linux-signed-arm64 (6.12.57+1) trixie; urgency=medium

  * Sign kernel from linux 6.12.57-1

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.49
    - wifi: wilc1000: avoid buffer overflow in WID string configuration
    - nvme: fix PI insert on write
    - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not
      supported
    - wifi: mac80211: increase scan_ies_len for S1G
    - wifi: mac80211: fix incorrect type for ret
    - cgroup: split cgroup_destroy_wq into 3 workqueues
    - btrfs: fix invalid extref key setup when replaying dentry
    - net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR
    - qed: Don't collect too many protection override GRC elements
    - bonding: set random address only when slaves already exist
    - mptcp: set remote_deny_join_id0 on SYN recv
    - mptcp: tfo: record 'deny join id0' info
    - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
    - ice: store max_frame and rx_buf_len only in ice_rx_ring
    - ice: fix Rx page leak on multi-buffer frames
    - i40e: remove redundant memory barrier when cleaning Tx descs
    - igc: don't fail igc_probe() on LED setup error
    - net/mlx5e: Harden uplink netdev access against device unbind
    - bonding: don't set oif to bond dev when getting NS target destination
    - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
    - tls: make sure to abort the stream if headers are bogus
    - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
    - net: liquidio: fix overflow in octeon_init_instr_queue()
    - cnic: Fix use-after-free bugs in cnic_delete_task
    - [arm64] octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
    - [amd64] perf/x86/intel: Fix crash in icl_update_topdown_event()
      (CVE-2025-38322)
    - ksmbd: smbdirect: validate data_offset and data_length field of
      smb_direct_data_transfer
    - ksmbd: smbdirect: verify remaining_data_length respects
      max_fragmented_recv_size
    - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
    - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
    - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
    - power: supply: bq27xxx: restrict no-battery detection to bq27000
    - dm-raid: don't set io_min and io_opt for raid1
    - dm-stripe: fix a possible integer overflow
    - gup: optimize longterm pin_user_pages() for large folio
    - mm: revert "mm: vmscan.c: fix OOM on swap stress test"
    - [amd64] iommu/vt-d: Fix __domain_mapping()'s usage of
      switch_to_super_page()
    - [amd64] iommu/amd/pgtbl: Fix possible race while increase page table level
    - btrfs: tree-checker: fix the incorrect inode ref size check
    - [arm64] ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S
      interface
    - [arm64] ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if
      source graph failed
    - [arm64] ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S
    - mmc: mvsdio: Fix dma_unmap_sg() nents value
    - [amd64] KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is
      active
    - drm/amd/display: Allow RX6xxx & RX7700 to invoke amdgpu_irq_get/put
    - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
    - rds: ib: Increment i_fastreg_wrs before bailing out
    - mptcp: propagate shutdown to subflows when possible
    - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx
    - io_uring/cmd: let cmds to know about dying task
    - io_uring: backport io_should_terminate_tw()
    - io_uring: include dying ring in task_work "should cancel" state
    - io_uring/msg_ring: kill alloc_cache for io_kiocb allocations
    - io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check
      (CVE-2025-39816)
    - [amd64] ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error
      message
    - [amd64] ASoC: Intel: catpt: Expose correct bit depth to userspace
    - drm/xe/tile: Release kobject for the failure path
    - drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
    - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
    - drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue()
    - smb: client: fix filename matching of deferred files
    - smb: client: let smbd_destroy() call
      disable_work_sync(&info->post_send_credits_work)
    - crypto: af_alg - Set merge to zero early in af_alg_sendmsg
    - smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
    - io_uring: fix incorrect io_kiocb reference in io_link_skb
    - [amd64] platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on
      ASUS ROG Z13
    - [amd64] platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk
    - vmxnet3: unregister xdp rxq info in the reset path (CVE-2025-22106)
    - mm: add folio_expected_ref_count() for reference count calculation
    - mm/gup: check ref_count instead of lru before migration
    - mptcp: pm: nl: announce deny-join-id0 flag
    - usb: xhci: introduce macro for ring segment list iteration
    - usb: xhci: remove option to change a default ring's TRB cycle bit
    - xhci: dbc: decouple endpoint allocation from initialization
    - xhci: dbc: Fix full DbC transfer ring after several reconnects
    - rtc: pcf2127: fix SPI command byte for PCF2131 backport
    - minmax.h: add whitespace around operators and after commas
    - minmax.h: update some comments
    - minmax.h: reduce the #define expansion of min(), max() and clamp()
    - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()
    - minmax.h: move all the clamp() definitions after the min/max() ones
    - minmax.h: simplify the variants of clamp()
    - minmax.h: remove some #defines that are only expanded once
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.50
    - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE
    - firewire: core: fix overlooked update of subsystem ABI version
    - ALSA: usb-audio: Fix code alignment in mixer_quirks
    - ALSA: usb-audio: Fix block comments in mixer_quirks
    - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
    - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
    - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
    - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
    - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
    - ALSA: usb-audio: Convert comma to semicolon
    - ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA
    - ALSA: usb-audio: Fix build with CONFIG_INPUT=n
    - usb: core: Add 0x prefix to quirks debug output
    - [arm64,armhf] net: fec: rename struct fec_devinfo fec_imx6x_info ->
      fec_imx6sx_info
    - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick
    - [riscv64] mmc: sdhci-cadence: add Mobileye eyeQ support
    - i2c: designware: Add quirk for Intel Xe
    - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
    - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk
    - ALSA: usb-audio: Add mute TLV for playback volumes on more devices
    - net: sfp: add quirk for FLYPRO copper SFP+ module
    - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
    - [amd64] HID: amd_sfh: Add sync across amd sfh work functions
    - cpufreq: Initialize cpufreq-based invariance before subsys
    - smb: server: don't use delayed_work for post_recv_credits_work
    - smb: server: use disable_work_sync in transport_rdma.c
    - bpf: Check the helper function is valid in get_helper_proto
    - btrfs: don't allow adding block device of less than 1 MB
    - wifi: virt_wifi: Fix page fault on connect
    - bpf: Reject bpf_timer for PREEMPT_RT
    - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
    - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
    - [armhf] can: sun4i_can: populate ndo_change_mtu() to prevent buffer
      overflow
    - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
    - can: peak_usb: fix shift-out-of-bounds issue
    - net: tun: Update napi->skb after XDP process
    - net/smc: fix warning in smc_rx_splice() when calling get_page()
    - [arm64] ethernet: rvu-af: Remove slash from the driver name
    - Bluetooth: hci_sync: Fix hci_resume_advertising_sync
    - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
    - vhost: Take a reference on the task in struct vhost_task.
    - bnxt_en: correct offset handling for IPv6 destination address
    - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
    - nexthop: Forbid FDB status change while nexthop is in a group
    - mm/gup: local lru_add_drain() to avoid lru_add_drain_all()
    - mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU
      batch"
    - mm: folio_may_be_lru_cached() unless folio_test_large()
    - [amd64] drm/gma500: Fix null dereference in hdmi teardown
    - futex: Prevent use-after-free during requeue-PI
    - [arm64] drm/panthor: Defer scheduler entitiy destruction to queue release
    - [amd64] platform/x86: lg-laptop: Fix WMAB call in fan_mode_store()
    - smb: client: fix wrong index reference in smb2_compound_op()
    - HID: asus: add support for missing PX series fn keys
    - i40e: add validation for ring_len param
    - i40e: fix idx validation in i40e_validate_queue_map
    - i40e: fix idx validation in config queues msg
    - i40e: fix input validation logic for action_meta
    - i40e: fix validation of VF state in get resources
    - i40e: add max boundary check for VF filters
    - i40e: add mask to apply valid bits for itr_idx
    - i40e: improve VF MAC filters accounting
    - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
    - tracing: dynevent: Add a missing lockdown check on dynevent
    - [armhf] dts: socfpga: sodia: Fix mdio bus probe and PHY address
    - drm/ast: Use msleep instead of mdelay for edid read
    - afs: Fix potential null pointer dereference in afs_put_server
    - fs/proc/task_mmu: check p->vec_buf for NULL
    - gpiolib: Extend software-node support to support secondary software-nodes
    - mm/hugetlb: fix folio is still mapped when deleted
    - fbcon: fix integer overflow in fbcon_do_set_font
    - fbcon: Fix OOB access in font allocation
    - iommufd: Fix race during abort for file descriptors
    - Revert "usb: xhci: remove option to change a default ring's TRB cycle bit"
    - [amd64] drm/i915/backlight: Return immediately when scale() finds invalid
      parameters
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.51
    - crypto: sha256 - fix crash at kexec
    - scsi: target: target_core_configfs: Add length check to avoid buffer
      overflow
    - media: b2c2: Fix use-after-free causing by irq_check_work in
      flexcop_pci_remove
    - media: tuner: xc5000: Fix use-after-free in xc5000_release
    - media: rc: fix races with imon_disconnect()
    - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID
    - mm: swap: check for stable address space before operating on the VMA
    - wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()
    - [arm64] ASoC: qcom: audioreach: fix potential null pointer dereference
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.52
    - wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()
    - USB: serial: option: add SIMCom 8230C compositions
    - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1
    - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
    - wifi: rtl8xxxu: Don't claim USB ID 07b8:8188
    - dm-integrity: limit MAX_TAG_SIZE to 255
    - [amd64] platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042
      list
    - [amd64] platform/x86/amd/pmf: Support new ACPI ID AMDI0108
    - [amd64,arm64] ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue
    - btrfs: ref-verify: handle damaged extent root tree
    - netfs: Prevent duplicate unlocking
    - can: hi311x: fix null pointer dereference when resuming from sleep before
      interface was enabled
    - [amd64] platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042
      quirks list
    - drm/amd : Update MES API header file for v11 & v12
    - drm/amd/include : MES v11 and v12 API header update
    - drm/amd/include : Update MES v12 API for fence update
    - drm/amdgpu: Enable MES lr_compute_wa by default (Closes: #1118658)
    - ALSA: usb-audio: Kill timer properly at removal (CVE-2025-38105)
    - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free
    - hid: fix I2C read buffer overflow in raw_event() for mcp2221
    - nvmem: layouts: fix automatic module loading
    - binder: fix double-free in dbitmap
    - driver core/PM: Set power.no_callbacks along with power.no_pm
    - crypto: rng - Ensure set_ent is always present
    - net/9p: fix double req put in p9_fd_cancelled
    - [amd64] KVM: x86: Don't (re)check L1 intercepts when completing userspace
      I/O
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.53
    - filelock: add FL_RECLAIM to show_fl_flags() macro
    - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
    - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast
    - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote
    - [powerpc*] 8xx: Remove left-over instruction and comments in
      DataStoreTLBMiss handler
    - [powerpc*] 603: Really copy kernel PGD entries into all PGDIRs
    - uprobes: uprobe_warn should use passed task
    - [arm64] coresight: trbe: Prevent overflow in PERF_IDX2OFF()
    - [arm64] perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
    - smb: server: fix IRD/ORD negotiation with the client
    - [amd64] EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller
    - [amd64] x86/vdso: Fix output operand size of RDPID
    - lsm: CONFIG_LSM can depend on CONFIG_SECURITY
    - btrfs: return any hit error from extent_writepage_io()
    - [arm64] pinctrl: renesas: rzg2l: Fix invalid unsigned return in
      rzg3s_oen_read()
    - [arm64] dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
    - regmap: Remove superfluous check for !config in __regmap_init()
    - bpf: Remove migrate_disable in kprobe_multi_link_prog_run
    - libbpf: Fix reuse of DEVMAP
    - [arm64] dts: imx93-kontron: Fix GPIO for panel regulator
    - [arm64] dts: imx93-kontron: Fix USB port assignment
    - [arm64] dts: imx95: Correct the lpuart7 and lpuart8 srcid
    - ACPI: processor: idle: Fix memory leak when register cpuidle device failed
    - [arm64] soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
    - [arm64] pinctrl: meson-gxl: add missing i2c_d pinmux
    - blk-mq: check kobject state_in_sysfs before deleting in
      blk_mq_unregister_hctx
    - block: use int to store blk_stack_limits() return value
    - PM: sleep: core: Clear power.must_resume in noirq suspend error path
    - vdso: Add struct __kernel_old_timeval forward declaration to gettime.h
    - [armhf] dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer
      property
    - [arm64] PM / devfreq: mtk-cci: Fix potential error pointer dereference in
      probe()
    - [arm64] power: supply: cw2015: Fix a alignment coding style issue
    - [arm64] pinctrl: renesas: Use int type to store negative error codes
    - null_blk: Fix the description of the cache_size module argument
    - nbd: restrict sockets to TCP and UDP
    - [arm64] PM / devfreq: rockchip-dfi: double count on RK3588
    - [arm64] soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure
    - [arm64] soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure
    - [arm64] arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model
    - mmc: core: Fix variable shadowing in mmc_route_rpmb_frames()
    - [arm64] dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value
    - [arm64] dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes
    - [arm64] dts: mediatek: mt8516-pumpkin: Fix machine compatible
    - [armhf] pwm: tiehrpwm: Don't drop runtime PM reference in .free()
    - [armhf] pwm: tiehrpwm: Make code comment in .free() more useful
    - [armhf] pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle
      calculation
    - [armhf] pwm: tiehrpwm: Fix corner case in clock divisor calculation
    - ACPICA: Fix largest possible resource descriptor index
    - [riscv64] bpf: Sign extend struct ops return values properly
    - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
    - i3c: master: svc: Use manual response for IBI events
    - i3c: master: svc: Recycle unused IBI slot
    - bpf: Explicitly check accesses to bpf_sock_addr
    - bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free()
    - smp: Fix up and expand the smp_call_function_many() kerneldoc
    - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host
      headers
    - spi: fix return code when spi device has too many chipselects
    - bpf: Mark kfuncs as __noclone
    - once: fix race by moving DO_ONCE to separate section
    - [arm64] thermal/drivers/qcom/lmh: Add missing IRQ includes
    - [arm64] i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
    - i2c: designware: Fix clock issue when PM is disabled
    - i2c: designware: Add disabling clocks when probe fails
    - libbpf: Fix error when st-prefix_ops and ops from differ btf
    - bpf: Enforce expected_attach_type for tailcall compatibility
    - drm/radeon/r600_cs: clean up of dead code in r600_cs
    - f2fs: fix condition in __allow_reserved_blocks()
    - [arm64] phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568
    - drm/amd/display: Remove redundant semicolons
    - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
    - scsi: myrs: Fix dma_alloc_coherent() error check
    - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count
    - RDMA/mlx5: Fix vport loopback forcing for MPV device
    - PCI/ACPI: Fix pci_acpi_preserve_config() memory leak
    - ALSA: lx_core: use int type to store negative error codes
    - inet: ping: check sock_net() in ping_get_port() and ping_lookup()
    - [arm64,armhf] coresight: Only register perf symlink for sinks with
      alloc_buffer
    - drm/amdgpu: Power up UVD 3 for FW validation (v2)
    - drm/amd/pm: Disable ULV even if unsupported (v3)
    - drm/amd/pm: Fix si_upload_smc_data (v3)
    - drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
    - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
    - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)
    - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3)
    - wifi: mwifiex: send world regulatory domain to driver
    - [arm64,armhf] PCI: tegra: Fix devm_kcalloc() argument order for port->phys
      allocation
    - tcp: fix __tcp_close() to only send RST when required
    - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
    - [armhf] usb: phy: twl6030: Fix incorrect type for ret
    - usb: gadget: configfs: Correctly set use_os_string at bind
    - tty: n_gsm: Don't block input queue by waiting MSC
    - [powerpc*] misc: genwqe: Fix incorrect cmd field being reported in error
    - pps: fix warning in pps_register_cdev when register device fail
    - wifi: iwlwifi: Remove redundant header files
    - [amd64,arm64] idpf: fix Rx descriptor ready check barrier in splitq
    - [amd64] ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
    - [amd64] ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
    - [amd64] ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
    - [arm64] drm/msm/dpu: fix incorrect type for ret
    - fs: ntfs3: Fix integer overflow in run_unpack()
    - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist
    - iio: consumers: Fix handling of negative channel scale in
      iio_convert_raw_to_processed()
    - iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
    - netfilter: ipset: Remove unused htable_bits in macro ahash_region
    - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable
    - drivers/base/node: handle error properly in register_one_node()
    - RDMA/cm: Rate limit destroy CM ID timeout error message
    - wifi: mt76: fix potential memory leak in mt76_wmac_probe()
    - wifi: mt76: mt7996: Fix RX packets configuration for primary WED device
    - wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE
    - wifi: mt76: mt7915: fix mt7981 pre-calibration
    - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()
    - f2fs: fix to truncate first page in error path of f2fs_truncate()
    - f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page()
    - ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on
      PREEMPT_RT
    - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
    - scsi: qla2xxx: edif: Fix incorrect sign of error code
    - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
    - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp()
    - HID: hidraw: tighten ioctl command parsing
    - f2fs: fix zero-sized extent for precache extents
    - Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems
      Running"
    - RDMA/core: Resolve MAC of next-hop device without ARP support
    - IB/sa: Fix sa_local_svc_timeout_ms read race
    - Documentation: trace: historgram-design: Separate sched_waking histogram
      section heading and the following diagram
    - wifi: ath12k: fix wrong logging ID used for CE
    - wifi: ath10k: avoid unnecessary wait for service ready message
    - iommu/vt-d: debugfs: Fix legacy mode page table dump logic
    - wifi: mac80211: fix Rx packet handling when pubsta information is not
      available
    - [amd64] ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback
    - RDMA/rxe: Fix race in do_task() when draining
    - wifi: rtw89: avoid circular locking dependency in ser_state_run()
    - [arm64] remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
    - dm vdo: return error on corrupted metadata in start_restoring_volume
      functions
    - [arm64] coresight-etm4x: Conditionally access register TRCEXTINSELR
    - [arm64,armhf] coresight: tmc: Support atclk
    - [arm64,armhf] coresight: catu: Support atclk
    - [arm64,armhf] coresight: etm4x: Support atclk
    - [arm64,armhf] coresight: trbe: Return NULL pointer for allocation failures
    - [arm64,armhf] coresight: tpda: fix the logic to setup the element size
    - [arm64] coresight: Fix incorrect handling for return value of devm_kzalloc
    - NFSv4.1: fix backchannel max_resp_sz verification check
    - ipvs: Defer ip_vs_ftp unregister during netns cleanup
    - netfilter: nfnetlink: reset nlh pointer during batch replay
    - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
    - usb: vhci-hcd: Prevent suspending virtually attached devices
    - iommu/vt-d: Disallow dirty tracking if incoherent page walk
    - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
    - ptp: Add a upper bound on max_vclocks
    - vhost: vringh: Fix copy_to_iter return value check
    - Bluetooth: MGMT: Fix not exposing debug UUID on
      MGMT_OP_READ_EXP_FEATURES_INFO
    - Bluetooth: ISO: Fix possible UAF on iso_conn_free
    - Bluetooth: ISO: free rx_skb if not consumed
    - Bluetooth: ISO: don't leak skb in ISO_CONT RX
    - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements
    - KEYS: X.509: Fix Basic Constraints CA flag parsing
    - ocfs2: fix double free in user_cluster_connect()
    - drivers/base/node: fix double free in register_one_node()
    - [arm64] PCI: j721e: Fix incorrect error message in probe()
    - [amd64,arm64] idpf: fix mismatched free function for dma_alloc_coherent
    - nfp: fix RSS hash key size when RSS is not supported
    - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not
      configurable
    - net: dlink: handle copy_thresh allocation failure
    - net/mlx5: Stop polling for command response if interface goes down
    - net/mlx5: pagealloc: Fix reclaim race during command interface teardown
    - net/mlx5: fw reset, add reset timeout work
    - smb: client: fix crypto buffers in non-linear memory
    - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
    - bpf: Reject negative offsets for ALU ops
    - tpm: Disable TPM2_TCG_HMAC by default
    - Squashfs: fix uninit-value in squashfs_get_parent
    - uio_hv_generic: Let userspace take care of interrupt mask
    - io_uring/waitid: always prune wait queue entry in io_waitid_wait()
    - [arm64] ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
    - [amd64,arm64] ASoC: SOF: ipc3-topology: Fix multi-core and static
      pipelines tear down
    - fs: udf: fix OOB read in lengthAllocDescs handling
    - net: nfc: nci: Add parameter validation for packet data
    - [arm64,armhf] mfd: vexpress-sysreg: Check the return value of
      devm_gpiochip_add_data()
    - dm: fix queue start/stop imbalance under suspend/load/resume races
    - dm: fix NULL pointer dereference in __dm_suspend()
    - ksmbd: Fix race condition in RPC handle list access
    - ksmbd: fix error code overwriting in smb2_get_info_filesystem()
    - ksmbd: add max ip connections parameter
    - ext4: fix checks for orphan inodes
    - [amd64] KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't
      valid
    - fbdev: simplefb: Fix use after free in simplefb_detach_genpds()
    - mm: hugetlb: avoid soft lockup when mprotect to large memory area
    - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
    - [arm64] misc: fastrpc: Save actual DMA size in fastrpc_map structure
    - [arm64] misc: fastrpc: Fix fastrpc_map_lookup operation
    - [arm64] misc: fastrpc: fix possible map leak in fastrpc_put_args
    - [arm64] misc: fastrpc: Skip reference for DMA handles
    - Input: atmel_mxt_ts - allow reset GPIO to sleep
    - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
    - sunrpc: fix null pointer dereference on zero-length checksum
    - [arm64] remoteproc: pru: Fix potential NULL pointer dereference in
      pru_rproc_set_ctable()
    - [amd64,arm64] tee: fix register_shm_helper()
    - pinctrl: check the return value of pinmux_ops::get_function_name()
    - bus: fsl-mc: Check return value of platform_get_resource()
    - net/9p: Fix buffer overflow in USB transport layer
    - net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
    - usb: typec: tipd: Clear interrupts first
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.54
    - fs: always return zero on success from replace_fd()
    - fscontext: do not consume log entries when returning -EMSGSIZE
    - [arm64] map [_text, _stext) virtual address range non-executable+read-only
    - rseq: Protect event mask against membarrier IPI
    - listmount: don't call path_put() under namespace semaphore
    - page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches
    - dma-mapping: fix direction in dma_alloc direction traces
    - [amd64] KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2
    - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
    - media: v4l2-subdev: Fix alloc failure check in
      v4l2_subdev_call_state_try()
    - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled
    - perf disasm: Avoid undefined behavior in incrementing NULL
    - perf test trace_btf_enum: Skip if permissions are insufficient
    - perf evsel: Avoid container_of on a NULL leader
    - libperf event: Ensure tracing data is multiple of 8 sized
    - [arm64] clk: qcom: common: Fix NULL vs IS_ERR() check in
      qcom_cc_icc_register()
    - [arm64] clk: renesas: cpg-mssr: Fix memory leak in
      cpg_mssr_reserved_init()
    - perf util: Fix compression checks returning -1 as bool
    - perf arm_spe: Correct setting remote access
    - perf arm-spe: Rename the common data source encoding
    - perf arm_spe: Correct memory level for remote access
    - perf vendor events arm64 AmpereOneX: Fix typo - should be
      l1d_cache_access_prefetches
    - perf session: Fix handling when buffer exceeds 2 GiB
    - perf tools: Add fallback for exclude_guest
    - perf evsel: Ensure the fallback message is always written to
    - [arm64] clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
    - [arm64] clk: mediatek: clk-mux: Do not pass flags to
      clk_mux_determine_rate_flags()
    - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (CVE-2025-40001)
    - [amd64] ASoC: SOF: Intel: hda-pcm: Place the constraint on period time
      instead of buffer time
    - [amd64] ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel
    - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
    - drm/xe/hw_engine_group: Fix double write lock release in error path
    - [s390x] cio: Update purge function to unregister the unused subchannels
    - drm/vmwgfx: Fix a null-ptr access in the cursor snooper
    - drm/vmwgfx: Fix Use-after-free in validation
    - drm/vmwgfx: Fix copy-paste typo in validation
    - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
    - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
    - [arm64] net: mscc: ocelot: Fix use-after-free caused by cyclic delayed
      work (CVE-2025-40003)
    - ice: ice_adapter: release xa entry on adapter allocation failure
    - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat()
    - [arm64] mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister()
      call
    - [arm64] mailbox: zynqmp-ipi: Remove dev.parent check in
      zynqmp_ipi_free_mboxes
    - [arm64] mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup
      loop
    - [arm64] mailbox: zynqmp-ipi: Fix SGI cleanup on unbind
    - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
    - [arm64] mailbox: mtk-cmdq-mailbox: Switch to
      __pm_runtime_put_autosuspend()
    - [arm64] mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend()
    - [arm64] mailbox: mtk-cmdq: Remove pm_runtime APIs from
      cmdq_mbox_send_data()
    - drm/amdgpu: Add additional DCE6 SCL registers
    - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
    - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
    - drm/amd/display: Properly disable scaling on DCE6
    - netfilter: nft_objref: validate objref and objrefmap expressions
    - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
    - crypto: essiv - Check ssize for decryption and in-place encryption
    - cifs: Fix copy_to_iter return value check
    - smb: client: fix missing timestamp updates after utime(2)
    - cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points
    - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
    - [arm64] gpio: wcd934x: mark the GPIO controller as sleeping
    - bpf: Avoid RCU context warning when unpinning htab with internal structs
    - [s390x] vmlinux.lds.S: Reorder sections
    - [s390x] vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections
    - ACPI: property: Fix buffer properties extraction for subnodes
    - ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
    - ACPI: debug: fix signedness issues in read/write helpers
    - [arm64] dts: qcom: msm8916: Add missing MDSS reset
    - [arm64] dts: qcom: msm8939: Add missing MDSS reset
    - [arm64] dts: qcom: sdm845: Fix slimbam num-channels/ees
    - [arm64] dts: qcom: x1e80100-pmics: Disable pm8010 by default
    - [arm64] dts: ti: k3-am62a-main: Fix main padcfg length
    - [arm64] kprobes: call set_memory_rox() for kprobe page
    - [armhf] AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on
      reset)
    - [armhf] OMAP2+: pm33xx-core: ix device node reference leaks in
      amx3_idle_init
    - [arm64] perf/arm-cmn: Fix CMN S3 DTM offset
    - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required
    - xen/events: Cleanup find_virq() return codes
    - xen/manage: Fix suspend error path
    - xen/events: Return -EEXIST for bound VIRQs
    - xen/events: Update virq_to_irq on migration
    - [arm64] firmware: meson_sm: fix device leak at probe
    - media: cx18: Add missing check after DMA map
    - media: mc: Fix MUST_CONNECT handling for pads with no links
    - media: pci: ivtv: Add missing check after DMA map
    - media: pci: mg4b: fix uninitialized iio scan data
    - [arm64] media: venus: firmware: Use correct reset sequence for IRIS2
    - media: vivid: fix disappearing <Vendor Command With ID> messages
    - media: lirc: Fix error handling in lirc_register()
    - [arm64] drm/panthor: Fix memory leak in panthor_ioctl_group_create()
    - drm/nouveau: fix bad ret code in nouveau_bo_move_prep
    - drm/xe/uapi: loosen used tracking restriction
    - drm/amd/display: Enable Dynamic DTBCLK Switch
    - blk-crypto: fix missing blktrace bio split events
    - btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
    - bus: mhi: ep: Fix chained transfer handling in read path
    - bus: mhi: host: Do not use uninitialized 'dev' pointer in
      mhi_init_irq_setup()
    - [arm64] clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP
      refclk
    - copy_sighand: Handle architectures where sizeof(unsigned long) <
      sizeof(u64)
    - [amd64] cpufreq: intel_pstate: Fix object lifecycle issue in
      update_qos_request()
    - [arm64,armhf] crypto: rockchip - Fix dma_unmap_sg() nents value
    - eventpoll: Replace rwlock with spinlock
    - fbdev: Fix logic error in "offb" name match
    - fs/ntfs3: Fix a resource leak bug in wnd_extend()
    - fs: quota: create dedicated workqueue for quota_release_work
    - fuse: fix possibly missing fuse_copy_finish() call in fuse_notify()
    - fuse: fix livelock in synchronous file put from fuseblk workers
    - iio: dac: ad5360: use int type to store negative error codes
    - iio: dac: ad5421: use int type to store negative error codes
    - iio: frequency: adf4350: Fix prescaler usage.
    - init: handle bootloader identifier in kernel parameters
    - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in
      resume
    - [amd64] iommu/vt-d: PRS isn't usable if PDS isn't supported
    - kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in
      sys_prlimit64() paths
    - KEYS: trusted_tpm1: Compare HMAC values in constant time
    - lib/genalloc: fix device leak in of_gen_pool_get()
    - loop: fix backing file reference leak on validation error
    - openat2: don't trigger automounts with RESOLVE_NO_XDEV
    - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
    - [powerpc*] powernv/pci: Fix underflow and leak issue
    - [powerpc*] pseries/msi: Fix potential underflow and leak issue
    - Revert "ipmi: fix msg stack when IPMI is disconnected"
    - sched/deadline: Fix race in push_dl_task()
    - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
    - scsi: sd: Fix build warning in sd_revalidate_disk()
    - sctp: Fix MAC comparison to be constant-time
    - xsk: Harden userspace-supplied xdp_desc validation
    - mmc: core: SPI mode remove cmd7
    - mmc: mmc_spi: multiple block read remove read crc ack
    - [armhf] memory: samsung: exynos-srom: Fix of_iomap leak in
      exynos_srom_probe
    - rtc: interface: Ensure alarm irq is enabled when UIE is enabled
    - rtc: interface: Fix long-standing race when setting alarm
    - [arm64] PCI: xilinx-nwl: Fix ECAM programming
    - [arm64,armhf] PCI: tegra: Convert struct tegra_msi mask_lock into raw
      spinlock
    - PCI/sysfs: Ensure devices are powered for config reads
    - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
    - PCI/ERR: Fix uevent on failure to recover
    - PCI/AER: Fix missing uevent on recovery when a reset is requested
    - PCI/AER: Support errors introduced by PCIe r6.0
    - [arm64] PCI: j721e: Fix programming sequence of "strap" settings
    - spi: cadence-quadspi: Flush posted register writes before INDAC access
    - spi: cadence-quadspi: Flush posted register writes before DAC access
    - spi: cadence-quadspi: Fix cqspi_setup_flash()
    - [x86] fred: Remove ENDBR64 from FRED entry points
    - [x86] umip: Check that the instruction opcode is at least two bytes
    - [x86] umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT
      aliases)
    - [s390x] dasd: enforce dma_alignment to ensure proper buffer validation
    - [s390x] dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request
    - [s390x] Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR
    - slab: prevent warnings when slab obj_exts vector allocation fails
    - slab: mark slab->obj_exts allocation failures unconditionally
    - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again
    - wifi: mt76: mt7925u: Add VID/PID for Netgear A9000
    - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500
    - mm/thp: fix MTE tag mismatch when replacing zero-filled subpages
    - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
    - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when
      max_huge_pages=0
    - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success
    - mm/damon/lru_sort: use param_ctx for damon_attrs staging
    - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
    - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
    - ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches()
    - ext4: verify orphan file size is not too big
    - ext4: increase i_disksize to offset + len in
      ext4_update_disksize_before_punch()
    - ext4: correctly handle queries for metadata mappings
    - ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
    - ext4: fix an off-by-one issue during moving extents
    - ext4: guard against EA inode refcount underflow in xattr update
    - ext4: validate ea_ino and size in check_xattrs
    - ACPICA: Allow to skip Global Lock initialization
    - ext4: free orphan info with kvfree
    - media: mc: Clear minor number before put device
    - Squashfs: add additional inode sanity checking
    - Squashfs: reject negative file sizes in squashfs_read_inode()
    - tracing: Fix race condition in kprobe initialization causing NULL pointer
      dereference
    - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork
    - [amd64] ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams
    - [amd64] ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples
    - [amd64] mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config
      max_register value
    - [amd64] mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for
      cache_type
    - [amd64] mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config
      flag
    - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
    - cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency
    - [amd64] KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace
    - statmount: don't call path_put() under namespace semaphore
    - [arm64] mte: Do not flag the zero page as PG_mte_tagged
    - [x86] mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state()
    - [x86] kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP
    - nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT
    - NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock()
    - nfsd: refine and rename NFSD_MAY_LOCK
    - nfsd: don't use sv_nrthreads in connection limiting calculations.
    - nfsd: unregister with rpcbind when deleting a transport
    - ACPI: battery: allocate driver data through devm_ APIs
    - ACPI: battery: initialize mutexes through devm_ APIs
    - ACPI: battery: Check for error code from devm_mutex_init() call
    - ACPI: battery: Add synchronization between interface updates
    - ACPI: property: Disregard references in data-only subnode lists
    - ACPI: property: Add code comments explaining what is going on
    - ACPI: property: Do not pass NULL handles to acpi_attach_data()
    - mptcp: pm: in-kernel: usable client side with C-flag
    - ipmi: Rework user message limit handling
    - ipmi: Fix handling of messages with provided receive message pointer
    - mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled
      mTHP subpage to shared zeropage
    - [s390x] bpf: Centralize frame offset calculations
    - [s390x] bpf: Describe the frame using a struct instead of constants
    - [s390x] bpf: Write back tail call counter for BPF_PSEUDO_CALL
    - [s390x] bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG
    - [riscv64] irqchip/sifive-plic: Make use of __assign_bit()
    - [riscv64] irqchip/sifive-plic: Avoid interrupt ID 0 handling during
      suspend/resume
    - copy_file_range: limit size if in compat mode
    - minixfs: Verify inode mode when loading from disk
    - pid: Add a judgment for ns null in pid_nr_ns
    - fs: Add 'initramfs_options' to set initramfs mount options
    - cramfs: Verify inode mode when loading from disk
    - writeback: Avoid softlockup when switching many inodes
    - writeback: Avoid excessively long inode switching times
    - sched/fair: Block delayed tasks on throttled hierarchy during dequeue
    - nfsd: fix __fh_verify for localio
    - nfsd: fix access checking for NLM under XPRTSEC policies
    - [amd64] ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA
    - mount: handle NULL values in mnt_ns_release()
    - nfsd: decouple the xprtsec policy check from check_nfsd_access()
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.55
    - drm/xe/guc: Check GuC running state before deregistering exec queue
    - smb: client: Fix refcount leak for cifs_sb_tlink
    - slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL
    - r8152: add error handling in rtl8152_driver_init
    - f2fs: fix wrong block mapping for multi-devices
    - jbd2: ensure that all ongoing I/O complete before freeing blocks
    - ext4: wait for ongoing I/O to complete before freeing blocks
    - ext4: detect invalid INLINE_DATA + EXTENTS flag combination
    - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already
      running
    - btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl
    - btrfs: fix incorrect readahead expansion length
    - btrfs: fix memory leaks when rejecting a non SINGLE data profile without
      an RST
    - btrfs: do not assert we found block group item when creating free space
      tree
    - can: gs_usb: gs_make_candev(): populate net_device->dev_port
    - can: gs_usb: increase max interface to U8_MAX
    - cifs: parse_dfs_referrals: prevent oob on malformed input
    - drm/sched: Fix potential double free in
      drm_sched_job_add_resv_dependencies
    - drm/amdgpu: use atomic functions with memory barriers for vm fault info
    - drm/amdgpu: fix gfx12 mes packet status return check
    - perf/core: Fix address filter match with backing files
    - perf/core: Fix MMAP event path names with backing files
    - perf/core: Fix MMAP2 event device with backing files
    - drm/amd: Check whether secure display TA loaded successfully
    - irqdomain: cdx: Switch to of_fwnode_handle()
    - [arm64] drm/msm/a6xx: Fix PDC sleep sequence
    - usb: gadget: Store endpoint pointer in usb_request
    - usb: gadget: Introduce free_usb_request helper
    - usb: gadget: f_ncm: Refactor bind path to use __free()
    - usb: gadget: f_acm: Refactor bind path to use __free()
    - usb: gadget: f_ecm: Refactor bind path to use __free()
    - usb: gadget: f_rndis: Refactor bind path to use __free()
    - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay
    - Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()"
      (Closes: #1116358)
    - HID: multitouch: fix sticky fingers
    - dax: skip read lock assertion for read-only filesystems
    - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable()
    - can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error
      Active
    - can: m_can: m_can_chip_config(): bring up interface in correct state
    - can: m_can: add deinit callback
    - can: m_can: call deinit/init callback when going into suspend/resume
    - can: m_can: fix CAN state in system PM
    - net: dlink: handle dma_map_single() failure properly
    - doc: fix seg6_flowlabel path
    - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H
    - net/ip6_tunnel: Prevent perpetual tunnel growth
    - [amd64,arm64] amd-xgbe: Avoid spurious link down messages during interface
      toggle
    - tcp: fix tcp_tso_should_defer() vs large RTT
    - ksmbd: fix recursive locking in RPC handle list access
    - tg3: prevent use of uninitialized remote_adv and local_adv variables
    - tls: trim encrypted message to match the plaintext on short splice
    - tls: wait for async encrypt in case of error during latter iterations of
      sendmsg
    - tls: always set record_type in tls_process_cmsg
    - tls: wait for pending async decryptions if tls_strp_msg_hold fails
    - tls: don't rely on tx_work during send()
    - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address
    - net: usb: lan78xx: fix use of improperly initialized dev->chipid in
      lan78xx_reset
    - [arm64] drm/panthor: Ensure MCU is disabled on suspend
    - nvme-multipath: Skip nr_active increments in RETRY disposition
    - [riscv64] kprobes: Fix probe address validation
    - [amd64] ASoC: nau8821: Cancel jdet_work before handling jack ejection
    - [amd64] ASoC: nau8821: Generalize helper to clear IRQ status
    - [amd64] ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit
    - [amd64] drm/i915/guc: Skip communication warning on reset in progress
    - drm/amdgpu: add ip offset support for cyan skillfish
    - drm/amdgpu: add support for cyan skillfish without IP discovery
    - drm/amdgpu: fix handling of harvesting for ip_discovery firmware
    - drm/amd/powerplay: Fix CIK shutdown temperature
    - [arm64] drm/rockchip: vop2: use correct destination rectangle height check
    - sched/fair: Fix pelt lost idle time detection
    - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
    - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card
    - HID: hid-input: only ignore 0 battery events for digitizers
    - HID: multitouch: fix name of Stylus input devices
    - nvme/tcp: handle tls partially sent records in write_space()
    - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
    - xfs: rename the old_crc variable in xlog_recover_process
    - xfs: fix log CRC mismatches between i386 and other architectures
    - PM: runtime: Add new devm functions
    - iio: imu: inv_icm42600: Simplify pm_runtime setup
    - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended
    - nfsd: Use correct error code when decoding extents
    - nfsd: Drop dprintk in blocklayout xdr functions
    - NFSD: Rework encoding and decoding of nfsd4_deviceid
    - NFSD: Minor cleanup in layoutcommit processing
    - NFSD: Implement large extent array support in pNFS
    - NFSD: Fix last write offset handling in layoutcommit
    - wifi: rtw89: avoid possible TX wait initialization race
    - xfs: use deferred intent items for reaping crosslinked blocks
    - padata: Reset next CPU when reorder sequence wraps around
    - md/raid0: Handle bio_split() errors
    - md/raid1: Handle bio_split() errors
    - md/raid10: Handle bio_split() errors
    - md: fix mssing blktrace bio split events
    - [amd64] x86/resctrl: Refactor resctrl_arch_rmid_read()
    - [amd64] x86/resctrl: Fix miscount of bandwidth event when reactivating
      previously unavailable RMID
    - d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier
    - vfs: Don't leak disconnected dentries on umount
    - PCI: Add PCI_VDEVICE_SUB helper macro
    - ixgbevf: Add support for Intel(R) E610 device
    - ixgbevf: fix getting link speed data for E610 devices
    - ixgbevf: fix mailbox API compatibility by negotiating supported features
    - tcp: convert to dev_net_rcu()
    - tcp: cache RTAX_QUICKACK metric in a hot cache line
    - net: dst: add four helpers to annotate data-races around dst->dev
    - ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]
    - net: Add locking to protect skb->dev access in ip_output
    - mptcp: Call dst_release() in mptcp_active_enable().
    - mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().
    - mptcp: reset blackhole on success with non-loopback ifaces
    - NFSD: Define a proc_layoutcommit for the FlexFiles layout type
    - [arm64] cputype: Add Neoverse-V3AE definitions
    - [arm64] errata: Apply workarounds for Neoverse-V3AE
    - [amd64] dmaengine: Add missing cleanup on module unload
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.56
    - exec: Fix incorrect type for ret
    - hfs: clear offset and space out of valid records in b-tree node
    - hfs: make proper initalization of struct hfs_find_data
    - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
    - hfs: validate record offset in hfsplus_bmap_alloc
    - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
    - dlm: check for defined force value in dlm_lockspace_release
    - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
    - hfsplus: return EIO when type of hidden directory mismatch in
      hfsplus_fill_super()
    - PCI: Test for bit underflow in pcie_set_readrq()
    - [arm64] sysreg: Correct sign definitions for EIESB and DoubleLock
    - drivers/perf: hisi: Relax the event ID check in the framework
    - [s390x] mm: Use __GFP_ACCOUNT for user page table allocations
    - smb: server: let smb_direct_flush_send_list() invalidate a remote key
      first
    - PM: EM: Drop unused parameter from em_adjust_new_capacity()
    - PM: EM: Slightly reduce em_check_capacity_update() overhead
    - PM: EM: Move CPU capacity check to em_adjust_new_capacity()
    - PM: EM: Fix late boot with holes in CPU topology
    - net/mlx5e: Return 1 instead of 0 in invalid case in
      mlx5e_mpwrq_umr_entry_size()
    - rtnetlink: Allow deleting FDB entries in user namespace
    - [arm64] net: enetc: fix the deadlock of enetc_mdio_lock
    - [arm64] net: enetc: correct the value of ENETC_RXB_TRUESIZE
    - [arm64] dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path
    - net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead
    - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ
    - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ
    - net/smc: fix general protection fault in __smc_diag_dump
    - [arm64] net: ethernet: ti: am65-cpts: fix timestamp loss due to race
      conditions
    - [arm64] mm: avoid always making PTE dirty in pte_mkwrite()
    - ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop
    - sctp: avoid NULL dereference when chunk data buffer is missing
    - net: phy: micrel: always set shared->phydev for LAN8814
    - net/mlx5: Fix IPsec cleanup over MPV device
    - fs/notify: call exportfs_encode_fid with s_umount
    - net: bonding: fix possible peer notify event loss or dup issue
    - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC
    - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
    - btrfs: directly free partially initialized fs_info in
      btrfs_check_leaked_roots()
    - gpio: pci-idio-16: Define maximum valid register address offset
    - gpio: 104-idio-16: Define maximum valid register address offset
    - xfs: fix locking in xchk_nlinks_collect_dir
    - Revert "cpuidle: menu: Avoid discarding useful information"
    - slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts
    - slab: Fix obj_ext mistakenly considered NULL due to race condition
    - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11
    - can: netlink: can_changelink(): allow disabling of automatic restart
    - cifs: Fix TCP_Server_Info::credits to be signed
    - ocfs2: clear extent cache after moving/defragmenting extents
    - vsock: fix lock inversion in vsock_assign_transport()
    - [arm64,armhf] net: stmmac: dwmac-rk: Fix disabling set_clock_selection
    - net: usb: rtl8150: Fix frame padding
    - mm: prevent poison consumption when splitting THP
    - drm/amd/display: increase max link count and fix link->enc NULL pointer
      access
    - [arm64] spi: spi-nxp-fspi: add extra delay after dll locked
    - [arm64] dts: broadcom: bcm2712: Add default GIC address cells
    - [arm64] dts: broadcom: bcm2712: Define VGIC interrupt
    - [arm64] firmware: arm_scmi: Account for failed debug initialization
    - [arm64] firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing
      in raw mode
    - [arm64] drm/panthor: Fix kernel panic on partial unmap of a GPU VA region
    - [riscv64] Define pgprot_dmacoherent() for non-coherent devices
    - [riscv64] Don't print details of CPUs disabled in DT
    - [riscv64] hwprobe: avoid uninitialized variable use in hwprobe_arch_id()
    - hwmon: (sht3x) Fix error handling
    - nbd: override creds to kernel when calling sock_{send,recv}msg()
    - drm/panic: Fix drawing the logo on a small narrow screen
    - drm/panic: Fix qr_code, ensure vmargin is positive
    - [amd64] gpio: ljca: Fix duplicated IRQ mapping
    - io_uring: correct __must_hold annotation in io_install_fixed_file
    - sched: Remove never used code in mm_cid_get()
    - io_uring/sqpoll: switch away from getrusage() for CPU accounting
    - io_uring/sqpoll: be smarter on when to update the stime usage
    - Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP
      (Closes: #1118660)
    - platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL
      (CVE-2025-39678)
    - USB: serial: option: add UNISOC UIS7720
    - USB: serial: option: add Quectel RG255C
    - USB: serial: option: add Telit FN920C04 ECM compositions
    - usb/core/quirks: Add Huawei ME906S to wakeup quirk
    - usb: raw-gadget: do not limit transfer length
    - xhci: dbc: enable back DbC in resume if it was enabled before suspend
    - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall
      event
    - [amd64] x86/microcode: Fix Entrysign revision check for Zen1/Naples
    - [arm*] binder: remove "invalid inc weak" check
    - [amd64] comedi: fix divide-by-zero in comedi_buf_munge() (CVE-2025-40106)
    - [amd64] mei: me: add wildcat lake P DID
    - [arm64] misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup
    - [amd64,arm64] tcpm: switch check for role_sw device with fw_node
    - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp
    - serial: 8250_dw: handle reset control deassert error
    - serial: 8250_exar: add support for Advantech 2 port card with Device ID
      0x0018
    - [arm64] serial: 8250_mtk: Enable baud clock and manage in runtime PM
    - serial: sc16is7xx: remove useless enable of enhanced features
    - devcoredump: Fix circular locking dependency with devcd->mutex.
    - [arm64] mte: Do not warn if the page is already tagged in copy_highpage()
    - xfs: always warn about deprecated mount options
    - ksmbd: transport_ipc: validate payload size before reading handle
      (CVE-2025-40084)
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.57
    - net/sched: sch_qfq: Fix null-deref in agg_dequeue (CVE-2025-40083)
    - audit: record fanotify event regardless of presence of rules
    - [amd64] perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into
      INTEL_FIXED_BITS_MASK
    - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of
      current->mm == NULL
    - perf: Have get_perf_callchain() return NULL if crosstask and user are set
    - perf: Skip user unwind if the task is a kernel thread
    - seccomp: passthrough uprobe systemcall without filtering
    - [amd64] x86/bugs: Report correct retbleed mitigation status
    - [amd64] x86/bugs: Fix reporting of LFENCE retpoline
    - [amd64,arm64] EDAC/mc_sysfs: Increase legacy channel support to 16
    - cpuset: Use new excpus for nocpu error check when enabling root partition
    - btrfs: abort transaction on specific error places when walking log tree
    - btrfs: abort transaction in the process_one_buffer() log tree walk
      callback
    - btrfs: zoned: return error from btrfs_zone_finish_endio()
    - btrfs: zoned: refine extent allocator hint selection
    - btrfs: scrub: replace max_t()/min_t() with clamp() in
      scrub_throttle_dev_io()
    - btrfs: always drop log root tree reference in btrfs_replay_log()
    - btrfs: use level argument in log tree walk callback replay_one_buffer()
    - btrfs: abort transaction if we fail to update inode in log replay dir
      fixup
    - btrfs: tree-checker: add inode extref checks
    - btrfs: use smp_mb__after_atomic() when forcing COW in
      create_pending_snapshot()
    - sched_ext: Make qmap dump operation non-destructive
    - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c
    - docs: kdoc: handle the obsolescensce of docutils.ErrorString()
    - mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR
    - f2fs: fix to avoid panic once fallocation fails for pinfile
      (CVE-2025-23130)
    - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac()
      (CVE-2025-38643)
    - bonding: return detailed error when loading native XDP fails
    - bonding: check xdp prog when set bond mode (CVE-2025-22105)
    - bits: add comments and newlines to #if, #else and #endif directives
    - bits: introduce fixed-type GENMASK_U*()
    - gpio: regmap: Allow to allocate regmap-irq device
    - gpio: regmap: add the .fixed_direction_output configuration parameter
    - gpio: idio-16: Define fixed direction of the GPIO lines
    - [amd64] iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (CVE-2025-21833)
    - wifi: ath12k: fix read pointer after free in
      ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995)
    - [amd64,arm64] udmabuf: fix a buf size overflow issue during udmabuf
      creation (CVE-2025-37803)
    - sfc: fix NULL dereferences in ef100_process_design_param()
      (CVE-2025-37860)
    - btrfs: tree-checker: fix bounds check in check_inode_extref()

  [ Salvatore Bonaccorso ]
  * drivers/infiniband/hw/bnxt_re: Enable INFINIBAND_BNXT_RE as module
    (Closes: #1109977)

  [ Ben Hutchings ]
  * d/salsa-ci.yml: Adjust filenames to allow source package name suffix
  * tools/hv: Make the sample hv_get_dhcp_info script more useful
  * hyperv-daemons: Install the sample network info scripts (Closes: #919350)
  * d/salsa-ci.yml: Fix cache configuration for build job
  * d/salsa-ci.yml: Move orig tarball generation to a separate job again
  * d/salsa-ci.yml: Restore lintian checking of source package

f33d673c054650549df1dfa7aa41cb36 9588 kernel optional linux-signed-arm64_6.12.57+1.dsc
5e4d6185b8a0ef10d1786e3c9ee0c8c6 850716 kernel optional linux-signed-arm64_6.12.57+1.tar.xz