[continued from previous message] 
  
      - wifi: cfg80211: fix use-after-free in cmp_bss() 
      - wifi: brcmfmac: fix use-after-free when rescheduling 
 brcmf_btcoex_info 
        work 
      - wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() 
      - wifi: mt76: prevent non-offchannel mgmt tx during scan/roc 
      - wifi: mt76: free pending offchannel tx frames on wcid cleanup 
      - wifi: mt76: fix linked list corruption 
      - netfilter: br_netfilter: do not check confirmed bit in 
 br_nf_local_in() 
        after confirm 
      - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY 
      - wifi: iwlwifi: uefi: check DSM item validity 
      - Bluetooth: vhci: Prevent use-after-free by removing debugfs files 
 early 
      - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() 
      - netfilter: nft_flowtable.sh: re-run with random mtu sizes 
      - net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y 
      - [amd64] xirc2ps_cs: fix register access when enabling FullDuplex 
      - mISDN: Fix memory leak in dsp_hwec_enable() 
      - bnxt_en: fix incorrect page count in RX aggr ring log 
      - icmp: fix icmp_ndo_send address translation for reply direction 
      - net: macb: Fix tx_ptr_lock locking 
      - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint 
      - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() 
      - net: mctp: mctp_fraq_queue should take ownership of passed skb 
      - ice: fix NULL access of tx->in_use in ice_ll_ts_intr 
      - [amd64,arm64] idpf: set mac type when adding and removing MAC filters 
      - i40e: remove read access to debugfs files 
      - i40e: Fix potential invalid access when MAC list is empty 
      - ixgbe: fix incorrect map used in eee linkmode 
      - wifi: ath11k: fix group data packet drops during rekey 
      - net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 
      - [arm64] net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets 
      - net: skb: add pskb_network_may_pull_reason() helper 
      - net: tunnel: add pskb_inet_may_pull_reason() helper 
      - net: vxlan: add skb drop reasons to vxlan_rcv() 
      - net: vxlan: make vxlan_snoop() return drop reasons 
      - vxlan: Fix NPD when refreshing an FDB entry with a nexthop object 
      - net: vxlan: make vxlan_set_mac() return drop reasons 
      - net: vxlan: use kfree_skb_reason() in vxlan_xmit() 
      - net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() 
      - net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE 
      - vxlan: Refresh FDB 'updated' time upon 'NTF_USE' 
      - vxlan: Avoid unnecessary updates to FDB 'used' time 
      - vxlan: Add RCU read-side critical sections in the Tx path 
      - vxlan: Rename FDB Tx lookup function 
      - vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects 
      - wifi: cw1200: cap SSID length in cw1200_do_join() 
      - wifi: libertas: cap SSID len in lbs_associate() 
      - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() 
      - [arm64] net: thunder_bgx: add a missing of_node_put 
      - [arm64] net: thunder_bgx: decrement cleanup index before use 
      - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() 
      - net/smc: Remove validation of reserved bits in CLC Decline message 
      - mctp: return -ENOPROTOOPT for unknown getsockopt options 
      - ax25: properly unshare skbs in ax25_kiss_rcv() 
      - net: atm: fix memory leak in atm_register_sysfs when device_register 
 fail 
      - ppp: fix memory leak in pad_compress_skb 
      - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock 
      - ALSA: usb-audio: Add mute TLV for playback volumes on some devices 
      - [amd64] accel/ivpu: Prevent recovery work from being queued during 
 device 
        removal 
      - ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() 
      - [arm64] ftrace: fix unreachable PLT for ftrace_caller in init_module 
 with 
        CONFIG_DYNAMIC_FTRACE 
      - pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() 
      - io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU 
        (CVE-2025-38453) 
      - [amd64] x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and 
        arch_sync_kernel_mappings() 
      - mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE 
      - mm: move page table sync declarations to linux/pgtable.h 
      - mm: fix possible deadlock in kmemleak 
      - mm: slub: avoid wake up kswapd in set_track_prepare 
      - sched: Fix sched_numa_find_nth_cpu() if mask offline 
      - ocfs2: prevent release journal inode after journal shutdown 
      - of_numa: fix uninitialized memory nodes causing kernel panic 
      - [arm64] soc: qcom: mdt_loader: Deal with zero e_shentsize 
      - wifi: mwifiex: Initialize the chan_stats array to zero 
      - wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete 
      - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() 
      - wifi: mt76: mt7925: fix the wrong bss cleanup for SAP 
      - net: ethernet: oa_tc6: Handle failure of spi_setup 
      - drm/amdgpu: drop hw access in non-DC audio fini 
      - drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG 
      - [amd64] platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 
 8042 
        quirks list 
      - scsi: lpfc: Fix buffer free/clear order in deferred receive path 
      - batman-adv: fix OOB read/write in network-coding decode 
      - cifs: prevent NULL pointer dereference in UTF16 conversion 
      - e1000e: fix heap overflow in e1000_set_eeprom 
      - net: pcs: rzn1-miic: Correct MODCTRL register offset 
      - fs/fhandle.c: fix a race in call of has_locked_children() 
 (CVE-2025-38306) 
      - [arm64,armhf] net: dsa: add hook to determine whether EEE is 
 supported 
      - [arm64,armhf] net: dsa: provide implementation of .support_eee() 
      - [armhf] net: dsa: b53/bcm_sf2: implement .support_eee() method 
      - [armhf] net: dsa: b53: do not enable EEE on bcm63xx (CVE-2025-38272) 
      - md/raid1,raid10: don't ignore IO flags (CVE-2025-22125) 
      - md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT 
      - md/raid1,raid10: strip REQ_NOWAIT from member bios 
      - ext4: define ext4_journal_destroy wrapper 
      - ext4: avoid journaling sb update on error if journal is destroying 
        (CVE-2025-22113) 
      - wifi: ath11k: update channel list in reg notifier instead reg worker 
        (CVE-2025-23133) 
      - wifi: ath11k: update channel list in worker when wait flag is set 
      - net: fix NULL pointer dereference in l3mdev_l3_rcv (CVE-2025-22103) 
      - md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb 
        (CVE-2025-22124) 
      - mm: slub: Print the broken data before restoring them 
      - mm: slub: call WARN() when detecting a slab corruption 
      - mm, slab: cleanup slab_bug() parameters 
      - mm/slub: avoid accessing metadata when pointer is invalid in 
 object_err() 
      - nouveau: fix disabling the nonstall irq due to storm code 
      - mm: fix accounting of memmap pages 
      - [arm64] thermal/drivers/mediatek/lvts: Disable low offset IRQ for 
 minimum 
        threshold 
      - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model 
      - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY 
      - Revert "drm/amdgpu: Avoid extra evict-restore process." 
      - pcmcia: omap: Add missing check for platform_get_resource 
      - pcmcia: Add error handling for add_interval() in do_validate_mem() 
  
 [continued in next message] 
  
 --- SoupGate-Win32 v1.05 
  * Origin: you cannot sedate... all the things you hate (1:229/2)