3fe3f7a9d2f9a7233c3f",
"subsystem": "slimbus",
"problem_description": "The kernel doc for of_slim_get_device() incorrectly claimed it allocates a new device if lookup fails, but it actually returns NULL."
},
{
"Commit": "46a2bb5a7f7ea2728be50f8f5b29a20267f700fe",
"Fixed-by": "9391380eb91ea5ac792aae9273535c8da5b9aa01",
"subsystem": "slimbus",
"problem_description": "The function slim_device_report_present leaks a device reference when looking up an already registered device."
},
{
"Commit": "4b14e62ad3c9e6e6774517f4077e197c0537fb07",
"Fixed-by": "0eb4ff6596114aabba1070a66afa2c2f5593739f",
"subsystem": "slimbus",
"problem_description": "Runtime PM usage count is not decremented in slim_device_report_present if the device retrieval fails or the logical address is already valid."
},
{
"Commit": "7588a511bdb41ee028c009c0d188738f50dbaa93",
"Fixed-by": "0b52edaeb5c2ae9d9d25476554671014d2a1057b",
"subsystem": "slimbus",
"problem_description": "The OF node reference taken during initialization is leaked if slimbus device registration fails."
},
{
"Commit": "39f4034693b7c7bd1fe4cb58c93259d600f55561",
"Fixed-by": "95fc36a234da24bbc5f476f8104a5a15f99ed3e3",
"subsystem": "intel_th",
"problem_description": "The device reference acquired in intel_th_output_open() is leaked on error paths and when the file is closed"
},
{
"Commit": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"Fixed-by": "10d28cffb3f6ec7ad67f0a4cd32c2afa92909452",
"subsystem": "comedi",
"problem_description": "The COMEDI_RANGEINFO ioctl fails for subdevice indices greater than 15 due to insufficient bits allocated for the subdevice index in the range_type encoding."
},
{
"Commit": "4863cb2b0f505c77f7b4632246d4de4859b86ed2",
"Fixed-by": "9aeacd2ff31e1520bd302e40f7d2500cb98a2401",
"subsystem": "mux",
"problem_description": "The probe function incorrectly checked the return value of devm_kmalloc() using IS_ERR() instead of checking for NULL."
},
{
"Commit": "4afeced55baa391490b61ed9164867e2927353ed",
"Fixed-by": "27aff0a56b3c77ea1a73641c9b3c4172a8f7238f",
"subsystem": "serial",
"problem_description": "The Fintek F81504/508/512 driver fails to advertise support for SER_RS485_RTS_AFTER_SEND, preventing users from unsetting SER_RS485_RTS_ON_SEND due to strict sanitization logic."
},
{
"Commit": "10904d725f6e382376266a679ff425af488fcbcd",
"Fixed-by": "fb47423dc7bf43301048d77289ce0114959de4de",
"subsystem": "serial",
"problem_description": "initializing the UART port before the wakeup IRQ setup resets the RX GPIO pinmux configuration, causing Bluetooth initialization failures"
},
{
"Commit": "a34fc329b1895fc8a6eb12099adc47009421ba6a",
"Fixed-by": "fdee1b09721605f532352628d0a24623e7062efb",
"subsystem": "platform/x86",
"problem_description": "The hp-bioscfg driver triggers kernel warnings by attempting to register kobjects with empty names when the BIOS returns attributes with empty name strings."
},
{
"Commit": "8c90dc68a5de4349ef9ba51449fb0a29cd690547",
"Fixed-by": "b9f5c38e4af1a094384650d2fc79fb992d6d5e64",
"subsystem": "arm_mpam",
"problem_description": "Atomic bit operations on the packed mpam_props structure features bitmap violate alignment requirements."
},
{
"Commit": "de66754e9f8029f8ae955a588959b99cab56b506",
"Fixed-by": "dd83dc1249737b837ac5d57c81f2b0977c613d9f",
"subsystem": "xhci",
"problem_description": "xhci_sideband_remove_endpoint() crashes by dereferencing a freed ring, and xhci_stop_endpoint_sync() incorrectly attempts to stop invalid or non-running endpoints."
},
{
"Commit": "53036aa8d03178a8d056a24a52a301ad290877d4",
"Fixed-by": "a74c7a58ca2ca1cbb93f4c01421cf24b8642b962",
"subsystem": "net",
"problem_description": "NULL pointer dereference occurs when accessing the TBI PHY if it cannot be found, due to a missing early return."
},
{
"Commit": "4ed591c8ab44e711e56b8e021ffaf4f407c045f5",
"Fixed-by": "4f5f148dd7c0459229d2ab9a769b2e820f9ee6a2",
"subsystem": "selftests",
"problem_description": "The fib-onlink-tests fail if the system under test already has a default IPv6 route configured."
},
{
"Commit": "364798056f518b0bf2f17cd9eaf0dd4e856d7393",
"Fixed-by": "4d10edfd1475b69dbd4c47f34b61a3772ece83ca",
"subsystem": "l2tp",
"problem_description": "l2tp_session object is leaked in l2tp_udp_encap_recv() when the protocol version check fails."
},
{
"Commit": "872254dd6b1f80cb95ee9e2e22980888533fc293",
"Fixed-by": "c84fcb79e5dbde0b8d5aeeaf04282d2149aebcf6",
"subsystem": "bonding",
"problem_description": "BOND_MODE_8023AD causes a global-out-of-bounds read when enslaving non-Ethernet devices."
},
{
"Commit": "c9b37458e95629b1d1171457afdcc1bf1eb7881d",
"Fixed-by": "7d7dbafefbe74f5a25efc4807af093b857a7612e",
"subsystem": "net",
"problem_description": "The dm9601 driver drops packets on SR9700 devices because it lacks support for the hardware's multi-packet transaction mode."
},
{
"Commit": "581512a6dc939ef122e49336626ae159f3b8a345",
"Fixed-by": "0386bd321d0f95d041a7b3d7b07643411b044a96",
"subsystem": "vsock",
"problem_description": "Attempting to coalesce non-linear skbs introduced by MSG_ZEROCOPY support results in data loss and appending uninitialized kernel memory."
},
{
"Commit": "7ff14c52049eafecdd72cd0a12cae6905876566a",
"Fixed-by": "c4efd7a770c54964bf2d8c98b2f4fd10be13dc54",
"subsystem": "usbnet",
"problem_description": "Enqueuing SKBs in usbnet_resume() without BQL accounting triggers a BUG_ON() in dql_completed()"
},
{
"Commit": "4d1608d0ab3365d1ef9447bdbc0cb4c0962f1774",
"Fixed-by": "8fdc61faa730e1213e925b8b2ea488d03e3510ac",
"subsystem": "soc: renesas",
"problem_description": "The ARCH_R9A07G043 configuration does not select the required CACHEMAINT_FOR_DMA symbol when enabling AX45MP_L2_CACHE"
},
{
"Commit": "4d1608d0ab3365d1ef9447bdbc0cb4c0962f1774",
"Fixed-by": "521cadb4b69e7b19cba3d926f3b3dbf0015bd8f5",
"subsystem": "riscv",
"problem_description": "The ERRATA_STARFIVE_JH7100 configuration option fails to select CACHEMAINT_FOR_DMA, which is a required dependency for the cache drivers it selects."
},
{
"Commit": "6f61a2637abe4f89877da3280775565baedb60e0",
"Fixed-by": "a995fe1a3aa78b7d06cc1cc7b6b8436c5e93b07f",
"subsystem": "rust",
"problem_description": "Device private data is dropped in remove() but may be accessed by subsequent devres cleanup callbacks."
},
{
"Commit": "6455ad5346c9cf755fa9dda6e326c4028fb3c853",
"Fixed-by": "627cc25f84466d557d86e5dc67b43a4eea604c80",
"subsystem": "sched",
"problem_description": "DEQUEUE_SAVE and ENQUEUE_RESTORE do not preserve deadline priority, triggering unexpected balance callback warnings."
},
{
"Commit": "ff77e468535987b3d21b7bd4da15608ea3ce7d0b",
"Fixed-by": "e008ec6c7904ed99d3b2cb634b6545b008a99288",
"subsystem": "sched",
"problem_description": "The scheduler incorrectly optimizes away necessary runqueue moves for deadline tasks when their static priority value remains unchanged."
},
{
"Commit": "6455ad5346c9cf755fa9dda6e326c4028fb3c853",
"Fixed-by": "53439363c0a111f11625982b69c88ee2ce8608ec",
"subsystem": "sched",
"problem_description": "balance callbacks queued during task movement are not processed before releasing the runqueue lock"
},
{
"Commit": "9f239df55546ee1d28f0976130136ffd1cad0fd7",
"Fixed-by": "4de9ff76067b40c3660df73efaea57389e62ea7a",
"subsystem": "sched/deadline",
"problem_description": "The function update_rq_clock() is erroneously called twice when enqueuing a deadline task."
},
{
"Commit": "6455ad5346c9cf755fa9dda6e326c4028fb3c853",
"Fixed-by": "375410bb9a403009a44af3cc7f087090da076e09",
"subsystem": "sched",
"problem_description": "stale deadline value returned by get_prio_dl() triggers a spurious balance callback and a kernel warning"
},
{
"Commit": "b1817b18ff20e69f5accdccefaf78bf5454bede2",
"Fixed-by": "d5811e6297f3fd9020ac31f51fc317dfdb260cb0",
"subsystem": "nfs",
"problem_description": "Reading the file size before locking the inode causes a race condition where nfs_truncate_last_folio may overwrite valid file data."
},
{
"Commit": "4a3efc6baff931da9a85c6d2e42c87bd9a827399",
"Fixed-by": "be55257fab181b93af38f8c4b1b3cb453a78d742",
"subsystem": "ftrace",
"problem_description": "Integer division truncation in page capacity calculations leads to ftrace memory over-allocation and false positive warnings."
},
{
"Commit": "581cf833cac4461d90ef5da4c5ef4475f440e489",
"Fixed-by": "ec19ed2b3e2af8ec5380400cdee9cb6560144506",
"subsystem": "block/rnbd",
"problem_description": "A double kobject_put() during device unmapping causes a refcount underflow and use-after-free."
},
{
"Commit": "4e00135b2dd1d7924a58bffa551b6ceb3bd836f2",
"Fixed-by": "f6b625639e39bc384a7bddbf134a698d40258b3b",
"subsystem": "spi",
"problem_description": "SPI read operations fail because the driver does not write to the TX register when the transmit buffer is NULL, preventing clock generation."
},
{
"Commit": "c683651b6791e85c2f892f8009268f1525f71408",
"Fixed-by": "f7fffd2e3f92ff526bf3a620e5bdd58bbbb96ccd",
"subsystem": "platform/x86",
"problem_description": "The OOBE exit command was incorrectly tied to deprecated attributes, preventing it from being sent on TUF laptops."
},
{
"Commit": "58e82a62669da52e688f4a8b89922c1839bf1001",
"Fixed-by": "2bf1877b7094c684e1d652cac6912cfbc507ad3e",
"subsystem": "platform/x86/amd",
"problem_description": "The tmp buffer allocated in wbrf_record() is not freed if acpi_evaluate_dsm() fails."
},
{
"Commit": "317bbe169c468b5dbe3ddc27b0a02f8981ede5b4",
"Fixed-by": "3113bcf4ccf06c938f0bc0c34cf6efe03278badc",
"subsystem": "platform/mellanox",
"problem_description": "Incorrect LED platform data was assigned for SN5640 and SN5610 systems."
},
{
"Commit": "db6df2e3fc16263e319a0869fc0334c9c2290ddb",
"Fixed-by": "861d21c43c98478eef70e68e31d4ff86400c6ef7",
"subsystem": "pmdomain",
"problem_description": "RK3588_PD_NPU initializes as on before the regulator is ready, causing rknn_iommu resume to fail with -EPROBE_DEFER."
},
{
"Commit": "7b2afeafaf9c2d584439fc14fdc1462425b41fd3",
"Fixed-by": "0d26ca8ec461c01f682402f73a89643f4fefbbb3",
"subsystem": "loongarch",
"problem_description": "Redundant initialization of Control Status Registers (CRMD, PRMD, EUEN) in smpboot_entry remains after the introduction of the SETUP_MODES macro which already handles this setup."
},
{
"Commit": "ed3100e90d0d120a045a551b85eb43cf2527e885",
"Fixed-by": "4156c3745f06bc197094b9ee97a9584e69ed00bf",
"subsystem": "virtio_net",
"problem_description": "Fixes a 1-byte misalignment of the RSS key passed to the device and resolves a compiler warning about a flexible array member not being at the end of the structure."
},
{
"Commit": "9d71dd0c70099914fcd063135da3c580865e924c",
"Fixed-by": "1809c82aa073a11b7d335ae932d81ce51a588a4a",
"subsystem": "j1939",
"problem_description": "j1939_session reference count leaks when receiving a second RTS packet."
},
{
"Commit": "1a620a723853a0f49703c317d52dc6b9602cbaa8",
"Fixed-by": "faba5860fcf9a0ae49d2e484397bce44293367ff",
"subsystem": "can",
"problem_description": "CAN FD frames are not rejected when the interface is in CAN XL-only mode."
},
{
"Commit": "1a620a723853a0f49703c317d52dc6b9602cbaa8",
"Fixed-by": "166e87329ce6f1eaa3475ba2d14ed30e54727c0d",
"subsystem": "can",
"problem_description": "Accessing CAN device internal data structures from the network layer caused dependency and linker problems."
},
{
"Commit": "b9a66cd5ccbb9fade15d0e427e19470d8ad35b75",
"Fixed-by": "12ffd561d2de28825f39e15e8d22346d26b09688",
"subsystem": "mshv",
"problem_description": "GPA intercepts for movable memory regions were not handled for arm64 guests, causing them to be non-functional."
},
{
"Commit": "abceb4297bf88340ce06016895babe292510a262",
"Fixed-by": "259add0d982cbe83170f0c2a9f160834f0f83dd4",
"subsystem": "mshv",
"problem_description": "Huge page operations are attempted for guest mappings that are not aligned to the huge page size, causing hypervisor rejections."
},
{
"Commit": "9c318a1d9b5000c77527011f158a75c5483510f5",
"Fixed-by": "49f49d47af67f8a7b221db1d758fc634242dc91a",
"subsystem": "hv",
"problem_description": "Hyper-V panic notification is skipped if the kernel message dump fails or yields no data, and a static checker warns about potentially using an uninitialized variable."
},
{
"Commit": "33cf94d7176672174042bea0566065f356e2caab",
"Fixed-by": "3e8e590fd65d0572584ab7bba89a35e6d19931f1",
"subsystem": "dax",
"problem_description": "The commit added the align field to struct dev_dax without adding the corresponding kerneldoc comment."
},
{
"Commit": "87482708210ff3333adab4dc5f1a491793159d43",
"Fixed-by": "f46c26f1bcd9164d7f3377f15ca75488a3e44362",
"subsystem": "mm",
"problem_description": "Missing <asm/numa.h> include in mm/numa_memblks.c causes a sparse warning that the symbol 'numa_nodes_parsed' was not declared."
},
{
"Commit": "66bce7afbaca6ca9022210b0cd9fa3405da36667",
"Fixed-by": "21c68ad1d9771d331198cc73cbf6e908d7915f35",
"subsystem": "mm",
"problem_description": "The gup_longterm selftest fails on unknown filesystems because it returns early without reporting the test result."
},
{
"Commit": "5749077415994eb02d660b2559b9d8278521e73d",
"Fixed-by": "038a102535eb49e10e93eafac54352fcc5d78847",
"subsystem": "mm",
"problem_description": "On UP systems, the per-cpu pages structure can be corrupted by nested locking if an interrupt occurs while the pcp lock is held without disabling interrupts."
},
{
"Commit": "e37d5a2d60a338c5917c45296bac65da1382eda5",
"Fixed-by": "4b5c493ff762bb0433529ca6870b284f0a2a5ca8",
"subsystem": "iommu",
"problem_description": "A missing header include causes build failures on some architectures like 32-bit arm due to an undeclared function."
},
{
"Commit": "b073d7f8aee4ebf05d10e3380df377b73120cf16",
"Fixed-by": "4795d205d78690a46b60164f44b8bb7b3e800865",
"subsystem": "mm",
"problem_description": "kmsan_free_page() incorrectly calculates the size of non-compound high-order pages, causing tail pages to not be poisoned when freed."
},
{
"Commit": "879bca0a2c4f40b08d09a95a2a0c3c6513060b5c",
"Fixed-by": "fb39444732f02c32a8312c168d97e33d872c14d3",
"subsystem": "mm",
"problem_description": "missing selftests for forked faulted/unfaulted VMA merges"
},
{
"Commit": "879bca0a2c4f40b08d09a95a2a0c3c6513060b5c",
"Fixed-by": "3b617fd3d317bf9dd7e2c233e56eafef05734c9d",
"subsystem": "mm",
"problem_description": "mremap incorrectly permits merging a forked VMA into an unfaulted one, leading to potential anon_vma lock scalability issues."
},
{
"Commit": "879bca0a2c4f40b08d09a95a2a0c3c6513060b5c",
"Fixed-by": "0ace8f2db6b3b4b0677e559d1a7ab7fd625d61ec",
"subsystem": "mm",
"problem_description": "mremap merging a faulted VMA into an unfaulted one causes use-after-free or zero refcount asserts due to incorrect anon_vma propagation"
},
{
"Commit": "879bca0a2c4f40b08d09a95a2a0c3c6513060b5c",
"Fixed-by": "61f67c230a5e7c741c352349ea80147fbe65bfae",
"subsystem": "mm",
"problem_description": "Fixes a use-after-free of anon_vma during mremap() when merging a faulted VMA with an unfaulted one, and prevents incorrect merging of copied VMAs that have copy-on-write parents."
},
{
"Commit": "779b9955f64327c339a16f68055af98252fd3315",
"Fixed-by": "590b13669b813d55844fecd9142c56abd567914d",
"subsystem": "mm",
"problem_description": "The failure path in zswap_cpu_comp_prepare() erroneously calls crypto_free_acomp() on an error pointer because it checks for NULL instead of using IS_ERR_OR_NULL()."
},
{
"Commit": "9bbb820a5bd5f406ae5e0819cc31f2c2e6f4d990",
"Fixed-by": "392b3d9d595f34877dd745b470c711e8ebcd225c",
"subsystem": "mm/damon",
"problem_description": "Subdirectories of the access_pattern directory are not cleaned up if DAMOS-scheme DAMON sysfs directory setup fails, leading to memory leaks and a broken sysfs interface."
},
{
"Commit": "1b32234ab087d15f4afcac644dbe036100bcc1c1",
"Fixed-by": "dc7e1d75fd8c505096d0cddeca9e2efb2b55aaf9",
"subsystem": "mm",
"problem_description": "Subdirectories of the quotas sysfs directory are not cleaned up if the subsequent watermarks directory setup fails, leading to memory leaks and a broken sysfs interface."
},
{
"Commit": "c951cd3b89010c7a4751b9d4ea074007e44851e6",
"Fixed-by": "9814cc832b88bd040fc2a1817c2b5469d0f7e862",
"subsystem": "mm/damon",
"problem_description": "DAMON sysfs subdirectories are not cleaned up if context directory setup fails, causing memory leaks and a broken interface."
},
{
"Commit": "8fbbcbeaafeb82498fd83f58c1e5ad1aff135212",
"Fixed-by": "a24ca8ebb0cd5ea07a1462b77be0f0823c40f319",
"subsystem": "mm",
"problem_description": "The intervals/intervals_goal directory is not cleaned up if the subsequent nr_regions_range allocation fails."
},
{
"Commit": "004ded6bee11b8ed463cdc54b89a4390f4b64f6d",
"Fixed-by": "f9132fbc2e83baf2c45a77043672a63a675c9394",
"subsystem": "mm/damon",
"problem_description": "damon_call() causes a use-after-free by failing to remove the call_control object from the context's list when the context is inactive."
},
{
"Commit": "a9af76a78760717361cccc884dc649e30db61c8b",
"Fixed-by": "e561383a39ed6e5c85a0b2369720743b694327ae",
"subsystem": "powerpc/watchdog",
"problem_description": "The hardlockup_sys_info sysctl was missing support in the PowerPC watchdog and triggered a compiler warning in generic watchdog code."
},
{
"Commit": "6faea3422e3b4e8de44a55aa3e6e843320da66d2",
"Fixed-by": "f171b55f1441294344b86edfeaa575ea9673fd23",
"subsystem": "mips",
"problem_description": "High memory is incorrectly initialized on MIPS CPUs with D-cache aliases because a check for CPU support was removed."
},
{
"Commit": "c2833a5bf75b3657c4dd20b3709c8c702754cb1f",
"Fixed-by": "b02019169284df8f4ce972a60da31d28bd5b5979",
"subsystem": "mm",
"problem_description": "Gigantic hugepages are allocated even when hugepages are unsupported, causing out-of-memory errors during boot."
},
{
"Commit": "b74a120bcf50787e5b9a2c3dcff999f9836ce1db",
"Fixed-by": "a38be546269073bf8edc3c49eaf18cdfce905777",
"subsystem": "mm",
"problem_description": "accessing the memcg structure without holding a reference to it is unsafe"
},
{
"Commit": "de51999e687c70a41997124b43291f84324c7924",
"Fixed-by": "582f0f3864110e1c6e4af3af768e1c2453ba2306",
"subsystem": "kho",
"problem_description": "List corruption and a double free of scratch memory occur when initializing with an empty preserved memory map due to late validation."
},
{
"Commit": "ad41251c290dfe3c01472c94d2439a59de23fe97",
"Fixed-by": "777a8560fd29738350c5094d4166fe5499452409",
"subsystem": "lib/buildid",
"problem_description": "Direct page cache access via read_cache_folio() caused a NULL pointer dereference in filemap_read_folio during sleepable build ID parsing."
},
{
"Commit": "2dfe63e61cc31ee59ce951672b0850b5229cd5b0",
"Fixed-by": "6cfab50e1440fde19af7c614aacd85e11aa4dcea",
"subsystem": "mm",
"problem_description": "Fixes a kernel-doc warning caused by the missing description of the slab parameter in the __kfence_obj_info function documentation."
},
{
"Commit": "4c5d3365882dbbc0784688784904f440d7a4c0f1",
"Fixed-by": "eb3f781ab73e7ed970070a0b9a7d951f980e717a",
"subsystem": "mm",
"problem_description": "The kernel-doc comment incorrectly referenced the internal _noprof function name instead of the public vrealloc_node_align macro, causing a Sphinx warning."
},
{
"Commit": "2de4ff7bd658c97fb357efa3095a509674dacb5a",
"Fixed-by": "f26528478bb102c28e7ac0cbfc8ec8185afdafc7",
"subsystem": "textsearch",
"problem_description": "The 'list' member of 'struct ts_ops' is missing its kernel-doc description."
},
{
"Commit": "3f6d5e6a468d02676244b868b210433831846127",
"Fixed-by": "e2fb7836b01747815f8bb94981c35f2688afb120",
"subsystem": "mm",
"problem_description": "The 'flags' parameter in the 'memalloc_flags_save' function was missing from the kernel-doc comments, resulting in a Sphinx warning."
},
{
"Commit": "ffef54ad41101f98ea6dd1dcd71c60bb6b7c8ee9",
"Fixed-by": "344c5281f43851b22c7cc223fd0250c143fcbc79",
"subsystem": "riscv",
"problem_description": "On RV32 systems, restoring the 64-bit stimecmp register using two separate 32-bit writes causes spurious timer interrupts due to a race condition where the intermediate state is evaluated as expired."
},
{
"Commit": "8f5cb44b1bae8520c0705ce348b30ffb1fdda43a",
"Fixed-by": "75870639bf5d1c447ddba4d738ff72771a69f2a1",
"subsystem": "riscv kvm",
"problem_description": "Spurious timer interrupts occur on 32-bit systems due to a race condition when updating the 64-bit vstimecmp CSR in two separate writes."
},
{
"Commit": "9f7a8ff6391fd5363363b8e5c8b1462a07922368",
"Fixed-by": "eaa9bb1d39d59e7c17b06cec12622b7c586ab629",
"subsystem": "clocksource",
"problem_description": "spurious timer interrupts occur on 32-bit RISC-V systems due to a race condition when updating the 64-bit stimecmp register"
},
{
"Commit": "57c5bd9aee944b0f5c2ab314e10a86fae51f7bf2",
"Fixed-by": "4181aceb4af414bd6d2ce5eb9a22637bbb4f5f8c",
"subsystem": "i2c",
"problem_description": "Device private data is freed during shutdown, potentially causing use-after-free bugs as devres registrations may still access it."
},
{
"Commit": "f07b2b3f9d47fea308af3ae05613b6b4801e68a3",
"Fixed-by": "69132c2d4c11858fa43edeb19a911eab625567f9",
"subsystem": "riscv",
"problem_description": "The documentation for ISA string ordering references chapter 27 of the RISC-V specification without specifying the version, which is incorrect for newer versions."
},
{
"Commit": "c918e75e1ed95be76f8e3156a411188f650fe03f",
"Fixed-by": "d04f73668bebbc5a44a2771ea92b6ec253148050",
"subsystem": "drm/amd/display",
"problem_description": "The HDMI HPD filter was enabled by default, which is unnecessary for most modern displays."
},
{
"Commit": "edc762a51c7181d6fe1e0837e2eb69afb406f98e",
"Fixed-by": "b2426a211dba6432e32a2e70e9183c6e134475c6",
"subsystem": "drm/amdgpu",
"problem_description": "The userq->last_fence reference is not released when the user queue is destroyed, causing a memory leak that prevents the slab cache from shutting down cleanly."
},
{
"Commit": "079ae5118e1f0dcf5b1ab68ffdb5760b06ed79a2",
"Fixed-by": "18dbcfb46f692e665c3fe3eee804e56c4eae53d6",
"subsystem": "drm/amdkfd",
"problem_description": "Suspending the entire MES during process queue eviction stops kernel mode queues, causing timeouts in mixed workloads."
},
{
"Commit": "54f7f3ca982af73512e5dfd541fe20dc72673180",
"Fixed-by": "90dbc0bc2aa60021615969841fed06790c992bde",
"subsystem": "drm/amd/pm",
"problem_description": "incorrect type definitions for overdrive percentages (uint32_t instead of int16_t) potentially caused calculation errors"
},
{
"Commit": "2fe87f54abdc5c29bd2ebc301964926ea27b3d89",
"Fixed-by": "52d3d115e9cc975b90b1fc49abf6d36ad5e8847a",
"subsystem": "drm/amd/display",
"problem_description": "initial backlight levels derived from ACPI may not match the actual hardware state, resulting in sudden brightness changes on the first update"
},
{
"Commit": "4321742c394ec369c93dd8860eb420165027d8f5",
"Fixed-by": "0a1253ba5096f531eaaef40caa4c069da6ad48ae",
"subsystem": "drm/amd/display",
"problem_description": "The PSR support message lacks the link name, causing confusion when multiple links are present."
},
{
"Commit": "11614c36bc8f4fd22ff91e6150ac63e8bfce33b5",
"Fixed-by": "80614c509810fc051312d1a7ccac8d0012d6b8d0",
"subsystem": "drm/amdkfd",
"problem_description": "Memory allocated for HIQ and SDMA MQDs is leaked if the device queue manager initialization fails."
},
{
"Commit": "237d623ae6594df547fbb003953b5d2dd57e6124",
"Fixed-by": "122b15cdbcc2eaccd7c1e630bb79ff4c268dd3f4",
"subsystem": "drm/amdgpu",
"problem_description": "The `amdgpu_gart_map_vram_range` function incorrectly uses the fixed `adev->gart.ptr` address instead of the provided `dst` parameter when setting up GART page table entries."
},
{
"Commit": "ce0478b02ed29465c1de3d03c3eea721355f9d2d",
"Fixed-by": "9c8120015270d8a31c335c7137977749e5e8cd30",
"subsystem": "drm/amdgpu",
"problem_description": "Duplicate code disabling peer-to-peer access for DCC-enabled GC12 VRAM surfaces was introduced during a merge."
},
{
"Commit": "fe151ed7af5425c424a5735ef9fa3d02c828be7f",
"Fixed-by": "9cb6278b44c38899961b36d303d7b18b38be2a6e",
"subsystem": "drm/amdgpu",
"problem_description": "A null pointer dereference occurs in amdgpu_display_get_scanout_buffer when the driver does not support atomic modesetting because it incorrectly accesses plane->state->fb instead of plane->fb."
},
{
"Commit": "746680ec6696585e30db3e18c93a63df9cbec39c",
"Fixed-by": "5d9c4c272ba06055d19e05c2a02e16e58acc8943",
"subsystem": "rust",
"problem_description": "Flags::new triggers build errors because missing inlining prevents build_assert! from optimizing out the error path."
},
{
"Commit": "ce30d94e6855a4f6dc687f658e63c225fcc1d690",
"Fixed-by": "33d19f621641de1b6ec6fe1bb2ac68a7d2c61f6a",
"subsystem": "rust",
"problem_description": "Build errors occur because functions using `build_assert` with arguments are not guaranteed to be inlined, preventing the compiler from optimizing out the error path."
},
{
"Commit": "d7659acca7a390b5830f0b67f3aa4a5f9929ab79",
"Fixed-by": "74e15ac34b098934895fd27655d098971d2b43d9",
"subsystem": "rust",
"problem_description": "The `pin_init_internal` crate was missing dependencies in the `rust-analyzer` configuration which resulted in broken code navigation."
},
{
"Commit": "d7659acca7a390b5830f0b67f3aa4a5f9929ab79",
"Fixed-by": "98dcca855343512a99432224447f07c5988753ad",
"subsystem": "scripts",
"problem_description": "The rust-analyzer configuration for the pin_init crate is missing a dependency on compiler_builtins."
},
{
"Commit": "8c4555ccc55cf90e1e3eb2507be3c354f3d15839",
"Fixed-by": "5157c328edb35bac05ce77da473c3209d20e0bbb",
"subsystem": "scripts",
"problem_description": "The compiler_builtins crate is missing a dependency on the core crate in the generated rust-analyzer configuration."
},
{
"Commit": "0b24f9740f26ac7ad91ac0f4de27717c14de91bd",
"Fixed-by": "81a304f5b39c9a0a26c1b42997e60a5c9be05ec8",
"subsystem": "rust",
"problem_description": "The documentation example for the `module!` macro fails to link due to undefined atomic helper symbols."
},
{
"Commit": "c0e0d6ba25f180ab76d3c18f8b360a119dffa634",
"Fixed-by": "da579f05ef0faada3559e7faddf761c75cdf85e1",
"subsystem": "io_uring",
"problem_description": "Infinite loop and 100% CPU usage during io_uring exit because local task work generated during cancellation is not processed when IORING_SETUP_DEFER_TASKRUN is set"
},
{
"Commit": "395ed1ef0012e1bb1e4050e84ba0173b3623112a",
"Fixed-by": "561940a7ee81319b9cba06d2b7ba6b45a5c41cbc",
"subsystem": "iomap",
"problem_description": "function __iomap_get_folio does not wait for writeback to complete when using batched folios, which breaks support for hardware requiring stable writes"
},
{
"Commit": "d2fe192348f93fe3a0cb1e33e4aba58e646397f4",
"Fixed-by": "0edb475ac0a7d153318a24d4dca175a270a5cc4f",
"subsystem": "nvme",
"problem_description": "The NVMe PCIe subsystem reset fails to recover the controller because transitioning directly from RESETTING to LIVE is disallowed."
},
{
"Commit": "48dbe731171e425611290f5b6d3058f86efb16bd",
"Fixed-by": "010dc57cb5163e5f4a32430dd5091cc29efd0471",
"subsystem": "usb",
"problem_description": "The interval duration for high-speed isochronous endpoints was calculated incorrectly by treating the bInterval value as a linear multiplier instead of an exponent."
},
{
"Commit": "98ad0329156094a63c5191bb0f57b7bae9659f18",
"Fixed-by": "2edc1acb1a2512843425aa19d0c6060a0a924605",
"subsystem": "usb: gadget: uvc",
"problem_description": "The req_payload_size calculation causes a division by zero when reqs_per_frame is 0 and can exceed the maximum request size, leading to undefined behavior and controller failure."
},
{
"Commit": "0ec946d32ef7b1f58070cbef06bd7bdc8193c94a",
"Fixed-by": "42c85d89b8d677b51f6a75569c69299a46d9f03d",
"subsystem": "usb",
"problem_description": "Redundant role switch interrupts on Apple Silicon devices cause resets that prevent USB device detection."
},
{
"Commit": "5df186e2ef11dca3fb6f0f332dc09c4ac0bed870",
"Fixed-by": "d13b6a128a12e528bb18f971f2969feb286f45c7",
"subsystem": "usb",
"problem_description": "The driver logs spurious error messages for missing optional wake IRQs because it uses platform_get_irq instead of platform_get_irq_optional."
},
{
"Commit": "0ec946d32ef7b1f58070cbef06bd7bdc8193c94a",
"Fixed-by": "c4380ee3ccbf591d855317249f31c820b7b73a46",
"subsystem": "usb",
"problem_description": "USB2 PHY role configuration fails if performed after the PHY is powered on or DWC3 is initialized, preventing device connectivity."
},
{
"Commit": "ed2b5a8e6b98d042b323afbe177a5dc618921b31",
"Fixed-by": "e07dea3de508cd6950c937cec42de7603190e1ca",
"subsystem": "phy",
"problem_description": "double free of child_np in rockchip_usb2phy_probe() if devm_request_threaded_irq() fails"
},
{
"Commit": "689c7655b50c5de2b6f0f42fecfb37bde5acf040",
"Fixed-by": "46378ab9fcb796dca46b51e10646f636e2c661f9",
"subsystem": "ASoC",
"problem_description": "The tlv320adcx140 driver misconfigures the word length by using data width instead of physical width, causing noise when they differ."
},
{
"Commit": "4e82971f7b556cff3491c867e8840e7d788693b9",
"Fixed-by": "be7664c81d3129fc313ef62ff275fd3d33cfecd4",
"subsystem": "sound",
"problem_description": "A null pointer dereference occurs in adcx140_pwr_ctrl because the uninitialized component member of adcx140_priv is dereferenced during error logging."
},
{
"Commit": "d74bad3b74524e4f34c97903ad170d9061bcfbd9",
"Fixed-by": "390caeed0897fcac75f3c414dbdd85d593183d9c",
"subsystem": "ASoC",
"problem_description": "Headphone audio output is missing when the jack impedance is detected as LINEOUT because the Headphone DAPM pin is not enabled for the SND_JACK_LINEOUT mask."
},
{
"Commit": "e377c94773171e8a97e716e57ec67d49b02ded0b",
"Fixed-by": "5b027c74f3ee8979193c50d31187edfa31acc0db",
"subsystem": "ASoC",
"problem_description": "asoc_sdw_rtd_init() incorrectly uses non-unique DAI names for codec lookup instead of SoundWire part IDs, which can lead to incorrect initialization."
},
{
"Commit": "1c5af5cf9308fff327f52c7efd2dfa732d370871",
"Fixed-by": "baaecfcac559bcac73206df447eb5c385fa22f2a",
"subsystem": "kconfig",
"problem_description": "Static linking of nconf fails because ncurses libraries are linked in the wrong order."
},
{
"Commit": "93863f3f859a626347ce2ec18947b11357b4ca14",
"Fixed-by": "946d462346d2ded161cfd3dc62a61d7050d9f9ec",
"subsystem": "kbuild",
"problem_description": "The check-function-names.sh script invoked 'nm' directly, which caused cross-compilation failures when the system default nm differed from the toolchain nm."
},
{
"Commit": "a09c8b3f9047959e60dde90c51dcca17f66778c1",
"Fixed-by": "f2a3f51365bf672dab4b58d1e8954926a9196b44",
"subsystem": "i2c",
"problem_description": "LPI2C transfers utilizing EDMA fail during system suspend/resume because EDMA resources are unavailable."
},
{
"Commit": "cacd9643eca7a1f4635479aff4ec33aaade45e64",
"Fixed-by": "c0c50e3743e467ec4752c638e10e97f89c8644e2",
"subsystem": "i2c",
"problem_description": "The driver incorrectly selects SE DMA mode for I2C Hub controllers, which do not support DMA, when handling mappable buffers."
},
{
"Commit": "a976d790f49499ccaa0f991788ad8ebf92e7fd5c",
"Fixed-by": "d7f1b4bdc7108be1b178e1617b5f45c8918e88d7",
"subsystem": "efi",
"problem_description": "cper_bits_to_str returns a negative value instead of the number of bytes written on success"
},
{
"Commit": "e8c086880b2bac0ebc931b635b3b10bdc5ec6496",
"Fixed-by": "b91a565ed14fcf900b4d95e86882b4b763860986",
"subsystem": "drm/sysfb",
"problem_description": "Duplicate function declarations for drm_sysfb_get_validated_int and drm_sysfb_get_validated_int0 were introduced in drm_sysfb_helper.h"
},
{
"Commit": "462dbc9101acd38e92eda93c0726857517a24bbd",
"Fixed-by": "3879cffd9d07aa0377c4b8835c4f64b4fb24ac78",
"subsystem": "net/sched",
"problem_description": "The function qfq_change_class incorrectly frees an existing class on error, causing a use-after-free."
},
{
"Commit": "6cf93a9ed39e9f86c7f69c28078500270e70a695",
"Fixed-by": "6a069876eb1402478900ee0eb7d7fe276bb1f4e3",
"subsystem": "rust",
"problem_description": "Linker errors occur on 32-bit ARM due to missing definitions for _find_* bit operation functions used by Rust bindings."
},
{
"Commit": "5ebfb4cc3048380b43506ffc71b9cf8b83128989",
"Fixed-by": "cf055f8c000445aa688c53a706ef4f580818eedb",
"subsystem": "selftests",
"problem_description": "The RPS bitmask bounds check incorrectly limits the allowed CPUs to 0-3 instead of the intended 0-15 due to a bitwise mask calculation error."
},
{
"Commit": "9cf9aa77a1f6339ac97ac4afe44939cf0974ef96",
"Fixed-by": "9d48c62f6b4ed70ebeea70f52ddb1c6d8613bed4",
"subsystem": "net",
"problem_description": "The toeplitz.py test passes the RPS mask without a '0x' prefix to toeplitz.c, causing it to be parsed as decimal instead of hexadecimal."
},
{
"Commit": "00b5b7aab9e422d00d5a9d03d7e0760a76b5d57f",
"Fixed-by": "ddf96c393a33aef4887e2e406c76c2f8cda1419c",
"subsystem": "ipv6",
"problem_description": "use-after-free in inet6_addr_del due to accessing flags after freeing the address"
},
{
"Commit": "8d0b94afdca84598912347e61defa846a0988d04",
"Fixed-by": "9a6f0c4d5796ab89b5a28a890ce542344d58bd69",
"subsystem": "net",
"problem_description": "Race conditions in rt6_uncached_list_del() and rt_del_uncached_list() caused by lockless list_empty() checks lead to use-after-free crashes."
},
{
"Commit": "962f3fee83a4ef9010ae84dc43ae7aecb572e2a9",
"Fixed-by": "d23564955811da493f34412d7de60fa268c8cb50",
"subsystem": "net",
"problem_description": "Updating the RSS hash key causes a system hang when the RX indirection table is not allocated."
},
{
"Commit": "1590700d94ac53772491ed3103a4e8b8de01640a",
"Fixed-by": "9e9bc6be0fa0b6b6b73f4f831f3b77716d0a8d9e",
"subsystem": "drm/nouveau",
"problem_description": "Display DMA channels hang because the display mutex is not held during cursor updates in curs507a_prepare."
},
{
"Commit": "32ece31db4df792c36bbabb8a1d263a5e1f5017a",
"Fixed-by": "7edf6f7ef5345e1b4202912ca98aaa7c73e1e82c",
"subsystem": "ACPI",
"problem_description": "Enabling PM debug messages causes suspend issues on some platforms because it triggers the problematic evaluation of LPS0 _DSM Function 1."
},
{
"Commit": "edd17206e363aebc9595b2ffefa7e4d8aba096ef",
"Fixed-by": "84164acba33158208c2b0e8e5607bdd43edc0dd4",
"subsystem": "nvmet",
"problem_description": "A KASAN slab-out-of-bounds read occurs in nvmet_passthru_override_id_ctrl when memcpy reads beyond the end of the dynamically allocated subsysnqn string."
},
{
"Commit": "0d58cdc902dace2298406b3972def04f55e3d775",
"Fixed-by": "8ad1b6c1e63d25f5465b7a8aa403bdcee84b86f9",
"subsystem": "igc",
"problem_description": "A 7KB TX packet buffer size per queue causes TX unit hangs under heavy timestamping load."
},
{
"Commit": "c789ad7cbebcac5d5f417296c140a1252c689524",
"Fixed-by": "6990dc392a9ab10e52af37e0bee8c7b753756dc4",
"subsystem": "igc",
"problem_description": "A race condition in the TX timestamp workaround logic causes valid timestamps to be dropped if they arrive between the ready bit check and the initial register read."
},
{
"Commit": "c814a2d2d48f04eb3c4480e8f7835a5f2b235f85",
"Fixed-by": "41a9a6826f20a524242a6c984845c4855f629841",
"subsystem": "igc",
"problem_description": "Changing channels clears the default Qbv schedule causing Tx stalls, and channel reconfiguration was incorrectly allowed when TSN offloads were active."
},
{
"Commit": "5f6df173f92eff2d6fa09d74e47e204b0072f82e",
"Fixed-by": "01139a2ce532d77379e1593230127caa261a8036",
"subsystem": "ice",
"problem_description": "The function ice_release_res incorrectly treats the microsecond-based ICE_CTL_Q_SQ_CMD_TIMEOUT as jiffies, resulting in an excessively long timeout."
},
{
"Commit": "1e0f9881ef79af9629bbf3cc3b307498d2e015ac",
"Fixed-by": "a9d45c22ed120cdd15ff56d0a6e4700c46451901",
"subsystem": "ice",
"problem_description": "stopping the primary interface of a bond incorrectly purges shared prune lists, breaking communication on the secondary interface"
},
{
"Commit": "2b245cb29421abbad508e93cdfedf81adc12edf1",
"Fixed-by": "8439016c3b8b5ab687c2420317b1691585106611",
"subsystem": "ice",
"problem_description": "ring statistics syncp is not initialized leading to improper lockdep state on 32-bit systems"
},
{
"Commit": "53326135d0e041ebe7d08bf22f82529ae69a096e",
"Fixed-by": "e383f0961422f983451ac4dd6aed1a3d3311f2be",
"subsystem": "i2c",
"problem_description": "I2C transfers are attempted while the controller is suspended due to inappropriate ordering of system sleep callbacks."
},
{
"Commit": "d8df126349dad855cdfedd6bbf315bad2e901c2f",
"Fixed-by": "7517e899e1b87b4c22a92c7e40d8733c48e4ec3c",
"subsystem": "x86/resctrl",
"problem_description": "incorrect overflow handling on Hygon CPUs due to the kernel falling back to the default 24-bit memory bandwidth counter width instead of the supported 32-bit width"
},
{
"Commit": "c3dd67681c70cc95cc2c889b1b58a1667bb1c48b",
"Fixed-by": "8441c7d3bd6c5a52ab2ecf77e43a5bf262004f5c",
"subsystem": "cxl",
"problem_description": "Invalid addresses returned by translation functions are not checked, leading to address corruption during subsequent calculations."
},
{
"Commit": "648a121bafa3f4487254ab8e9e298f12540f0603",
"Fixed-by": "31707572108da55a005e7fed32cc3869c16b7c16",
"subsystem": "wifi: ath12k",
"problem_description": "The P2P device link ID is incorrectly set to 0 instead of 15 during negotiation, leading to transmission failures."
},
{
"Commit": "56dcbf0b520796e26b2bbe5686bdd305ad924954",
"Fixed-by": "f88e9fc30a261d63946ddc6cc6a33405e6aa27c3",
"subsystem": "ath12k",
"problem_description": "Deadlock occurs when flushing management frames because the flush operation holds the wiphy lock, preventing the transmission work item it waits for from running."
},
{
"Commit": "3863f014ad23f1f966b78e8fe6f4cbed97fd4737",
"Fixed-by": "8b8d6ee53dfdee61b0beff66afe3f712456e707a",
"subsystem": "wifi: ath12k",
"problem_description": "The scan state remains stuck in ABORTING blocking subsequent scans because the cleanup work is cancelled instead of flushed during cancel_remain_on_channel."
},
{
"Commit": "feed05f1526e81677f508b026fd2d66d178f65f8",
"Fixed-by": "39c90b1a1dbe6d7c49d19da6e5aec00980c55d8b",
"subsystem": "ath12k",
"problem_description": "Scan cancellation causes a kernel crash by accessing uninitialized links and incorrectly aborts unrelated scans."
},
{
"Commit": "d8df126349dad855cdfedd6bbf315bad2e901c2f",
"Fixed-by": "6ee98aabdc700b5705e4f1833e2edc82a826b53b",
"subsystem": "x86/resctrl",
"problem_description": "Critical resctrl data structures for Hygon CPUs remain uninitialized because they are not included in the AMD-specific initialization paths."
},
{
"Commit": "bb4c19e030f45c5416f1eb4daa94fbaf7165e9ea",
"Fixed-by": "40b94ec7edbbb867c4e26a1a43d2b898f04b93c5",
"subsystem": "null_blk",
"problem_description": "Memory leak occurs because references to fault-injection configfs items are not released when removing a null_blk device."
},
{
"Commit": "73cfd166e045769a1b42d36897accaa6e06b8102",
"Fixed-by": "dc2d5ddb193e363187bae2ad358245642d2721fb",
"subsystem": "drm/gud",
"problem_description": "Kernel oops occurs due to NULL pointer dereferences of 'fb' and 'crtc' in gud_plane_atomic_check() and gud_plane_atomic_update() during USB disconnect."
},
{
"Commit": "2144833e7b41459fa2d52bb0676f0ab4920cf32c",
"Fixed-by": "6a0243c4020636482797acfd48d7d9b0ea2f2a20",
"subsystem": "ALSA",
"problem_description": "The KUnit test suite for the Cirrus side-codec library was incorrectly named 'snd-hda-scodec-cs35l56-test' instead of 'snd-hda-cirrus-scodec-test'."
},
{
"Commit": "2144833e7b41459fa2d52bb0676f0ab4920cf32c",
"Fixed-by": "c5e96e54eca3876d4ce8857e2e22adbe9f44f4a2",
"subsystem": "ALSA",
"problem_description": "The cirrus_scodec_test KUnit test fails to associate the software node with the GPIO driver because the mock gpio_chip does not have its parent device set."
},
{
"Commit": "d633b8a702ab2eb4ef9263f1ab1610bb8cdf71a5",
"Fixed-by": "c8c6fb886f57d5bf71fb6de6334a143608d35707",
"subsystem": "ata",
"problem_description": "supported features were not printed for ATAPI devices during device scan"
},
{
"Commit": "b1f5af54f1f5202ba0cd29a94e45ee7ac7517c0f",
"Fixed-by": "89531b68fc293e91187bf0992147e8d22c65cff3",
"subsystem": "ata",
"problem_description": "ata_dev_print_features() incorrectly returns early and fails to print supported features if the device only supports DIPM or HIPM."
},
{
"Commit": "fe22e1c2f705676a705d821301fc52eecc2fe055",
"Fixed-by": "a6bee5e5243ad02cae575becc4c83df66fc29573",
"subsystem": "ata",
"problem_description": "ata_dev_print_features returns early and fails to print the Concurrent Positioning Ranges (CPR) feature if it is the only supported feature."
},
{
"Commit": "0060beec0bfa647c4b510df188b1c4673a197839",
"Fixed-by": "ce83767ea323baf8509a75eb0c783cd203e14789",
"subsystem": "ata",
"problem_description": "The link_power_management_supported sysfs attribute incorrectly indicates support for ports lacking the set_lpm callback."
},
{
"Commit": "d360121832d8a36871249271df5b9ff05f835f62",
"Fixed-by": "8f3fb33f8f3f825c708ece800c921977c157f9b6",
"subsystem": "ata",
"problem_description": "LPM configuration and quirks are not applied for ATAPI devices because ata_dev_config_lpm() is not called for them."
},
{
"Commit": "f7131935238d00745638b826f8c31efc8d361435",
"Fixed-by": "ea4d4ea6d10a561043922d285f1765c7e4bfd32a",
"subsystem": "ata",
"problem_description": "registers of unimplemented ports are accessed, violating the AHCI specification"
},
{
"Commit": "aab12022b076f0b385b7a9a78e1161bd2df5d1e3",
"Fixed-by": "12d4fd9a657174496677cff2841315090f1c11fc",
"subsystem": "soundwire",
"problem_description": "ida_alloc_max() is called with an inclusive limit equal to the IRQ domain size, allowing an out-of-bounds ID allocation that fails IRQ mapping."
},
{
"Commit": "f5a538c07df26f5c601e41f7b9c7ade3e1e75803",
"Fixed-by": "ca1e8eede4fc68ce85a9fdce1a6c13ad64933318",
"subsystem": "sched",
"problem_description": "The deadline server stops unexpectedly while fair tasks are runnable due to incorrect idle state tracking."
},
{
"Commit": "59953303827eceb06d486ba66cc0d71f55ded8ec",
"Fixed-by": "436326bc525d467e38db1da576139ec5f28268c5",
"subsystem": "objtool",
"problem_description": "The build fails when libbfd is present but libopcodes is missing, and feature detection incorrectly uses the cross-compiler instead of the host compiler."
},
{
"Commit": "318e18ed22e89397635e15095c014accaf47ed30",
"Fixed-by": "64e6fa76610ec970cfa8296ed057907a4b384ca5",
"subsystem": "sched",
"problem_description": "A race condition in dl_add_task_root_domain() occurs because local_cpu_mask_dl is accessed without disabling preemption, allowing a migrating task to corrupt the per-CPU buffer of the previous CPU."
},
{
"Commit": "a3493b33384a01a1f0e38b420d1a4766aec903a6",
"Fixed-by": "26bea10450afe5ad4dd0e0bbb797c44e1df110fe",
"subsystem": "objtool",
"problem_description": "Compilation fails with the x32 toolchain because the printf specifier \"%lx\" expects a long but the checksum variable is a long long."
},
{
"Commit": "1e7f7fbcd40c69d23e3fe641ead9f3dc128fa8aa",
"Fixed-by": "05dc4a9fc8b36d4c99d76bbc02aa9ec0132de4c2",
"subsystem": "hrtimer",
"problem_description": "The update_needs_ipi function incorrectly uses the clockid instead of the base index to identify softirq clock bases."
},
{
"Commit": "56d1115c9bc7853e143f59fb5976cf3de609f657",
"Fixed-by": "c360004c0160dbe345870f59f24595519008926f",
"subsystem": "xfs",
"problem_description": "The max_agbno calculation was too conservative, preventing sparse inode cluster allocation in the last full inode chunk of an allocation group, potentially leading to allocation failures and filesystem shutdowns."
},
{
"Commit": "e94b53ff699c2674a9ec083342a5254866210ade",
"Fixed-by": "6b2d155366581705a848833a9b626bfea41d5a8d",
"subsystem": "xfs",
"problem_description": "xfs_rtcopy_summary() always returns 0, ignoring any error codes generated during execution"
},
{
"Commit": "100dfa74cad9d4665cdcf0cc8e673b123a3ea910",
"Fixed-by": "ffe4ccd359d006eba559cb1a3c6113144b7fb38c",
"subsystem": "net",
"problem_description": "Packets were incorrectly dropped for the HTB Qdisc because the temporary queue length was checked against q->limit, which is zero for HTB."
},
{
"Commit": "de04bb0089a96cc00d13b12cbf66a088befe3057",
"Fixed-by": "9380dc33cd6ae4a6857818fcefce31cf716f3fae",
"subsystem": "drm/panel",
"problem_description": "Panels without an explicit connector type fail to initialize because the fallback connector type logic is bypassed during panel allocation."
},
{
"Commit": "97ceb1fb08b6a2f78aa44a7c229ca280964860c0",
"Fixed-by": "6ab3d4353bf75005eaa375677c9fed31148154d6",
"subsystem": "drm/panel",
"problem_description": "The DataImage SCF0700C48GGU18 panel configuration lacks the required connector type, which triggers a kernel warning and prevents the panel from functioning."
},
{
"Commit": "f45fc18b6de04483643e8aa2ab97737abfe03d59",
"Fixed-by": "dfdf774656205515b2d6ad94fce63c7ccbe92d91",
"subsystem": "net",
"problem_description": "The function airoha_ppe_dev_setup_tc_block_cb is misspelled as airoha_ppe_setup_tc_block_cb when CONFIG_NET_AIROHA is disabled."
},
{
"Commit": "355b82c54c122e59487c52c084a146101bedc2c8",
"Fixed-by": "e02f2a0f1f9b6d4f0c620de2ce037d4436b58f70",
"subsystem": "net",
"problem_description": "The full and half duplex LED settings were inadvertently swapped in the motorcomm PHY driver."
},
{
"Commit": "1c194998252469cad00a08bd9ef0b99fd255c260",
"Fixed-by": "ec69daabe45256f98ac86c651b8ad1b2574489a7",
"subsystem": "bpf",
"problem_description": "A netdevice reference count is leaked in bpf_prog_test_run_xdp() when memory allocation or data copy fails during fragment processing, as the cleanup function is skipped."
},
{
"Commit": "4d4021b0bbd1fad7c72b9155863f5b3ccb43ae91",
"Fixed-by": "f34b32745e2c9f85ee33b42e7a8cdaa1ee1c16a3",
"subsystem": "ASoC",
"problem_description": "Switching to REGCACHE_FLAT_S caused -EBUSY errors when accessing registers from cache before they were read from hardware, breaking audio tests."
},
{
"Commit": "d219b7eb379235531af86d4f87ab298c878d54f1",
"Fixed-by": "2120f3a3738a65730c81bf10447b1ff776078915",
"subsystem": "wifi",
"problem_description": "The loop iterator 'i' is erroneously reused for an inner loop in mwifiex_update_ampdu_rxwinsize, causing loop corruption."
},
{
"Commit": "dad0d04fa7ba41ce603a01e8e64967650303e9a2",
"Fixed-by": "4f431d88ea8093afc7ba55edf4652978c5a68f33",
"subsystem": "wifi",
"problem_description": "The rsi driver fails to set the vif driver data size, causing memory corruption due to out-of-bounds access to vif->drv_priv."
},
{
"Commit": "32ece31db4df792c36bbabb8a1d263a5e1f5017a",
"Fixed-by": "8f334e35220721f65180bc2e0fe9187436c2c475",
"subsystem": "ACPI",
"problem_description": "acpi_s2idle_begin_lps0() attempts to retrieve constraints without verifying if the LPS0 device is present or enabled."
},
{
"Commit": "1cd3b407977c3ab1d2ddc26cb7113e7fb1509cd1",
"Fixed-by": "f93fc5d12d69012788f82151bee55fce937e1432",
"subsystem": "net",
"problem_description": "The error path in `octep_vf_request_irqs` passes the wrong `dev_id` to `free_irq`, causing a mismatch that fails to release the interrupt and may lead to a use-after-free."
},
{
"Commit": "b6d2a520f4638c2e7d3f2f11946918946941be18",
"Fixed-by": "803e18641fd444a614415711a5af53dcde21104b",
"subsystem": "nfs",
"problem_description": "Synchronously returning a delegation via nfs_inode_evict_delegation() from nfs4_have_delegation() is unsafe because it may be called under a lock."
},
{
"Commit": "473b9f331718267815649cd93801da832200db71",
"Fixed-by": "05f66cf5e7a5fc7c7227541f8a4a476037999916",
"subsystem": "PCI",
"problem_description": "The build fails when CONFIG_PCI is disabled because the pci_free_irq_vectors function is undefined."
},
{
"Commit": "991d98f17d31644826977e49477544987000a08a",
"Fixed-by": "d4026a44626490dc4eca4dd2c4d0816338fa179b",
"subsystem": "cxl",
"problem_description": "potential infinite loop in __cxl_dpa_reserve() due to incorrect loop termination condition"
},
{
"Commit": "2be12ef79fe9f5333cb9fadc85ef20b6832a56d7",
"Fixed-by": "a11224a016d6d1d46a4d9b6573244448a80d4d7f",
"subsystem": "btrfs",
"problem_description": "Memory leak in create_space_info() error paths when create_space_info_sub_group() or btrfs_sysfs_add_space_info_type() fails."
},
{
"Commit": "8a157e0a0aa5143b5d94201508c0ca1bb8cfb941",
"Fixed-by": "469d71512d135907bf5ea0972dfab8c420f57848",
"subsystem": "gfs2",
"problem_description": "The commit incorrectly swapped bio_chain arguments, breaking the logic where the first bio's callback is invoked when all bios in the chain have completed."
},
{
"Commit": "8698b9364710e7bac84b3af07dd410e39c8c2e08",
"Fixed-by": "4b58aac989c1e3fafb1c68a733811859df388250",
"subsystem": "regmap",
"problem_description": "A race condition in the hardware spinlock irqsave routine caused interrupt flags to be corrupted by concurrent lock contenders because the flags were stored in a shared structure member instead of a local variable."
},
{
"Commit": "ac1775012058e13ef1522938e27f5973d9e3f053",
"Fixed-by": "383d4f5cffcc8df930d95b06518a9d25a6d74aac",
"subsystem": "spi",
"problem_description": "Double free of the spi_controller structure in the probe error path."
},
{
"Commit": "ba391a102ec11ab7f5b249e46dcf61ef836a57e7",
"Fixed-by": "81d0223832f99c0833e46be114a8310888015f8b",
"subsystem": "drm/i915",
"problem_description": "The guc_hw_reg_state array was not declared static, causing a sparse warning."
},
{
"Commit": "a2f4870697a5bcf4a87073ec6b32dd2928c1211d",
"Fixed-by": "543467d6fe97e27e22a26e367fda972dbefebbff",
"subsystem": "writeback",
"problem_description": "Setting dirtytime_expire_interval to 0 causes wakeup_dirtytime_writeback to infinitely reschedule itself with zero delay, resulting in 100% CPU usage."
},
{
"Commit": "c31f91c6af96a5eb0632f4aee8d4e39cad7d7559",
"Fixed-by": "c644bce62b9c6b441143a03c910f986109c47001",
"subsystem": "overlayfs",
"problem_description": "Overlayfs fails to recognize whiteouts on FUSE filesystems because unmasked internal flag bits in d_type cause type comparison mismatches."
},
{
"Commit": "e6d28ebc17eb5e011b80c42a5196af0570c12240",
"Fixed-by": "8a5511eeaa5c4e5c2be6209abe549302b70311b0",
"subsystem": "vboxsf",
"problem_description": "directory delegations are not properly denied"
},
{
"Commit": "e6d28ebc17eb5e011b80c42a5196af0570c12240",
"Fixed-by": "ffb321045b0f1cd8bcea215269fbaa17c12da038",
"subsystem": "ceph",
"problem_description": "Directory delegations are not explicitly denied for Ceph directories after the removal of the S_ISREG check in vfs_setlease."
},
{
"Commit": "e6d28ebc17eb5e011b80c42a5196af0570c12240",
"Fixed-by": "ce946c4fb98c95519ee39ab7d4b117ff15f09efa",
"subsystem": "gfs2",
"problem_description": "directory delegations are incorrectly allowed on directories after the removal of the S_ISREG check in vfs_setlease"
},
{
"Commit": "e6d28ebc17eb5e011b80c42a5196af0570c12240",
"Fixed-by": "5d65a70bd0437d2a7762164eb5015f6975937986",
"subsystem": "9p",
"problem_description": "directory leases are not explicitly disabled on 9p directories following the removal of the global S_ISREG check"
},
{
"Commit": "e6d28ebc17eb5e011b80c42a5196af0570c12240",
"Fixed-by": "b9a9be4d3557b97303ac6c8b5e153b7ef569d886",
"subsystem": "smb/client",
"problem_description": "The S_ISREG check was incorrectly placed in cifs_setlease which is not called for directories, failing to properly disallow delegations on directories."
},
{
"Commit": "e6d28ebc17eb5e011b80c42a5196af0570c12240",
"Fixed-by": "10dcd5110678c6b241bbcf062f72ea14fb3597f3",
"subsystem": "nfs",
"problem_description": "The S_ISREG check is incorrectly placed in nfs4_setlease instead of explicitly denying directory leases via simple_nosetlease."
},
{
"Commit": "c9ba789dad15ba65662bba17595c0aeaa0cfcf1c",
"Fixed-by": "cab012375122304a6343c1ed09404e5143b9dc01",
"subsystem": "fuse",
"problem_description": "The conversion to start_removing() in fuse_reverse_inval_entry() causes a deadlock by invoking ->lookup, which the original code did not do."
},
{
"Commit": "e623c4303ed112a1fc20aec8427ba8407e2842e6",
"Fixed-by": "471e998c0e31206ff0eac7202b2659698cf9b46e",
"subsystem": "gpiolib",
"problem_description": "A redundant check in gpiod_get_direction returned the wrong error code -ENOTSUPP."
},
{
"Commit": "a060b8c511abb0997381b397e52149a5e3e5259a",
"Fixed-by": "c18790018799155e58d5a11c6697f9c398bf8b60",
"subsystem": "gpio",
"problem_description": "The gpio-davinci driver is missing the .get_direction() callback, causing the GPIO core to emit a warning when reading the direction of a pin."
},
{
"Commit": "d9d660f6e562a47b4065eeb7e538910b0471b988",
"Fixed-by": "901a5f309daba412e2a30364d7ec1492fa11c32c",
"subsystem": "scsi",
"problem_description": "struct vscsiblk_info is not freed in scsiback_remove()"
},
{
"Commit": "770c69f037c18cfaa37c3d6c6ef8bd257635513f",
"Fixed-by": "8cc27f5c6dd17dd090f3a696683f04336c162ff5",
"subsystem": "interconnect",
"problem_description": "The src_node and dst_node pointers passed to debugfs_create_str() are not initialized to valid strings, which can cause unsafe reads and writes."
},
{
"Commit": "b127315d9a78c011c011b88b92f650510edcfbd2",
"Fixed-by": "76cba1e60b69c9cd53b9127d017a7dc5945455b1",
"subsystem": "dmaengine",
"problem_description": "The driver is missing the specific \"apple,t8103-admac\" compatible string."
},
{
"Commit": "7bedaa5537604f34d1d63c5ec7891e559d2a61ed",
"Fixed-by": "2e1136acf8a8887c29f52e35a77b537309af321f",
"subsystem": "dmaengine",
"problem_description": "The dma_pool resource is not destroyed in the probe error paths, leading to a resource leak if dma_async_device_register() or of_dma_controller_register() fails."
},
{
"Commit": "5d0c3533a19f48e5e7e73806a3e4b29cd4364130",
"Fixed-by": "3f747004bbd641131d9396d87b5d2d3d1e182728",
"subsystem": "dmaengine",
"problem_description": "Memory leak in gpi_peripheral_config() when krealloc() fails and overwrites the original pointer with NULL."
},
{
"Commit": "b1c5d68ea66e511dfb16cd0e6a730488bd3c3317",
"Fixed-by": "978d28136c53df38f8f0b747191930e2f95e9084",
"subsystem": "iio",
"problem_description": "Out-of-bounds stack write in ad3552r_hs_write_data_source due to using the user-provided count index instead of the actual copied length for null termination."
},
{
"Commit": "46e33707fe95a21aa9896bded0be97285b779509",
"Fixed-by": "b8f15d1df2e73322e2112de21a4a7f3553c7fb60",
"subsystem": "iio",
"problem_description": "The IIS328DQ accelerometer uses incorrect gain values due to erroneously sharing configuration with the H3LIS331DL sensor which has different sensitivity parameters."
},
{
"Commit": "c4d7eb57687f358cd498ea3624519236af8db97e",
"Fixed-by": "5629f8859dca7ef74d7314b60de6a957f23166c0",
"subsystem": "net/mlx5e",
"problem_description": "The MLX5E_STATE_DESTROYING bit is incorrectly cleared during profile cleanup, preventing proper resource teardown and causing firmware errors during driver unload."
},
{
"Commit": "c4d7eb57687f358cd498ea3624519236af8db97e",
"Fixed-by": "4ef8512e1427111f7ba92b4a847d181ff0aeec42",
"subsystem": "net/mlx5e",
"problem_description": "Fixes a kernel NULL pointer dereference in mlx5e_remove and ensures robust netdev destruction when the device private structure is zeroed out due to a failed profile change."
},
{
"Commit": "ee75f1fc44dd73f0323118f31cf91f9b6db147fa",
"Fixed-by": "123eda2e5b1638e298e3a66bb1e64a8da92de5e1",
"subsystem": "net/mlx5e",
"problem_description": "Kernel NULL pointer dereference in mlx5e_remove when switchdev mode fails due to change profile failure"
},
{
"Commit": "c4d7eb57687f358cd498ea3624519236af8db97e",
"Fixed-by": "4dadc4077e3f77d6d31e199a925fc7a705e7adeb",
"subsystem": "net/mlx5e",
"problem_description": "A null pointer dereference occurs when retrying a profile change if a previous attempt failed to rollback, as the device private data remains in an invalid state."
},
{
"Commit": "2f65b44e199c6521be8dbc7458250c74a86ce2aa",
"Fixed-by": "c39a6a277e0e67ffff6a8efcbbf7e7e23ce9e38c",
"subsystem": "vsock",
"problem_description": "If the last test fails, the other side still completes correctly, leading to false positive results."
},
{
"Commit": "c54419321455631079c7d6e60bc732dd0c5914c5",
"Fixed-by": "e67c577d89894811ce4dcd1a9ed29d8b63476667",
"subsystem": "ipv4",
"problem_description": "ipgre_header() crashes if the socket buffer has insufficient headroom for the GRE header."
},
{
"Commit": "4bc12818b363bd30f0f7348dd9ab077290a637ae",
"Fixed-by": "fcdef3bcbb2c04e06ae89f8faff2cd6416b3a467",
"subsystem": "virtio-net",
"problem_description": "A deadlock occurs when the delayed refill worker races with virtnet_xdp_set, causing napi_disable() to be called on an already disabled NAPI."
},
{
"Commit": "c546d6f438338017480d105ab597292da67f6f6a",
"Fixed-by": "ca22c566b89164f6e670af56ecc45f47ef3df819",
"subsystem": "block",
"problem_description": "Uninitialized kernel memory is leaked when the integrity metadata buffer is larger than the protection information tuple size."
},
{
"Commit": "072a7c7cdbea4f91df854ee2bb216256cd619f2a",
"Fixed-by": "7893cc12251f6f19e7689a4cf3ba803bddbd8437",
"subsystem": "erofs",
"problem_description": "Mounting a file-backed EROFS image fails if the backing file resides on an EROFS filesystem backed by a block device."
},
{
"Commit": "fce886a6020734d6253c2c5a3bc285e385cc5496",
"Fixed-by": "19cffd16ed6489770272ba383ff3aaec077e01ed",
"subsystem": "kvm",
"problem_description": "Page-table walks at EL2 fail to terminate early when encountering concurrent updates because the walker flags are not correctly propagated."
},
{
"Commit": "7c5b184db7145fd417785377337bd15c4fe1d0f4",
"Fixed-by": "6a3d5fda2ce464a80a9af9e358dfbab6a989ab5d",
"subsystem": "iommu",
"problem_description": "Build failure on powerpc with gcc 8.5 because pt_feature and pts_feature are not inlined, preventing constant propagation and causing an undefined symbol error."
},
{
"Commit": "e93d5945ed5bb086431e83eed7ab98b6c058cc0b",
"Fixed-by": "7adfd682745a41fdf0279e4457d11fffab145a8f",
"subsystem": "iommufd",
"problem_description": "Link failures occur when IOMMU_PT_AMDV1 is configured as a module while IOMMUFD is built-in, causing undefined references in the selftest."
},
{
"Commit": "d2041f1f11dd99076010841a86c4d02d04650814",
"Fixed-by": "faa37ff3bf18d5242fe3d54f5462b1c3254c2567",
"subsystem": "iommufd",
"problem_description": "The iommufd selftest fails to build due to missing DMA_SHARED_BUFFER Kconfig selection."
},
{
"Commit": "01569c216ddeda94d3d8ffb8a5241ba3b2d72a5a",
"Fixed-by": "cefd81e76a8c0dc4aa2bacd884acca44e7b61e5b",
"subsystem": "iommu",
"problem_description": "kunit tests fail to build because GENERIC_PT is unselectable without COMPILE_TEST enabled"
},
{
"Commit": "820a6ee944e74e57255ac2e90916ecdaade57b95",
"Fixed-by": "b45f721775947a84996deb5c661602254ce25ce6",
"subsystem": "x86/fpu",
"problem_description": "The kernel panics via a #NM exception during XRSTOR if guest FPU state has bits set in XSTATE_BV for features that are disabled by XFD."
},
{
"Commit": "d53cd891f0e4311889349fff3a784dc552f814b9",
"Fixed-by": "072a7c7cdbea4f91df854ee2bb216256cd619f2a",
"subsystem": "erofs",
"problem_description": "Incrementing s_stack_depth broke composefs mounts by causing valid stacked filesystem configurations to exceed the maximum allowed depth."
},
{
"Commit": "79cf79abce71eb7dbc40e2f3121048ca5405cb47",
"Fixed-by": "7470a7a63dc162f07c26dbf960e41ee1e248d80e",
"subsystem": "macvlan",
"problem_description": "A potential use-after-free in macvlan_forward_source() occurs due to missing RCU protection on the vlan pointer in macvlan_source_entry."
},
{
"Commit": "1a33e10e4a95cb109ff1145098175df3113313ef",
"Fixed-by": "eb74c19fe10872ee1f29a8f90ca5ce943921afe9",
"subsystem": "net",
"problem_description": "Missing entries in netdev_lock_type and netdev_lock_name arrays for protocols like CAN, MCTP, and others cause them to incorrectly use the default lockdep class."
},
{
"Commit": "8d975c15c0cd744000ca386247432d57b21f9df0",
"Fixed-by": "81c734dae203757fb3c9eee6f9896386940776bd",
"subsystem": "ipv6",
"problem_description": "The use of pskb_inet_may_pull failed to account for VLAN encapsulations, leading to uninitialized memory access in __INET_ECN_decapsulate."
},
{
"Commit": "31cbc39b6344916c20452e43a9171009214c409c",
"Fixed-by": "b25a0b4a2193407aa72a4cd1df66a7ed07dd4f1e",
"subsystem": "net",
"problem_description": "Data races occur when accessing fdb->updated and fdb->used fields locklessly."
},
{
"Commit": "4fe516d2ad1a6b827694db134fa2a0af97917b41",
"Fixed-by": "49d106347913201b6bc6d810c964b90781db8343",
"subsystem": "cxl",
"problem_description": "NULL pointer dereference occurs when accessing platform_data for Host Bridge Interleave Ways values of 1 or 3."
},
{
"Commit": "bff8aa213dee742b09151a34494418050afed948",
"Fixed-by": "9e27085c33cca7ad26bec0af2c17aab072dd802e",
"subsystem": "kvm",
"problem_description": "The stage-1 software page table walker updates the Access Flag in a descriptor without verifying that the corresponding stage-2 translation allows write access."
},
{
"Commit": "37f46601383aa5a19bd42ea99617fa0fa6215f77",
"Fixed-by": "6e39903c73df08b256322d04c4dfe4a82ec63a45",
"subsystem": "selftests/tracing",
"problem_description": "The test_multiple_writes test stalls when the tracing buffer size is less than 12KB due to insufficient buffer space."
},
{
"Commit": "485e0626e58768f3c53ba61ab9e09d6b60a455f4",
"Fixed-by": "ab749bfe6a1fc233213f2d00facea5233139d509",
"subsystem": "bluetooth",
"problem_description": "The LE PA Sync Lost event was not enabled in the HCI event mask, preventing the controller from reporting it."
},
{
"Commit": "bd26631ccdfd11701fa29e665a7f041875ba9423",
"Fixed-by": "ebabc32ddb84caf2c018ae6aeca2ca2989a8056b",
"subsystem": "PM",
"problem_description": "The Energy Model netlink YAML specification triggered yamllint warnings due to a missing document start marker and incorrect indentation."
},
{
"Commit": "82bfb2e7b645c8f228dc3b6d3b27b0b10125ca4f",
"Fixed-by": "08b096c1372cd69627f4f559fb47c9fb67a52b39",
"subsystem": "btrfs",
"problem_description": "The function range_is_hole_in_parent causes invalid memory access by reading the disk_bytenr field of inline extents, which actually contains inline data."
},
{
"Commit": "69673992b1aea5540199d9b8b658ede72f55a6cf",
"Fixed-by": "1e1f2055ad5a7a5d548789b334a4473a7665c418",
"subsystem": "btrfs",
"problem_description": "Failure to release the B-tree path lock before calling iget_failed() causes an ABBA deadlock involving delayed_node->mutex during inode eviction."
},
{
"Commit": "4f06d81e7c6a02f850bfe9812295b1e859ab2db0",
"Fixed-by": "3e8aaacdad4f66641f87ab441fe644b45f8ebdff",
"subsystem": "cxl",
"problem_description": "Target list enumeration fails for multiple decoders sharing the same downstream port because the iteration stops after finding the first matching target."
},
{
"Commit": "acc152f9be205d76771f8156002d55c3fcd21252",
"Fixed-by": "1fed08c5519d2f929457f354d3c06c6a8c33829c",
"subsystem": "ath12k",
"problem_description": "A race condition in freq_to_idx() causes spurious invalid frequency warnings during regulatory updates."
},
{
"Commit": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
"Fixed-by": "bb97131fbf9b708dd9616ac2bdc793ad102b5c48",
"subsystem": "ath12k",
"problem_description": "dma_free_coherent() is incorrectly called with aligned addresses instead of the original unaligned addresses returned by the allocator."
},
{
"Commit": "2a1e1ad3fd37a632b61f50e73dafddb4b0fa57f1",
"Fixed-by": "9282a1e171ad8d2205067e8ec3bbe4e3cef4f29f",
"subsystem": "ath10k",
"problem_description": "dma_free_coherent() is called with an aligned pointer instead of the original unaligned pointer returned by dma_alloc_coherent()."
},
{
"Commit": "57d72196dfc8502b7e376ecdffb11c4f8766f26d",
"Fixed-by": "1690eeb0cb2bb77096cb6c826b6849ef05013e34",
"subsystem": "irqchip",
"problem_description": "The ITTE read in gicv5_its_map_event() lacks proper endianness handling."
},
{
"Commit": "5bd2927aceba181b84286e00aa2f56e117e699c3",
"Fixed-by": "7d3fa7e954934fbda0a017ac1c305b7b10ecceef",
"subsystem": "nvme",
"problem_description": "The driver was missing the specific compatible string 'apple,t8103-nvme-ans2' for the T8103 SoC."
},
{
"Commit": "efa56305908ba20de2104f1b8508c6a7401833be",
"Fixed-by": "32b63acd78f577b332d976aa06b56e70d054cbba",
"subsystem": "nvmet-tcp",
"problem_description": "Missing validation of command data structure initialization allows NULL pointer dereferences in nvmet_tcp_build_pdu_iovec when handling H2C_DATA PDUs."
},
{
"Commit": "7fc4da6a304bdcd3de14fc946dc2c19437a9cc5a",
"Fixed-by": "f0d385f6689f37a2828c686fb279121df006b4cb",
"subsystem": "ublk",
"problem_description": "Use-after-free of ub->ub_disk in ublk_partition_scan_work due to a race condition with device teardown."
},
{
"Commit": "2dcb8e8782d8e4c38903bf37b1a24d3ffd193da7",
"Fixed-by": "e707c591a139d1bfa4ddc83036fc820ca006a140",
"subsystem": "can",
"problem_description": "Secondary Sample Point is incorrectly disabled for data bitrates higher than 1 MBit/s."
},
{
"Commit": "2b9c8d2b3c89708d53b6124dc49c212dc5341840",
"Fixed-by": "25b858474497b5f7e2198f6fc9381488d9bdb55d",
"subsystem": "ASoC",
"problem_description": "The device-tree property 'realtek,jack-detect-source' triggers a build warning because the value 7 (for HDA header support) was missing from the allowed values in the binding documentation."
},
{
"Commit": "eba5a0bac211075b9673139df42bab955e984fce",
"Fixed-by": "66b47b9c069fa548db64bde6a32d3b33aa05f740",
"subsystem": "ASoC",
"problem_description": "The conversion of the rt5640 dt-binding to dtschema dropped 'clock' and 'clock-names' properties, causing DTB build warnings for boards defining an 'mclk'."
},
{
"Commit": "b0c3d51b54f8a4f4c809432d210c0c983d5cd97e",
"Fixed-by": "2bdf777410dc6e022d1081885ff34673b5dfee99",
"subsystem": "sched",
"problem_description": "sched_mm_cid_after_execve() causes a NULL pointer dereference by unconditionally calling sched_mm_cid_fork() on tasks with a NULL mm."
},
{
"Commit": "dc68c0f601691010dd5ae53442f8523f41a53131",
"Fixed-by": "8dad31f85c7b91fd8bdbc6d0f27abc53bd8b1ffe",
"subsystem": "xfs",
"problem_description": "memory leak of nmp in xfs_growfs_check_rtgeom when rextsize is not 1"
},
{
"Commit": "f83d51a5bdfe5ab56c27fd5dfe01c613b37e2dad",
"Fixed-by": "15e8d739fda1084d81f7d3813e9600eba6e0f134",
"subsystem": "selftests/landlock",
"problem_description": "The server file descriptor srv_fd is leaked in the named_unix_domain_socket_ioctl test."
},
{
"Commit": "bf83dae90fbc01d66477a3440eaad07da6657fdc",
"Fixed-by": "bdf3f4176092df5281877cacf42f843063b4784d",
"subsystem": "arm64",
"problem_description": "The E0POE bit in TCR2_EL1 is not saved and restored during CPU suspend/resume, causing the Permission Overlay Extension to stop working after resume."
},
{
"Commit": "d08e973a77d128b25e01a08c34d89593fdf222da",
"Fixed-by": "7352e1d5932a0e777e39fa4b619801191f57e603",
"subsystem": "can",
"problem_description": "URBs are not re-anchored in the receive callback, causing a memory leak as they cannot be freed by usb_kill_anchored_urbs during close."
},
{
"Commit": "8537257874e949a59c834cecfd5a063e11b64b0b",
"Fixed-by": "b1979778e98569c1e78c2c7f16bb24d76541ab00",
"subsystem": "can",
"problem_description": "Anchored URBs are leaked if es58x_alloc_rx_urbs() returns an error after partially allocating URBs."
},
{
"Commit": "7b78b26757e0d997b31635d76eaa46d5ef5e1431",
"Fixed-by": "d578b31856cec31315f27b3ba97b212e4c6989b3",
"subsystem": "gpio",
"problem_description": "Unnecessary shared proxy devices are created for non-shared reset-gpios due to false-positive sharing detection."
},
{
"Commit": "0bef512012b1cd8820f0c9ec80e5f8ceb43fdd59",
"Fixed-by": "872ac785e7680dac9ec7f8c5ccd4f667f49d6997",
"subsystem": "net",
"problem_description": "All IPv4 tunnel types share the same lockdep class due to the centralized netdev_lockdep_set_classes call in ip_tunnel_init."
},
{
"Commit": "fb10ddf35c1cc3b2888a944c0a3b1aa3baea585e",
"Fixed-by": "145cc42fe1217c66174c44c4034cc0fe3040bbb0",
"subsystem": "kvm",
"problem_description": "Unprotected pKVM VCPUs use uninitialized FGT values leading to unwanted traps and unauthorized access because the host FGT configuration is copied only once at initialization instead of on every VCPU load."
},
{
"Commit": "6537565fd9b7f169cda025482f6de2646cf7b60a",
"Fixed-by": "8d8e882c2b4b73a3f894c3cad74718b633e3d166",
"subsystem": "kvm",
"problem_description": "The EL2 stage-1 XN permission bit definition is incorrect for hVHE setups using the EL2&0 translation regime."
},
{
"Commit": "a06494adb7efba2dda3866ac2e354aeacb3992f1",
"Fixed-by": "5fcd5513072b09f6533e22a779183fa2818bce81",
"subsystem": "arm64/mm",
"problem_description": "resetting KASAN tags only on the area address results in an incorrect page index calculation when the start address is tagged, leading to faults in vmalloc paths"
},
{
"Commit": "b5e0b032b6c31c052ee0132ee70b155c22cf7b28",
"Fixed-by": "74d74bb78aeccc9edc10db216d6be121cf7ec176",
"subsystem": "crypto",
"problem_description": "The AES S-box tables were placed in a writable data section instead of read-only memory, lacking MMU protection against modification."
},
{
"Commit": "15c64c47e48472875c2b85838581843f05057787",
"Fixed-by": "0f42c2a52d8a7535088895c3104150ac9019afd8",
"subsystem": "crypto",
"problem_description": "A syntax error in scripts/crypto/gen-hash-testvecs.py causes build failures with older Python versions due to improper quoting in an f-string."
},
{
"Commit": "b3aed551b3fca753469520c95b6f4c61ada028d3",
"Fixed-by": "fcff71fd888dce1533a3975e68fc80824ff69ef9",
"subsystem": "crypto",
"problem_description": "The KUnit test test_polyval_preparekey_in_irqs fails on fast machines because the iteration count is too low to guarantee IRQ execution."
},
{
"Commit": "823e7c3712c584641b4ef890a8af34884c677197",
"Fixed-by": "c2803bd580db226008aabf2fb2f0c9a7d3b5d0de",
"subsystem": "arm_mpam",
"problem_description": "The function __ris_msmon_read() uses uninitialized variables 'now' and 'overflow' when encountering unknown monitor types or non-mbwu monitors."
},
{
"Commit": "db5b4e39c4e63700c68a7e65fc4e1f1375273476",
"Fixed-by": "c92510f5e3f82ba11c95991824a41e59a9c5ed81",
"subsystem": "arp",
"problem_description": "The arp pointer becomes invalid if dev_hard_header() reallocates the skb head."
},
{
"Commit": "e59bc32df2e989f034623a580e30a2a72af33b3f",
"Fixed-by": "4b5bdabb5449b652122e43f507f73789041d4abe",
"subsystem": "net",
"problem_description": "Build warning when PAGE_SIZE is greater than 128K because the RX buffer DMA size exceeds the 16-bit hardware limit."
},
{
"Commit": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"Fixed-by": "4d984b0574ff708e66152763fbfdef24ea40933f",
"subsystem": "atm",
"problem_description": "The dma_free_coherent() function was called with an incorrect size argument, using the dimensions of the TBRQ buffer instead of the correct TPDRQ buffer size."
},
{
"Commit": "308b7dee3e5c767e88bbecceff3883c8b17c55b6",
"Fixed-by": "790792ebc9603a7ccbf6996cb537d89607e3a75b",
"subsystem": "tools",
"problem_description": "the main install target incorrectly installs test artifacts"
},
{
"Commit": "4d1442979e4a53b9457ce1e373e187e1511ff688",
"Fixed-by": "7d11e047eda5f98514ae62507065ac961981c025",
"subsystem": "af_unix",
"problem_description": "A NULL pointer dereference occurs in unix_stream_read_generic during splice operations because the code attempts to write to msg->msg_get_inq when msg is NULL."
},
{
"Commit": "63e919a31625d5d2878cfc2511274826e29336b2",
"Fixed-by": "9ce4aef9a5b1b76207152ba019f838f62dff97b8",
"subsystem": "drm/gpuvm",
"problem_description": "Lock inversion occurs because `drm_gpuvm_bo_obtain_prealloc()` frees a `vm_bo` while holding the GEM gpuva mutex, triggering a callback that acquires the `dma_resv` lock."
},
{
"Commit": "a60fc3294a377204664b5484e4a487fa124155da",
"Fixed-by": "3358995b1a7f9dcb52a56ec8251570d71024dad0",
"subsystem": "bnxt_en",
"problem_description": "A NULL pointer dereference occurs in bnxt_ptp_enable during error cleanup because PTP unregistration is performed after HWRM resources have been freed."
},
{
"Commit": "323b34963d113efb566635f43858f40cce01d5f9",
"Fixed-by": "afa27621a28af317523e0836dad430bec551eb54",
"subsystem": "net",
"problem_description": "memory leak in update_eth_regs_async if usb_submit_urb fails"
},
{
"Commit": "55c82617c3e82210b7471e9334e8fc5df6a9961f",
"Fixed-by": "a4e305ed60f7c41bbf9aabc16dd75267194e0de3",
"subsystem": "net",
"problem_description": "Potential NULL pointer dereference in vortex_probe1() when calling dma_free_coherent() using the pdev pointer which is NULL for non-PCI devices."
},
{
"Commit": "0545a3037773512d3448557ba048cebb73b3e4af",
"Fixed-by": "c1d73b1480235731e35c81df70b08f4714a7d095",
"subsystem": "net/sched",
"problem_description": "qfq_reset triggers a NULL pointer dereference by deactivating an inactive class if its shared leaf qdisc has a non-zero queue length."
},
{
"Commit": "cbe5aeedecc72314c3a8fd0d41d9b270f576aee1",
"Fixed-by": "e25348c5405c38c7b5e7b833898f2d205289186a",
"subsystem": "PM: EM",
"problem_description": "The em_create_pd function leaks the allocated performance domain structure and returns an incorrect error code if ida_alloc fails."
},
{
"Commit": "1b600da510735a0f92c8b4140a7e2cb037a6a6c3",
"Fixed-by": "54b603f2db6b95495bc33a8f2bde80f044baff9a",
"subsystem": "PM",
"problem_description": "The comment describing the cost field in struct em_perf_state was incorrect because it did not reflect the multiplication by 10 introduced in the calculation logic."
},
{
"Commit": "3e89a8c6835476aa782da80585dee9ddae651eea",
"Fixed-by": "7f6721b767e219343cfe9a894f5bd869ff5b9d3a",
"subsystem": "drm/rockchip",
"problem_description": "Simultaneous plane zpos changes on multiple CRTCs cause a long timeout because the driver waits for a completion signal that hasn't been triggered."
},
{
"Commit": "3e89a8c6835476aa782da80585dee9ddae651eea",
"Fixed-by": "9fae82450d8a5f9c8fa016cd15186e975609b2ac",
"subsystem": "drm/rockchip",
"problem_description": "Using a delay of 0 in readx_poll_timeout_atomic causes inaccurate timeout duration calculations when waiting for VOP2 register updates."
},
{
"Commit": "9700b0fccf386b671e6f8401ddea6c5669cd0914",
"Fixed-by": "36f597bba049928004a050c132ab787ba0eba524",
"subsystem": "gpiolib",
"problem_description": "gpiod_find() incorrectly returns NULL instead of ERR_PTR(-ENOENT) when a GPIO lookup fails, leading to potential NULL pointer dereferences."
},
{
"Commit": "0a44dfc070749514b804ccac0b1fd38718f7daa1",
"Fixed-by": "d594cc6f2c588810888df70c83a9654b6bc7942d",
"subsystem": "mac80211",
"problem_description": "Packet injection in monitor mode fails when running concurrently with another interface because the monitor interface does not have an assigned channel context."
},
{
"Commit": "1ce954c98b8968e66a304c8586122d706bae97c3",
"Fixed-by": "c0d82ba9612fb65a8394af639f1427dbe87fb788",
"subsystem": "mac80211",
"problem_description": "Channel context iterators incorrectly visit interfaces that are not currently running."
},
{
"Commit": "a37a6f54439bf82b827a7072415d3a4afa4e12bd",
"Fixed-by": "333418872bfecf4843f1ded7a4151685dfcf07d5",
"subsystem": "wifi",
"problem_description": "A typo in the NAN frequency notification (5475 MHz instead of 5745 MHz) can cause a NULL pointer dereference due to an invalid channel lookup."
},
{
"Commit": "87de87d5e47f94b4ea647a5bd1bc8dc1f7930db4",
"Fixed-by": "21cbf883d073abbfe09e3924466aa5e0449e7261",
"subsystem": "wifi",
"problem_description": "Uninitialized padding in the stack-allocated struct iw_point leaks kernel stack data to user space on 64-bit architectures."
},
{
"Commit": "00a7678310fe3d3f408513e55d9a0b67f0db380f",
"Fixed-by": "6abcf751bc084804a9e5b3051442e8a2ce67f48a",
"subsystem": "net",
"problem_description": "The airoha_ppe_deinit() function causes a schedule while atomic error by calling a sleeping function inside an RCU read lock."
},
{
"Commit": "b51e4aea3ecfe81053dfbb20411b578fc8c6a7ea",
"Fixed-by": "94ad504e67cd3be94fa1b2fed0cb87da0d8f9396",
"subsystem": "ARM: dts",
"problem_description": "The #size-cells property for the i2c3 node was incorrectly set to 1 instead of 0, causing a dtbs_check error."
},
{
"Commit": "b51e4aea3ecfe81053dfbb20411b578fc8c6a7ea",
"Fixed-by": "aabc977aa472ccf756372ae594d890022c19c9c8",
"subsystem": "arm/dts",
"problem_description": "The ranges property for the flx9 node was incorrectly configured with the physical address of the flx8 node (0xe281c000) instead of its own (0xe2820000)."
},
{
"Commit": "93a81ca0657758b607c3f4ba889ae806be9beb73",
"Fixed-by": "47c27c9c9c720bc93fdc69605d0ecd9382e99047",
"subsystem": "ALSA",
"problem_description": "The function snd_pcm_runtime_buffer_set_silence() ignores the error code returned by snd_pcm_buffer_access_lock(), failing to propagate locking errors."
},
{
"Commit": "7bffa14c9aed5f788d3126271f0fd8758fbd129e",
"Fixed-by": "70b8c45d8621c4d77b5659270e9a26ce7b1123cf",
"subsystem": "arm",
"problem_description": "The Kconfig symbol ARM_ERRATA_794072 is selected but the corresponding errata workaround code was never merged into the kernel."
},
{
"Commit": "493d9e0d608339a32f568504d5fd411a261bb0af",
"Fixed-by": "9df5fad801c5c568ee5f5dacd8b53565d88e4f02",
"subsystem": "bpf",
"problem_description": "The verifier incorrectly allows BPF_MAP_TYPE_INSN_ARRAY maps to be passed as constant string arguments, leading to potential out-of-bounds reads."
},
{
"Commit": "069e8a65cd7970b15672825541be59218d9a8a0f",
"Fixed-by": "c7fabe4ad9219866c203164a214c474c95b36bf2",
"subsystem": "HID",
"problem_description": "The generic HID driver takes control of Apple Cinema Display devices, preventing the specialized appledisplay driver from binding to them."
},
{
"Commit": "2a6c826cfeedd7714611ac115371a959ead55bda",
"Fixed-by": "6b2989ac5e8c496c1814d7961bee6f2d05382b3e",
"subsystem": "drm/amd",
"problem_description": "skipping power ungating for VPE during suspend causes VPE queue reset failures and timeouts"
},
{
"Commit": "754babaaf33349d9ef27bb1ac6f5d9d5a503a2a6",
"Fixed-by": "bdb32359eab94013e80cf7e3d40a3fd4972da93a",
"subsystem": "sparc",
"problem_description": "PCI devices with 64-bit non-prefetchable BARs fail to enable because the generic pci_enable_resources function enforces resource assignment checks that the removed architecture-specific pcibios_enable_device implementation bypassed."
},
{
"Commit": "dd293df6395a2c9e0fc4faa8defeceaa907e7717",
"Fixed-by": "1e2ed4bfd50ace3c4272cfab7e9aa90956fb7ae0",
"subsystem": "tracing",
"problem_description": "The ftrace_dump_on_oops variable triggers a sparse warning because it is not declared and should be static as it is not used outside trace.c"
},
{
"Commit": "5f5fa7ea89dc82d34ed458f4d7a8634e8e9eefce",
"Fixed-by": "5f1ef0dfcb5b7f4a91a9b0e0ba533efd9f7e2cdb",
"subsystem": "tracing",
"problem_description": "Infinite recursion occurs when tracing RCU events with the kernel stack trace trigger enabled."
},
{
"Commit": "f83ac7544fbf7ba3f77c122e16ab5319f75bbdfd",
"Fixed-by": "5232196ff49be08350b27f1ba8e1fad87afc9cdf",
"subsystem": "ftrace",
"problem_description": "The function graph depth integrity checks fail because the depth field was converted to an unsigned type, making it impossible to detect if the depth goes below zero."
},
{
"Commit": "091bdcfcece0963a9a6590ba7cfcc9e1d454165f",
"Fixed-by": "60699ab7cbf0a4eb19929cce243002b39c67917d",
"subsystem": "nfs",
"problem_description": "localio does not correctly handle page bases larger than PAGE_SIZE, causing incorrect bio_vec initialization"
},
{
"Commit": "6a218b9c3183ed19d5703130025282cf20463d87",
"Fixed-by": "001945a777ec4de8610f646397a054c62d272c2d",
"subsystem": "nfs",
"problem_description": "the I/O loop continues to issue subsequent requests even if an error occurs, resulting in non-contiguous data chunks"
},
{
"Commit": "156b0948293362b036caf49e6e4d97cae30201de",
"Fixed-by": "df56ddd057424d21483bd0bee4da3632706d6606",
"subsystem": "nfs",
"problem_description": "State recovery logic intended for regular files is incorrectly executed for directory delegations, potentially causing corruption."
},
{
"Commit": "18e4a4669c5023eb1157f2a3f1bf6ca2b8535572",
"Fixed-by": "bf72b4b7bb7dbb643d204fa41e7463894a95999f",
"subsystem": "drm/vmwgfx",
"problem_description": "The function vmw_compat_shader_add incorrectly checks the integer variable ret instead of the pointer res returned by vmw_shader_alloc."
},
{
"Commit": "d6667f0ddf46c671d379cd5fe66ce0a54d2a743a",
"Fixed-by": "37a0cff4551c14aca4cfa6ef3f2f0e0f61d66825",
"subsystem": "drm/vmwgfx",
"problem_description": "A warning is triggered because the resource tree is checked for emptiness before the dumb surface resource is released."
},
{
"Commit": "965544150d1cadf0e8f5bb6c13c19697e46e1429",
"Fixed-by": "d9186faeae6efb7d0841a5e8eb213ff4c7966614",
"subsystem": "drm/vmwgfx",
"problem_description": "A NULL pointer dereference occurs in vmw_kms_fb_create on HW version 10 because surface-backed framebuffers lack backing buffers."
},
{
"Commit": "53c6d854be4e93fa21b80bd40e3a666c3961e82c",
"Fixed-by": "1d32389dc52f6e0305228988243b61cbe687414d",
"subsystem": "usb",
"problem_description": "The MSM8994 DWC3 binding incorrectly required DP/DM interrupts instead of the QUSB2 PHY interrupt, causing validation warnings."
},
{
"Commit": "53c6d854be4e93fa21b80bd40e3a666c3961e82c",
"Fixed-by": "db0635a30462f6dbdc7284a712f65ec5345a0caa",
"subsystem": "usb",
"problem_description": "The device tree bindings for the IPQ5018 platform incorrectly defined interrupts by assuming a QUSB2 PHY configuration instead of matching the IPQ5332 interrupt scheme."
},
{
"Commit": "2d8713f807a49b8a67c221670e50ae04967e915d",
"Fixed-by": "1366cd228b0c67b60a2c0c26ef37fe9f7cfedb7f",
"subsystem": "usb",
"problem_description": "The driver fails to find the USB role switch for devices with ports in the main node because the fallback lookup is skipped if the primary lookup returns an error."
},
{
"Commit": "89e1fb7ceffd898505ad7fa57acec0585bfaa2cc",
"Fixed-by": "9670db22e7ab4aefe2b2619589a47fef9d3e0c7e",
"subsystem": "block",
"problem_description": "The use of synchronize_rcu_expedited caused a 15-second boot stall when probing virtio-scsi disks."
},
{
"Commit": "08e136ebd193eae7d5eff4c66d576c4a2dabdc3f",
"Fixed-by": "2704024d83fa9eb8e5f16925aae340fd9d246694",
"subsystem": "block",
"problem_description": "The loop driver fails to abort a block device claim if the mutex lock fails in loop_set_status."
},
{
"Commit": "128a9bf8ace290d86d2805c06f3b0e4cfab75de0",
"Fixed-by": "14adddc65340f2034751c95616861c0e888e2bb1",
"subsystem": "drm/bridge",
"problem_description": "Spurious interrupts are generated during resume from suspend because the HDMI IP loses state, causing the kernel to disable the IRQ."
},
{
"Commit": "a060b8c511abb0997381b397e52149a5e3e5259a",
"Fixed-by": "a80208072df8f4ceb53cd905c1f4362f84ce397f",
"subsystem": "gpio",
"problem_description": "memory for the GPIO lookup table is allocated unnecessarily if the function returns early"
},
{
"Commit": "49416483a953662aa53c6d9bef651757d4a95ba5",
"Fixed-by": "476e44d06fc107f8cd99695d8e4f1c792dfc3379",
"subsystem": "gpio",
"problem_description": "A race condition occurs when matching a reset-gpio reference with a consumer firmware node due to missing locking, and a lockdep false-positive is triggered."
},
{
"Commit": "49416483a953662aa53c6d9bef651757d4a95ba5",
"Fixed-by": "0fe50631791bd3504dc7f32af6421bd4041f14aa",
"subsystem": "gpio",
"problem_description": "the wrong firmware node is assigned to the shared reference for the reset-gpio use-case"
},
{
"Commit": "936ee2675eee1faca0dcdfa79165c7990422e0fc",
"Fixed-by": "20cf2aed89ac6d78a0122e31c875228e15247194",
"subsystem": "gpio",
"problem_description": "The Rockchip GPIO controller triggers a \"sleeping function called from invalid context\" error because it uses mutex-protected pinctrl helpers but was not marked as a sleeping controller."
},
{
"Commit": "3d8b5a22d40435b4a7e58f06ae2cd3506b222898",
"Fixed-by": "6acd4ac5f8f0ec9b946875553e52907700bcfc77",
"subsystem": "block",
"problem_description": "Bios with different app_tag values are incorrectly merged into a single request."
},
{
"Commit": "1a8fed52f7be14e45785e8e54d0d0b50fc17dbd8",
"Fixed-by": "d83dddffe1904e4a576d11a541878850a8e64cd2",
"subsystem": "netdevsim",
"problem_description": "Carrier state remains down when netdevsim interfaces are linked after being brought up."
},
{
"Commit": "68a052239fc4b351e961f698b824f7654a346091",
"Fixed-by": "353cfc0ef3f34ef7fe313ae38dac37f2454a7cf5",
"subsystem": "selftests",
"problem_description": "The 'tool' module is missing from the net selftests library imports, causing ImportErrors in tests."
},
{
"Commit": "84a7d6797e6a03705e6b48c613fa424662049d87",
"Fixed-by": "adb25a46dc0a43173f5ea5f5f58fc8ba28970c7c",
"subsystem": "net/sched",
"problem_description": "tcf_idrinfo_destroy crashes by dereferencing an ERR_PTR entry in the action IDR during network namespace teardown."
},
{
"Commit": "7662abf4db945e0c78ac56c58b198ad1504b554e",
"Fixed-by": "13ff3e724207f579d3c814ee05516fefcb4f32e8",
"subsystem": "net",
"problem_description": "The sfp_smbus_byte_write function incorrectly returns 0 instead of the number of bytes written, which can cause errors when setting a module's high-power state."
},
{
"Commit": "6471658dc66c670580a7616e75f51b52917e7883",
"Fixed-by": "e5c8eda39a9fc1547d1398d707aa06c1d080abdd",
"subsystem": "udp",
"problem_description": "The skmsg layer sets skb->destructor, which triggers a warning in skb_attempt_defer_free()."
},
{
"Commit": "926eae604403acfa27ba5b072af458e87e634a50",
"Fixed-by": "7801edc9badd972cb62cf11c0427e70b6dca239d",
"subsystem": "dsa",
"problem_description": "The driver incorrectly retrieves the 'tx-p2p-microvolt' property from the external PHY's device node, which fails when no external PHY is present and pollutes the PHY's device tree binding."
},
{
"Commit": "be91128c579c86d295da4325f6ac4710e4e6d2b4",
"Fixed-by": "4648fb2f2e7210c53b85220ee07d42d1e4bae3f9",
"subsystem": "idpf",
"problem_description": "NULL pointer dereference in idpf_idc_vport_dev_down() when accessing unallocated vdev_info for vports without RDMA support."
},
{
"Commit": "74d1412ac8f3719bc8dd08b5775276dd1cbc3997",
"Fixed-by": "086efe0a1ecc36cffe46640ce12649a4cd3ff171",
"subsystem": "idpf",
"problem_description": "Rx queue configuration fails on systems with large pages because the calculated buffer size exceeds the hardware limit."
},
{
"Commit": "d4d5587182664b0c4ab6d3556ce881cb975507c2",
"Fixed-by": "87b8ee64685bc096a087af833d4594b2332bfdb1",
"subsystem": "idpf",
"problem_description": "Interrupts are not properly cleaned up if idpf_vport_open() fails after interrupt initialization."
},
{
"Commit": "02cbfba1add5bd9088c7d14c6b93b77a6ea8f3bb",
"Fixed-by": "ebecca5b093895da801b3eba1a55b4ec4027d196",
"subsystem": "idpf",
"problem_description": "NULL pointer dereference occurs when accessing the RSS LUT via ethtool after a soft reset if the interface is down, as the LUT is freed but not restored."
},
{
"Commit": "02cbfba1add5bd9088c7d14c6b93b77a6ea8f3bb",
"Fixed-by": "445b49d13787da2fe8d51891ee196e5077feef44",
"subsystem": "idpf",
"problem_description": "RSS LUT configuration and queries fail silently when the interface is down"
},
{
"Commit": "a251eee62133774cf35ff829041377e721ef9c8c",
"Fixed-by": "83f38f210b85676f40ba8586b5a8edae19b56995",
"subsystem": "idpf",
"problem_description": "NULL pointer dereference occurs when performing ethtool operations (like rxhash on/off) before the interface is brought up because the RSS LUT is not initialized"
},
{
"Commit": "ada3e24b84a097b27a823f1ad98e5b2e8c979689",
"Fixed-by": "36aae2ea6bd76b8246caa50e34a4f4824f0a3be8",
"subsystem": "idpf",
"problem_description": "The command `ethtool -n` displays an 'Unknown flow type' error due to incomplete flow spec storage, incorrect error codes are returned for missing entries, and duplicate filters are not rejected."
},
{
"Commit": "ada3e24b84a097b27a823f1ad98e5b2e8c979689",
"Fixed-by": "f9841bd28b600526ca4f6713b0ca49bf7bb98452",
"subsystem": "idpf",
"problem_description": "Memory leak of flow steering list entries during module removal and missing locking for list access."
},
{
"Commit": "0fe45467a1041ea3657a7fa3a791c84c104fbd34",
"Fixed-by": "4d792219fe6f891b5b557a607ac8a0a14eda6e38",
"subsystem": "idpf",
"problem_description": "The service and mailbox tasks are not disabled if the initialization task fails during driver load, leading to a NULL pointer dereference."
},
{
"Commit": "6aa53e861c1a0c042690c9b7c5c153088ae61079",
"Fixed-by": "e111cbc4adf9f9974eed040aeece7e17460f6bff",
"subsystem": "idpf",
"problem_description": "Memory leak of hw->lan_regs in idpf_vc_core_deinit"
},
{
"Commit": "0fe45467a1041ea3657a7fa3a791c84c104fbd34",
"Fixed-by": "f6242b354605faff263ca45882b148200915a3f6",
"subsystem": "idpf",
"problem_description": "Memory leak of vport->rx_ptype_lkup in idpf_vport_rel() during reset."
},
{
"Commit": "0fe45467a1041ea3657a7fa3a791c84c104fbd34",
"Fixed-by": "2e281e1155fc476c571c0bd2ffbfe28ab829a5c3",
"subsystem": "idpf",
"problem_description": "Simultaneous hard and soft resets cause vport state loss, and reset failures leave netdevs exposed to callbacks, leading to NULL pointer dereference crashes."
},
{
"Commit": "cd63c22168257a0b0b59245394915e2488065f7d",
"Fixed-by": "1eb217ab2e737609f8a861b517649e82e7236d05",
"subsystem": "perf",
"problem_description": "NULL pointer dereference occurs in the error handling path when evsel allocation fails because the code attempts to access members of the NULL evsel pointer."
},
{
"Commit": "a71e4f103aed69e7a11ea913312726bb194c76ee",
"Fixed-by": "75ddaa4ddc86d31edb15e50152adf4ddee77a6ba",
"subsystem": "pidfs",
"problem_description": "Opening a file descriptor for a disabled namespace type causes a failure during inode eviction because the namespace operations structure is NULL."
},
{
"Commit": "3b83f5d5e78ac5cddd811a5e431af73959864390",
"Fixed-by": "8510ef5e3cfbd7d59a16845f85cd0194a8689761",
"subsystem": "rust",
"problem_description": "Explicit import of CStrExt causes a build error when CONFIG_PRINTK is disabled"
},
{
"Commit": "01e345e82ec3a5a7edeb9fa0dcb7fd4b0e5c534e",
"Fixed-by": "3a1ec424dd9c9491138a5ebadb24ce9f33e6a822",
"subsystem": "rust",
"problem_description": "The `Bounded::__new` constructor is incorrectly marked as safe despite relying on the caller to ensure the value fits within the specified bit width to maintain type invariants."
},
{
"Commit": "bf9651f84b4e49ca006fd8b5534f16a38dae875c",
"Fixed-by": "9f92d7d1cb9cccc6c703ca53d4f1d1acca79b598",
"subsystem": "pci",
"problem_description": "Typos in the Bar struct documentation and a safety comment."
},
{
"Commit": "7454048db27d685a155aaf4ea03bb9ad0d086bb9",
"Fixed-by": "609db7e73b3ecc6a0b44dc6486e88e4bce6fd8c0",
"subsystem": "rust",
"problem_description": "the GCC-specific flag -fdiagnostics-show-context causes errors when passed to bindgen because clang does not support it"
},
{
"Commit": "b6f1f780b3932ae497ed85e79bc8a1e513883624",
"Fixed-by": "e558cca217790286e799a8baacd1610bda31b261",
"subsystem": "bpf",
"problem_description": "bpf_test_run fails to account for xdp_frame size in headroom checks, allowing userspace to supply oversized metadata that causes xdp_update_frame_from_buff to fail."
},
{
"Commit": "47c9214dcbea9043ac20441a285c7bb5486b8b2d",
"Fixed-by": "8f3e00af8e52c0d2d8e0e15154d28ec7d639d4d9",
"subsystem": "bpf",
"problem_description": "Incorrect usage of BPF_TRAMP_F_ORIG_STACK instead of BPF_TRAMP_F_CALL_ORIG in the RISC-V BPF JIT causes a kernel stack overflow."
},
{
"Commit": "ce1b75d0635ce6daf7c1c3c75ea2f0da61e065b0",
"Fixed-by": "083029bd8b445595222a3cd14076b880781c1765",
"subsystem": "idpf",
"problem_description": "The network interface is removed if the initialization task fails during a reset."
},
{
"Commit": "57b1ce9039665c6cb6907aee4b517f43e1557d2f",
"Fixed-by": "955b263c421c6fe5075369c52199f278289ec8c4",
"subsystem": "arm64",
"problem_description": "The GPU register range for the rk3576 SoC is incorrectly sized at 2MB instead of 128KB in the device tree, causing it to overlap with the eInk interface address space."
},
{
"Commit": "96cbdfdd3ac20700b9b1c251fb15c944f33a424a",
"Fixed-by": "3e4a81881c0929b21a0577bc6e69514c09da5c3f",
"subsystem": "arm64: dts: rockchip",
"problem_description": "Analog sound output is silent on the NanoPi M5 due to incorrect MCLK pin and clock configuration."
},
{
"Commit": "96cbdfdd3ac20700b9b1c251fb15c944f33a424a",
"Fixed-by": "5ab3dd9d0a63af66377f58633fec9dad650e6827",
"subsystem": "arm64: dts: rockchip",
"problem_description": "A mismatch between the headphones widget name and the routing table prevents the sound card from initializing."
},
{
"Commit": "a5baf582f4c026c25a206ac121bceade926aec74",
"Fixed-by": "dd4d71f587f3908f058b516d3793aaed66cfb692",
"subsystem": "arm64/efi",
"problem_description": "firmware errors trigger a kernel oops instead of recovery because the current_in_efi() check incorrectly fails when preemption is enabled"
},
{
"Commit": "d5ebe3f7d13d4cee3ff7e718de23564915aaf163",
"Fixed-by": "b75710155a823369976bba9f3497cee113830ae9",
"subsystem": "media",
"problem_description": "Video capture is upside down on Dell XPS 13 9350 and XPS 16 9640 laptops due to missing sensor rotation information in firmware."
},
{
"Commit": "b7cd2ba3f692729906ad6eeefc78dd625021c7bd",
"Fixed-by": "1d2e3b4443a85374fdd6fb8fd2c015e3e3e16100",
"subsystem": "media",
"problem_description": "The horizontal flip control logic is inverted, causing the image to be mirrored when the control is disabled."
},
{
"Commit": "b7cd2ba3f692729906ad6eeefc78dd625021c7bd",
"Fixed-by": "d0bb6f1f2b79d96953bf81a3839ac2aa946ba2fa",
"subsystem": "media",
"problem_description": "Enabling hflip or vflip changed the Bayer pattern because the sensor window coordinates were not adjusted to compensate."
},
{
"Commit": "d5ebe3f7d13d4cee3ff7e718de23564915aaf163",
"Fixed-by": "905120d7470e5ed79d59b61ef6aa13344ffca229",
"subsystem": "media",
"problem_description": "The reported Bayer pattern is incorrect following a change to the default vertical flip setting."
},
{
"Commit": "d8c4bddcd8bcb41885d3db2ba18c840c411564c2",
"Fixed-by": "d5bdf88d1f9d1e4808177f03d89de3d0ba6c6e84",
"subsystem": "drm",
"problem_description": "drm_fb_helper_fb_dirty triggers a VBlank wait timeout during GPU reset or suspend because VBlank interrupts are disabled."
},
{
"Commit": "ad90860bd10ee3ed387077aed88828b139339976",
"Fixed-by": "fd390ff144513eb0310c350b1cf5fa8d6ddd0c53",
"subsystem": "PCI",
"problem_description": "incorrectly identifying a VGA device as the boot VGA device when no other VGA device is found, leading to the wrong device being advertised to userspace"
},
{
"Commit": "d6602e25819dea2c239972e98e09ba5db4aebd22",
"Fixed-by": "88c72bab77aaf389beccf762e112828253ca0564",
"subsystem": "cxl",
"problem_description": "The non-portable format string %#llx was used for the architecture-specific resource_size_t type instead of the recommended %pap."
},
{
"Commit": "7ffb791423c7c518269a9aad35039ef824a40adb",
"Fixed-by": "269031b15c1433ff39e30fa7ea3ab8f0be9d6ae2",
"subsystem": "x86/kaslr",
"problem_description": "The KASLR direct map size mitigation was too narrow, as it only covered PCI_P2PDMA while all ZONE_DEVICE users require the direct map to cover all physical addresses."
},
{
"Commit": "ed4cccef64c1d0d5b91e69f7a8a6697c3a865486",
"Fixed-by": "238e03d0466239410b72294b79494e43d4fabe77",
"subsystem": "net",
"problem_description": "Incorrect truesize accounting in skb_segment_list causes a persistent socket memory leak for GRO packets."
},
{
"Commit": "b5b4287accd702f562a49a60b10dbfaf7d40270f",
"Fixed-by": "5e5be092ffadcab0093464ccd9e30f0c5cce16b9",
"subsystem": "riscv",
"problem_description": "Unused VA_USER_SV39, VA_USER_SV48, and VA_USER_SV57 macros remain in pgtable.h after the mmap hint address implementation changes"
},
{
"Commit": "0d8295ed975b6df487f0b4018770a60b070fc76d",
"Fixed-by": "8632180daf735074a746ce2b3808a8f2c079310e",
"subsystem": "riscv",
"problem_description": "The Zk bundled extension definition was missing the Zknh extension."
},
{
"Commit": "b3ef7bdec66fb1813e865fd39d179a93cefd2015",
"Fixed-by": "a7fc8c641cab855824c45e5e8877e40fd528b5df",
"subsystem": "net",
"problem_description": "Incorrect bitmask definitions for NPU RX DMA descriptors (NPU_RX_DMA_DESC_LAST_MASK, NPU_RX_DMA_DESC_LEN_MASK, NPU_RX_DMA_DESC_CUR_LEN_MASK, and NPU_RX_DMA_PKT_COUNT_MASK) in airoha_offload.h."
},
{
"Commit": "1d856251a009d64007d71d01c988bead6d3a098c",
"Fixed-by": "9892353726ad222219aa18c329e3a3636134dd56",
"subsystem": "net/sched",
"problem_description": "A socket buffer is leaked when a mirred redirect to self on egress is detected because the loop check occurs after the buffer allocation."
},
{
"Commit": "2753e49176240f21e4bb10e03514f99e732704bb",
"Fixed-by": "530e3d4af566ca44807d79359b90794dea24c4f3",
"subsystem": "btrfs",
"problem_description": "do_abort_log_replay unconditionally dereferences a NULL wc->subvol_path pointer when handling a log replay failure if btrfs_alloc_path failed."
},
{
"Commit": "9f73f1aef98b2fa7252c0a89be64840271ce8ea0",
"Fixed-by": "30bcf4e824aa37d305502f52e1527c7b1eabef3d",
"subsystem": "btrfs",
"problem_description": "The free space tree (v2 cache) is forcibly enabled for subpage mounts (block size < page size) even when the user explicitly requests to disable space caching with the nospace_cache mount option."
},
{
"Commit": "8679d2687c351824d08cf1f0e86f3b65f22a00fe",
"Fixed-by": "8731f2c50b0b1d2b58ed5b9671ef2c4bdc2f8347",
"subsystem": "btrfs",
"problem_description": "Calling btrfs_init_file_extent_tree() while holding a read lock on a leaf can trigger memory reclaim (GFP_KERNEL), leading to a circular lock dependency and potential deadlock."
},
{
"Commit": "ec20799064c881e373939ea3cea55b1c406c6b76",
"Fixed-by": "1aff297ffb925ee49299f86af5fcdf854cb48c5f",
"subsystem": "btrfs",
"problem_description": "Encoded writes with block size larger than page size allow inline extents larger than a page, causing out-of-bounds memory access because the insertion logic expects the data to fit in a single folio."
},
{
"Commit": "e0718bd82e27d85086ada18e7f04847ee84b710a",
"Fixed-by": "ce5e612dd411de096aa041b9e9325ba1bec5f9f4",
"subsystem": "vsock",
"problem_description": "The SOCK_CUSTOM_SOCKOPT flag is not set for accepted sockets, which prevents the custom vsock setsockopt handler from being called to handle SO_ZEROCOPY."
},
{
"Commit": "69b29b894660429280dfff0daed7d183c2fae7a7",
"Fixed-by": "e0d20a7658129fc681e392ba27edea99b77c2e21",
"subsystem": "drm/amd/display",
"problem_description": "The DAC encoder fails to work on some GPUs because the BIOS parser lacks support for the necessary setup action, treating it as a disable command instead."
},
{
"Commit": "7fb4f254c8ebcd89e32c13c2a5758b0664f9fcc4",
"Fixed-by": "fd40c146c8ed7f7e8ae36922dcc583bd0ca70b75",
"subsystem": "drm/amd/display",
"problem_description": "The SelectCRTC_Source command passed the raw integer bit depth to the VBIOS instead of the expected enum values."
},
{
"Commit": "1a18607c07bb68661a6373b4027c26ea8eab4b40",
"Fixed-by": "dc8a887de1a7d397ab4131f45676e89565417aa8",
"subsystem": "drm/amd/pm",
"problem_description": "The previous commit stopped sending PCIe DPM parameters when no clamping was needed, which caused initialization failures on Navi 1x GPUs where the firmware relies on the driver to unconditionally provide these parameters."
},
{
"Commit": "1a18607c07bb68661a6373b4027c26ea8eab4b40",
"Fixed-by": "4f74c2dd970611d3ec3bb0d58215e73af5cd7214",
"subsystem": "drm/amd/pm",
"problem_description": "PCIe DPM parameters on Navi1x GPUs are incorrectly set to capability limits instead of the intended table values."
},
{
"Commit": "f628d799972799023d32c2542bb2639eb8c4f84e",
"Fixed-by": "11194b416ef95012c2cfe5f546d71af07b639e93",
"subsystem": "libceph",
"problem_description": "The sparse-read state is not reset when an OSD fault occurs, causing new replies to be misinterpreted as continuations of the previous one."
},
{
"Commit": "cd1a677cad994021b19665ed476aea63f5d54f31",
"Fixed-by": "e84b48d31b5008932c0a0902982809fbaa1d3b70",
"subsystem": "libceph",
"problem_description": "The handler error from mon_handle_auth_done() is improperly ignored, causing msgr2 to proceed with session establishment despite authentication failure, which leads to a NULL pointer dereference in prepare_auth_signature() when using secure mode."
},
{
"Commit": "751eedc4b4b79332ecf1a78c0dbeb47d573a8f59",
"Fixed-by": "e0392a10c9e80a3991855a81317da3039fcbe32c",
"subsystem": "io_uring",
"problem_description": "The io_wq_for_each_worker() function incorrectly aborted iteration when the callback returned false instead of true."
},
{
"Commit": "b03d542c3c9569f549b1ba0cf7f4d90151fbf8ab",
"Fixed-by": "7966cf0ebe32c981bfa3db252cb5fc3bb1bf2e77",
"subsystem": "PM: hibernate",
"problem_description": "Kernel crash during hibernation cleanup due to dereferencing an ERR_PTR returned by a failed crypto_alloc_acomp call."
},
{
"Commit": "9c0ef6d34fdbfb4f948b96d7611f0fd47649044e",
"Fixed-by": "df27c03b9e3ef2baa9e9c9f56a771d463a84489d",
"subsystem": "PCI",
"problem_description": "The meson PCIe driver incorrectly reports the link as down when in ASPM L0s or L1 states, leading to configuration access failures."
},
{
"Commit": "39ae6c50e599aa0cf62ea3d0dcf06492f7690ed7",
"Fixed-by": "487764a514e97e3b921c4eb13ab35920e09f6b7d",
"subsystem": "platform/x86",
"problem_description": "The DMI match identifier was too broad, causing incorrect power limits to be applied to non-GA403UI models."
},
{
"Commit": "aa21a7d4f68a0a5067578cbb93c136ab5ac09cfa",
"Fixed-by": "120f3e6ff76209ee2f62a64e5e7e9d70274df42b",
"subsystem": "ASoC",
"problem_description": "The wsa884x codec's initialization flag is inverted, causing repeated unnecessary initialization and preventing initialization on the first attach."
},
{
"Commit": "a0aab9e1404ac9f8a300b4546cac3c38e04d07bf",
"Fixed-by": "29d71b8a5a40708b3eed9ba4953bfc2312c9c776",
"subsystem": "ASoC",
"problem_description": "The wsa881x codec is unnecessarily re-initialized on repeated SoundWire ATTACHED status updates."
},
{
"Commit": "43b8c7dc85a14f36048a27bb6c627fd49144a8d1",
"Fixed-by": "49aadf830eb048134d33ad7329d92ecff45d8dbb",
"subsystem": "ASoC",
"problem_description": "The wsa883x codec driver performs unnecessary repeated initialization when the SoundWire update_status callback is invoked multiple times with an ATTACHED status."
},
{
"Commit": "eb3182ef0405ff2f6668fd3e5ff9883f60ce8801",
"Fixed-by": "ff5860f5088e9076ebcccf05a6ca709d5935cfa9",
"subsystem": "perf",
"problem_description": "The swevent hrtimer might still be active when the event is freed because hrtimer_try_to_cancel is used, potentially leading to use-after-free."
},
{
"Commit": "156b0948293362b036caf49e6e4d97cae30201de",
"Fixed-by": "3f77eda548c82564ae4a23c76b51d36c6e39c865",
"subsystem": "nfs",
"problem_description": "NFSv4 client frees the session slot prematurely when requesting a directory delegation, causing race conditions with delegation recalls"
},
{
"Commit": "156b0948293362b036caf49e6e4d97cae30201de",
"Fixed-by": "105c2db2474f50f109082ab8d070efcc8c3d52bd",
"subsystem": "nfs",
"problem_description": "The function nfs_clear_verifier_delegated incorrectly clears the verifier delegated bit on dentries without checking if a parent directory delegation or a specific file delegation remains active."
},
{
"Commit": "156b0948293362b036caf49e6e4d97cae30201de",
"Fixed-by": "6f9bda2337f8b0a4c10ed5630e85eceb126a2c5c",
"subsystem": "nfs",
"problem_description": "Checking for directory delegation in nfs_check_verifier caused excessive on-the-wire lookups."
},
{
"Commit": "d76c769c8db4c321aa4d697e810e0ed0b30bcc91",
"Fixed-by": "5a74af51c3a6f4cd22c128b0c1c019f68fa90011",
"subsystem": "nfs",
"problem_description": "file reference is not released in bl_parse_scsi() if the block device length is zero"
},
{
"Commit": "d67ae825a59d639e4d8b82413af84d854617a87e",
"Fixed-by": "0c728083654f0066f5e10a1d2b0bd0907af19a58",
"subsystem": "nfs",
"problem_description": "memory leak of dsaddrs list in nfs4_ff_alloc_deviceid_node when ds_versions allocation fails"
},
{
"Commit": "96780ca55e3cbf4f150fd5a833a61492c9947b5b",
"Fixed-by": "cce0be6eb4971456b703aaeafd571650d314bcca",
"subsystem": "nfs",
"problem_description": "Deadlock in nfs_release_folio() during memory reclaim when waiting for writeback completion while NFSv4.1 state recovery is pending."
},
{
"Commit": "29ade5db12930ec60133f6a02791f4b1a4af2943",
"Fixed-by": "857bf9056291a16785ae3be1d291026b2437fc48",
"subsystem": "nfs",
"problem_description": "deadlock when returning a delegation during open() because pnfs_roc waits for a layout return that is blocked by the pending open operation"
},
{
"Commit": "51d9ee90ea9060be240830eb28f5f117ad00318c",
"Fixed-by": "c18f35e4904920db4c51620ba634e4d175b24741",
"subsystem": "objtool",
"problem_description": "objtool emits a spurious fallthrough warning for `u64::from_str_radix` because `core::num::from_ascii_radix_panic` is not tracked as a noreturn function"
},
{
"Commit": "c5cf01ba8dfe9c0f631ace6f64ec436303783000",
"Fixed-by": "f1db6538794f5af081940850a7976319d376110a",
"subsystem": "rust",
"problem_description": "The fmt macro fails to compile complex expressions passed as arguments due to missing parentheses when creating a reference to the expression."
},
{
"Commit": "ab844cf32058d6ba9bd98a921afa2256085e21fc",
"Fixed-by": "946c5efe6a059f7d3303442644ee38384453ff68",
"subsystem": "rust",
"problem_description": "The doctest line number anchor was not updated when adding an `#![allow]` attribute, resulting in off-by-one line numbers in KUnit test output."
},
{
"Commit": "01e345e82ec3a5a7edeb9fa0dcb7fd4b0e5c534e",
"Fixed-by": "f6b8d4b7e54ffa1492db476c299c7058603108cb",
"subsystem": "rust",
"problem_description": "Typos and grammatical errors in the Bounded type documentation"
},
{
"Commit": "c5cf01ba8dfe9c0f631ace6f64ec436303783000",
"Fixed-by": "1e4e2a847f3c0bb3f34f3b20229be5c0214b80fa",
"subsystem": "rust",
"problem_description": "missing 'and' in the description of the Adapter struct"
},
{
"Commit": "98c14e40e07a077827f6842e8f31d191cb82576c",
"Fixed-by": "45f6aed8a835ee2bdd0a5d5ee626a91fe285014f",
"subsystem": "rust",
"problem_description": "The documentation for the peek_next method incorrectly stated that it accesses the previous node instead of the next node."
},
{
"Commit": "f46b9a595fa95c82e3279b687869cac249838e96",
"Fixed-by": "ee229e7c256ab5d7b277abf8d48a732c10571750",
"subsystem": "scsi",
"problem_description": "Link startup fails because MCQ configuration occurs before link startup completes."
},
{
"Commit": "6471658dc66c670580a7616e75f51b52917e7883",
"Fixed-by": "2ef02ac38d3c17f34a00c4b267d961a8d4b45d1a",
"subsystem": "inet",
"problem_description": "conntrack cleanup hangs because skbs in the defragmentation queue retain nf_conn references via their frag_list"
},
{
"Commit": "4944be2f5ad8c74b93e4e272f3a0f1a136bbc438",
"Fixed-by": "acb4bc6e1ba34ae1a34a9334a1ce8474c909466e",
"subsystem": "virtio_net",
"problem_description": "memory allocated with the virtio device is incorrectly freed using the net device, causing a devres warning"
},
{
"Commit": "ec4d8e7cf024e42def027531676918048e5c7982",
"Fixed-by": "ffeafa65b2b26df2f5b5a6118d3174f17bd12ec5",
"subsystem": "bnxt_en",
"problem_description": "The find_first_zero_bit() function was passed the number of long words instead of bits, leading to incorrect TPA ID allocation and potential data corruption."
},
{
"Commit": "1f52d7b622854b8bd7a1be3de095ca2e1f77098e",
"Fixed-by": "92e6e0a87f6860a4710f9494f8c704d498ae60f8",
"subsystem": "net",
"problem_description": "Memory allocated for pp_qlt in ipc_mux_init() is not freed in ipc_mux_deinit(), causing a leak."
},
{
"Commit": "816b52624cf6a03ea541956b448025d844a8287d",
"Fixed-by": "8da901ffe497a53fa4ecc3ceed0e6d771586f88e",
"subsystem": "net/ena",
"problem_description": "The devlink lock is not acquired before calling devl_param_driverinit_value_set, causing a lock assertion warning."
},
{
"Commit": "9536fbe10c9ded3f5ce37eda40650039aed5e2ac",
"Fixed-by": "0462a15d2d1fafd3d48cf3c7c67393e42d03908c",
"subsystem": "net/mlx5e",
"problem_description": "A modify header HW object is not freed during cleanup, causing fatal health errors when reloading the driver."
},
{
"Commit": "bb64143eee8c036a89b31daa4e9bf8360a8bded1",
"Fixed-by": "144297e2a24e3e54aee1180ec21120ea38822b97",
"subsystem": "net/mlx5e",
"problem_description": "Legacy userspace tools querying module EEPROM on newer modules cause dmesg flooding with 'Module ID not recognized' error messages."
},
{
"Commit": "2e4c44b12f4da60d3e8dcbc1ccf38bb28a878050",
"Fixed-by": "7d36a4a8bf62dc508bc6bb4b59727aec25064ca5",
"subsystem": "net/mlx5",
"problem_description": "NULL pointer dereference in mlx5_query_mcia() when the status pointer is NULL during an EEPROM query"
},
{
"Commit": "6b81b8a0b1978284e007566d7a1607b47f92209f",
"Fixed-by": "6c75dc9de40ff91ec2b621b78f6cd9031762067c",
"subsystem": "net/mlx5e",
"problem_description": "The ppcnt_statistical_group capability check incorrectly gates access to FEC histogram statistics."
},
{
"Commit": "ad11c4f1d8fd1f03639460e425a36f7fd0ea83f5",
"Fixed-by": "31057979cdadfee9f934746fd84046b43506ba61",
"subsystem": "net/mlx5",
"problem_description": "multipath offload logic does not prioritize routes with smaller network prefixes"
},
{
"Commit": "b0ce3508b25ea6fa10ae3ca254de1d695b521702",
"Fixed-by": "02d1e1a3f9239cdb3ecf2c6d365fb959d1bf39df",
"subsystem": "netdev",
"problem_description": "updating TSO features inadvertently clears NETIF_F_ALL_FOR_ALL flags on the master device, which prevents enabling features like nocache copy"
},
{
"Commit": "6d07d1cd300f4c7e16005f881fea388164999cc8",
"Fixed-by": "2a71a1a8d0ed718b1c7a9ac61f07e5755c47ae20",
"subsystem": "net",
"problem_description": "sock_recv_errqueue triggers a hardened usercopy panic because skbuff_fclone_cache objects lack a usercopy whitelist required for copying data to userspace."
},
{
"Commit": "b2908a989c594f9eb1c93016abc1382f97ee02b1",
"Fixed-by": "62f7edd59964eb588e96fce1ad35a2327ea54424",
"subsystem": "net: phy",
"problem_description": "The mxl-86110 driver lacks a soft reset callback causing MDIO access failures after interface toggling, and is missing system suspend/resume support."
},
{
"Commit": "c319b4d76b9e583a5d88d6bf190e079c4e43213d",
"Fixed-by": "4c0856c225b39b1def6c9a6bc56faca79550da13",
"subsystem": "net",
"problem_description": "ICMP_MIB_OUTMSGS is incremented twice when sending ICMP_ECHO messages via IPPROTO_ICMP sockets."
},
{
"Commit": "528d3f190c98c8f7d9581f68db4af021696727b2",
"Fixed-by": "34f3ff52cb9fa7dbf04f5c734fcc4cb6ed5d1a95",
"subsystem": "net",
"problem_description": "NULL pointer dereference in ocelot_set_aggr_pgids() when accessing unused ports while adding an interface under a LAG."
},
{
"Commit": "11538d039ac6efcf4f1a6c536e1b87cd3668a9fd",
"Fixed-by": "3128df6be147768fe536986fbb85db1d37806a9f",
"subsystem": "bridge",
"problem_description": "C-VLAN tag is incorrectly stripped from the payload during vlan_tunnel egress processing on an 802.1ad bridge"
},
{
"Commit": "8ac050ec3b1c0dcb5e89cf86fe2ebe0afcc73554",
"Fixed-by": "d7065436e8a04520f60c18240b775861be7999d2",
"subsystem": "net",
"problem_description": "The build fails with undefined references to auxiliary bus functions because the BNGE driver uses them without selecting the AUXILIARY_BUS Kconfig option."
},
{
"Commit": "34dd1710f5a3c9a7dc78e1ff6de69a19d407db25",
"Fixed-by": "a428e0da1248c353557970848994f35fd3f005e2",
"subsystem": "net",
"problem_description": "prestera_devlink_alloc() causes a NULL pointer dereference if devlink_alloc() fails"
},
{
"Commit": "df8bc08c192f00f155185bfd6f052d46a728814a",
"Fixed-by": "0ff7c44106b4715fc27a2e455d9f57f1dfcfd54f",
"subsystem": "edac",
"problem_description": "The mapped memory window is not unmapped if the memory controller allocation fails in x38_probe1."
},
{
"Commit": "dd8ef1db87a486577b3a76e6ad45df52e12d0145",
"Fixed-by": "d42d5715dcb559342ff356327b241c53a67584d9",
"subsystem": "edac",
"problem_description": "The memory mapped window is not unmapped if edac_mc_alloc() fails in i3200_probe1()."
},
{
"Commit": "da67179e5538b473a47c87e87cb35b1a7551ad9b",
"Fixed-by": "e8b3627bec357698f2d4d6dbf27cdcfa0e9d8715",
"subsystem": "drm/nouveau",
"problem_description": "Unconditional loading of fwsec-sb firmware causes failures on newer GPUs that do not use this path."
},
{
"Commit": "c9b1150a68d9362a0827609fc0dc1664c0d8bfe1",
"Fixed-by": "2fc04340cf30d7960eed2525d26ffb8905aca02b",
"subsystem": "drm/tidss",
"problem_description": "TI's OLDI and DSI encoders need to be set up before the CRTC is enabled, but the DRM helpers enable the CRTC first, causing visual artifacts or sync lost warnings."
},
{
"Commit": "c9b1150a68d9362a0827609fc0dc1664c0d8bfe1",
"Fixed-by": "d1c7dc57ff2400b141e6582a8d2dc5170108cf81",
"subsystem": "drm",
"problem_description": "Drivers with custom commit tails cannot implement the corrected bridge and CRTC enable/disable sequence because the necessary helper functions are not exported."
},
{
"Commit": "c9b1150a68d9362a0827609fc0dc1664c0d8bfe1",
"Fixed-by": "33e8150bd32d7dc25c977bb455f1f5d54bfd5241",
"subsystem": "drm/mediatek",
"problem_description": "The Mediatek DSI driver retains a stale workaround for bridge pre-enable ordering after the revert of a core DRM change."
},
{
"Commit": "c9b1150a68d9362a0827609fc0dc1664c0d8bfe1",
"Fixed-by": "c1ef9a6cabb34dbc09e31417b0c0a672fe0de13a",
"subsystem": "drm",
"problem_description": "Changing the bridge chain pre-enable and post-disable sequence caused regressions on R-Car, MCDE, and Rockchip platforms."
},
{
"Commit": "608d7c325e855cb4a853afef3cd9f0df594bd12d",
"Fixed-by": "3de49966499634454fd59e0e6fecd50baab7febd",
"subsystem": "pmdomain",
"problem_description": "Resetting G1 or G2 VPU domains separately on i.MX8MQ platforms leads to a system hang."
},
{
"Commit": "2eb46da2a760e5764c48b752a5ef320e02b96b21",
"Fixed-by": "235a1eb8d2dcc49a6cf0a5ee1aa85544a5d0054b",
"subsystem": "of",
"problem_description": "Allocated memory is leaked in unittest_data_add() if of_resolve_phandles() fails."
},
{
"Commit": "39972494e318a21b3059287909fc090186dbe60a",
"Fixed-by": "0b88bfa42e5468baff71909c2f324a495318532b",
"subsystem": "nfsd",
"problem_description": "Memory for the net percpu reference counter is leaked because percpu_ref_exit is skipped if the nfsd network namespace has not fully started up."
},
{
"Commit": "1ac3629bf012592cb0320e52a1cceb319a05ad17",
"Fixed-by": "d0424066fcd294977f310964bed6f2a487fa4515",
"subsystem": "nfsd",
"problem_description": "Attempting to unlock a filesystem when nfsd is not running causes a server crash due to accessing freed state structures."
},
{
"Commit": "1ac3629bf012592cb0320e52a1cceb319a05ad17",
"Fixed-by": "fb321998de7639f1954430674475e469fb529d9c",
"subsystem": "nfsd",
"problem_description": "The loop in nfsd4_revoke_states terminates early because it uses CLIENT_HASH_MASK instead of CLIENT_HASH_SIZE, causing it to miss clients in the last hash bucket."
},
{
"Commit": "7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6",
"Fixed-by": "2857bd59feb63fcf40fe4baf55401baea6b4feb4",
"subsystem": "nfsd",
"problem_description": "Writing to v4_end_grace can race with server shutdown, causing a use-after-free in reclaim_str_hashtbl."
},
{
"Commit": "abc02e5602f7bf9bbae1e8999570a2ad5114578c",
"Fixed-by": "e901c7fce59e72d9f3c92733c379849c4034ac50",
"subsystem": "nfsd",
"problem_description": "LAYOUTGET fails for executable-only files because the addition of NFSD_MAY_OWNER_OVERRIDE caused the special permission check for reading binaries to fail."
},
{
"Commit": "f4e44b393389c77958f7c58bf4415032b4cda15b",
"Fixed-by": "c6c209ceb87f64a6ceebe61761951dcbbf4a0baa",
"subsystem": "nfsd",
"problem_description": "NFSD returns an invalid status code 11 (NFSERR_EAGAIN) instead of NFS4ERR_DELAY during inter-server copy operations."
},
{
"Commit": "d6e26c1ae4a602d8b7eeb39e23514f6f98d91eb5",
"Fixed-by": "a9a42f0754b6c69525612d678b73da790e28b9fd",
"subsystem": "rust",
"problem_description": "Intra-doc links to `pci::Device` cause rustdoc warnings when `CONFIG_PCI` is disabled."
},
{
"Commit": "d06d5f66f5494e29c1520583eac8382f0ab5f8a7",
"Fixed-by": "32cb3840386fd3684fbe8294cfc0a6684417139e",
"subsystem": "rust",
"problem_description": "intra-doc link to `pci::Device` causes rustdoc warnings when CONFIG_PCI is disabled"
},
{
"Commit": "c46a74ff05c0ac76ba11ef21c930c3b447abf31a",
"Fixed-by": "1e876e5a0875e71e34148c9feb2eedd3bf6b2b43",
"subsystem": "gpio",
"problem_description": "The USB device reference obtained via usb_get_dev() in gpio_mpsse_probe() is not released in error paths."
},
{
"Commit": "d265929930e2ffafc744c0ae05fb70acd53be1ee",
"Fixed-by": "7811ba452402d58628e68faedf38745b3d485e3c",
"subsystem": "netfilter",
"problem_description": "The garbage collection timestamp is updated on every connection addition even when garbage collection is skipped, which prevents garbage collection from running under high packet rates and causes the connection list to grow infinitely."
},
{
"Commit": "1689f25924ada8fe14a4a82c38925d04994c7142",
"Fixed-by": "d077e8119ddbb4fca67540f1a52453631a47f221",
"subsystem": "netfilter",
"problem_description": "Memory leak in nf_tables_newrule() where the allocated flow rule is not freed if the chain reference counter increment fails."
},
{
"Commit": "d6179f6c6204f9932aed3a7a2100b4a295dfed9d",
"Fixed-by": "014a17deb41201449f76df2b20c857a9c3294a7c",
"subsystem": "gpio",
"problem_description": "Short interrupt pulses are missed on PCAL devices because the driver relies solely on observing level changes between reads, failing to detect pulses that return to the initial state before the read occurs."
},
{
"Commit": "47d8b4c1d868148c8fb51b785a89e58ca2d02c4d",
"Fixed-by": "a7ac22d53d0990152b108c3f4fe30df45fcb0181",
"subsystem": "gpio",
"problem_description": "A race condition and potential crash occur because the gpio device is added to the global list before its internal SRCU structure is initialized, allowing other drivers to access it in an uninitialized state."
},
{
"Commit": "7b78b26757e0d997b31635d76eaa46d5ef5e1431",
"Fixed-by": "49416483a953662aa53c6d9bef651757d4a95ba5",
"subsystem": "gpio",
"problem_description": "A shared reset-gpios pin cannot be used simultaneously by one driver using the GPIOLIB API and another using the reset control API due to lookup conflicts."
},
{
"Commit": "a060b8c511abb0997381b397e52149a5e3e5259a",
"Fixed-by": "cb0451e33be047fff7137f58d9996370e11fb344",
"subsystem": "gpio",
"problem_description": "shared GPIO lookup ignores the connection ID which causes false positives when a consumer has multiple shared GPIOs"
},
{
"Commit": "6e261d1090d6db0e9dd22978b6f38a2c58558a3f",
"Fixed-by": "ebc18e9854e5a2b62a041fb57b216a903af45b85",
"subsystem": "pinctrl",
"problem_description": "The LPASS LPI GPIO controller is not marked as sleeping despite using a mutex for synchronization."
},
{
"Commit": "38cf9d6413142290316776c80f19eb92a4e19a9f",
"Fixed-by": "bc277212b41ade2137b6278db24652d0847e9a91",
"subsystem": "pinctrl",
"problem_description": "Missing REGMAP_MMIO dependency causes linker errors when building with COMPILE_TEST=y."
},
{
"Commit": "21bf6fc47a1e45031ba8a7084343b7cfd09ed1d3",
"Fixed-by": "fb21116099bbea1fc59efa9207e63c4be390ab72",
"subsystem": "phy",
"problem_description": "Casting a void pointer to a smaller enum type causes a compiler warning on 64-bit architectures."
},
{
"Commit": "ee394f96ad7517fbc0de9106dcc7ce9efb14f264",
"Fixed-by": "36a3200575642846a96436d503d46544533bb943",
"subsystem": "netfilter",
"problem_description": "Data race occurs when reading nf_synproxy_info during packet evaluation while it is being concurrently updated."
},
{
"Commit": "0eb4b5ee33f2461d149408a247af8ae24756a6ca",
"Fixed-by": "7711f4bb4b360d9c0ff84db1c0ec91e385625047",
"subsystem": "netfilter",
"problem_description": "range overlap detection compares only the size of a single register instead of the full key length, failing to correctly reject overlapping intervals"
},
{
"Commit": "bed41005e6174d079948aa6c7796982c2dae6d8e",
"Fixed-by": "0ddd3bb4b14c9102c0267b3fd916c81fe5ab89c1",
"subsystem": "drm",
"problem_description": "Resources are leaked if devm_request_irq() fails in pl111_amba_probe."
},
{
"Commit": "d87b29179aa00efe15c88eebbcb88819e87e7f2a",
"Fixed-by": "b889b4fb4cbea3ca7eb9814075d6a51936394bd9",
"subsystem": "selftests/ftrace",
"problem_description": "The func_traceonoff_triggers test fails because the md5sum check is sensitive to non-deterministic task name resolution updates in the trace output even when tracing is paused."
},
{
"Commit": "544460c33821b44c2f0c643121303c3dc3f66ef1",
"Fixed-by": "4fe2bd195435e71c117983d87f278112c5ab364c",
"subsystem": "drm/i915",
"problem_description": "The `eb.vma` array is not zero-initialized, causing `eb_release_vmas` to dereference invalid pointers during error cleanup if `eb_add_vma` fails."
},
{
"Commit": "9cdc3b6a299c6314485bcfb695546c11d35dac4c",
"Fixed-by": "bb85d206be208bbf834883e948125a35ac59993a",
"subsystem": "ftrace",
"problem_description": "The LoongArch ftrace direct call samples incorrectly restored registers ($t0 and $ra) from the stack, causing incorrect jump logic."
},
{
"Commit": "677e6123e3d24adaa252697dc89740f2ac07664e",
"Fixed-by": "73721d8676771c6c7b06d4e636cc053fc76afefd",
"subsystem": "LoongArch",
"problem_description": "the bpf_arch_text_poke() function fails to skip the 'move t0, ra' instruction when modifying the entry point of a BPF program, leading to incorrect jump address copying"
},
{
"Commit": "677e6123e3d24adaa252697dc89740f2ac07664e",
"Fixed-by": "26138762d9a27a7f1c33f467c4123c600f64a36e",
"subsystem": "bpf",
"problem_description": "Trampoline-based tracing for kernel module functions was disabled on LoongArch."
},
{
"Commit": "677e6123e3d24adaa252697dc89740f2ac07664e",
"Fixed-by": "61319d15a56093358c6822d30659fe2941f589f1",
"subsystem": "LoongArch: BPF",
"problem_description": "the jump offset for tail calls is incorrect, failing to skip the first instruction of TCC initialization"
},
{
"Commit": "677e6123e3d24adaa252697dc89740f2ac07664e",
"Fixed-by": "d314e1f48260cef3f869e3edc02a02c8a48b08e1",
"subsystem": "bpf",
"problem_description": "The return address register ra is not saved to t0 before trampoline operations, causing errors in BPF-to-BPF call chains."
},
{
"Commit": "5dc615520c4dfb358245680f1904bad61116648e",
"Fixed-by": "eb71f5c433e1c6dff089b315881dec40a88a7baf",
"subsystem": "bpf",
"problem_description": "The bpf_tail_call() index is not zero-extended to 32 bits, which may lead to calling the wrong BPF program"
},
{
"Commit": "5dc615520c4dfb358245680f1904bad61116648e",
"Fixed-by": "3f5a238f24d7b75f9efe324d3539ad388f58536e",
"subsystem": "loongarch",
"problem_description": "BPF kfunc call arguments are not sign-extended properly, leading to kernel panics"
},
{
"Commit": "9cdc3b6a299c6314485bcfb695546c11d35dac4c",
"Fixed-by": "45cb47c628dfbd1994c619f3eac271a780602826",
"subsystem": "LoongArch",
"problem_description": "The ftrace direct call return path passed incorrect register values (swapped return addresses) to the custom trampoline."
},
{
"Commit": "3e86e4d74c0490e5fc5a7f8de8f29e7579c9ffe5",
"Fixed-by": "66562b66dcbc8f93c1e28632299f449bb2f5c47d",
"subsystem": "riscv",
"problem_description": "kexec fails to boot a relocatable kernel image because the .modinfo section is unexpectedly included, causing a file size mismatch with the image header."
},
{
"Commit": "970a7c68788e3fec237713eef22ace46507bcf9c",
"Fixed-by": "4c9f6a782f6078dc94450fcb22e65d520bfa0775",
"subsystem": "rust",
"problem_description": "Intra-doc links to `auxiliary::Driver` and `pci::Driver` cause build errors when `CONFIG_AUXILIARY_BUS` or `CONFIG_PCI` are disabled."
},
{
"Commit": "bf0beec0607db3c6f6fb7bd2c6d503792b05cf3f",
"Fixed-by": "10845a105bbcb030647a729f1716c2309da71d33",
"subsystem": "block",
"problem_description": "CPU hotplug offline notifier triggers a NULL pointer dereference by accessing uninitialized tags on unmapped hardware queues"
},
{
"Commit": "8d0f798862731c62b09e7138a9032964d70566c2",
"Fixed-by": "1384cc00bc5f444ddfb66e027fb20c33844b21e1",
"subsystem": "drm/mediatek",
"problem_description": "Multi-byte I2C writes are incorrectly performed as a series of single-byte transfers, causing the target address to be resent for each byte and leading to corrupted transfers."
},
{
"Commit": "8d0f798862731c62b09e7138a9032964d70566c2",
"Fixed-by": "2788c969d89afb1e6ff66b8530584a634d1327dd",
"subsystem": "drm/mediatek",
"problem_description": "DDC transfers are not aborted on timeout, causing subsequent transfers to fail"
},
{
"Commit": "8d0f798862731c62b09e7138a9032964d70566c2",
"Fixed-by": "4e7fd55411faf6c1abfa2ddd1504713b2006d166",
"subsystem": "drm/mediatek",
"problem_description": "The function mtk_hdmi_v2_hdmi_tmds_char_rate_valid has an incorrect return type of int instead of enum drm_mode_status, causing a kCFI violation."
},
{
"Commit": "8d0f798862731c62b09e7138a9032964d70566c2",
"Fixed-by": "2de5bdc2d9819d645b4d0e91d3a520b7fee87294",
"subsystem": "drm/mediatek",
"problem_description": "The driver incorrectly handled platform_get_irq() errors by checking for zero instead of negative values and storing the result in an unsigned integer."
},
{
"Commit": "c6f361cba51c536e7a6af31973c6a4e5d7e4e2e4",
"Fixed-by": "3009738a855cf938bbfc9078bec725031ae623a4",
"subsystem": "mmc",
"problem_description": "Reducing the clock frequency below 52MHz in HS200 or HS400 modes leads to a broken link."
},
{
"Commit": "cc26f593dc193567bdb059a6ffde58e627a44f65",
"Fixed-by": "fa2fd0b10f66b08bc44745feed1761d7c1539d6e",
"subsystem": "smb",
"problem_description": "UBSAN detects an array-index-out-of-bounds error in smb2_copychunk_range because the ChunkCount field holds a stale value while the Chunks array is being populated, violating the __counted_by_le annotation."
},
{
"Commit": "1ac5a404797523cedaf424a3aaa3cf8f9548dff8",
"Fixed-by": "fcd431a9627f272b4c0bec445eba365fe2232a94",
"subsystem": "bnxt_re",
"problem_description": "dma_free_coherent is passed an incorrectly page-masked pointer instead of the original allocated address"
},
{
"Commit": "d2d6422f8bd17c6bb205133e290625a564194496",
"Fixed-by": "1adaea51c61b52e24e7ab38f7d3eba023b2d050d",
"subsystem": "ipv6",
"problem_description": "A race condition in rt6_make_pcpu_route() triggers a BUG_ON() crash on PREEMPT_RT kernels."
},
{
"Commit": "6a98d71daea186247005099758af549e6afdd244",
"Fixed-by": "43bd09d5b750f700499ae8ec45fd41a4c48673e6",
"subsystem": "RDMA/rtrs",
"problem_description": "clt_path::max_pages_per_mr calculation results in zero due to integer truncation, causing ib_alloc_mr to receive an invalid parameter."
},
{
"Commit": "64b8bc7d5f1434c636a40bdcfcd42b278d1714be",
"Fixed-by": "6595beb40fb0ec47223d3f6058ee40354694c8e4",
"subsystem": "net/rose",
"problem_description": "The function rose_kill_by_device() incorrectly uses the total count variable instead of the loop iterator to access an array of sockets, causing potential out-of-bounds reads, invalid pointer dereferences, and leaked references."
},
{
"Commit": "50bfd9c06f0ff80e3ab6cfe6169d5ae2fe1afaa2",
"Fixed-by": "5939b6dbcda8b0f5f03a8e5179c13dc0195eb6cd",
"subsystem": "net",
"problem_description": "The enetc driver incorrectly prints an error log when the PHY address is 0, which is a valid value indicating no register configuration is needed."
},
{
"Commit": "633e98a711ac060fa5aa4061a11aeb8f886b46e1",
"Fixed-by": "99537d5c476cada9cf75aef9fa75579a31faadb9",
"subsystem": "net",
"problem_description": "A circular locking dependency occurs on PREEMPT_RT kernels because mog_init_rings() performs memory allocation while holding a spinlock in macb_mac_link_up()."
},
{
"Commit": "32607a332cfea5a4b2a185f3e3d605a9bf4f8df0",
"Fixed-by": "6e17474aa9fe15015c9921a5081c7ca71783aac6",
"subsystem": "ipv4",
"problem_description": "Preferring nexthops matching the source address breaks ECMP balancing for packets with source addresses on loopback or dummy interfaces."
},
{
"Commit": "493ced1ac47c48bb86d9d4e8e87df8592be85a0e",
"Fixed-by": "ac782f4e3bfcde145b8a7f8af31d9422d94d172a",
"subsystem": "ipv4",
"problem_description": "Error routes are not flushed when their associated nexthop object is deleted, causing a reference count leak."
},
{
"Commit": "c9b37458e95629b1d1171457afdcc1bf1eb7881d",
"Fixed-by": "fa0b198be1c6775bc7804731a43be5d899d19e7a",
"subsystem": "net",
"problem_description": "The sr9700 driver uses the incorrect command `SR_WR_REGS` instead of `SR_WR_REG` when writing a single register, which prevents the device from resetting and initializing correctly."
},
{
"Commit": "2fae67ab63db7e8b35520f897935d694ad92f2fe",
"Fixed-by": "3c68cf68233e556e0102f45b69f7448908dc1f44",
"subsystem": "infiniband",
"problem_description": "mutex umem_odp->umem_mutex is not released if rxe_check_pagefault fails in rxe_odp_map_range_and_lock"
},
{
"Commit": "70cf622bb16e810a36db755a136e419fb3b3853f",
"Fixed-by": "89e87d0dc87eb3654c9ae01afc4a18c1c6d1e523",
"subsystem": "arm64: dts",
"problem_description": "The Ethernet PHY interrupt was incorrectly configured as edge-triggered instead of level-triggered."
},
{
"Commit": "5a8e9b022e569f9f8fdb5106c3c6e0636ad3ebcf",
"Fixed-by": "a988caeed9d918452aa0a68de2c6e94d86aa43ba",
"subsystem": "arm64: dts",
"problem_description": "The LPUART DMA RX and TX channels were swapped, resulting in incorrect mappings to the assigned 'rx' and 'tx' DMA names."
},
{
"Commit": "8d6712695bc8e1433098e73fab85598d5d79c3fd",
"Fixed-by": "c63749a7ddc59ac6ec0b05abfa0a21af9f2c1d38",
"subsystem": "arm64: dts",
"problem_description": "sporadic link bouncing on LAN8740Ai PHY due to missing reference clock management"
},
{
"Commit": "bac63d7c5f461f0efc7af7072d686ea495880ddd",
"Fixed-by": "cdf4e631eec5ddd49bb625df9fb144d6ecdd6f15",
"subsystem": "arm64",
"problem_description": "The eqos and fec ethernet interfaces lack nvmem-cells properties in the device tree, preventing them from retrieving the correct MAC addresses from the hardware fuses."
},
{
"Commit": "03f07be54cdc5c3dd86bd538d3cc69a5639ff2b8",
"Fixed-by": "056c68875122dd342782e5956ed145fe9e059614",
"subsystem": "arm64: dts",
"problem_description": "The compatible string was missing the SoM compatible and the specific hardware revision."
},
{
"Commit": "24e67d28ef9590ea00a258e29a5107b11ce905a8",
"Fixed-by": "1815b16d02ae471b80d7f88c8c62d3b02c18f42a",
"subsystem": "dt-bindings",
"problem_description": "the compatible definition for the Moduline Display controller lacked the Ka-Ro TX8P-ML81 SoM compatible string and a hardware revision specific compatible"
},
{
"Commit": "56c27310c1b4fa5d253e49c3e16ff9e46ae6f3a3",
"Fixed-by": "e6a4eedd49ce27c16a80506c66a04707e0ee0116",
"subsystem": "ARM: dts",
"problem_description": "The RTC interrupt level for the imx6q-ba16 board was incorrectly configured as active high instead of active low."
},
{
"Commit": "5614c8c487f6af627614dd2efca038e4afe0c6d7",
"Fixed-by": "0c56693b06a68476ba113db6347e7897475f9e4c",
"subsystem": "ksmbd",
"problem_description": "memory leak in get_file_all_info() where the allocated filename is not freed if vfs_getattr() fails"
},
{
"Commit": "8a9fb5129e8e64d24543ebc70de941a2d77a9e77",
"Fixed-by": "150b1b97e27513535dcd3795d5ecd28e61b6cb8c",
"subsystem": "x86/microcode",
"problem_description": "Entrysign signature checking is mistakenly skipped for AMD Zen 5 family 1Ah models 0x70 through 0x7f."
},
{
"Commit": "2917f57b6bc15cc6787496ee5f2fdf17f0e9b7d3",
"Fixed-by": "58fc7342b529803d3c221101102fe913df7adb83",
"subsystem": "ipv6",
"problem_description": "kernel oops in pskb_expand_head() via calipso_skbuff_setattr() when skb_cow() is passed a large headroom value causing an integer overflow"
},
{
"Commit": "7ff14c52049eafecdd72cd0a12cae6905876566a",
"Fixed-by": "e34f0df3d81ad4ae7819f14f7a9dcd2efcfbe8c1",
"subsystem": "usbnet",
"problem_description": "The usbnet driver crashes in dql_completed() because netdev_reset_queue() is invoked before cancelling pending bottom-half work."
},
{
"Commit": "1dfc2e46117e5c41037e27e859e75a7518881ee6",
"Fixed-by": "3d970eda003441f66551a91fda16478ac0711617",
"subsystem": "gve",
"problem_description": "Interrupts are automatically enabled before NAPI context initialization completes, causing system crashes."
},
{
"Commit": "bba2556efad66e7eaa56fece13f7708caa1187f8",
"Fixed-by": "a48e232210009be50591fdea8ba7c07b0f566a13",
"subsystem": "net",
"problem_description": "The stmmac driver crashes during zero-copy XDP_TX actions because it treats zero-copy buffers as standard page pool buffers, leading to invalid DMA synchronization."
},
{
"Commit": "d45d8979840d9c9ac93d3fe8cfc8e794b7228445",
"Fixed-by": "85f4b0c650d9f9db10bda8d3acfa1af83bf78cf7",
"subsystem": "octeontx2-pf",
"problem_description": "UBSAN shift-out-of-bounds error occurs when setting a small or zero RX ring size via ethtool."
},
{
"Commit": "39ae6c50e599aa0cf62ea3d0dcf06492f7690ed7",
"Fixed-by": "6a02651c4c4b710ecbaf798eb4feb57c97f2bc14",
"subsystem": "platform/x86",
"problem_description": "The power limits (PPT) for the Asus FA507R model were incorrect and missing DC mode definitions."
},
{
"Commit": "d9a0788093565c300f7c8dd034dbfa6ac4da9aa6",
"Fixed-by": "66e245db16f0175af656cd812b6dc1a5e1f7b80a",
"subsystem": "platform/x86",
"problem_description": "An invalid device pointer (ERR_PTR) is passed to dev_err_probe when device_create fails."
},
{
"Commit": "fefcf0f7cf470845b3675286c298484a056a7b13",
"Fixed-by": "7aa593d8fb64b884bf00c13e01387b0733f3d786",
"subsystem": "selftests/landlock",
"problem_description": "Missing semicolon after EXPECT_EQ statement in the scoped_vs_unscoped test."
},
{
"Commit": "2fc80c69df823628f1f0f2aace99e393c57112fa",
"Fixed-by": "602acfb541195eb35584d7a3fc7d1db676f059bd",
"subsystem": "landlock",
"problem_description": "landlock_request structures are allocated on the stack even when CONFIG_AUDIT is disabled"
},
{
"Commit": "e6c7b3e15559699a30646dd45195549c7db447bd",
"Fixed-by": "e44c42c830b7ab36e3a3a86321c619f24def5206",
"subsystem": "platform/x86",
"problem_description": "out-of-bounds array access occurs during ACPI package parsing because the bounds check fails to account for the loop offset when accessing multi-element fields"
},
{
"Commit": "90bbe88e0ea61bf3ab2376b0497bacf42b66e4a9",
"Fixed-by": "15599306fb6c38c834fa0266bf71557c9be4fb12",
"subsystem": "arm64: dts: freescale",
"problem_description": "The SMARC_SDIO_WP gpio-line-name is incorrectly positioned at line 17 instead of line 15 in the som_gpio_expander_1 node."
},
{
"Commit": "90bbe88e0ea61bf3ab2376b0497bacf42b66e4a9",
"Fixed-by": "466798368e51d0a8fb9628730399957ec2281824",
"subsystem": "arm64: dts",
"problem_description": "The ethernet PHY interrupt is incorrectly configured with a level-low trigger instead of edge-falling, mismatching the PCA9745 GPIO expander hardware capabilities."
},
{
"Commit": "9b90864bb42befdc10fa5c60dd1d8033c8535726",
"Fixed-by": "3691fd19ccad4c1c0e3fc4888ef36edaa6e571be",
"subsystem": "rust",
"problem_description": "The safety documentation for the `RawDeviceId` trait incorrectly stated that implementers must be layout-compatible with `RawDeviceId` instead of `RawType`."
},
{
"Commit": "d37a39f607c4a479d59781639b9c2a05448568a3",
"Fixed-by": "68ece1e2ce3a1cb0aac9f5af685cf18fa2fa31aa",
"subsystem": "dma",
"problem_description": "The `write` function documentation incorrectly refers to a returned slice, but the function does not return a slice."
},
{
"Commit": "da5a70f3519fd6f73ece3eea261a861c9a4d6bbd",
"Fixed-by": "2f4ca87469b9499eb9218cf2a374018cfee6b649",
"subsystem": "Documentation",
"problem_description": "sample values for family and machine in sysfs-devices-soc documentation were swapped"
},
{
"Commit": "56f529ce4370757afe57b2e51810348831183398",
"Fixed-by": "d37cd54ebeac37a763fbf303ed25f8a6e98328ff",
"subsystem": "platform/x86",
"problem_description": "Reading the battery charge threshold returns garbage values because casting an int pointer to a u8 pointer leaves upper bytes uninitialized."
},
{
"Commit": "721cabf6c6600dbe689ee2782bc087270e97e652",
"Fixed-by": "73cb5f6eafb0ac7aea8cdeb8ff12981aa741d8fb",
"subsystem": "pmdomain: imx",
"problem_description": "A reference count leak occurs in imx_gpc_probe() because the pgc_node acquired via of_get_child_by_name() is not released."
},
{
"Commit": "c1bac49fe91f7c10fec95e6ef8304062202d5263",
"Fixed-by": "305f254727bd379bbed0385afa0162f5bde1f51c",
"subsystem": "pmdomain",
"problem_description": "The device node's reference count is decremented multiple times without being incremented when calling of_find_node_with_property, risking early memory release."
},
{
"Commit": "eafedbc7c050c44744fbdf80bdf3315e860b7513",
"Fixed-by": "361e0ff456a8daf9753c18030533256e4133ce7a",
"subsystem": "binder",
"problem_description": "Recursive locking in rust_shrink_free_page due to acquiring the already held list_lru lock."
},
{
"Commit": "dd08ebf6c3525a7ea2186e636df064ea47281987",
"Fixed-by": "bed2a6bd20681aacfb063015c1edfab6f58a333e",
"subsystem": "drm/xe",
"problem_description": "The compiler may ignore important modifications to g2h_fence->done due to missing READ_ONCE and WRITE_ONCE annotations."
},
{
"Commit": "307fd14d4b14c8cfda5870e1af3962f7b58e59d7",
"Fixed-by": "ca643894a37a25713029b36cfe7d1bae515cac08",
"subsystem": "arm64: dts",
"problem_description": "The usdhc2 regulator lacks a sufficient off-on delay, causing SD cards to fail entering SD3.0 mode after a power cycle because the supply voltage does not drop below 0.5V."
},
{
"Commit": "9918092cbb0e0cc33de6a85f43173f456612d391",
"Fixed-by": "e0d8678c2f09dca22e6197321f223fa9a0ca2839",
"subsystem": "arm64: dts",
"problem_description": "The light sensor interrupt was incorrectly configured as edge-falling instead of level-low, causing a type mismatch error on a shared interrupt line."
},
{
"Commit": "969497ebefcfe69c8d0ee6f6291102418d5589b1",
"Fixed-by": "cd0caaf2005547eaef8170356939aaabfcad4837",
"subsystem": "arm64: dts",
"problem_description": "assigned incorrect pclk clock ID to the I3C2 controller"
},
{
"Commit": "9567d3dc760931afc38f7f1144c66dd8c4b8c680",
"Fixed-by": "961ac9d97be72267255f1ed841aabf6694b17454",
"subsystem": "crypto",
"problem_description": "restarting message is sent twice from PF to VF during AER error handling, causing userspace subservices to shutdown unexpectedly"
},
{
"Commit": "1f5556ec8b9efbb784aeb3536e147182dee73d0f",
"Fixed-by": "acf44a2361b8d6356b71a970ab016065b5123b0e",
"subsystem": "vfio/xe",
"problem_description": "migf->filp is accessed after migf has been freed in xe_vfio_pci_alloc_file"
},
{
"Commit": "2e7c6feb4ef5257189819359e754625ccf5a1d6c",
"Fixed-by": "665077d78dc7941ce6a330c02023a2b469cc8cc7",
"subsystem": "vfio/pds",
"problem_description": "memory leak in pds_vfio_dirty_enable() if interval_tree_iter_first() returns NULL"
},
{
"Commit": "71f28f3136aff5890cd56de78abc673f8393cad9",
"Fixed-by": "7fc4da6a304bdcd3de14fc946dc2c19437a9cc5a",
"subsystem": "ublk",
"problem_description": "Synchronous partition scan during add_disk can deadlock if IO errors occur while holding the device mutex."
},
{
"Commit": "a69040ed57f50156e5452474d25c79b9e62075d0",
"Fixed-by": "c9894e6f0160414b57e895332c580cf5c8da6780",
"subsystem": "sched_ext",
"problem_description": "The scx_show_state.py script fails because it references the scx_in_softlockup and scx_breather_depth variables which were removed in a previous commit."
},
{
"Commit": "48e12677738663c6ac7be6abe7b216ec74a5b6e6",
"Fixed-by": "f92ff79ba2640fc482bf2bfb5b42e33957f90caf",
"subsystem": "tools/sched_ext",
"problem_description": "The scx_show_state.py script fails because the 'scx_ops' symbol was removed and replaced by 'scx_root'."
},
{
"Commit": "df30285b3670bf52e1e5512e4d4482bec5e93c16",
"Fixed-by": "4d1442979e4a53b9457ce1e373e187e1511ff688",
"subsystem": "af_unix",
"problem_description": "SCM_INQ control messages are incorrectly attached to io_uring reads without SO_INQ enabled and are attached even on read failures."
},
{
"Commit": "a10ad1b104024efe0a01d21ce7c08002cf4034c4",
"Fixed-by": "684d3b2670a26313bbb99de6d66f384ac0e31c9b",
"subsystem": null,
"problem_description": null
},
{
"Commit": "2c927c0c73fd9f6de9ff576e08cd59f13b9d0ef7",
"Fixed-by": "cc8f92e41eb76f450f05234fef2054afc3633100",
"subsystem": "w1",
"problem_description": "Redundant decrements of slave count and family reference count in the error path of w1_attach_slave_device cause double decrements."
},
{
"Commit": "9bf66036d686b9a67000ba22bd94be13a4ea79ac",
"Fixed-by": "3387a7ad478b46970ae8254049167d166e398aeb",
"subsystem": "net",
"problem_description": "Use-after-free in mana_serv_reset where the gdma_context structure is dereferenced after being freed by mana_serv_rescan."
},
{
"Commit": "b2e9821cff6c3c9ac107fce5327070f4462bf8a7",
"Fixed-by": "c04de0c79534ec03c3efa49b72a90a55851b2c25",
"subsystem": "net",
"problem_description": "prefetching from a NULL pointer causes crashes on some architectures"
},
{
"Commit": "efa5356b0d9753b9d7e63e41459eba106cce30f3",
"Fixed-by": "f79f9b7ace1713e4b83888c385f5f55519dfb687",
"subsystem": "bridge",
"problem_description": "The tunnel_hash member of struct net_bridge_vlan_group is missing its kernel-doc description, causing a Sphinx warning."
},
{
"Commit": "3e3b5dfcd16a3e254aab61bd1e8c417dd4503102",
"Fixed-by": "1ab526d97a57e44d26fadcc0e9adeb9c0c0182f5",
"subsystem": "nfc",
"problem_description": "A deadlock occurs between nfc_unregister_device and rfkill_fop_write due to lock ordering inversion between device_lock and rfkill_global_mutex."
},
{
"Commit": "7e88b11a862afe59ee0c365123ea5fb96a26cb3b",
"Fixed-by": "a1e077a3f76eea0dc671ed6792e7d543946227e8",
"subsystem": "net",
"problem_description": "The function asix_read_phy_addr does not validate the PHY address read from the device, allowing invalid addresses to trigger warnings in mdiobus_get_phy."
},
{
"Commit": "24e31e4747698dc50d408f0082d7eb9b9520d2f6",
"Fixed-by": "a4f800c4487dc5d6fcc28da89c7cc3c187ccc731",
"subsystem": "net",
"problem_description": "Reference count leak of fwnode_handle when returning early from loops in the RTL9300 MDIO driver."
},
{
"Commit": "7678523109d1d9ee58adfe1cadbcd8fe195164ae",
"Fixed-by": "fe072f651083c612278de82ce08bccdfecf574b3",
"subsystem": "tools/build",
"problem_description": "The `test-all` feature test always fails to link because the `-lssl` flag is missing."
},
{
"Commit": "3764e82e5150d87b205c10cd78a9c9ab86fbfa51",
"Fixed-by": "1f4ea4838b13c3b2278436a8dcb148e3c23f4b64",
"subsystem": "mcb",
"problem_description": "The mcb bus lacks modpost support, preventing client drivers from autoloading using MODULE_DEVICE_TABLE data."
},
{
"Commit": "e7e2941300d258d551dda6ca9a370e29e085fa73",
"Fixed-by": "b08fc4d0ec2466558f6d5511434efdfabbddf2a6",
"subsystem": "kbuild",
"problem_description": "Device tree blobs specified on the command line without a corresponding make rule cannot be compiled."
},
{
"Commit": "9362d34acf91a706c543d919ade3e651b9bd2d6f",
"Fixed-by": "07fe35b766a6fcd4ec8214e5066b7b0056b6ec6a",
"subsystem": "scripts",
"problem_description": "gen_compile_commands.py generates false entries for .c files included in other .c files that are not meant for standalone compilation"
},
{
"Commit": "1da6df85c6fbed8f39c56eadcae7fa75a7a0c635",
"Fixed-by": "d42bce414d1c5c0b536758466a1f63ac358e613c",
"subsystem": "net",
"problem_description": "port_fdb_dump() incorrectly includes multicast entries from the ARL table, interpreting their port bitmasks as single port numbers."
},
{
"Commit": "74715c4ab0fa0c0911ba78cb639db6b8da88b085",
"Fixed-by": "d5dc28305143f126dc3d8da21e1ad75865b194e2",
"subsystem": "bnge",
"problem_description": "The module description and Kconfig help text were missing the ThorUltra branding for the BCM57708/800G NIC family."
},
{
"Commit": "ac917a81117ce0286847666b55dd265f6cda8383",
"Fixed-by": "9910159f06590c17df4fbddedaabb4c0201cc4cb",
"subsystem": "iio",
"problem_description": "lockdep reports a false positive deadlock warning when one IIO device consumes another due to shared lock class for info_exist_lock"
},
{
"Commit": "62ed1b58224636185fa689db81224b8c8af46473",
"Fixed-by": "a4166f1c4893a9a620507255b9d1ccab44fab189",
"subsystem": "md",
"problem_description": "Writing the logical block size to a reserved metadata padding field caused older kernels to reject the array during assembly due to non-zero padding checks, breaking forward compatibility."
},
{
"Commit": "62ed1b58224636185fa689db81224b8c8af46473",
"Fixed-by": "864466c38c4a0446088a8e866538c83c3f2018cb",
"subsystem": "md",
"problem_description": "The logical block size configuration is ineffective because it is unconditionally overwritten by the value from the superblock metadata in super_1_validate."
},
{
"Commit": "fa1944bbe6220eb929e2c02e5e8706b908565711",
"Fixed-by": "7ad6ef91d8745d04aff9cce7bdbc6320d8e05fe9",
"subsystem": "md/raid5",
"problem_description": "Possible null-pointer dereferences in raid5_store_group_thread_cnt() because raid5_quiesce() is called before checking if mddev->private is valid."
},
{
"Commit": "33e65b0d3add6bdc731e9298995cbbc979349f51",
"Fixed-by": "60207df2ebf3b740770aa605173d2d7d19ee66b2",
"subsystem": "landlock",
"problem_description": "The file security/landlock/ruleset.c unnecessarily includes the \"audit.h\" header."
},
{
"Commit": "2fc80c69df823628f1f0f2aace99e393c57112fa",
"Fixed-by": "29fbfa46e4287c596bdc77e2c599e3a1bbf8bb67",
"subsystem": "landlock",
"problem_description": "the local variable mask is declared as access_mask_t instead of layer_mask_t"
},
{
"Commit": "f83d51a5bdfe5ab56c27fd5dfe01c613b37e2dad",
"Fixed-by": "e1a57c33590a50a6639798e60a597af4a23b0340",
"subsystem": "selftests/landlock",
"problem_description": "The named_unix_domain_socket_ioctl test calls bind() with an uninitialized sun_path, causing random test failures due to reading stack garbage."
},
{
"Commit": "a549d055a22e4fc5559ef642b30721899fa07b75",
"Fixed-by": "bd09d9a05cf04028f639e209b416bacaeffd4909",
"subsystem": "landlock",
"problem_description": "The bind(AF_UNSPEC) test incorrectly expects -EINVAL instead of -EAFNOSUPPORT on IPv6 sockets and uses an insufficient address length."
},
{
"Commit": "fff69fb03dde1dfa348cfdb74b13287dabe42c25",
"Fixed-by": "e4d82cbce2258f454634307fdabf33aa46b61ab0",
"subsystem": "landlock",
"problem_description": "The current_check_access_socket function incorrectly enforces a minimum length of sizeof(struct sockaddr_in) for AF_UNSPEC addresses, rejecting valid short AF_UNSPEC addresses."
},
{
"Commit": "b4dbfd8653b34b0ab6c024ceda32af488c9b5602",
"Fixed-by": "552dbf47a85c3b0eea1d7984ce3794b8d9b20e94",
"subsystem": "landlock",
"problem_description": "Code formatting violation in security/landlock/fs.c after automated conversion."
},
{
"Commit": "518919276c4119e34e24334003af70ab12477f00",
"Fixed-by": "fa917d3d570279dc3d699cbd947d0da0fde2e402",
"subsystem": "pinctrl",
"problem_description": "Reordering the register base name array caused a mismatch with hardcoded indices used by PIN_FIELD_BASE macros, breaking pin configuration."
},
{
"Commit": "286468210d83ce0ca1e37e346ed9f4457a161650",
"Fixed-by": "c48c0fd0e19684b6ecdb4108a429e3a4e73f5e21",
"subsystem": "firewire",
"problem_description": "dma_free_coherent is called with PAGE_SIZE instead of the allocated RCV_BUFFER_SIZE when freeing the receive buffer"
},
{
"Commit": "cf4fd52e323604ccfa8390917593e1fb965653ee",
"Fixed-by": "97872fa28b33a1ca6acc0a7b260750c9a123b193",
"subsystem": "MAINTAINERS",
"problem_description": "The Tyr driver is not excluded from the DRM MISC maintainer entry."
},
{
"Commit": "cf4fd52e323604ccfa8390917593e1fb965653ee",
"Fixed-by": "de0bdcaf36494c9d91653cb062766846f7c51041",
"subsystem": "MAINTAINERS",
"problem_description": "A missing colon in the ARM MALI TYR DRM DRIVER entry prevents get_maintainer.pl from properly parsing the entry."
},
{
"Commit": "b9445598d8c60a1379887b957024b71343965f74",
"Fixed-by": "b14fad555302a2104948feaff70503b64c80ac01",
"subsystem": "io_uring",
"problem_description": "Memory leak of struct filename in __io_openat_prep() when a request specifies both a fixed file slot and the O_CLOEXEC flag."
},
{
"Commit": "d8730f0cf4effa015bc5e8840d8f8fb3cdb01aab",
"Fixed-by": "00f6c1b4d15d35fadb7f34768a1831c81aaa8936",
"subsystem": "md",
"problem_description": "The iterator 'i' in the analyze_sbs function is not incremented, rendering the check against max_disks ineffective."
},
{
"Commit": "78599c42ae3c70300a38b0d1271a85bc9f2d704a",
"Fixed-by": "1f941b2c23fd34c6f3b76d36f9d0a2528fa92b8f",
"subsystem": "nfsd",
"problem_description": "Client reference is leaked if seq_open fails in client_states_open"
},
{
"Commit": "e5e9b24ab8fa9e899d6627123d7d5ba0c317d267",
"Fixed-by": "8f9e967830ff32ab7756f530a36adf74a9f12b76",
"subsystem": "nfsd",
"problem_description": "notify_change() triggers an unintended delegation break when finalizing timestamps during delegation release, causing the update to fail."
},
{
"Commit": "e7a8ebc305f26cab608e59a916a4ae89d6656c5f",
"Fixed-by": "8072e34e1387d03102b788677d491e2bcceef6f5",
"subsystem": "nfsd",
"problem_description": "nfsd4_add_rdaccess_to_wrdeleg() leaks nfsd_file references by overwriting existing read-open pointers and mishandling reference counts for write delegations, leading to open conflicts and a BUG() during server shutdown"
},
{
"Commit": "20fa19027286983ab2734b5910c4a687436e0c31",
"Fixed-by": "a49a2a1baa0c553c3548a1c414b6a3c005a8deba",
"subsystem": "lockd",
"problem_description": "nlmsvc_testlock() incorrectly passes an initialized file_lock to vfs_test_lock(), which can overwrite the lock's owner and operations, leading to potential memory corruption when the lock is freed."
},
{
"Commit": "a5baf582f4c026c25a206ac121bceade926aec74",
"Fixed-by": "61ed08c2fd1db0eb43c8b62ade249a3061e39444",
"subsystem": "efi",
"problem_description": "Missing initialization of user_ns in efi_mm causes a NULL pointer dereference in security capability checks when kthreads use this memory context."
},
{
"Commit": "17029cdd8f9d0182a6499e0b7bfc6391e8463091",
"Fixed-by": "5688e977ed2b98b2f881cdf2b1306a7bb2ba5018",
"subsystem": "efi",
"problem_description": "Boot crash on mixed-mode UEFI systems caused by incorrect EDID pointer values resulting from direct access to protocol fields instead of using the efi_table_attr() helper."
},
{
"Commit": "0f0e357902957fba28ed31bde0d6921c6bd1485d",
"Fixed-by": "cb6d5aa9c0f10074f1ad056c3e2278ad2cc7ec8d",
"subsystem": "cifs",
"problem_description": "memory and information leak in smb3_reconfigure() due to missing cleanup of newly allocated passwords when smb3_sync_session_ctx_passwords() fails"
},
{
"Commit": "834e772c8db0c6a275d75315d90aba4ebbb1e249",
"Fixed-by": "d8ee3cfdc89b75dc059dc21c27bef2c1440f67eb",
"subsystem": "vhost/vsock",
"problem_description": "Suspicious RCU usage warnings occur when vhost_vsock_get() iterates the RCU hash table without an explicit RCU read lock or lockdep annotation."
},
{
"Commit": "f046fbb4d81d1b0c4a169707411e3cd540c03354",
"Fixed-by": "5c56afd204ad266d23889ee8823fb65b2c3b63da",
"subsystem": "ecryptfs",
"problem_description": "The lower parent dentry is not released in ecryptfs_mkdir, causing a dentry leak and potential BUG on unmount."
},
{
"Commit": "f046fbb4d81d1b0c4a169707411e3cd540c03354",
"Fixed-by": "5f9ad16bccd351321d9cd65726fd09390d34b06c",
"subsystem": "ecryptfs",
"problem_description": "ecryptfs_mknod() incorrectly calls end_removing() instead of end_creating() in the return path."
},
{
"Commit": "ff7c4ea11a05c886f018fff4a4d4f4d68d951e25",
"Fixed-by": "73a91ef328a9d728c7f3357f925980937f0d520c",
"subsystem": "VFS",
"problem_description": "Fixes kernel-doc warnings for the __start_dirop function caused by a missing parameter description and incorrect function name."
},
{
"Commit": "a27628f4363435beac84b55c749c41a005054d30",
"Fixed-by": "fe33729d2907415ff953d84673caebca628cbd77",
"subsystem": "fs",
"problem_description": "The @isnew parameter in ilookup5_nowait() was missing from the kernel-doc comments, resulting in a Sphinx warning."
},
{
"Commit": "7c179096e77eca210caf43abfcf3e556030fea3b",
"Fixed-by": "46af9ae1305f1025fd9ff7d8945de98a6ec0a52b",
"subsystem": "fs",
"problem_description": "try_to_unlazy and try_to_unlazy_next incorrectly succeed when LOOKUP_CACHED is set and nd->depth is 0, causing the slowpath to be taken and defeating the LOOKUP_CACHED flag"
},
{
"Commit": "e2d46f2ec332533816417b60933954173f602121",
"Fixed-by": "570ad253a3455a520f03c2136af8714bc780186d",
"subsystem": "netfs",
"problem_description": "folios are unlocked before the tail beyond EOF is zeroed, exposing uninitialized data"
},
{
"Commit": "12d821bd13d42e6de3ecb1c13918b1f06a3ee213",
"Fixed-by": "60489936aced785ef9e5a865e23a296bd0b470b6",
"subsystem": "regulator",
"problem_description": "The fp9931 driver fails to look up regulator properties in the 'regulators' subnode."
},
{
"Commit": "d7d0e73f7de33a2b9998b607707a3e944ef3b86d",
"Fixed-by": "88733a0b64872357e5ecd82b7488121503cb9cc6",
"subsystem": "drm/msm/dpu",
"problem_description": "A potential NULL pointer dereference occurs in `dpu_encoder_phys_wb_setup_ctl` when accessing the pingpong block (`hw_pp`) without checking if it is valid."
},
{
"Commit": "d7ec9366b15cd04508fa015cb94d546b1c01edfb",
"Fixed-by": "da9168d8ef1cbc5dcd1cee91416bd7b408ca8377",
"subsystem": "drm/msm/dpu",
"problem_description": "The dual-DSI dual-DSC scenario is broken."
},
{
"Commit": "5978864e34b66bdae4d7613834c03dd5d0a0c891",
"Fixed-by": "35ab5123bd24dcb082d8e7152536bb2bcda5e054",
"subsystem": "drm/msm",
"problem_description": "IOMMU faults and eDP artifacts occur on Hamoa based devices."
},
{
"Commit": "bbf711682cd570697086e88388a2c718da918894",
"Fixed-by": "b246caa68037aa495390a60d080acaeb84f45fff",
"subsystem": "phy",
"problem_description": "Reliance on hardware reset values for HS_DISCON_LEVEL leads to potential USB signal detection failures."
},
{
"Commit": "2e38c50ae4929f0b954fee69d428db7121452867",
"Fixed-by": "1e91505038823e51b98d1a63660606307202d5b6",
"subsystem": "vfio/xe",
"problem_description": "The vfio/xe driver is missing the required .get_region_info_caps callback, which causes -EINVAL errors."
},
{
"Commit": "2b938e3db335e3670475e31a722c2bee34748c5a",
"Fixed-by": "dc85a46928c41423ad89869baf05a589e2975575",
"subsystem": "vfio/pci",
"problem_description": "qword access to the PCI ROM bar triggers PCI AER errors on certain devices"
},
{
"Commit": "5d4939fc2258e80e0eda2a8a190c9e4f78f52456",
"Fixed-by": "d6b5a8d6f142ad0a8e45181f06e70b4746c4abc3",
"subsystem": "mm",
"problem_description": "break_ksm_pmd_entry passes a pointer potentially outside the mapped page to pte_unmap_unlock, causing the wrong address to be unmapped on HIGHMEM systems."
},
{
"Commit": "765973a098037b198ffb813244dbdb45c875ad5f",
"Fixed-by": "a76a5ae2c6c645005672c2caf2d49361c6f2500f",
"subsystem": "mm",
"problem_description": "Memory leak in page_owner_stack_fops->release() due to using seq_release() instead of seq_release_private()."
},
{
"Commit": "d245f9b4ab806733a77e51a218ca7b8bc3135cd9",
"Fixed-by": "077d925b60c320027dd64b69e0ab2dd2e00ed45c",
"subsystem": "mm",
"problem_description": "A spurious warning is triggered when freeing large FS-DAX folios because the code incorrectly assumes non-anonymous zone device folios cannot be large."
},
{
"Commit": "2783088ef24e32df9d70eb2a24f70de28b476a05",
"Fixed-by": "0c75714095e06692f7a0e00a3dfd829c0d3c0ada",
"subsystem": "mm",
"problem_description": "Deadlocks occur on NOMMU systems because zone_batchsize incorrectly returns 0 instead of 1."
},
{
"Commit": "86ebd50224c0734d965843260d0dc057a9431c61",
"Fixed-by": "f183663901f21fe0fba8bd31ae894bc529709ee0",
"subsystem": "mm",
"problem_description": "folio_expected_ref_count() fails to account for swap cache references on non-anonymous folios, leading to migration failures."
},
{
"Commit": "da939ef4c494246bc2102ecb628bbcc71d650410",
"Fixed-by": "6558749ef3405c143711cbdc67ec88cbc1582d91",
"subsystem": "maple_tree",
"problem_description": "The destructor triggers a lockdep warning because it calls mas_find() without holding the RCU read lock."
},
{
"Commit": "bc8e51c05ad50a5a0b02114d3cc94d151a332595",
"Fixed-by": "6db12d5c474d77016ca9130eb32490c9771fb157",
"subsystem": "mm",
"problem_description": "The K() macro was incorrectly passed a byte count instead of a page count when dumping memcg protection info in OOM logs, resulting in incorrect values."
},
{
"Commit": "2ec41967189cd65a8f79c760dd1b50c4f56e8ac6",
"Fixed-by": "e6dbcb7c0e7b508d443a9aa6f77f63a2f83b1ae4",
"subsystem": "mm",
"problem_description": "memory failure handling for PFNMAP memory incorrectly uses the PFN instead of the file page offset to determine the virtual address"
},
{
"Commit": "8f9c447e2e2b53c2db4fac85fc42ecada8b39e52",
"Fixed-by": "7013803444dd3bbbe28fd3360c084cec3057c554",
"subsystem": "mm",
"problem_description": "The compare_ts function in page_owner_sort incorrectly returns 1 instead of 0 for equal timestamps, causing unstable sorting behavior."
},
{
"Commit": "f60b6634cd88a749fdcd9edfeb2079c23aa05b66",
"Fixed-by": "632b874d59a36caf829ab5790dafb90f9b350fd6",
"subsystem": "mm",
"problem_description": "The uffd-unit-tests selftest fails on 32-bit architectures because it uses sizeof on a pointer instead of strlen to calculate a string offset."
},
{
"Commit": "07d24902977e4704fab8472981e73a0ad6dfa1fd",
"Fixed-by": "a3785ae5d334bb71d47a593d54c686a03fb9d136",
"subsystem": "kexec",
"problem_description": "kimage_map_segment incorrectly assumes source pages exist for CMA-allocated segments, causing a warning and failure when IMA attempts to map them."
},
{
"Commit": "07d24902977e4704fab8472981e73a0ad6dfa1fd",
"Fixed-by": "fe55ea85939efcbf0e6baa234f0d70acb79e7b58",
"subsystem": "kexec",
"problem_description": "kimage_map_segment fails to map segments allocated via CMA because it attempts to reconstruct the mapping from kimage entries instead of using the direct CMA page pointer."
},
{
"Commit": "09efc56a3b1cfda995586ef27ed8d6f8f92ed917",
"Fixed-by": "02129e623c18ad77ebb85210340f72125ae8a7a1",
"subsystem": "mm",
"problem_description": "The function `damos_va_migrate_pmd_entry` fails to release the PTE lock before returning when `damos_va_filter_out` returns true."
},
{
"Commit": "e6cf9e1c4cde8a53385423ecb8ca581097f42e02",
"Fixed-by": "7838a4eb8a1d23160bd3f588ea7f2b8f7c00c55b",
"subsystem": "mm",
"problem_description": "When coalescing pages, only the first pageblock of a buddy page had its migrate type updated, causing inconsistencies and warnings for larger pages."
},
{
"Commit": "1d96320f8d5320423737da61e6e6937f6b475b5c",
"Fixed-by": "6a0e5b333842cf65d6f4e4f0a2a4386504802515",
"subsystem": "mm",
"problem_description": "KASAN tag mismatches occur in multi-chunk allocations because subsequent chunks are assigned different random tags while being accessed with the first chunk's tag."
},
{
"Commit": "1d96320f8d5320423737da61e6e6937f6b475b5c",
"Fixed-by": "6f13db031e27e88213381039032a9cc061578ea6",
"subsystem": "kasan",
"problem_description": "pcpu_get_vm_areas causes KASAN tag mismatches on multi-node systems because separate vmalloc chunks receive different tags but are accessed using the tag of the first chunk."
},
{
"Commit": "a0309faf1cb0622cac7c820150b7abf2024acff5",
"Fixed-by": "007f5da43b3d0ecff972e2616062b8da1f862f5e",
"subsystem": "mm",
"problem_description": "vrealloc breaks KASAN tracking by missing the KASAN_VMALLOC_VM_ALLOC flag and generating a new tag instead of reusing the existing one when extending a vmalloc region."
},
{
"Commit": "6ce711f2750031d12cec91384ac5cfa0a485b60a",
"Fixed-by": "c6e8e595a0798ad67da0f7bebaf69c31ef70dfff",
"subsystem": "idr",
"problem_description": "idr_alloc() returns an ID outside the requested range when the requested range lies entirely below the IDR base."
},
{
"Commit": "52fbf1134d479234d7e64ba9dcbaea23405f229e",
"Fixed-by": "5393802c94e0ab1295c04c94c57bcb00222d4674",
"subsystem": "genalloc",
"problem_description": "The 'start_addr' parameter added to 'genpool_algo_t' was not documented, causing an htmldocs warning."
},
{
"Commit": "75e961730b9e8506aa9b5cb670bdd674ce80e46a",
"Fixed-by": "9e724085dacdeec60642e25b1b89245e14f48ef9",
"subsystem": "perf",
"problem_description": "The basic perf top coverage test is flaky and fails to capture samples when running in parallel with other tests due to system load."
},
{
"Commit": "b58261584d2f6b5241ac1693026242ef2f2148b4",
"Fixed-by": "b3d1dcd02c8cc1da723c1e9a6b74849ed94b6d30",
"subsystem": "perf",
"problem_description": "The permission check for perf kvm stat record leaves a stray perf.data.guest file in the current directory."
},
{
"Commit": "98898f3bc83c8a74e562869332cb1b349976a116",
"Fixed-by": "7d8f725b79e35fa47e42c88716aad8711e1168d8",
"subsystem": "phy",
"problem_description": "USB gadget communication is disrupted because charger detection logic incorrectly disables the PHY operational mode while VBUS is attached."
},
{
"Commit": "98898f3bc83c8a74e562869332cb1b349976a116",
"Fixed-by": "028e8ca7b20fb7324f3e5db34ba8bd366d9d3acc",
"subsystem": "phy",
"problem_description": "The rockchip-inno-usb2 driver incorrectly powers off the PHY during charger detection when the state is undefined, causing a disconnection in gadget mode."
},
{
"Commit": "5ab90f40121a9f6a9b368274cd92d0f435dc7cfa",
"Fixed-by": "4914d67da947031d6f645c81c74f7879e0844d5d",
"subsystem": "phy",
"problem_description": "The mmio regmap allocated during probe is never freed, resulting in a memory leak on probe failure or driver unbind."
},
{
"Commit": "ee8e41b5044f637d9f2dc160f9099a308ec65533",
"Fixed-by": "08aa19de72110df8ac10c9e67349dd884eeed41d",
"subsystem": "phy",
"problem_description": "The return value of devm_pm_runtime_enable() is ignored, potentially leaving the device in an inconsistent state if initialization fails."
},
{
"Commit": "94c358da3a0545205c6c6a50ae26141f1c73acfa",
"Fixed-by": "cabd25b57216ddc132efbcc31f972baa03aad15a",
"subsystem": "phy",
"problem_description": "An off-by-one error in the probe function allows the 'reg' index to equal the number of phys, potentially leading to out-of-bounds access."
},
{
"Commit": "891a96f65ac3b12883ddbc6d1a9adf6e54dc903c",
"Fixed-by": "1ca52c0983c34fca506921791202ed5bdafd5306",
"subsystem": "phy",
"problem_description": "Enabling runtime PM before setting driver data causes a NULL pointer dereference in the runtime suspend callback, and the driver fails to properly disable runtime PM on removal."
},
{
"Commit": "63c85ad0cd811ed43653a5e17b7c4172ad1bb023",
"Fixed-by": "8becf9179a4b45104a1701010ed666b55bf4b3a6",
"subsystem": "phy",
"problem_description": "The PCS_TX_SWING_FULL field in the PHY_CTRL5 register is not cleared before setting a new value, resulting in incorrect register configuration."
},
{
"Commit": "382b1e8f30f779af8d6d33268e53df7de579ef3c",
"Fixed-by": "2b742094582db365fe07021b0a9c5405f85049f9",
"subsystem": "kernfs",
"problem_description": "NULL pointer dereference in __kernfs_new_node() error path when attempting to free an unallocated kn->iattr."
},
{
"Commit": "3e082978c33151d576694deac8abde021ea669a8",
"Fixed-by": "e7a9f6600166efb889453c524eb644cb798acd22",
"subsystem": "usb",
"problem_description": "Lack of concurrency protection allows message length modifications during ongoing transactions, resulting in NULL pointer dereferences and boot failures."
},
{
"Commit": "14ad4c10d5bdd413ff9a914260e89b5f54b7a2c7",
"Fixed-by": "df3e3169303f7084db3990c999701934af0c04c0",
"subsystem": "usb",
"problem_description": "The commit is a fix that is no longer needed because the originally offending commit is being reverted."
},
{
"Commit": "5106dbab44fba8ec6dede3f4e75d17f5aa777ec8",
"Fixed-by": "0dc580d4a6518b539cbb2877dd9b283df14aac6f",
"subsystem": "usb",
"problem_description": "Deadlock during initialization caused by holding connector locks while enabling notifications"
},
{
"Commit": "73108aa90cbfc663649885a06fe5c1235307de1c",
"Fixed-by": "b4c61e542faf8c9131d69ecfc3ad6de96d1b2ab8",
"subsystem": "usb",
"problem_description": "The driver leaks the ISP1301 device reference on probe failure or unbind."
},
{
"Commit": "c84117912bddd9e5d87e68daf182410c98181407",
"Fixed-by": "b4b64fda4d30a83a7f00e92a0c8a1d47699609f3",
"subsystem": "usb",
"problem_description": "The isp1301_get_client() function fails to increment the reference count in non-OF configurations, causing a use-after-free when the caller subsequently releases the reference."
},
{
"Commit": "c84117912bddd9e5d87e68daf182410c98181407",
"Fixed-by": "782be79e4551550d7a82b1957fc0f7347e6d461f",
"subsystem": "usb",
"problem_description": "The clock is disabled in the error path before being enabled, causing a clock imbalance, and a redundant NULL check is performed on the I2C client."
},
{
"Commit": "c1b0bc2dabfa884dea49c02adaf3cd6b52b33d2f",
"Fixed-by": "5106dbab44fba8ec6dede3f4e75d17f5aa777ec8",
"subsystem": "usb",
"problem_description": "A connector change event can be missed if it occurs between reading the initial connector status and enabling notifications, causing the status to become unsynchronized."
},
{
"Commit": "955a48a5353f4fe009704a9a4272a3adf627cd35",
"Fixed-by": "0831269b5f71594882accfceb02638124f88955d",
"subsystem": "usb-storage",
"problem_description": "The previous commit inadvertently disabled necessary quirks for devices with bcdDevice versions lower than 0x0309."
},
{
"Commit": "342a93247e0837101f27bbcca26f402902df98dc",
"Fixed-by": "6402078bd9d1ed46e79465e1faaa42e3458f8a33",
"subsystem": "smc91x",
"problem_description": "The smc_special_trylock macro manually disables interrupts via local_irq_save, but on PREEMPT_RT kernels, smc_special_unlock (mapped to spin_unlock_irqrestore) fails to restore them because it ignores the flags argument."
},
{
"Commit": "0c4dcd602817502bb3dced7a834a13ef717d65a4",
"Fixed-by": "3d70e0fb0f289b0c778041c5bb04d099e1aa7c1c",
"subsystem": "RDMA",
"problem_description": "incorrect page size is used for PDE and PBL table allocations in bnxt_qplib_alloc_init_hwq"
},
{
"Commit": "e46e59b77a9e6f322ef1ad08a8874211f389cf47",
"Fixed-by": "393e132efcc5e3fc4ef2bd9bbed2a096096c9359",
"subsystem": "dt-bindings",
"problem_description": "The QCS8300 PCIe PHY binding incorrectly required the unused gcc_aux_clk."
},
{
"Commit": "b58f0f86fd6156d7b084257f5c91ceaf7d760927",
"Fixed-by": "49ccab4bedd4779899246107dc19fb01c5b6fea3",
"subsystem": "phy",
"problem_description": "The Type-C orientation switch registration is skipped when the Type-C driver is built as a module, causing orientation detection to fail."
},
{
"Commit": "d9a0788093565c300f7c8dd034dbfa6ac4da9aa6",
"Fixed-by": "00c22b1e84288bf0e17ab1e7e59d75237cf0d0dc",
"subsystem": "platform/x86/intel/pmt",
"problem_description": "Memory for the kobject is leaked because kobject_put() is not called if kobject_init_and_add() fails during feature discovery."
},
{
"Commit": "a0008a3658a34a54e77f2568bdaa2626233b1459",
"Fixed-by": "b94f11af9d9201426f4d6c8a753493fd58d6ac16",
"subsystem": "net",
"problem_description": "Linker errors occur when building the ngbevf driver due to a missing PHYLINK dependency."
},
{
"Commit": "2e64fe4624d19bc71212aae434c54874e5c49c5a",
"Fixed-by": "472c5dd6b95c02b3e5d7395acf542150e91165e7",
"subsystem": "selftests/net",
"problem_description": "The test fails with a false positive buffer overflow error when compiled with _FORTIFY_SOURCE=3, and the IFLA_IFNAME attribute was incorrectly sent without null termination."
},
{
"Commit": "4d12997a9bb3d217ad4b925ec3074ec89364bf95",
"Fixed-by": "12cab1191d9890097171156d06bfa8d31f1e39c8",
"subsystem": "net",
"problem_description": "The async_req structure and URB are leaked in async_set_registers() if usb_submit_urb() fails."
},
{
"Commit": "81236c74dba6f4966d76c471ef4434846c2fc05c",
"Fixed-by": "f0e5126f5e55d4939784ff61b0b7e9f9636d787d",
"subsystem": "selftests",
"problem_description": "The test case name is not visible to ksft_run because it is assigned inside the test function execution rather than during its creation."
},
{
"Commit": "8f90dc6e417a64144d06405ee0404965139c825a",
"Fixed-by": "d52668cac3f98f86aa1fb238dec1320c80fbefea",
"subsystem": "selftests",
"problem_description": "Templated test names in psp_ip_ver_test_builder are not visible to the test runner because the test_case.__name__ assignment occurs during test execution rather than at construction time."
},
{
"Commit": "fccc9d9233f918ee50cf2955ae7134a7f3418351",
"Fixed-by": "267ee93c417e685d9f8e079e41c70ba6ee4df5a5",
"subsystem": "serial",
"problem_description": "RTS line control is scheduled too early, potentially changing state before the hardware buffer is empty."
},
{
"Commit": "7cc0e0a43a91052477c2921f924a37d9c3891f0c",
"Fixed-by": "c3ca8a0aac832fe8047608bb2ae2cca314c6d717",
"subsystem": "serial",
"problem_description": "passing an invalid DMA cookie to dmaengine_tx_status leads to incorrect TX status reporting and long wait times when opening the device"
},
{
"Commit": "24ec03cc55126b7b3adf102f4b3d9f716532b329",
"Fixed-by": "f54151148b969fb4b62bec8093d255306d20df30",
"subsystem": "serial",
"problem_description": "The of_node_reused flag is inadvertently dropped during serial device initialization when restoring sysfs fwnode information."
},
{
"Commit": "945865a0ddf3e3950aea32e23e10d815ee9b21bc",
"Fixed-by": "e340663bbf2a75dae5d4fddf90b49281f5c9df3f",
"subsystem": "ALSA",
"problem_description": "TAS2563 devices fail to load firmware because the speaker_id defaults to 0 instead of -1, leading the driver to incorrectly attempt to load a non-existent firmware file with a '0' suffix."
},
{
"Commit": "74426fbff66eea8e8d1f42c8238c268d1e63a832",
"Fixed-by": "830988b6cf197e6dcffdfe2008c5738e6c6c3c0f",
"subsystem": "ALSA: ac97",
"problem_description": "double free in snd_ac97_controller_register() and memory leak in ac97_adapter_release()"
},
{
"Commit": "4f3b20bfbb75289c18729b6eb2da3f3c5e7f58b0",
"Fixed-by": "df60c332caf95d70f967aeace826e7e2f0847361",
"subsystem": "amd-xgbe",
"problem_description": "RX adaptation loops on an invalid configuration because the retry counter and mode flag are not properly reset."
},
{
"Commit": "acc43b7bf52a015221d989164c2600c1e1f28790",
"Fixed-by": "a9f96dc59b4a50ffbf86158f315e115969172d48",
"subsystem": "net",
"problem_description": "Missing put_device() in dsa_tree_find_first_conduit() results in a device reference count leak."
},
{
"Commit": "83c0afaec7b730b16c518aecc8e6246ec91b265e",
"Fixed-by": "06e219f6a706c367c93051f408ac61417643d2f9",
"subsystem": "net",
"problem_description": "The OF binding implementation leaks a kobject reference to the conduit device and fails to ensure the conduit net_device remains registered during use."
},
{
"Commit": "c5b3eb5a906c4777960050b9fece20a4722453b8",
"Fixed-by": "754c23238438600e9236719f7e67aff2c4d02093",
"subsystem": "drm/xe",
"problem_description": "Device memory allocation is not guaranteed to be idle before use during migration."
},
{
"Commit": "cc795e0410342076a4ad65ca2b5450cda779f784",
"Fixed-by": "d2d7f5636f0d752a1e0e7eadbbc1839c29177bba",
"subsystem": "drm/xe",
"problem_description": "Excessive logging occurs because drm_info is used instead of drm_dbg when a range is already in VRAM."
},
{
"Commit": "9cd451d414f6e29f507a216fb3b19fa68c011f8c",
"Fixed-by": "5e7365b5a1ac8f517a7a84442289d7de242deb76",
"subsystem": "net",
"problem_description": "Race condition where userspace configures a device before all sibling ports are initialized, leading to incorrect hardware configuration checks."
},
{
"Commit": "bb5e62f2d547c4de6d1b144cbce2373a76c33f18",
"Fixed-by": "35ddf66c65eff93fff91406756ba273600bf61a3",
"subsystem": "erspan",
"problem_description": "kernel panic occurs with FORTIFY_SOURCE because options_len is not initialized before writing to the options flexible array"
},
{
"Commit": "ae155060247be8dcae3802a95bd1bdf93ab3215d",
"Fixed-by": "86730ac255b0497a272704de9a1df559f5d6602e",
"subsystem": "mptcp",
"problem_description": "The subflow context is not properly reset during disconnect if the subflow is already in TCP_CLOSE status or has fallback to TCP, leading to warnings in subsequent connections."
},
{
"Commit": "23e89e8ee7be73e21200947885a6d3a109a2c58d",
"Fixed-by": "71154bbe49423128c1c8577b6576de1ed6836830",
"subsystem": "mptcp",
"problem_description": "A race condition during MPTCP simultaneous connection establishment leads to inconsistent fallback status and kernel warnings because the state change callback is not invoked when transitioning to TCP_FIN_WAIT1."
},
{
"Commit": "6c31ff366c1116823e77019bae3e92e9d77a49f4",
"Fixed-by": "932ac51d9953eaf77a1252f79b656d4ca86163c6",
"subsystem": "team",
"problem_description": "The function team_queue_override_port_prio_changed incorrectly proceeds for disabled ports, causing list corruption when attempting to remove them from the list."
},
{
"Commit": "950a81224e8bda92813c5ecf851f488c94f06aba",
"Fixed-by": "c31f4aa8fed048fa70e742c4bb49bb48dc489ab3",
"subsystem": "kunit",
"problem_description": "KUnit interrupt tests may fail if the main task finishes before interrupts execute, execution counters lack atomicity, and assertion messages are overly specific."
},
{
"Commit": "0a2319308de88b9e819c0b43d0fccd857123eb31",
"Fixed-by": "6c11aa2b4cf767f5ccfe290b2572d53102dbe5ea",
"subsystem": "ASoC",
"problem_description": "missing kerneldoc fields for the sun4i_spdif_quirks structure cause documentation build warnings"
},
{
"Commit": "35f0ce032b0f2d6974da516b5a113f49b7b70b09",
"Fixed-by": "15dd100349b8526cbdf2de0ce3e72e700eb6c208",
"subsystem": "platform/x86",
"problem_description": "The driver searches only the first quarter of the EBDA table for the signature due to incorrect pointer arithmetic in the search loop."
},
{
"Commit": "03696e51d75a3f23feb6b63dc6f3976a64c40b12",
"Fixed-by": "1461209cf813b6ee6d40f29b96b544587df6d2b1",
"subsystem": "platform/x86",
"problem_description": "The sysfs group msipf_old_attribute_group is created when old_ec_model is enabled but is never removed during driver cleanup."
},
{
"Commit": "423c3361855c1e81f1cb91728a2ac5ddfd2cbf16",
"Fixed-by": "f13bce715d1600698310a4a7832f6a52499d5395",
"subsystem": "platform/mellanox",
"problem_description": "Trailing whitespaces in event names prevent successful programming of counters when using those names."
},
{
"Commit": "2997876c4a1a5864baa13d7393c2b68cf5b51183",
"Fixed-by": "608328ba5b0619cbc28b409296b5e3840bcb97b6",
"subsystem": "powerpc",
"problem_description": "Delayed clearing of MSR[RI] inadvertently delayed the disabling of interrupts at interrupt/syscall exit."
},
{
"Commit": "db792e9adbf85ffc9d6b0b060ac3c8e3148c8992",
"Fixed-by": "ce652c98a7bfa0b7c675ef5cd85c44c186db96af",
"subsystem": "arm64: dts: rockchip",
"problem_description": "Redundant declaration of the max-link-speed property in the NanoPi R4S device tree."
},
{
"Commit": "755fff528b1b760c700dbf39928ff3dda825f748",
"Fixed-by": "0368e4afcf20f377c81fa77b1c7d0dee4a625a44",
"subsystem": "arm64: dts",
"problem_description": "The RK3399 PCIe core on the Helios64 board was configured with a dangerous 5.0 GT/s link speed which could lead to catastrophic failures."
},
{
"Commit": "a31dfc060a747f08705ace36d8de006bc13318fa",
"Fixed-by": "cd8967ea3105d30adb878a9fea0e34a9378df610",
"subsystem": "arm64: dts",
"problem_description": "The unit addresses for the RK3588 NPU IOMMU nodes (core 1 and 2) in the device tree incorrectly mismatched the addresses defined in their reg properties."
},
{
"Commit": "d7cdbbc93c564902169e854e78716a7b5e6cb241",
"Fixed-by": "87e7f6019097746d1d06f98874a9f179b7a68f3e",
"subsystem": "software node",
"problem_description": "The SOFTWARE_NODE_REFERENCE macro fails to support references to non-constant software nodes."
},
{
"Commit": "0ebc7feae79ac07772a20382eebd8c3503313714",
"Fixed-by": "b94b73567561642323617155bf4ee24ef0d258fe",
"subsystem": "powerpc",
"problem_description": "The shared font data pointer used for early boot text is not correctly relocated, causing a crash on Old World PowerMacs."
},
{
"Commit": "79f2a17024412fd6f62208ab3fd6814e52588a31",
"Fixed-by": "7c6bbcb010b1b8e4e6452de109f0506bb05d6efb",
"subsystem": "arm64: dts",
"problem_description": "The wifi interrupt flag was incorrectly configured with GPIO_ACTIVE_HIGH instead of IRQ_TYPE_LEVEL_HIGH on Sakura Pi RK3308B."
},
{
"Commit": "0f71dcfb4aef6043da6cc509e7a7f6a3ae87c12d",
"Fixed-by": "f1164534ad62f0cc247d99650b07bd59ad2a49fd",
"subsystem": "powerpc",
"problem_description": "The `set -o pipefail` shell option causes GCC check scripts to fail incorrectly when `grep -q` exits early, triggering a SIGPIPE in the compiler command."
},
{
"Commit": "38253464bc821d6de6bba81bb1412ebb36f6cbd1",
"Fixed-by": "c2296a1e42418556efbeb5636c4fa6aa6106713a",
"subsystem": "powerpc/kexec",
"problem_description": "kexec reboot triggers a warning when waking offline CPUs if SMT is disabled or partially enabled because add_cpu() fails for disallowed threads"
},
{
"Commit": "fe67b063f687d8f32c466778aad57508bc1c618a",
"Fixed-by": "dabac51b8102e1643d8e297a8e6948dab190aa4c",
"subsystem": "net/handshake",
"problem_description": "NULL pointer dereference in handshake_complete() when handshake_req_next() returns NULL because the code incorrectly falls through to the completion handler."
},
{
"Commit": "c12b395a46646bab69089ce7016ac78177f6001f",
"Fixed-by": "db5b4e39c4e63700c68a7e65fc4e1f1375273476",
"subsystem": "ipv6",
"problem_description": "The ip6gre_header() function crashes the kernel by attempting to push headers onto an skb without verifying that sufficient headroom is available."
},
{
"Commit": "b07c26511e94ab856f3700c56d582c0da36d5b4d",
"Fixed-by": "5498227676303e3ffa9a3a46214af96bc3e81314",
"subsystem": "openvswitch",
"problem_description": "Unnecessary RTNL lock acquisition during vport destruction causes contention and 'waiting for ... to become free' warnings."
},
{
"Commit": "98c485eaf509bc0e2a85f9b58d17cd501f274c4e",
"Fixed-by": "1e5a541420b8c6d87d88eb50b6b978cdeafee1c9",
"subsystem": "net",
"problem_description": "nvmem cell reference is not released if nvmem_cell_read() fails in mt798x_phy_calibration"
},
{
"Commit": "8cdc3f6c5d22dd059fe8127be7b5cae113e79afb",
"Fixed-by": "15ef641a0c6728d25a400df73922e80ab2cf029c",
"subsystem": "fjes",
"problem_description": "The fjes_hw_init function fails to unmap I/O memory on error paths, causing a resource leak."
},
{
"Commit": "f160e99462c68ab5b9e2b9097a4867459730b49a",
"Fixed-by": "d1a1a4bade4b20c0858d0b2f81d2611de055f675",
"subsystem": "net: mdio",
"problem_description": "The Aspeed MDIO controller may return stale data when a read operation follows immediately after a write due to a hardware bug."
},
{
"Commit": "98ffe02529117095fad0399ce16235d66b8b5f8d",
"Fixed-by": "9517d76dd160208b7a432301ce7bec8fc1ddc305",
"subsystem": "counter",
"problem_description": "The quad8_irq_handler function incorrectly returns negative error codes instead of proper irqreturn_t values when regmap operations fail."
},
{
"Commit": "a55ebd47f21f6f0472766fb52c973849e31d1466",
"Fixed-by": "23f9485510c338476b9735d516c1d4aacb810d46",
"subsystem": "counter",
"problem_description": "The `IRQF_NO_THREAD` flag causes invalid wait context warnings because the interrupt handler acquires a spinlock."
},
{
"Commit": "4f8ef33dd44a3d1136d3934609b8a43e62aaaa0d",
"Fixed-by": "870b10f61d527fec594e0888f18cc4f32c47433d",
"subsystem": "ASoC",
"problem_description": "The function is_sdca_endpoint_present performs a bogus NULL check on the result of dev_to_sdw_dev() which uses container_of() and cannot return NULL."
},
{
"Commit": "9be3ec196da41b20b624ae4ed0303df58548644e",
"Fixed-by": "61a50d6f58b41e8a7e68d8fc8fc6bfbe30d790d8",
"subsystem": "ASoC",
"problem_description": "The driver performs a bogus NULL check on the return value of dev_to_sdw_dev(), which uses container_of() and never returns NULL."
},
{
"Commit": "8ad5294849379543782e290e8e670b69e4580a24",
"Fixed-by": "54fa71f5f965fa3ec8846cef9d1154bcb2ba2850",
"subsystem": "ASoC",
"problem_description": "The return value of dev_to_sdw_dev() was checked for NULL, but it uses container_of() and can never be NULL."
},
{
"Commit": "ef56081d1864582a6db50710733416c0510b7826",
"Fixed-by": "9b68a1cc966bc947d00e4c0df7722d118125aa37",
"subsystem": "RDMA/bnxt_re",
"problem_description": "Fixes an out-of-bounds write in bnxt_re_copy_err_stats() caused by placing new hardware counters after the BNXT_RE_OUT_OF_SEQ_ERR boundary marker."
},
{
"Commit": "1ac5a404797523cedaf424a3aaa3cf8f9548dff8",
"Fixed-by": "f01765a2361323e78e3d91b1cb1d5527a83c5cf7",
"subsystem": "bnxt_re",
"problem_description": "IP checksum offload is not enabled when multiple send flags are present due to an incorrect exact match check."
},
{
"Commit": "83bfbd0bb9025f98fa62b44f93bd67466773d1db",
"Fixed-by": "3b9c30eb8f5aaad4a54cdfa470b74c0467cc71e8",
"subsystem": "smb/server",
"problem_description": "The minimum SMB1 PDU size check became incorrect after the RFC1002 header was removed from the `smb_hdr` structure."
},
{
"Commit": "83bfbd0bb9025f98fa62b44f93bd67466773d1db",
"Fixed-by": "0a70cac7896712a08e3cd22c16f44be976d40dbf",
"subsystem": "ksmbd",
"problem_description": "ksmbd fails to gracefully reject SMB1 protocol requests because it accesses incorrect packet offsets following the removal of the RFC1002 header from struct smb_hdr"
},
{
"Commit": "4b2b5e142ff499a2bef2b8db0272bbda1088a3fe",
"Fixed-by": "3fbd97618f49e07e05aad96510e5f2ed22d68809",
"subsystem": "drm/gem-shmem",
"problem_description": "The MODULE_LICENSE string 'GPL v2' is incorrect and should be 'GPL' to properly declare the module license."
},
{
"Commit": "e3f4bdaf2c5bfebcfb483a8caa1fb989ec042e5b",
"Fixed-by": "8f05e411aee3ce27ab7b790181cbac9eb81bfedc",
"subsystem": "drm",
"problem_description": "Fixes compile-time warnings by correcting the kernel-doc for drm_gem_shmem_init to properly describe the 'shmem' and 'size' parameters."
},
{
"Commit": "49d22b695cbb690b1d1a9d21b61eaf8f61a525d4",
"Fixed-by": "81d5a5366d3c20203fb9d7345e1aa46d668445a2",
"subsystem": "iio",
"problem_description": "Buffered data is converted to CPU endianness but declared as big-endian, causing incorrect values on little-endian architectures."
},
{
"Commit": "27e072bc34d12857cfd9f8a8424450c2aa6ecd47",
"Fixed-by": "943cbf906956a6c081636bec2458a31dbe482170",
"subsystem": "iio",
"problem_description": "the temperature offset reported by the inv_icm45600 driver is incorrect, leading to erroneous temperature values"
},
{
"Commit": "c6e126de43e7d4abfd6cf796b40589db3a046167",
"Fixed-by": "ea6b4feba85e996e840e0b661bc42793df6eb701",
"subsystem": "iio",
"problem_description": "Child devices are not created on driver rebind because the OF_POPULATED flag remains set after manual deregistration."
},
{
"Commit": "2349d2fa02db19ebc5e9033ddc3ed09e22c4abb5",
"Fixed-by": "4012d78562193ef5eb613bad4b0c0fa187637cfe",
"subsystem": "erofs",
"problem_description": "Incorrect error propagation causes synchronous reads to fail with EIO if a preceding readahead request in the same queue failed due to memory pressure."
},
{
"Commit": "bca51197620a257e2954be99b16f05115c3b2630",
"Fixed-by": "fa3c411d21ebc26ffd175c7256c37cefa35020aa",
"subsystem": "RDMA",
"problem_description": "Device reference count is not released in ib_del_sub_device_and_put() when returning -EOPNOTSUPP."
},
{
"Commit": "4177381b440130ccb686712aaa09b45539114698",
"Fixed-by": "441ac29923c9172bc5e4b2c4f52ae756192f5715",
"subsystem": "iio",
"problem_description": "The AD5695R chip info was missing from the ad5686_chip_info_tbl, causing the device to initialize with no channels."
},
{
"Commit": "df36de13677a0ebd3ab31dd2c603f9eafdf8de7d",
"Fixed-by": "4ff39d6de4bf359ec6d5cd2be34b36d077dd0a07",
"subsystem": "iio",
"problem_description": "The driver incorrectly treats a valid positive interrupt number as an error due to a reversed condition check, and the error message is missing a trailing newline."
},
{
"Commit": "b5969abfa8b8ed43ebd93479d394f664bd4a5a87",
"Fixed-by": "c34e2e2d67b3bb8d5a6d09b0d6dac845cdd13fb3",
"subsystem": "iio",
"problem_description": "A NULL pointer dereference occurs when userspace attempts to configure accelerometer wakeup events on sensors that do not support event detection, such as the LSM6DS0."
},
{
"Commit": "0fb528c8255bd2de6a2fba26ed28d75a7f0cb630",
"Fixed-by": "da934ef0fdff5ba21e82ec3ab3f95fe73137b0c9",
"subsystem": "iio: adc",
"problem_description": "The return value of the clamp() macro is ignored, resulting in the curr_energy variable not being clamped to the specified range."
},
{
"Commit": "4606d0f4b05faad88fdf8472d7b2f0d600546f5e",
"Fixed-by": "92452b1760ff2d1d411414965d4d06f75e1bda9a",
"subsystem": "iio",
"problem_description": "The AD9434 ADC voltage reference (VREF) mask is defined incorrectly due to a copy-paste error."
},
{
"Commit": "849cebf8dc670947e7aafc9a8fcfb3f69793837e",
"Fixed-by": "c5512e016817a150fd6de97fbb3e74aa799ea3c1",
"subsystem": "iio",
"problem_description": "The return variable `ret` is declared as `unsigned int` instead of `int`, preventing the detection of negative error codes."
},
{
"Commit": "2051f25d2a26573918b59d69847f5bf77635023e",
"Fixed-by": "6b39824ac4c15783787e6434449772bfb2e31214",
"subsystem": "iio",
"problem_description": "The probe function in the ad7280a driver ignored the return value of spi_setup, leaving SPI configuration failures undetected."
},
{
"Commit": "23ec2774f1cc168b1f32a2e0ed2709cb473bb94e",
"Fixed-by": "dbdb442218cd9d613adeab31a88ac973f22c4873",
"subsystem": "iio",
"problem_description": "A use-after-free occurs in the at91-sama5d2_adc driver when the touchscreen workqueue accesses the IIO device after it has been unregistered during driver removal."
},
{
"Commit": "80a85a771deb113cfe2e295fb9e84467a43ebfe4",
"Fixed-by": "de41cbc64d02ae85d56078764616b6ba75a55a48",
"subsystem": "RDMA",
"problem_description": "The rdma_rxe module cannot be unloaded because socket reclassification acquires a reference to the module that is never released."
},
{
"Commit": "a30fa812222278ba8484f1817ea772960e3038c3",
"Fixed-by": "17753d1755a589659433ff4ead595f2bb7f695a8",
"subsystem": "ALSA",
"problem_description": "The PCI SSID for the HP Abe A6U laptop was incorrectly specified as 0x8eb7 instead of 0x8ee7, preventing the mute/micmute LED quirk from functioning on that device."
},
{
"Commit": "cee0c7bba4869170fd471758053406784eba35a5",
"Fixed-by": "145a417a39d7efbc881f52e829817376972b278c",
"subsystem": "RDMA",
"problem_description": "The driver fails to detect unassigned BAR regions because it checks the non-zero BAR ID constant instead of the BAR base address."
},
{
"Commit": "1c15b4f2a42ff6697767c22c8ff5f9bcc22fdbe5",
"Fixed-by": "8aaa848eaddd9ef8680fc6aafbd3a0646da5df40",
"subsystem": "RDMA",
"problem_description": "The logic in ib_get_gids_from_rdma_hdr() incorrectly treats the constant RDMA_NETWORK_ROCE_V1 as a boolean truthy value instead of comparing it against the net_type variable, causing the condition to always evaluate to true."
},
{
"Commit": "c9b5645fd8ca10f310e41b07540f98e6a9720f40",
"Fixed-by": "1ddb815fdfd45613c32e9bd1f7137428f298e541",
"subsystem": "block",
"problem_description": "the unsigned clt_device_id variable prevents proper error checking of ida_alloc_max return values, treating negative error codes as large positive integers"
},
{
"Commit": "e63d2228ef831af36f963b3ab8604160cfff84c1",
"Fixed-by": "daa24603d9f0808929514ee62ced30052ca7221c",
"subsystem": "block",
"problem_description": "Leaked reference counts for UBLK_F_USER_COPY requests during server exit trigger warnings and allow invalid data copy operations on completed requests."
},
{
"Commit": "1590700d94ac53772491ed3103a4e8b8de01640a",
"Fixed-by": "560271e10b2c86e95ea35afa9e79822e4847f07a",
"subsystem": "drm/nouveau",
"problem_description": "The prepare_fb callback incorrectly calls drm_atomic_get_crtc_state(), triggering a warning because it runs after the atomic check phase."
},
{
"Commit": "91389b4e3263eaa8549f20d73beeed77f5616f4c",
"Fixed-by": "d2b6e710d2706c8915fe5e2f961c3365976d2ae1",
"subsystem": "drm/msm",
"problem_description": "The GEN7_GRAS_NC_MODE_CNTL register was incorrectly programmed for only the BR pipe instead of both BR and BV pipes."
},
{
"Commit": "a6a0157cc68ec561392fc81f603b5b9de1a20e4e",
"Fixed-by": "6c6915bfea212d32844b2b7f22bc1aa3669eabc4",
"subsystem": "drm/msm",
"problem_description": "The PERFCTR_CNTL register resets to zero after Inter-Frame Power Collapse (IFPC), breaking performance counters."
},
{
"Commit": "50117cad0c50410cff0d43a1141a562b1347e7c5",
"Fixed-by": "ef3b04091fd8bc737dc45312375df8625b8318e2",
"subsystem": "drm/msm",
"problem_description": "Dereferencing the preempt_postamble_ptr in preempt_prepare_postamble before checking for allocation failure causes a crash."
},
{
"Commit": "a6a0157cc68ec561392fc81f603b5b9de1a20e4e",
"Fixed-by": "129049d4fe22c998ae9fd1ec479fbb4ed5338c15",
"subsystem": "drm/msm",
"problem_description": "A NULL pointer dereference occurs in a7xx_patch_pwrup_reglist on a7xx GPUs that do not support IFPC because ifpc_reglist is accessed without a validity check."
},
{
"Commit": "98921dbd00c4e2e4bdd56423cb5edf98d57b45f7",
"Fixed-by": "252714f1e8bdd542025b16321c790458014d6880",
"subsystem": "bluetooth",
"problem_description": "Using devm_kzalloc ties the driver data lifetime to the primary interface, leading to a use-after-free when that interface is unbound while secondary interfaces are still active."
},
{
"Commit": "ae75336131337f926d61b7fd86a0cca3146a7620",
"Fixed-by": "348240e5fa901d3d4ba8dffa0e2ba9fc7aba93ab",
"subsystem": "Bluetooth",
"problem_description": "MGMT_SETTING_ISO_BROADCASTER and MGMT_SETTING_ISO_RECEIVER flags are missing from supported_settings despite being present in current_settings"
},
{
"Commit": "cbc29538dbf7d7400f1ffc5dd5713e6a551463a0",
"Fixed-by": "b3db91c3bfea69a6c6258fea508f25a59c0feb1a",
"subsystem": "hwmon",
"problem_description": "reset_history attributes are incorrectly reported as readable"
},
{
"Commit": "833d2b3a072f7ff6005bf84c065c7cbda81a8aaa",
"Fixed-by": "d412ff9e26ebf433672ba0ff649c308b1fea2a12",
"subsystem": "debugfs",
"problem_description": "memory leak of new_name in debugfs_change_name() when lookup_noperm_unlocked() fails"
},
{
"Commit": "4c8ff61199a70e73e6c4d5e8a03f02d32730821c",
"Fixed-by": "ce7b1d58609abc2941a1f38094147f439fb74233",
"subsystem": "arm64: dts: mediatek",
"problem_description": "the mt8395-radxa DT overlay is not applied to the base DTB at build time, preventing validation"
},
{
"Commit": "a58c368067417f3d89b92ccc18fa0bb610b34349",
"Fixed-by": "987697749def9c5e10d9a2d992f012db61ae1967",
"subsystem": "arm64: dts: mediatek",
"problem_description": "The build system does not generate full Device Tree Binaries (DTBs) with applied overlays."
},
{
"Commit": "eb972eab0794dedeef5b3b1845e5f9a78793f184",
"Fixed-by": "f4ea8e05f2a857d5447c25f7daf00807d38b307d",
"subsystem": "lkdtm",
"problem_description": "Empty busy wait loops in hardirq test functions cause objtool warnings regarding unexpected section ends when building with Clang on x86_64."
},
{
"Commit": "96ddf2ef58ec070afa8275f371b619462cd8fb2c",
"Fixed-by": "7f2e8e1d22f6e28edff3782535c16cfbace30902",
"subsystem": "parisc",
"problem_description": "On 32-bit systems, the I/O PDIR validity bit is truncated when stored in a 32-bit `phys_addr_t` variable, causing block device driver failures."
},
{
"Commit": "22da60f0304b6bfd2c7cba8ee88086f344ef5206",
"Fixed-by": "f39006965dd37e7be823dba6ca484adccc7a4dff",
"subsystem": "hid",
"problem_description": "The driver reads from an incorrect register when configuring the max input size and interrupt delay."
},
{
"Commit": "a688404b2e20f00cce6d0a2b888ef4ca9154e144",
"Fixed-by": "0e13150c1a13a3a3d6184c24bfd080d5999945d1",
"subsystem": "hid",
"problem_description": "dma_unmap_sg() is called with the return value of dma_map_sg() instead of the original number of entries"
},
{
"Commit": "38e5f33ee3596f37ee8d1e694073a17590904004",
"Fixed-by": "c2e8dc1222c2136e714d5d972dce7e64924e4ed8",
"subsystem": "iommu/amd",
"problem_description": "Domain IDs in the reused device table are not reserved in the kdump kernel, leading to potential ID reallocation and IO_PAGE_FAULTs."
},
{
"Commit": "0ac2a08f42ce5c06d5d1216eac59c046961acd4f",
"Fixed-by": "a305df4125d17f23d3ce777bb1af9f9bba05efb1",
"subsystem": "interconnect",
"problem_description": "The header file include/linux/interconnect-clk.h was missing from the MAINTAINERS file."
},
{
"Commit": "8a55fbe4c94db5f86e2dce9caa72eeb2233e0a02",
"Fixed-by": "472100721b4b1d357e99512306ba7dda7bddad6f",
"subsystem": "interconnect",
"problem_description": "The 'reg' and 'clocks' properties were incorrectly allowed for all sa8775p interconnect nodes, even though they are only valid for the specific nodes that support QoS."
},
{
"Commit": "f5a332980a6877c79863fbf5c16ae86555627ba6",
"Fixed-by": "b74fd80d7fe578898a76344064d2678ce1efda61",
"subsystem": "crypto",
"problem_description": "interrupts are not processed in qm_get_complete_eqe_num() due to an incorrect loop condition"
},
{
"Commit": "0a270321dbf948963aeb0e8382fe17d2c2eb3771",
"Fixed-by": "50fdb78b7c0bcc550910ef69c0984e751cac72fa",
"subsystem": "crypto",
"problem_description": "dereferencing req->iv after crypto_aead_encrypt returns is invalid because the request may be freed by asynchronous completion"
},
{
"Commit": "bb76dc09ddfc135c6c5e8eb7d3c583bfa8bdd439",
"Fixed-by": "248d3a73a0167dce15ba100477c3e778c4787178",
"subsystem": "input",
"problem_description": "An off-by-one error in the wire_order validation check allows an out-of-bounds access to the config_pins array."
},
{
"Commit": "471a92f8a21a0e0219e254df7b07133b4f121f33",
"Fixed-by": "d579478cee228bdc0029a0c12a1f6a63ea9d1c77",
"subsystem": "input",
"problem_description": "The apple_z2 driver incorrectly interprets non-touch data as touch reports when the controller sends a premature boot interrupt."
},
{
"Commit": "04aae283ba6a8cd4851d937bf9c6d6ef0361d794",
"Fixed-by": "bf40644ef8c8a288742fa45580897ed0e0289474",
"subsystem": "input",
"problem_description": "A race condition allows the dev3_register_work delayed work to execute after the driver data structure has been freed during device disconnection, causing a use-after-free."
},
{
"Commit": "9cf6e24c9fbf17e52de9fff07f12be7565ea6d61",
"Fixed-by": "2aaf33c6e1e82561d7dce2345298a985a2483266",
"subsystem": "Input",
"problem_description": "The internal keyboard on HONOR FMB-P laptops stops working because atkbd_deactivate() is incorrectly called during initialization."
},
{
"Commit": "7d138cb269dbd2fa9b0da89a9c10503d1cf269d5",
"Fixed-by": "1107aac1ad7f445a83604b14af7be47f1a795c66",
"subsystem": "firewire",
"problem_description": "The topology map generation field is incorrectly calculated because the buffer holding the previous generation is cleared via memset before the value is read."
},
{
"Commit": "78524b05f1a3e16a5d00cc9c6259c41a9d6003ce",
"Fixed-by": "1c2a936edd71e133f2806e68324ec81a4eb07588",
"subsystem": "mm",
"problem_description": "VMA readahead may trigger a Use-After-Free (UAF) when processing swap entries from a device other than the target entry's device without holding a reference"
},
{
"Commit": "42187bdc3ca45435bec96c66a90276315b2db1cb",
"Fixed-by": "216158f063fe24fb003bd7da0cd92cd6e2c4d48b",
"subsystem": "selftests/user_events",
"problem_description": "Taking the address of the packed member write_index triggers a -Waddress-of-packed-member compiler warning due to potential unaligned pointer access."
},
{
"Commit": "b753522bed0b7e388a643f58d91bd81d8849ba43",
"Fixed-by": "a26ec8f3d4e56d4a7ffa301e8032dca9df0bbc05",
"subsystem": "kho",
"problem_description": "The KHO test module accesses uninitialized internal data structures because it fails to check if KHO is enabled before issuing commands."
},
{
"Commit": "58729c04cf1092b87aeef0bf0998c9e2e4771133",
"Fixed-by": "f1d47cafe513b5552a5b20a7af0936d9070a8a78",
"subsystem": "mm",
"problem_description": "Splitting anonymous folios in swapcache to non-zero orders causes data corruption because swapcache only supports PMD order and order-0 entries."
},
{
"Commit": "16c6006af4d4e70ecef93977a5314409d931020b",
"Fixed-by": "00fbff75c5acb4755f06f08bd1071879c63940c5",
"subsystem": "kexec",
"problem_description": "Shrinking the crash kernel memory incorrectly updates the global crashk_res resource instead of the specific resource being shrunk, leading to corruption when modifying low memory reservations."
},
{
"Commit": "7b4f21f5e0386dfe02c68c009294d8f26e3c1bad",
"Fixed-by": "39231e8d6ba7f794b566fd91ebd88c0834a23b98",
"subsystem": "mm",
"problem_description": "The `MAX_FOLIO_ORDER` limit is too low on some PowerPC configurations, causing `hugetlb_add_hstate` to falsely warn about unreasonable folio sizes when registering gigantic pages."
},
{
"Commit": "fc33e4b44b2717feba2f6f07ce7943a96499c9ec",
"Fixed-by": "b05addf6f0596edb1f82ab4059438c7ef2d2686d",
"subsystem": "kexec",
"problem_description": "Attempting to unpreserve a memory range that was not previously preserved causes a soft lockup due to an infinite loop."
},
{
"Commit": "a667300bd53f272a3055238bcefe108f88836270",
"Fixed-by": "7ecd2e439d1272ac02d798b0033a426e3b00dff5",
"subsystem": "kho",
"problem_description": "higher-order vmalloc pages are leaked during unpreservation because the logic assumes order-0 pages"
},
{
"Commit": "a667300bd53f272a3055238bcefe108f88836270",
"Fixed-by": "0b07092d09e54e49b85379a9c60f82d54a881514",
"subsystem": "kho",
"problem_description": "Out-of-bounds memory access occurs when iterating over a full vmalloc chunk because the loops fail to check array bounds."
},
{
"Commit": "1507f51255c9ff07d75909a84e7c0d7f3c4b2f49",
"Fixed-by": "6f86d0534fddfbd08687fa0f01479d4226bc3c3d",
"subsystem": "mm",
"problem_description": "A race condition in the secretmem fault handler frees a page before restoring it to the direct map, which can result in a supervisor not-present page fault if the page is immediately reallocated."
},
{
"Commit": "d82d09e482199e6bbc204df10b2082f764cbe1f4",
"Fixed-by": "adfb6609c6809e107ded9a1cd46f519c882e64ea",
"subsystem": "mm",
"problem_description": "MTE tags of the huge zero folio are uninitialized on arm64, and accessing the folio triggers a spurious warning."
},
{
"Commit": "3f66cc261ccb54a8e4d8d5aa51c389c19453b00c",
"Fixed-by": "9a6b60cb147d53968753a34805211d2e5e08c027",
"subsystem": "nilfs2",
"problem_description": "sc_timer is not shutdown before freeing the nilfs_sc_info struct if kthread_stop fails to stop the log writer thread."
}
]