[continued from previous message] 
  
      - Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION 
      - ice: create new Tx scheduler nodes for new queues only 
      - ice: fix rebuilding the Tx scheduler tree for large queue counts 
      - [armhf] net: dsa: tag_brcm: legacy: fix pskb_may_pull length 
      - net: stmmac: make sure that ptp_rate is not 0 before configuring 
        timestamping 
      - net: fix udp gso skb_segment after pull from frag_list 
      - vmxnet3: correctly report gso type for UDP tunnels 
      - PM: sleep: Fix power.is_suspended cleanup for direct-complete devices 
      - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO 
      - netfilter: nf_set_pipapo_avx2: fix initial map fill 
      - wireguard: device: enable threaded NAPI 
      - seg6: Fix validation of nexthop addresses 
      - fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) 
      - do_change_type(): refuse to operate on unmounted/not ours mounts 
      - xfs: fix interval filtering in multi-step fsmap queries 
      - xfs: fix integer overflows in the fsmap rtbitmap and logdev backends 
      - xfs: fix getfsmap reporting past the last rt extent 
      - xfs: clean up the rtbitmap fsmap backend 
      - xfs: fix logdev fsmap query result filtering 
      - xfs: validate fsmap offsets specified in the query keys 
      - xfs: fix xfs_btree_query_range callers to initialize btree rec fully 
      - xfs: fix an agbno overflow in __xfs_getfsmap_datadev 
      - xfs: fix the contact address for the sysfs ABI documentation 
      - xfs: verify buffer, inode, and dquot items every tx commit 
      - xfs: use consistent uid/gid when grabbing dquots for inodes 
      - xfs: declare xfs_file.c symbols in xfs_file.h 
      - xfs: create a new helper to return a file's allocation unit 
      - xfs: Fix xfs_flush_unmap_range() range for RT 
      - xfs: Fix xfs_prepare_shift() range for RT 
      - xfs: don't walk off the end of a directory data block (CVE-2024- 
 41013) 
      - xfs: remove unused parameter in macro XFS_DQUOT_LOGRES 
      - xfs: attr forks require attr, not attr2 
      - xfs: conditionally allow FS_XFLAG_REALTIME changes if S_DAX is set 
      - xfs: Fix the owner setting issue for rmap query in xfs fsmap 
      - xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code 
      - xfs: take m_growlock when running growfsrt 
      - xfs: reset rootdir extent size hint after growfsrt 
      - pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() 
      - Input: synaptics-rmi - fix crash with unsupported versions of F34 
      - [arm64] serial: sh-sci: Check if TX data was written to device in 
        .tx_empty() 
      - [arm64] serial: sh-sci: Move runtime PM enable to sci_probe_single() 
      - [arm64] serial: sh-sci: Clean sci_ports[0] after at earlycon exit 
      - scsi: core: ufs: Fix a hang in the error handler 
      - Bluetooth: hci_core: fix list_for_each_entry_rcu usage 
      - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete 
      - ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() 
      - ath10k: snoc: fix unbalanced IRQ enable in crash recovery 
      - wifi: ath11k: remove unused function ath11k_tm_event_wmi() 
      - wifi: ath11k: fix soc_dp_stats debugfs file permission 
      - wifi: ath11k: convert timeouts to secs_to_jiffies() 
      - wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request() 
      - wifi: ath11k: don't use static variables in 
        ath11k_debugfs_fw_stats_process() 
      - wifi: ath11k: don't wait when there is no vdev started 
      - wifi: ath11k: validate ath11k_crypto_mode on top of 
        ath11k_core_qmi_firmware_ready 
      - regulator: max20086: Fix refcount leak in ma 
 x20086_parse_regulators_dt() 
      - pinctrl: qcom: pinctrl-qcm2290: Add missing pins 
      - scsi: iscsi: Fix incorrect error path labels for flashnode operations 
      - net_sched: sch_sfq: fix a potential crash on gso_skb handling 
      - [powerpc*] powernv/memtrace: Fix out of bounds issue in memtrace mmap 
        (CVE-2025-38088) 
      - [powerpc*] vas: Return -EINVAL if the offset is non-zero in mmap() 
      - [arm64] drm/meson: use unsigned long long / Hz for frequency types 
      - [arm64] drm/meson: fix debug log statement when setting the HDMI 
 clocks 
      - [arm64] drm/meson: use vclk_freq instead of pixel_freq in debug print 
      - [arm64] drm/meson: fix more rounding issues with 59.94Hz modes 
      - i40e: return false from i40e_reset_vf if reset is in progress 
      - i40e: retry VFLR handling if there is ongoing VF reset 
      - ACPI: CPPC: Fix NULL pointer dereference when nosmp is used 
      - net: Fix TOCTOU issue in sk_is_readable() 
      - macsec: MACsec SCI assignment for ES = 0 
      - net: mdio: C22 is now optional, EOPNOTSUPP if not provided 
      - net/mdiobus: Fix potential out-of-bounds read/write access 
      - Bluetooth: Fix NULL pointer deference on eir_get_service_data 
      - Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance 
      - Bluetooth: MGMT: Fix sparse errors 
      - net/mlx5: Ensure fw pages are always allocated on same NUMA 
      - net/mlx5: Fix return value when searching for existing flow group 
      - net/mlx5e: Fix leak of Geneve TLV option object 
      - net_sched: prio: fix a race in prio_tune() (CVE-2025-38083) 
      - net_sched: red: fix a race in __red_change() 
      - net_sched: tbf: fix a race in tbf_change() 
      - net_sched: ets: fix a race in ets_qdisc_change() 
      - fs/filesystems: Fix potential unsigned integer underflow in fs_name() 
      - nvmet-fcloop: access fcpreq only when holding reqlock 
      - perf: Ensure bpf_perf_link path is properly serialized 
      - bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP 
      - tools/resolve_btfids: Fix build when cross compiling kernel with 
 clang. 
      - ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 
      - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() 
      - Revert "io_uring: ensure deferred completions are posted for 
 multishot" 
      - posix-cpu-timers: fix race between handle_posix_cpu_timers() and 
        posix_cpu_timer_del() 
      - drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang 
      - kbuild: Add KBUILD_CPPFLAGS to as-option invocation 
      - usb: usbtmc: Fix read_stb function and get_stb ioctl 
      - VMCI: fix race between vmci_host_setup_notify and 
 vmci_ctx_unset_notify 
      - usb: Flush altsetting 0 endpoints before reinitializating them after 
        reset. 
      - usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() 
      - [arm64] xen/arm: call uaccess_ttbr0_enable for dm_op hypercall 
      - [x86] iopl: Cure TIF_IO_BITMAP inconsistencies 
      - calipso: unlock rcu before returning -EAFNOSUPPORT 
      - net: usb: aqc111: debug info before sanitation 
      - [arm64] drm/meson: Use 1000ULL when operating with mode->clock 
      - configfs: Do not override creating attribute file failure in 
        populate_attrs() 
      - crypto: marvell/cesa - Do not chain submitted requests 
      - gfs2: move msleep to sleepable context 
      - [arm64,armhf] ASoC: meson: meson-card-utils: use 
 of_property_present() 
 for 
        DT parsing 
      - io_uring: account drain memory to cgroup 
      - [powerpc*] pseries/msi: Avoid reading PCI device registers in reduced 
        power states 
      - regulator: max20086: Fix MAX200086 chip id 
      - regulator: max20086: Change enable gpio to optional 
      - net/mlx5_core: Add error handling inmlx5_query_nic_vport_ 
 key_viol_cntr() 
  
 [continued in next message] 
  
 --- SoupGate-Win32 v1.05 
  * Origin: you cannot sedate... all the things you hate (1:229/2)