linux (6.12.22-1~bpo12+1) bookworm-backports; urgency=medium

  * Rebuild for bookworm-backports:
    - lintian: Override invalid-arch-string-in-source-relation for loong64
  * Revert "d/salsa-ci.yml: Suppress aliased-location lintian errors"

linux (6.12.22-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.22
    - ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names
    - HID: hid-plantronics: Add mic mute mapping and generalize quirks
    - atm: Fix NULL pointer dereference
    - drm/amd/display: Don't write DP_MSTM_CTRL after LT
    - netfilter: socket: Lookup orig tuple for IPv6 SNAT
    - ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx
    - tty: serial: 8250: Add some more device IDs
    - tty: serial: 8250: Add Brainboxes XC devices
    - tty: serial: fsl_lpuart: disable transmitter before changing RS485 related
      registers
    - net: usb: qmi_wwan: add Telit Cinterion FN990B composition
    - net: usb: qmi_wwan: add Telit Cinterion FE990B composition
    - net: usb: usbnet: restore usb%d name exception for local mac addresses
    - usb: xhci: Don't skip on Stopped - Length Invalid
    - usb: xhci: Apply the link chain quirk on NEC isoc endpoints
    - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
    - perf tools: Fix up some comments and code to properly use the event_source
      bus
    - [armhf] serial: stm32: do not deassert RS485 RTS GPIO prematurely
    - serial: 8250_dma: terminate correct DMA in tx_dma_flush()
    - bcachefs: bch2_ioctl_subvolume_destroy() fixes

  [ Salvatore Bonaccorso ]
  * ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model
    (Closes: #1100928)
  * md: fix mddev uaf while iterating all_mddevs list (Closes: #1086175)

linux (6.12.21-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.21
    - [arm64] firmware: qcom: scm: Fix error code in probe()
    - [arm64] dts: freescale: tqma8mpql: Fix vqmmc-supply
    - [arm64] dts: rockchip: remove supports-cqe from rk3588 jaguar
    - [arm64] dts: rockchip: remove supports-cqe from rk3588 tiger
    - xfrm: fix tunnel mode TX datapath in packet offload mode
    - xfrm_output: Force software GSO only in tunnel mode
    - [arm64] soc: imx8m: Remove global soc_uid
    - [arm64] soc: imx8m: Use devm_* to simplify probe failure handling
    - [arm64] soc: imx8m: Unregister cpufreq and soc dev in cleanup path
    - [arm64] dts: bcm2712: PL011 UARTs are actually r1p5
    - [arm64] dts: rockchip: Remove undocumented sdmmc property from lubancat-1
    - RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex()
      tests
    - RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx
    - RDMA/mlx5: Handle errors returned from mlx5r_ib_rate()
    - dma-mapping: fix missing clear bdr in check_ram_in_range_map()
    - RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path
    - [arm64] RDMA/hns: Fix soft lockup during bt pages loop
    - [arm64] RDMA/hns: Fix unmatched condition in error path of
      alloc_user_qp_db()
    - [arm64] RDMA/hns: Fix invalid sq params not being blocked
    - [arm64] RDMA/hns: Fix a missing rollback in error path of
      hns_roce_create_qp_common()
    - [arm64] RDMA/hns: Fix missing xa_destroy()
    - [arm64] RDMA/hns: Fix wrong value of max_sge_rd
    - Bluetooth: Fix error code in chan_alloc_skb_cb()
    - Bluetooth: hci_event: Fix connection regression between LE and non-LE
      adapters
    - tracing: tprobe-events: Fix to clean up tprobe correctly when module
      unload
    - [arm64] net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence
    - net: ipv6: fix TCP GSO segmentation with NAT
    - ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().
    - ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create().
    - devlink: fix xa_alloc_cyclic() error handling
    - dpll: fix xa_alloc_cyclic() error handling
    - phy: fix xa_alloc_cyclic() error handling
    - [arm64,armhf] gpu: host1x: Do not assume that a NULL domain means no DMA
      IOMMU
    - net: atm: fix use after free in lec_send()
    - net: ti: icssg-prueth: Add lock to stats
    - net: lwtunnel: fix recursion loops
    - net: ipv6: ioam6: fix lwtunnel_output() loop
    - libfs: Fix duplicate directory entry in offset_dir_lookup
    - net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES
    - Revert "gre: Fix IPv6 link-local address generation."
    - tracing: tprobe-events: Fix leakage of module refcount
    - i2c: omap: fix IRQ storms
    - net: mana: Support holes in device list reply msg
    - dt-bindings: can: renesas,rcar-canfd: Fix typo in pattern properties for
      R-Car V4M
    - can: ucan: fix out of bound read in strscpy() source
    - [arm64,armhf] can: flexcan: only change CAN state when link up in system
      PM
    - [arm64,armhf] can: flexcan: disable transceiver during system PM
    - drm/xe: Fix exporting xe buffers multiple times
    - [arm64] drm/v3d: Don't run jobs that have errors flagged in its fence
    - io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally
    - [riscv64] dts: starfive: Fix a typo in StarFive JH7110 pin function
      definitions
    - netfs: Call `invalidate_cache` only if implemented
    - regulator: dummy: force synchronous probing
    - regulator: check that dummy regulator has been probed before using it
    - [arm64] dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound
      card
    - [arm64] dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound
      card
    - [arm64] dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou
    - [arm64] dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou
    - mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT
    - mm/migrate: fix shmem xarray update during migration
    - mm/page_alloc: fix memory accept before watermarks gets initialized
    - proc: fix UAF in proc_get_inode()
    - memcg: drain obj stock on cpu hotplug teardown
    - [arm64] firmware: qcom: uefisecapp: fix efivars registration race
    - efi/libstub: Avoid physical address 0x0 when doing random allocation
    - keys: Fix UAF in key_put()
    - xsk: fix an integer overflow in xp_create_and_assign_umem()
    - batman-adv: Ignore own maximum aggregation size during RX
    - [arm64] soc: qcom: pdr: Fix the potential deadlock
    - pmdomain: amlogic: fix T7 ISP secpower
    - drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()
    - drm/sched: Fix fence reference count leak
    - drm/amdgpu/gfx12: correct cleanup of 'me' field with gfx_v12_0_me_fini()
    - drm/amd/display: Fix message for support_edp0_on_dp1
    - drm/amd/display: Use HW lock mgr for PSR1 when only one eDP
    - drm/amd/pm: add unique_id for gfx12
    - drm/amdgpu: Restore uncached behaviour on GFX12
    - drm/amdgpu/pm: Handle SCLK offset correctly in overdrive for smu 14.0.2
    - drm/amdgpu/pm: wire up hwmon fan speed for smu 14.0.2
    - drm/amdgpu: Remove JPEG from vega and carrizo video caps
    - drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size
    - drm/amdgpu: Fix JPEG video caps max size for navi1x and raven
    - ksmbd: fix incorrect validation for num_aces field of smb_acl
    - io_uring/net: fix sendzc double notif flush
    - [arm64] KVM: arm64: Calculate cptr_el2 traps on activating traps
    - [arm64] KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state
    - [arm64] KVM: arm64: Remove host FPSIMD saving for non-protected KVM
    - [arm64] KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN
    - [arm64] KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN
    - [arm64] KVM: arm64: Refactor exit handlers
    - [arm64] KVM: arm64: Mark some header functions as inline
    - [arm64] KVM: arm64: Eagerly switch ZCR_EL{1,2}
    - Revert "sched/core: Reduce cost of sched_move_task when config autogroup"
    - libsubcmd: Silence compiler warning
    - [arm64] dts: rockchip: fix u2phy1_host status for NanoPi R4S
    - mm/huge_memory: drop beyond-EOF folios with the right number of refs
    - mptcp: Fix data stream corruption in the address announcement

  [ Ben Hutchings ]
  * lintian: Restore override for perf-read-vdso32 in linux-perf
  * linux-perf: Fix perf-check manual page built with asciidoctor
  * rtla: Add man page link for hwnoise(1)
  * intel-sdsi, rtla: Add "Depends: ${misc:Depends}"
  * d/copyright: Update filenames under arch/arm/boot/dts
  * d/copyright: Remove special case for drivers/crypto/vmx/*.pl
  * lintian: Override superfluous-file-pattern for d/copyright in
    linux-signed-*
  * d/salsa-ci.yml: Run lintian from the target release, not always unstable
  * [powerpc*] Revert "fbdev/offb: Update expected device name" (Closes:
    #1085949)
  * d/b/genpatch-rt: Fix subprocess cleanup with Python 3.13

  [ Salvatore Bonaccorso ]
  * sound/soc/amd/acp: Enable SND_AMD_ASOC_RENOIR as module (Closes: #1101155)
  * d/b/genpatch-rt: Drop now unused 'io' module.

  [ Vagrant Cascadian ]
  * drivers/net/wireless/realtek/rtw88: Enable RTW88_8723CS as a module

  [ Miguel Bernal Marin ]
  * [amd64,arm64/cloud] Enable virtualisation drivers on cloud flavours,
    (Closes: #1101378)
    - drivers/virt: Enable VIRT_DRIVERS
    - drivers/virt: Enable VMGENID
    - drivers/virt/nitro_enclaves: Enable NITRO_ENCLAVES as module
    - drivers/virt/coco/sev-guest: Enable SEV_GUEST as module
    - drivers/virt/coco/tdx-guest: Enable TDX_GUEST_DRIVER as module

linux (6.12.20-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.20
    - mm/slab/kvfree_rcu: Switch to WQ_MEM_RECLAIM wq
    - mm: fix kernel BUG when userfaultfd_move encounters swapcache
    - userfaultfd: fix PTE unmapping stack-allocated PTE copies
    - fbdev: hyperv_fb: iounmap() the correct memory when removing a device
    - netfilter: nft_ct: Use __refcount_inc() for per-CPU nft_ct_pcpu_template.
    - ice: do not configure destination override for switchdev
    - ice: fix memory leak in aRFS after reset
    - ice: Fix switchdev slow-path in LAG
    - netfilter: nf_conncount: garbage collection is not skipped when jiffies wrap around
    - netfilter: nf_tables: make destruction work queue pernet
    - sched: address a potential NULL pointer dereference in the GRED scheduler.
    - wifi: iwlwifi: mvm: fix PNVM timeout for non-MSI-X platforms
    - wifi: mac80211: don't queue sdata::work for a non-running sdata
    - wifi: cfg80211: cancel wiphy_work before freeing wiphy
    - Bluetooth: hci_event: Fix enabling passive scanning
    - Revert "Bluetooth: hci_core: Fix sleeping function called from invalid context"
    - net/mlx5: Fill out devlink dev info only for PFs
    - [arm64,armhf] net: dsa: mv88e6xxx: Verify after ATU Load ops
    - net: mctp i3c: Copy headers if cloned
    - net: mctp i2c: Copy headers if cloned
    - netpoll: hold rcu read lock in __netpoll_send_skb()
    - drm/hyperv: Fix address space leak when Hyper-V DRM device is removed
    - fbdev: hyperv_fb: Fix hang in kdump kernel when on Hyper-V Gen 2 VMs
    - fbdev: hyperv_fb: Simplify hvfb_putmem
    - fbdev: hyperv_fb: Allow graceful removal of framebuffer
    - Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio()
    - net/mlx5: handle errors in mlx5_chains_create_table()
    - eth: bnxt: fix truesize for mb-xdp-pass case
    - eth: bnxt: return fail if interface is down in bnxt_queue_mem_alloc()
    - eth: bnxt: do not use BNXT_VNIC_NTUPLE unconditionally in queue restart logic
    - eth: bnxt: do not update checksum in bnxt_xdp_build_skb()
    - eth: bnxt: fix kernel panic in the bnxt_get_queue_stats{rx | tx}
    - eth: bnxt: use page pool for head frags
    - bnxt_en: refactor tpa_info alloc/free into helpers
    - bnxt_en: handle tpa_info in queue API implementation
    - eth: bnxt: fix memory leak in queue reset
    - net: switchdev: Convert blocking notification chain to a raw one
    - net: mctp: unshare packets when reassembling
    - bonding: fix incorrect MAC address setting to receive NS messages
    - netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()
    - ipvs: prevent integer overflow in do_ip_vs_get_ctl()
    - net_sched: Prevent creation of classes with TC_H_ROOT
    - netfilter: nft_exthdr: fix offset with ipv4_find_option()
    - gre: Fix IPv6 link-local address generation.
    - net: openvswitch: remove misbehaving actions length check
    - Revert "openvswitch: switch to per-action label counting in conntrack"
    - net/mlx5: HWS, Rightsize bwc matcher priority
    - net/mlx5: Fix incorrect IRQ pool usage when releasing IRQs
    - net/mlx5: Lag, Check shared fdb before creating MultiPort E-Switch
    - net/mlx5: Bridge, fix the crash caused by LAG state check
    - net/mlx5e: Prevent bridge link show failure for non-eswitch-allowed devices
    - nvme-fc: go straight to connecting state when initializing
    - nvme-fc: do not ignore connectivity loss during connecting
    - hrtimers: Mark is_migration_base() with __always_inline
    - powercap: call put_device() on an error path in powercap_register_control_type()
    - btrfs: avoid starting new transaction when cleaning qgroup during subvolume drop
    - futex: Pass in task to futex_queue()
    - iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
    - [x86] platform/x86/intel: pmc: fix ltr decode in pmc_core_ltr_show()
    - drm/amd/display: Fix out-of-bound accesses
    - scsi: core: Use GFP_NOIO to avoid circular locking dependency
    - scsi: ufs: core: Fix error return with query response
    - scsi: qla1280: Fix kernel oops when debug level > 2
    - ACPI: resource: IRQ override for Eluktronics MECH-17
    - smb: client: fix noisy when tree connecting to DFS interlink targets
    - sched_ext: selftests/dsp_local_on: Fix sporadic failures
    - [amd64] HID: intel-ish-hid: fix the length of MNG_SYNC_FW_CLOCK in doorbell
    - [amd64] HID: intel-ish-hid: Send clock sync message immediately after reset
    - HID: ignore non-functional sensor in HP 5MP Camera
    - HID: hid-steam: Fix issues with disabling both gamepad mode and lizard mode
    - usb: phy: generic: Use proper helper for property detection
    - [amd64] HID: intel-ish-hid: ipc: Add Panther Lake PCI device IDs
    - HID: topre: Fix n-key rollover on Realforce R3S TKL boards
    - HID: hid-apple: Apple Magic Keyboard a3203 USB-C support
    - HID: apple: fix up the F6 key on the Omoton KB066 keyboard
    - btrfs: fix two misuses of folio_shift()
    - objtool: Ignore dangling jump table entries
    - sched: Clarify wake_up_q()'s write to task->wake_q.next
    - [x86] platform/x86: thinkpad_acpi: Fix invalid fan speed on ThinkPad X120e
    - [x86] platform/x86: thinkpad_acpi: Support for V9 DYTC platform profiles
    - [x86] platform/x86: int3472: Use correct type for "polarity", call it gpio_flags
    - [x86] platform/x86: int3472: Call "reset" GPIO "enable" for INT347E
    - [s390x] cio: Fix CHPID "configure" attribute caching
    - thermal/cpufreq_cooling: Remove structure member documentation
    - [arm64] amu: Delay allocating cpumask for AMU FIE support
    - Xen/swiotlb: mark xen_swiotlb_fixup() __init
    - Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
    - [amd64] ASoC: Intel: sof_sdw: Add lookup of quirk using PCI subsystem ID
    - [amd64] ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S14
    - [amd64] ASoC: Intel: soc-acpi-intel-mtl-match: declare adr as ull
    - ASoC: simple-card-utils.c: add missing dlc->of_node
    - ALSA: hda/realtek: Limit mic boost on Positivo ARN50
    - [amd64] ASoC: SOF: Intel: hda: add softdep pre to snd-hda-codec-hdmi module
    - PCI: pci_ids: add INTEL_HDA_PTL_H
    - ALSA: hda: intel-dsp-config: Add PTL-H support
    - [amd64] ASoC: SOF: Intel: pci-ptl: Add support for PTL-H
    - ALSA: hda: hda-intel: add Panther Lake-H support
    - [amd64] ASoC: SOF: amd: Add post_fw_run_delay ACP quirk
    - [amd64] ASoC: SOF: amd: Handle IPC replies before FW_BOOT_COMPLETE
    - net: wwan: mhi_wwan_mbim: Silence sequence number glitch errors
    - io-wq: backoff when retrying worker creation
    - nvme-pci: quirk Acer FA100 for non-uniqueue identifiers
    - nvmet-rdma: recheck queue state is LIVE in state lock in recv done
    - apple-nvme: Release power domains when probe fails
    - cifs: Treat unhandled directory name surrogate reparse points as mount directory nodes
    - sctp: Fix undefined behavior in left shift operation
    - nvme: only allow entering LIVE from CONNECTING state
    - phy: ti: gmii-sel: Do not use syscon helper to build regmap
    - fuse: don't truncate cached, mutated symlink
    - ASoC: dapm-graph: set fill colour of turned on nodes
    - [amd64] ASoC: SOF: Intel: don't check number of sdw links when set dmic_fixup
    - drm/vkms: Round fixp2int conversion in lerp_u16
    - [x86] perf/x86/intel: Use better start period for frequency mode
    - [x86] of: Don't use DTB for SMP setup if ACPI is enabled
    - [x86] irq: Define trace events conditionally
    - [x86] perf/x86/rapl: Add support for Intel Arrow Lake U
    - mptcp: safety check before fallback
    - drm/nouveau: Do not override forced connector status
    - net: Handle napi_schedule() calls from non-interrupt
    - block: fix 'kmem_cache of name 'bio-108' already exists'
    - vhost: return task creation error instead of NULL
    - cifs: Validate content of WSL reparse point buffers
    - cifs: Throw -EOPNOTSUPP error on unsupported reparse point type from parse_reparse_point()
    - Input: goodix-berlin - fix vddio regulator references
    - Input: ads7846 - fix gpiod allocation
    - Input: iqs7222 - preserve system status register
    - Input: xpad - add 8BitDo SN30 Pro, Hyperkin X91 and Gamesir G7 SE controllers
    - Input: xpad - add multiple supported devices
    - Input: xpad - add support for ZOTAC Gaming Zone
    - Input: xpad - add support for TECNO Pocket Go
    - Input: xpad - rename QH controller to Legion Go S
    - Input: i8042 - swap old quirk combination with new quirk for NHxxRZQ
    - Input: i8042 - add required quirks for missing old boardnames
    - Input: i8042 - swap old quirk combination with new quirk for several devices
    - Input: i8042 - swap old quirk combination with new quirk for more devices
    - USB: serial: ftdi_sio: add support for Altera USB Blaster 3
    - USB: serial: option: add Telit Cinterion FE990B compositions
    - USB: serial: option: fix Telit Cinterion FE990A name
    - USB: serial: option: match on interface class for Telit FN990B
    - [x86] microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes
    - spi: microchip-core: prevent RX overflows when transmit size > FIFO size
    - [amd64] drm/i915/cdclk: Do cdclk post plane programming later
    - drm/panic: use `div_ceil` to clean Clippy warning
    - drm/panic: fix overindented list items in documentation
    - drm/atomic: Filter out redundant DPMS calls
    - drm/dp_mst: Fix locking when skipping CSN before topology probing
    - drm/amdgpu: NULL-check BO's backing store when determining GFX12 PTE flags
    - drm/amd/amdkfd: Evict all queues even HWS remove queue failed
    - drm/amdgpu/display: Allow DCC for video formats on GFX12
    - drm/amd/display: Disable unneeded hpd interrupts during dm_init
    - drm/amd/display: fix default brightness
    - drm/amd/display: fix missing .is_two_pixels_per_container
    - drm/amd/display: Restore correct backlight brightness after a GPU reset
    - drm/amd/display: Assign normalized_pix_clk when color depth = 14
    - drm/amd/display: Fix slab-use-after-free on hdcp_work
    - ksmbd: fix use-after-free in ksmbd_free_work_struct
    - ksmbd: prevent connection release during oplock break notification
    - clk: samsung: update PLL locktime for PLL142XX used on FSD platform
    - clk: samsung: gs101: fix synchronous external abort in samsung_clk_save()
    - [amd64] ASoC: Intel: sof_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks()
    - [amd64] ASoC: amd: yc: Support mic on another Lenovo ThinkPad E16 Gen 2 model
    - netmem: prevent TX of unreadable skbs
    - dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature
    - [arm64] mm: Populate vmemmap at the page level if not section aligned
    - Fix mmu notifiers for range-based invalidates
    - qlcnic: fix memory leak issues in qlcnic_sriov_common.c
    - smb: client: fix regression with guest option
    - net: phy: nxp-c45-tja11xx: add TJA112X PHY configuration errata
    - net: phy: nxp-c45-tja11xx: add TJA112XB SGMII PCS restart errata
    - sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl()
    - ASoC: ops: Consistently treat platform_max as control value
    - drm/gma500: Add NULL check for pci_gfx_root in mid_get_vbt_data()
    - [amd64] ASoC: cs42l43: Fix maximum ADC Volume
    - [amd64] ASoC: rt722-sdca: add missing readable registers
    - drm/xe: cancel pending job timer before freeing scheduler
    - drm/xe: Release guc ids before cancelling work
    - drm/xe/userptr: Fix an incorrect assert
    - drm/xe/pm: Temporarily disable D3Cold on BMG
    - nvme: move error logging from nvme_end_req() to __nvme_end_req()
    - ASoC: codecs: wm0010: Fix error handling path in wm0010_spi_probe()
    - [amd64] drm/i915: Increase I915_PARAM_MMAP_GTT_VERSION version to indicate support for partial mmaps
    - scripts: generate_rust_analyzer: add missing macros deps
    - scripts: generate_rust_analyzer: add missing include_dirs
    - scripts: generate_rust_analyzer: add uapi crate
    - block: change blk_mq_add_to_batch() third argument type to bool
    - cifs: Fix integer overflow while processing acregmax mount option
    - cifs: Fix integer overflow while processing acdirmax mount option
    - cifs: Fix integer overflow while processing actimeo mount option
    - cifs: Fix integer overflow while processing closetimeo mount option
    - [x86] vmware: Parse MP tables for SEV-SNP enabled guests under VMware hypervisors
    - i2c: ali1535: Fix an error handling path in ali1535_probe()
    - i2c: ali15x3: Fix an error handling path in ali15x3_probe()
    - i2c: sis630: Fix an error handling path in sis630_probe()
    - mm/hugetlb: wait for hugetlb folios to be freed
    - smb3: add support for IAKerb
    - smb: client: Fix match_session bug preventing session reuse
    - sched_ext: selftests/dsp_local_on: Fix selftest on UP systems
    - tools/sched_ext: Add helper to check task migration state
    - Bluetooth: L2CAP: Fix corrupted list in hci_chan_del
    - nvme-fc: rely on state transitions to handle connectivity loss
    - HID: apple: disable Fn key handling on the Omoton KB066

  [ Madhu Adav M J ]
  * drivers/nvme/target: Enable NVME_TARGET_PASSTHRU
  * drivers/nvme/target: Enable NVME_TARGET_LOOP and NVME_TARGET_FCLOOP
    as modules

  [ Salvatore Bonaccorso ]
  * net/sunrpc: Enable RPCSEC_GSS_KRB5_ENCTYPES_AES_SHA2 (Closes: #1100641)
  * [x86] drivers/pinctrl/intel: Enable PINCTRL_INTEL_PLATFORM as module
    (Closes: #1100694)
  * ata: libata-core: Add ATA_QUIRK_NO_LPM_ON_ATI for certain Samsung SSDs
    (Closes: #1091696)

linux (6.12.19-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.18
    - RDMA/mlx5: Fix the recovery flow of the UMR QP
    - IB/mlx5: Set and get correct qp_num for a DCT QP
    - RDMA/mlx5: Fix a race for DMABUF MR which can lead to CQE with error
    - RDMA/mlx5: Fix a WARN during dereg_mr for DM type
    - RDMA/mana_ib: Allocate PAGE aligned doorbell index
    - RDMA/hns: Fix mbox timing out by adding retry mechanism
    - RDMA/bnxt_re: Fail probe early when not enough MSI-x vectors are reserved
    - RDMA/bnxt_re: Refactor NQ allocation
    - RDMA/bnxt_re: Cache MSIx info to a local structure
    - RDMA/bnxt_re: Add sanity checks on rdev validity
    - RDMA/bnxt_re: Allocate dev_attr information dynamically
    - RDMA/bnxt_re: Fix the statistics for Gen P7 VF
    - landlock: Fix non-TCP sockets restriction
    - scsi: ufs: core: Fix ufshcd_is_ufs_dev_busy() and ufshcd_eh_timed_out()
    - ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
    - NFS: O_DIRECT writes must check and adjust the file length
    - NFS: Adjust delegated timestamps for O_DIRECT reads and writes
    - SUNRPC: Prevent looping due to rpc_signal_task() races
    - NFSv4: Fix a deadlock when recovering state on a sillyrenamed file
    - SUNRPC: Handle -ETIMEDOUT return from tlshd
    - RDMA/mlx5: Fix implicit ODP hang on parent deregistration
    - RDMA/mlx5: Fix AH static rate parsing
    - scsi: core: Clear driver private data when retrying request
    - scsi: ufs: core: Set default runtime/system PM levels before
      ufshcd_hba_init()
    - RDMA/mlx5: Fix bind QP error cleanup flow
    - RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers
    - sunrpc: suppress warnings for unused procfs functions
    - ALSA: usb-audio: Avoid dropping MIDI events at closing multiple ports
    - Bluetooth: L2CAP: Fix L2CAP_ECRED_CONN_RSP response
    - rxrpc: rxperf: Fix missing decoding of terminal magic cookie
    - afs: Fix the server_list to unuse a displaced server rather than putting
      it
    - afs: Give an afs_server object a ref on the afs_cell object it points to
    - net: loopback: Avoid sending IP packets without an Ethernet header
    - net: set the minimum for net_hotdata.netdev_budget_usecs
    - ipv4: Convert icmp_route_lookup() to dscp_t.
    - ipv4: Convert ip_route_input() to dscp_t.
    - ipvlan: Prepare ipvlan_process_v4_outbound() to future .flowi4_tos
      conversion.
    - ipvlan: ensure network headers are in skb linear part
    - net: cadence: macb: Synchronize stats calculations
    - net: dsa: rtl8366rb: Fix compilation problem
    - [armhf] ASoC: es8328: fix route from DAC to output
    - [arm64,armhf] ASoC: fsl: Rename stream name of SAI DAI driver
    - ipvs: Always clear ipvs_property flag in skb_scrub_packet()
    - drm/xe/oa: Signal output fences
    - drm/xe/oa: Move functions up so they can be reused for config ioctl
    - drm/xe/oa: Add syncs support to OA config ioctl
    - drm/xe/oa: Allow only certain property changes from config
    - drm/xe/oa: Allow oa_exponent value of 0
    - firmware: cs_dsp: Remove async regmap writes
    - [amd64] ASoC: cs35l56: Prevent races when soft-resetting using SPI control
    - ALSA: hda/realtek: Fix wrong mic setup for ASUS VivoBook 15
    - net: ethernet: ti: am65-cpsw: select PAGE_POOL
    - tcp: devmem: don't write truncated dmabuf CMSGs to userspace
    - ice: add E830 HW VF mailbox message limit support
    - ice: Fix deinitializing VF in error path
    - ice: Avoid setting default Rx VSI twice in switchdev setup
    - tcp: Defer ts_recent changes until req is owned
    - net: Clear old fragment checksum value in napi_reuse_skb
    - [arm64,armhf] net: mvpp2: cls: Fixed Non IP flow, with vlan tag flow
      defination.
    - net/mlx5: IRQ, Fix null string in debug print
    - net: ipv6: fix dst ref loop on input in seg6 lwt
    - net: ipv6: fix dst ref loop on input in rpl lwt
    - idpf: fix checksums set in idpf_rx_rsc()
    - net: ti: icss-iep: Reject perout generation request
    - thermal: gov_power_allocator: Fix incorrect calculation in
      divvy_up_power()
    - perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list
    - uprobes: Reject the shared zeropage in uprobe_write_opcode()
    - thermal: of: Simplify thermal_of_should_bind with scoped for each OF child
    - thermal/of: Fix cdev lookup in thermal_of_should_bind()
    - thermal: core: Move lists of thermal instances to trip descriptors
    - thermal: gov_power_allocator: Update total_weight on bind and cdev updates
    - io_uring/net: save msg_control for compat
    - unreachable: Unify
    - objtool: Remove annotate_{,un}reachable()
    - objtool: Fix C jump table annotations for Clang
    - [x86] CPU: Fix warm boot hang regression on AMD SC1100 SoC systems
    - phy: rockchip: fix Kconfig dependency more
    - [riscv64] KVM: Fix hart suspend status check
    - [riscv64] KVM: Fix hart suspend_type use
    - [riscv64] KVM: Fix SBI IPI error generation
    - [riscv64] KVM: Fix SBI TIME error generation
    - tracing: Fix bad hist from corrupting named_triggers list
    - ftrace: Avoid potential division by zero in function_stat_show()
    - ALSA: usb-audio: Re-add sample rate quirk for Pioneer DJM-900NXS2
    - ALSA: hda/realtek: Fix microphone regression on ASUS N705UD
    - [arm64] KVM: arm64: Ensure a VMID is allocated before programming
      VTTBR_EL2
    - perf/core: Add RCU read lock protection to perf_iterate_ctx()
    - [x86] perf/x86: Fix low freqency setting issue
    - perf/core: Fix low freq setting via IOC_PERIOD
    - drm/xe/regs: remove a duplicate definition for RING_CTL_SIZE(size)
    - drm/xe/userptr: restore invalidation list on error
    - drm/xe/userptr: fix EFAULT handling
    - drm/amdkfd: Preserve cp_hqd_pq_control on update_mqd
    - drm/amdgpu: disable BAR resize on Dell G5 SE
    - drm/amdgpu: init return value in amdgpu_ttm_clear_buffer
    - drm/amd/display: Disable PSR-SU on eDP panels
    - drm/amd/display: add a quirk to enable eDP0 on DP1
    - drm/amd/display: Fix HPD after gpu reset
    - [arm64] mm: Fix Boot panic on Ampere Altra
    - block: Remove zone write plugs when handling native zone append writes
    - i2c: npcm: disable interrupt enable bit before devm_request_irq
    - i2c: ls2x: Fix frequency division register access
    - usbnet: gl620a: fix endpoint checking in genelink_bind()
    - net: phy: qcom: qca807x fix condition for DAC_DSP_BIAS_CURRENT
    - [arm64] net: enetc: fix the off-by-one issue in enetc_map_tx_buffs()
    - [arm64] net: enetc: keep track of correct Tx BD count in
      enetc_map_tx_tso_buffs()
    - [arm64] net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC
    - [arm64] net: enetc: update UDP checksum when updating originTimestamp
      field
    - [arm64] net: enetc: correct the xdp_tx statistics
    - [arm64] net: enetc: fix the off-by-one issue in enetc_map_tx_tso_buffs()
    - [arm64,armhf] phy: exynos5-usbdrd: fix MPLL_MULTIPLIER and SSC_REFCLKSEL
      masks in refclk
    - [arm64,armhf] phy: exynos5-usbdrd: gs101: ensure power is gated to SS phy
      in phy_exit()
    - [amd64] iommu/vt-d: Remove device comparison in
      context_setup_pass_through_cb
    - [amd64] iommu/vt-d: Fix suspicious RCU usage
    - [amd64] intel_idle: Handle older CPUs, which stop the TSC in deeper C
      states, correctly (Closes: #1088682)
    - mptcp: always handle address removal under msk socket lock
    - mptcp: reset when MPTCP opts are dropped after join
    - vmlinux.lds: Ensure that const vars with relocations are mapped R/O
    - rcuref: Plug slowpath race in rcuref_put()
    - sched/core: Prevent rescheduling when interrupts are disabled
    - sched_ext: Fix pick_task_scx() picking non-queued tasks when it's called
      without balance()
    - dm-integrity: Avoid divide by zero in table status in Inline mode
    - dm vdo: add missing spin_lock_init
    - ima: Reset IMA_NONACTION_RULE_FLAGS after post_setattr
    - scsi: ufs: core: bsg: Fix crash when arpmb command fails
    - [riscv64] futex: sign extend compare value in atomic cmpxchg
    - [riscv64] signal: fix signal frame size
    - [riscv64] cacheinfo: Use of_property_present() for non-boolean properties
    - [riscv64] signal: fix signal_minsigstksz
    - [riscv64] cpufeature: use bitmap_equal() instead of memcmp()
    - efi: Don't map the entire mokvar table to determine its size
    - amdgpu/pm/legacy: fix suspend/resume issues
    - [x86] microcode/AMD: Return bool from find_blobs_in_containers()
    - [x86] microcode/AMD: Have __apply_microcode_amd() return bool
    - [x86] microcode/AMD: Remove ugly linebreak in __verify_patch_section()
      signature
    - [x86] microcode/AMD: Remove unused save_microcode_in_initrd_amd()
      declarations
    - [x86] microcode/AMD: Merge early_apply_microcode() into its single
      callsite
    - [x86] microcode/AMD: Get rid of the _load_microcode_amd() forward
      declaration
    - [x86] microcode/AMD: Add get_patch_level()
    - [x86] microcode/AMD: Load only SHA256-checksummed patches
    - thermal: gov_power_allocator: Add missing NULL pointer check
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.19
    - [x86] amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range()
    - [amd64] drm/i915/dsi: convert to struct intel_display
    - [amd64] drm/i915/dsi: Use TRANS_DDI_FUNC_CTL's own port width macro
    - [arm64,armhf] gpio: vf610: use generic device_get_match_data()
    - [arm64,armhf] gpio: vf610: add locking to gpio direction functions
    - cifs: Remove symlink member from cifs_open_info_data union
    - smb311: failure to open files of length 1040 when mounting with SMB3.1.1
      POSIX extensions
    - btrfs: fix data overwriting bug during buffered write when block size <
      page size
    - [x86] microcode/AMD: Add some forgotten models to the SHA check
    - Revert "of: reserved-memory: Fix using wrong number of cells to get
      property 'alignment'"
    - tracing: tprobe-events: Fix a memory leak when tprobe with $retval
    - tracing: tprobe-events: Reject invalid tracepoint name
    - [amd64] HID: appleir: Fix potential NULL dereference at raw event handle
    - ksmbd: fix type confusion via race condition when using
      ipc_msg_send_request
    - ksmbd: fix out-of-bounds in parse_sec_desc()
    - ksmbd: fix use-after-free in smb2_lock
    - ksmbd: fix bug on trap in smb2_lock
    - [arm64] gpio: rcar: Use raw_spinlock to protect register access
    - ALSA: seq: Avoid module auto-load handling at event delivery
    - ALSA: hda: intel: Add Dell ALC3271 to power_save denylist
    - ALSA: hda/realtek - add supported Mic Mute LED for Lenovo platform
    - ALSA: hda/realtek: update ALC222 depop optimize
    - btrfs: fix a leaked chunk map issue in read_one_chunk()
    - hwmon: (peci/dimmtemp) Do not provide fake thresholds data
    - drm/amd/display: Fix null check for pipe_ctx->plane_state in
      resource_build_scaling_params
    - drm/amdkfd: Fix NULL Pointer Dereference in KFD queue
    - drm/amd/pm: always allow ih interrupt from fw
    - drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M
    - Revert "mm/page_alloc.c: don't show protection in zone's
      ->lowmem_reserve[] for empty zone"
    - Revert "selftests/mm: remove local __NR_* definitions"
    - [x86] platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e
    - [x86] boot: Sanitize boot params before parsing command line
    - [x86] cacheinfo: Validate CPUID leaf 0x2 EDX output
    - [x86] cpu: Validate CPUID leaf 0x2 EDX output
    - [x86] cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63
    - drm/xe: Add staging tree for VM binds
    - drm/xe/hmm: Style- and include fixes
    - drm/xe/hmm: Don't dereference struct page pointers without notifier lock
    - drm/xe/vm: Fix a misplaced #endif
    - drm/xe/vm: Validate userptr during gpu vma prefetching
    - mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr
    - drm/xe: Fix GT "for each engine" workarounds
    - drm/xe: Fix fault mode invalidation with unbind
    - drm/xe/userptr: properly setup pfn_flags_mask
    - drm/xe/userptr: Unmap userptrs in the mmu notifier
    - Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name()
    - Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected()
    - wifi: cfg80211: regulatory: improve invalid hints checking
    - wifi: nl80211: reject cooked mode if it is set along with other flags
    - rapidio: add check for rio_add_net() in rio_scan_alloc_net()
    - rapidio: fix an API misues when rio_add_net() fails
    - dma: kmsan: export kmsan_handle_dma() for modules
    - [s390x] traps: Fix test_monitor_call() inline assembly
    - NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback
    - userfaultfd: do not block on locking a large folio with raised refcount
    - block: fix conversion of GPT partition name to 7-bit
    - mm/page_alloc: fix uninitialized variable
    - mm: abort vma_modify() on merge out of memory failure
    - mm: memory-failure: update ttu flag inside unmap_poisoned_folio
    - mm: don't skip arch_sync_kernel_mappings() in error paths
    - mm: fix finish_fault() handling for large folios
    - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio
    - mm: memory-hotplug: check folio ref count first in do_migrate_range
    - wifi: iwlwifi: mvm: clean up ROC on failure
    - wifi: iwlwifi: mvm: don't try to talk to a dead firmware
    - wifi: iwlwifi: limit printed string from FW file
    - wifi: iwlwifi: Free pages allocated when failing to build A-MSDU
    - wifi: iwlwifi: Fix A-MSDU TSO preparation
    - HID: google: fix unused variable warning under !CONFIG_ACPI
    - [amd64] HID: intel-ish-hid: Fix use-after-free issue in
      hid_ishtp_cl_remove()
    - [amd64] HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
    - coredump: Only sort VMAs when core_sort_vma sysctl is set
    - nvme-pci: add support for sgl metadata
    - nvme-pci: use sgls for all user requests if possible
    - nvme-ioctl: fix leaked requests on mapping error
    - wifi: mac80211: Support parsing EPCS ML element
    - wifi: mac80211: fix MLE non-inheritance parsing
    - wifi: mac80211: fix vendor-specific inheritance
    - drm/fbdev-helper: Move color-mode lookup into 4CC format helper
    - drm/fbdev: Add memory-agnostic fbdev client
    - drm: Add client-agnostic setup helper
    - drm/fbdev-ttm: Support struct drm_driver.fbdev_probe
    - drm/nouveau: Run DRM default client setup
    - drm/nouveau: select FW caching
    - bluetooth: btusb: Initialize .owner field of force_poll_sync_fops
    - nvme-tcp: add basic support for the C2HTermReq PDU
    - nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()
    - nvmet-tcp: Fix a possible sporadic response drops in weakly ordered arch
    - ALSA: hda/realtek: Remove (revert) duplicate Ally X config
    - net: gso: fix ownership in __udp_gso_segment
    - caif_virtio: fix wrong pointer check in cfv_probe()
    - perf/core: Fix pmus_lock vs. pmus_srcu ordering
    - hwmon: (pmbus) Initialise page count in pmbus_identify()
    - hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table
    - hwmon: (ad7314) Validate leading zero bits and return error
    - tracing: probe-events: Remove unused MAX_ARG_BUF_LEN macro
    - drm/imagination: Fix timestamps in firmware traces
    - ALSA: usx2y: validate nrpacks module parameter on probe
    - llc: do not use skb_get() before dev_queue_xmit()
    - hwmon: fix a NULL vs IS_ERR_OR_NULL() check in xgene_hwmon_probe()
    - drm/sched: Fix preprocessor guard
    - be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink
    - [arm64] net: hns3: make sure ptp clock is unregister and freed if
      hclge_ptp_get_cycle returns an error
    - [amd64] drm/i915/color: Extract intel_color_modeset()
    - [amd64] drm/i915: Plumb 'dsb' all way to the plane hooks
    - drm/xe: Remove double pageflip
    - HID: hid-steam: Fix use-after-free when detaching device
    - [arm64] net: ipa: Fix v4.7 resource group names
    - [arm64] net: ipa: Fix QSB data for v4.7
    - [arm64] net: ipa: Enable checksum for IPA_ENDPOINT_AP_MODEM_{RX,TX} for
      v4.7
    - ppp: Fix KMSAN uninit-value warning with bpf
    - ethtool: linkstate: migrate linkstate functions to support multi-PHY
      setups
    - net: ethtool: plumb PHY stats to PHY drivers
    - net: ethtool: netlink: Allow NULL nlattrs when getting a phy_device
    - vlan: enforce underlying device type
    - [x86] sgx: Fix size overflows in sgx_encl_create()
    - exfat: fix just enough dentries but allocate a new cluster to dir
    - exfat: fix soft lockup in exfat_clear_bitmap
    - exfat: short-circuit zero-byte writes in exfat_file_write_iter
    - net-timestamp: support TCP GSO case for a few missing flags
    - ublk: set_params: properly check if parameters can be applied
    - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list
    - nvme-tcp: fix signedness bug in nvme_tcp_init_connection()
    - net: dsa: mt7530: Fix traffic flooding for MMIO devices
    - mctp i3c: handle NULL header address
    - net: ipv6: fix dst ref loop in ila lwtunnel
    - net: ipv6: fix missing dst ref drop in ila lwtunnel
    - [arm64] gpio: rcar: Fix missing of_node_put() call
    - Revert "drivers/card_reader/rtsx_usb: Restore interrupt based detection"
    - usb: renesas_usbhs: Call clk_put()
    - xhci: Restrict USB4 tunnel detection for USB3 devices to Intel hosts
    - usb: renesas_usbhs: Use devm_usb_get_phy()
    - usb: hub: lack of clearing xHC resources
    - usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card
      Reader
    - usb: typec: ucsi: Fix NULL pointer access
    - usb: renesas_usbhs: Flush the notify_hotplug_work
    - usb: gadget: u_ether: Set is_suspend flag if remote wakeup fails
    - usb: atm: cxacru: fix a flaw in existing endpoint checks
    - usb: dwc3: Set SUSPENDENABLE soon after phy init
    - usb: dwc3: gadget: Prevent irq storm when TH re-executes
    - usb: typec: ucsi: increase timeout for PPM reset operations
    - usb: typec: tcpci_rt1711h: Unmask alert interrupts to fix functionality
    - usb: gadget: Set self-powered based on MaxPower and bmAttributes
    - usb: gadget: Fix setting self-powered state on suspend
    - usb: gadget: Check bmAttributes only if configuration is valid
    - acpi: typec: ucsi: Introduce a ->poll_cci method
    - xhci: pci: Fix indentation in the PCI device ID definitions
    - usb: xhci: Enable the TRB overfetch quirk on VIA VL805
    - [amd64] KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI
      shadow
    - [amd64] KVM: SVM: Save host DR masks on CPUs with DebugSwap
    - [amd64] KVM: SVM: Drop DEBUGCTL[5:2] from guest's effective value
    - [amd64] KVM: SVM: Suppress DEBUGCTL.BTF on AMD
    - [amd64] KVM: x86: Snapshot the host's DEBUGCTL in common x86
    - [amd64] KVM: SVM: Manually context switch DEBUGCTL if LBR virtualization
      is disabled
    - [amd64] KVM: x86: Snapshot the host's DEBUGCTL after disabling IRQs
    - [amd64] KVM: x86: Explicitly zero EAX and EBX when PERFMON_V2 isn't
      supported by KVM
    - cdx: Fix possible UAF error in driver_override_show()
    - mei: me: add panther lake P DID
    - mei: vsc: Use "wakeuphostint" when getting the host wakeup GPIO
    - [amd64] intel_th: pci: Add Arrow Lake support
    - [amd64] intel_th: pci: Add Panther Lake-H support
    - [amd64] intel_th: pci: Add Panther Lake-P/U support
    - char: misc: deallocate static minor in error path
    - drivers: core: fix device leak in __fw_devlink_relax_cycles()
    - slimbus: messaging: Free transaction ID in delayed interrupt scenario
    - bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid
      deadlock
    - eeprom: digsy_mtc: Make GPIO lookup table match the device
    - drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl
    - iio: filter: admv8818: Force initialization of SDO
    - iio: light: apds9306: fix max_scale_nano values
    - iio: dac: ad3552r: clear reset status flag
    - iio: adc: ad7192: fix channel select
    - iio: adc: at91-sama5d2_adc: fix sama7g5 realbits value
    - mm: hugetlb: Add huge page size param to huge_ptep_get_and_clear()
    - [arm64] hugetlb: Fix huge_ptep_get_and_clear() for non-present ptes
    - fs/netfs/read_pgpriv2: skip folio queues without `marks3`
      (Closes: #1098698, #1099591)
    - fs/netfs/read_collect: fix crash due to uninitialized `prev` variable
      (Closes: #1098698, #1099591)
    - ALSA: hda: realtek: fix incorrect IS_REACHABLE() usage
    - nvme-tcp: Fix a C2HTermReq error message
    - Revert "KVM: e500: always restore irqs"
    - Revert "KVM: PPC: e500: Use __kvm_faultin_pfn() to handle page faults"
    - Revert "KVM: PPC: e500: Mark "struct page" pfn accessed before dropping
      mmu_lock"
    - Revert "KVM: PPC: e500: Mark "struct page" dirty in
      kvmppc_e500_shadow_map()"
    - KVM: e500: always restore irqs
    - uprobes: Fix race in uprobe_free_utask
    - [x86] mm: Don't disable PCID when INVLPG has been fixed by microcode
    - wifi: iwlwifi: pcie: Fix TSO preparation

  [ Bastian Blank ]
  * Compress kernel with zstd where supported. (Closes: #1099722)

  [ Matt Mower ]
  * [amd64] sound/soc/amd/acp: Enable SND_AMD_ASOC_ACP70, SND_SOC_AMD_ACP_PCI
    and SND_SOC_AMD_LEGACY_MACH as modules (Closes: #1096006)

  [ Uwe Kleine-König ]
  * Enable IIO HRTIMER and SYSFS trigger. These are useful to do high-speed
    continuous and manual (or scripted) sensor reading respectively.

  [ Dmytro Sinina ]
  * sound/pci/hda: Enable SND_HDA_SCODEC_CS35L56_I2C,
    SND_HDA_SCODEC_CS35L56_SPI, SND_SOC_CS35L56_I2C, SND_SOC_CS35L56_SPI,
    SND_SOC_CS35L56_SDW as modules

  [ Steev Klimaszewski ]
  * [arm64] Enable modules for Thinkpad X13s webcam (Closes: #1100036)

  [ Salvatore Bonaccorso ]
  * drm/amdkfd: Fix user queue validation on Gfx7/8 (Closes: #1093124)
  * fs/netfs/read_collect: add to next->prev_donated
    (Closes: #1098698, #1099591)

linux (6.12.17-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.17
    - [arm64] mte: Do not allow PROT_MTE on MAP_HUGETLB user mappings
    - drm/xe/oa: Separate batch submission from waiting for completion
    - drm/xe/oa/uapi: Define and parse OA sync properties
    - drm/xe/oa: Add input fence dependencies
    - xe/oa: Fix query mode of operation for OAR/OAC
    - btrfs: do not assume the full page range is not dirty in
      extent_writepage_io()
    - btrfs: move the delalloc range bitmap search into extent_io.c
    - btrfs: mark all dirty sectors as locked inside writepage_delalloc()
    - btrfs: remove unused btrfs_folio_start_writer_lock()
    - btrfs: unify to use writer locks for subpage locking
    - btrfs: rename btrfs_folio_(set|start|end)_writer_lock()
    - btrfs: use btrfs_inode in extent_writepage()
    - btrfs: fix double accounting race when btrfs_run_delalloc_range() failed
    - btrfs: fix double accounting race when extent_writepage_io() failed
    - [amd64] KVM: x86: Get vcpu->arch.apic_base directly and drop
      kvm_get_apic_base()
    - [amd64] KVM: x86: Inline kvm_get_apic_mode() in lapic.h
    - [amd64] KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o
      VID
    - drm/amd/display: Refactoring if and endif statements to enable DC_LOGGER
    - drm/amd/display: update dcn351 used clock offset
    - drm/amd/display: Correct register address in dcn35
    - Bluetooth: qca: Update firmware-name to support board specific nvm
    - Bluetooth: qca: Fix poor RF performance for WCN6855
    - Input: serio - define serio_pause_rx guard to pause and resume serio ports
    - Input: synaptics - fix crash when enabling pass-through port
      (CVE-2025-21746)
    - PCI: Make pcim_request_all_regions() a public function
    - PCI: Export pci_intx_unmanaged() and pcim_intx()
    - PCI: Remove devres from pci_intx()
    - PCI: Restore original INTX_DISABLE bit by pcim_intx()
    - [arm64] dts: mediatek: mt8183-pumpkin: add HDMI support
    - [arm64] dts: mediatek: mt8183: Disable DSI display output by default
    - [amd64] accel/ivpu: Limit FW version string length
    - [amd64] accel/ivpu: Add coredump support
    - [amd64] accel/ivpu: Add FW state dump on TDR
    - [amd64] accel/ivpu: Fix error handling in recovery/reset
    - drm/amdkfd: Move gfx12 trap handler to separate file
    - drm/amdkfd: Ensure consistent barrier state saved in gfx12 trap handler
    - tracing: Switch trace.c code over to use guard()
    - tracing: Have the error of __tracing_resize_ring_buffer() passed to user
    - USB: gadget: f_midi: f_midi_complete to call queue_work
    - sched_ext: Factor out move_task_between_dsqs() from
      scx_dispatch_from_dsq()
    - sched_ext: Fix migration disabled handling in targeted dispatches
    - [arm64] ASoC: rockchip: i2s-tdm: fix shift config for
      SND_SOC_DAIFMT_DSP_[AB]
    - [amd64] ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers
    - [powerpc*] code-patching: Disable KASAN report during patching via
      temporary mm
    - [powerpc*] 64s: Rewrite __real_pte() and __rpte_to_hidx() as static inline
    - ALSA: hda/realtek: Fixup ALC225 depop procedure
    - [powerpc*] code-patching: Fix KASAN hit by not flagging text patching area
      as VM_ALLOC
    - [arm64] ASoC: imx-audmix: remove cpu_mclk which is from cpu dai device
    - vsock/virtio: fix variables initialization during resuming
    - geneve: Fix use-after-free in geneve_find_dev().
    - ALSA: hda/cirrus: Correct the full scale volume set logic
    - net/sched: cls_api: fix error handling causing NULL dereference
    - ALSA: seq: Drop UMP events when no UMP-conversion is set
    - [s390x] ism: add release function for struct device
    - ibmvnic: Add stat for tx direct vs tx batched
    - ibmvnic: Don't reference skb after sending to VIOS
    - sockmap, vsock: For connectible sockets allow only connected
    - vsock/bpf: Warn on socket without transport
    - tcp: adjust rcvq_space after updating scaling ratio
    - net: pse-pd: Avoid setting max_uA in regulator constraints
    - net: pse-pd: Use power limit at driver side instead of current limit
    - net: pse-pd: pd692x0: Fix power limit retrieval
    - gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().
    - geneve: Suppress list corruption splat in geneve_destroy_tunnels().
    - flow_dissector: Fix handling of mixed port and port-range keys
    - flow_dissector: Fix port range key handling in BPF conversion
    - net: Add non-RCU dev_getbyhwaddr() helper
    - arp: switch to dev_getbyhwaddr() in arp_req_set_public()
    - net: axienet: Set mac_managed_pm
    - tcp: drop secpath at the same time as we currently drop dst
    - net: allow small head cache usage with large MAX_SKB_FRAGS values
    - bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()
    - bpf: unify VM_WRITE vs VM_MAYWRITE use in BPF map mmaping logic
    - bpf: avoid holding freeze_mutex during mmap operation
    - strparser: Add read_sock callback
    - bpf: Fix wrong copied_seq calculation
    - bpf: Disable non stream socket for strparser
    - bpf: Fix deadlock when freeing cgroup storage
    - [arm64] dts: rockchip: Fix lcdpwr_en pin for Cool Pi GenBook
    - power: supply: da9150-fg: fix potential overflow
    - power: supply: axp20x_battery: Fix fault handling for AXP717
    - net: Add rx_skb of kfree_skb to raw_tp_null_args[].
    - bpf: Fix softlockup in arena_map_free on 64k page kernel
    - [arm64] dts: rockchip: adjust SMMU interrupt type on rk3588
    - [arm64] firmware: arm_scmi: imx: Correct tx size of scmi_imx_misc_ctrl_set
    - md/raid*: Fix the set_queue_limits implementations
    - nouveau/svm: fix missing folio unlock + put after
      make_device_exclusive_range()
    - [arm64] drm/msm: Avoid rounding up to one jiffy
    - [arm64] drm/msm/dpu: skip watchdog timer programming through TOP on >=
      SM8450
    - [arm64] drm/msm/dpu: enable DPU_WB_INPUT_CTRL for DPU 5.x
    - [arm64] drm/msm/dpu: Don't leak bits_per_component into random DSC_ENC
      fields
    - [arm64] drm/msm/dsi/phy: Protect PHY_CMN_CLK_CFG0 updated from driver side
    - [arm64] drm/msm/dsi/phy: Protect PHY_CMN_CLK_CFG1 against clock driver
    - [arm64] drm/msm/dsi/phy: Do not overwite PHY_CMN_CLK_CFG1 when choosing
      bitclk source
    - nvme: tcp: Fix compilation warning with W=1
    - nvme-tcp: fix connect failure on receiving partial ICResp PDU
    - nvme/ioctl: add missing space in err message
    - bpf: skip non exist keys in generic_map_lookup_batch
    - drm/nouveau/pmu: Fix gp10b firmware guard
    - irqchip/jcore-aic, clocksource/drivers/jcore: Fix jcore-pit interrupt
      request
    - drm: panel: jd9365da-h3: fix reset signal polarity
    - [arm64] drm/msm/dpu: Disable dither in phys encoder cleanup
    - [amd64] drm/i915: Make sure all planes in use by the joiner have their
      crtc included
    - [amd64] drm/i915/dp: Fix error handling during 128b/132b link training
    - [amd64] drm/i915/ddi: Fix HDMI port width programming in DDI_BUF_CTL
    - [amd64] drm/i915/gt: Use spin_lock_irqsave() in interruptible context
    - io_uring/rw: forbid multishot async reads
    - io_uring: prevent opcode speculation
    - gpiolib: protect gpio_chip with SRCU in array_info paths in multi get/set
    - [arm64] tee: optee: Fix supplicant wait loop
    - drop_monitor: fix incorrect initialization order
    - mm/migrate_device: don't add folio to be freed to LRU in
      migrate_device_finalize()
    - [arm64] dts: rockchip: Fix broken tsadc pinctrl names for rk3588
    - [arm64] dts: rockchip: Move uart5 pin configuration to px30 ringneck SoM
    - [arm64] dts: rockchip: Disable DMA for uart5 on px30-ringneck
    - [s390x] boot: Fix ESSA detection
    - xfs: fix online repair probing when CONFIG_XFS_ONLINE_REPAIR=n
    - lib/iov_iter: fix import_iovec_ubuf iovec management
    - smb: client: fix chmod(2) regression with ATTR_READONLY
    - nfp: bpf: Add check for nfp_app_ctrl_msg_alloc()
    - gve: set xdp redirect target only when it is available
    - ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data()
    - [arm64] ASoC: fsl_micfil: Enable default case in micfil_set_quality()
    - ALSA: hda: Add error check for snd_ctl_rename_id() in
      snd_hda_create_dig_out_ctls()
    - ALSA: hda/conexant: Add quirk for HP ProBook 450 G4 mute LED
    - ASoC: SOF: pcm: Clear the susbstream pointer to NULL on close
    - acct: perform last write from workqueue
    - acct: block access to kernel internal filesystems
    - mm,madvise,hugetlb: check for 0-length range after end address adjustment
    - mtd: spi-nor: sst: Fix SST write failure
    - [x86] perf/x86/intel: Fix event constraints for LNC
    - irqchip/gic-v3: Fix rk3399 workaround when secure interrupts are enabled
    - smb: client: Add check for next_buffer in receive_encrypted_standard()
    - EDAC/qcom: Correct interrupt enable register configuration
    - ftrace: Correct preemption accounting for function tracing.
    - ftrace: Fix accounting of adding subops to a manager ops
    - ftrace: Do not add duplicate entries in subops manager ops
    - tracing: Fix using ret variable in tracing_set_tracer()
    - net: pse-pd: Fix deadlock in current limit functions
    - sched_ext: Fix incorrect assumption about migration disabled tasks in
      task_can_run_on_remote_rq()
    - [arm64] dts: rockchip: change eth phy mode to rgmii-id for orangepi r1
      plus lts
    - drm/amdgpu/gfx9: manually control gfxoff for CS on RV
    - drm/amdgpu: bump version for RV/PCO compute fix

  [ Salvatore Bonaccorso ]
  * kbuild: Add Depends on pahole (Closes: #1098706)
  * [arm64] phy: rockchip: naneng-combphy: compatible reset with old DT
    (Closes: #1095745, #1098250, #1098354)
  * [amd64,arm64] drivers/net/ethernet/intel/idpf: Enable IDPF as module
    (Closes: #1099143, #1099144, #1099145, #1099146)
  * [amd64,arm64] drivers/iommu: Enable VIRTIO_IOMMU as module
    (Closes: #1099158)

linux (6.12.16-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.16
    - nfsd: clear acl_access/acl_default after releasing them
    - NFSD: fix hang in nfsd4_shutdown_callback
    - [x86] cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit
    - HID: multitouch: Add NULL check in mt_input_configured
    - pinctrl: pinconf-generic: Print unsigned value if a format is registered
    - HID: hid-thrustmaster: fix stack-out-of-bounds read in
      usb_check_int_endpoints()
    - HID: hid-steam: Don't use cancel_delayed_work_sync in IRQ context
    - net: fib_rules: annotate data-races around rule->[io]ifindex
    - Documentation/networking: fix basic node example document ISO 15765-2
    - ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()
    - vrf: use RCU protection in l3mdev_l3_out()
    - idpf: fix handling rsc packet with a single segment
    - idpf: record rx queue in skb for RSC packets
    - idpf: call set_real_num_queues in idpf_open
    - igc: Fix HW RX timestamp when passed by ZC XDP
    - vxlan: check vxlan_vnigroup_init() return value
    - [arm64] net: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases
    - [arm64] net: ethernet: ti: am65_cpsw: fix tx_cleanup for XDP case
    - Bluetooth: btintel_pcie: Fix a potential race condition
    - team: better TEAM_OPTION_TYPE_STRING validation
    - workqueue: Put the pwq after detaching the rescuer from the pool
    - sched_ext: Fix lock imbalance in dispatch_to_local_dsq()
    - [arm64] cacheinfo: Avoid out-of-bounds write to cacheinfo array
    - [arm64,armhf] gpu: host1x: Fix a use of uninitialized mutex
    - cgroup: Remove steal time from usage_usec
    - [x86] perf/x86/intel: Clean up PEBS-via-PT on hybrid
    - drm/xe/client: bo->client does not need bos_lock
    - [amd64] drm/i915/selftests: avoid using uninitialized context
    - io_uring/waitid: don't abuse io_tw_state
    - io_uring/uring_cmd: remove dead req_has_async_data() check
    - amdkfd: properly free gang_ctx_bo when failed to init user queue
    - drm/amdgpu: bail out when failed to load fw in psp_init_cap_microcode()
    - drm: Fix DSC BPP increment decoding
    - block: cleanup and fix batch completion adding conditions
    - sched_ext: Fix the incorrect bpf_list kfunc API in common.bpf.h.
    - sched_ext: Use SCX_CALL_OP_TASK in task_tick_scx
    - gpiolib: Fix crash on error in gpiochip_get_ngpios()
    - [amd64] iommu/amd: Expicitly enable CNTRL.EPHEn bit in resume path
    - tools: fix annoying "mkdir -p ..." logs when building tools in parallel
    - [arm64] firmware: qcom: scm: smc: Handle missing SCM device
    - [arm64,armhf] soc/tegra: fuse: Update Tegra234 nvmem keepout list
    - media: cxd2841er: fix 64-bit division on gcc-9
    - media: i2c: ds90ub913: Add error handling to ub913_hw_init()
    - media: i2c: ds90ub953: Add error handling for i2c reads/writes
    - media: bcm2835-unicam: Disable trigger mode operation
    - media: uvcvideo: Implement dual stream quirk to fix loss of usb packets
    - media: uvcvideo: Add new quirk definition for the Sonix Technology Co.
      292a camera
    - media: uvcvideo: Add Kurokesu C1 PRO camera
    - media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread
    - PCI/DPC: Quirk PIO log size for Intel Raptor Lake-P
    - PCI: switchtec: Add Microchip PCI100X device IDs
    - scsi: ufs: bsg: Set bsg_queue to NULL after removal
    - rtla/timerlat_hist: Abort event processing on second signal
    - rtla/timerlat_top: Abort event processing on second signal
    - serial: 8250_pci: Resolve WCH vendor ID ambiguity
    - serial: 8250_pci: Share WCH IDs with parport_serial driver
    - 8250: microchip: pci1xxxx: Add workaround for RTS bit toggle
    - kunit: platform: Resolve 'struct completion' warning
    - vfio/pci: Enable iowrite64 and ioread64 for vfio pci
    - NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()
    - vfio/nvgrace-gpu: Read dvsec register to determine need for uncached
      resmem
    - vfio/nvgrace-gpu: Expose the blackwell device PF BAR1 to the VM
    - fs/ntfs3: Unify inode corruption marking with _ntfs_bad_inode()
    - Grab mm lock before grabbing pt lock
    - [x86] ACPI: x86: Add skip i2c clients quirk for Vexia EDU ATLA 10 tablet
      5V
    - [x86] mm/tlb: Only trim the mm_cpumask once a second
    - orangefs: fix a oob in orangefs_debug_write
    - kbuild: suppress stdout from merge_config for silent builds
    - [amd64] ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10
      tablet 5V
    - kbuild: Use -fzero-init-padding-bits=all
    - batman-adv: fix panic during interface removal
    - batman-adv: Ignore neighbor throughput metrics in error case
    - batman-adv: Drop unmanaged ELP metric worker
    - drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
    - [x86] KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't
      in-kernel
    - [x86] KVM: x86: Load DR6 with guest value only before entering .vcpu_run()
      loop
    - [x86] KVM: nSVM: Enter guest mode before initializing nested NPT MMU
    - [x86] perf/x86/intel: Fix ARCH_PERFMON_NUM_COUNTER_LEAF
    - [x86] perf/x86/intel: Ensure LBRs are disabled when a CPU is starting
    - ring-buffer: Unlock resize on mmap error
    - tracing: Do not allow mmap() of persistent ring buffer
    - ring-buffer: Validate the persistent meta data subbuf array
    - ring-buffer: Update pages_touched to reflect persistent buffer content
    - usb: gadget: f_midi: Fixing wMaxPacketSize exceeded issue during MIDI bind
      retries
    - usb: dwc3: Fix timeout issue during controller enter/exit from halt state
    - usb: roles: set switch registered flag early on
    - usb: gadget: udc: renesas_usb3: Fix compiler warning
    - usb: dwc2: gadget: remove of_node reference upon udc_stop
    - usb: xhci: Restore xhci_pci support for Renesas HCs
    - USB: pci-quirks: Fix HCCPARAMS register error for LS7A EHCI
    - usb: core: fix pipe creation for get_bMaxPacketSize0
    - USB: quirks: add USB_QUIRK_NO_LPM quirk for Teclast dist
    - usb: gadget: f_midi: fix MIDI Streaming descriptor lengths
    - USB: hub: Ignore non-compliant devices with too many configs or interfaces
    - USB: cdc-acm: Fill in Renesas R-Car D3 USB Download mode quirk
    - usb: cdc-acm: Check control transfer buffer size before access
    - usb: cdc-acm: Fix handling of oversized fragments
    - usb: gadget: core: flush gadget workqueue after device removal
    - USB: serial: option: add MeiG Smart SLM828
    - USB: serial: option: add Telit Cinterion FN990B compositions
    - USB: serial: option: fix Telit Cinterion FN990A name
    - USB: serial: option: drop MeiG Smart defines
    - can: ctucanfd: handle skb allocation failure
    - can: c_can: fix unbalanced runtime PM disable in error path
    - can: j1939: j1939_sk_send_loop(): fix unable to send messages with data
      length zero
    - can: etas_es58x: fix potential NULL pointer dereference on udev->serial
    - [alpha] make stack 16-byte aligned (most cases)
    - wifi: ath12k: fix handling of 6 GHz rules
    - PCI: Avoid FLR for Mediatek MT7922 WiFi
    - kbuild: userprogs: fix bitsize and target detection on clang
    - efi: Avoid cold plugged memory for placing the kernel
    - [arm64] rust: clean Rust 1.85.0 warning using softfloat target
    - cgroup: fix race between fork and cgroup.kill
    - serial: port: Assign ->iotype correctly when ->iobase is set
    - serial: port: Always update ->iotype in __uart_read_properties()
    - serial: 8250: Fix fifo underflow on flush
    - alpha: replace hardcoded stack offsets with autogenerated ones
    - alpha: align stack for page fault and user unaligned trap handlers
    - [s390x] pci: Pull search for parent PF out of zpci_iov_setup_virtfn()
    - [s390x] pci: Fix handling of isolated VFs
    - gpiolib: acpi: Add a quirk for Acer Nitro ANV14
    - gpio: stmpe: Check return value of stmpe_reg_read in
      stmpe_gpio_irq_sync_unlock
    - partitions: mac: fix handling of bogus partition table
    - sched_ext: Fix incorrect autogroup migration detection
    - regulator: qcom_smd: Add l2, l5 sub-node to mp5496 regulator
    - [amd64] iommu: Fix potential memory leak in iopf_queue_remove_device()
    - regmap-irq: Add missing kfree()
    - [arm64] Handle .ARM.attributes section in linker scripts
    - mmc: mtk-sd: Fix register settings for hs400(es) mode
    - igc: Set buffer type for empty frames in igc_init_empty_frame
    - cifs: pick channels for individual subrequests
    - btrfs: fix hole expansion when writing at an offset beyond EOF
    - include: net: add static inline dst_dev_overhead() to dst.h
    - net: ipv6: ioam6_iptunnel: mitigate 2-realloc issue
    - net: ipv6: seg6_iptunnel: mitigate 2-realloc issue
    - net: ipv6: rpl_iptunnel: mitigate 2-realloc issue
    - net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels
    - clocksource: Use pr_info() for "Checking clocksource synchronization"
      message
    - clocksource: Use migrate_disable() to avoid calling get_random_u32() in
      atomic context
    - scsi: ufs: core: Introduce ufshcd_has_pending_tasks()
    - scsi: ufs: core: Prepare to introduce a new clock_gating lock
    - scsi: ufs: core: Introduce a new clock_gating lock
    - scsi: ufs: Fix toggling of clk_gating.state when clock gating is not
      allowed
    - [amd64] cpufreq/amd-pstate: Call cppc_set_epp_perf in the reenable
      function
    - [amd64] cpufreq/amd-pstate: Align offline flow of shared memory and MSR
      based systems
    - [amd64] cpufreq/amd-pstate: Refactor amd_pstate_epp_reenable() and
      amd_pstate_epp_offline()
    - [amd64] cpufreq/amd-pstate: Remove the cppc_state check in offline/online
      functions
    - [amd64] cpufreq/amd-pstate: Merge amd_pstate_epp_cpu_offline() and
      amd_pstate_epp_offline()
    - [amd64] cpufreq/amd-pstate: convert mutex use to guard()
    - [amd64] cpufreq/amd-pstate: Fix cpufreq_policy ref counting
    - ipv4: add RCU protection to ip4_dst_hoplimit()
    - ipv4: use RCU protection in ip_dst_mtu_maybe_forward()
    - net: add dev_net_rcu() helper
    - ipv4: use RCU protection in ipv4_default_advmss()
    - ipv4: use RCU protection in rt_is_expired()
    - ipv4: use RCU protection in inet_select_addr()
    - net: ipv4: Cache pmtu for all packet paths if multipath enabled
    - ipv4: use RCU protection in __ip_rt_update_pmtu()
    - ipv4: icmp: convert to dev_net_rcu()
    - flow_dissector: use RCU protection to fetch dev_net()
    - ipv6: use RCU protection in ip6_default_advmss()
    - ipv6: icmp: convert to dev_net_rcu()
    - HID: hid-steam: Make sure rumble work is canceled on removal
    - HID: hid-steam: Move hidraw input (un)registering to work
    - ndisc: use RCU protection in ndisc_alloc_skb()
    - neighbour: use RCU protection in __neigh_notify()
    - arp: use RCU protection in arp_xmit()
    - openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
    - ndisc: extend RCU protection in ndisc_send_skb()
    - ipv6: mcast: extend RCU protection in igmp6_send()
    - btrfs: rename __get_extent_map() and pass btrfs_inode
    - btrfs: fix stale page cache after race between readahead and direct IO
      write
    - ipv6: mcast: add RCU protection to mld_newpack()
    - [arm64] drm/tidss: Fix issue in irq handling causing irq-flood issue
    - [arm64] drm/tidss: Fix race condition while handling interrupt registers
    - [arm64] drm/tidss: Clear the interrupt status for interrupts being
      disabled
    - [arm64] drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()
    - [arm64] drm/msm/dpu: fix x1e80100 intf_6 underrun/vsync interrupt
    - [arm64] drm/msm/dpu1: don't choke on disabling the writeback connector
    - [arm64] drm/v3d: Stop active perfmon if it is being destroyed
    - drm/xe/tracing: Fix a potential TP_printk UAF
    - drm: renesas: rz-du: Increase supported resolutions
    - netdevsim: print human readable IP address
    - [x86] static-call: Remove early_boot_irqs_disabled check to fix Xen PVH
      dom0
    - bpf: handle implicit declaration of function gettid in bpf_iter.c
    - wifi: rtw89: pci: disable PCIE wake bit when PCIE deinit
    - cpufreq/amd-pstate: Remove the goto label in amd_pstate_update_limits
    - net: ipv6: fix dst refleaks in rpl, seg6 and ioam6 lwtunnels
    - scsi: ufs: core: Ensure clk_gating.lock is used only after initialization
    - io_uring/kbuf: reallocate buf lists on upgrade
    - vsock: Keep the binding until socket destruction
    - vsock: Orphan socket after transport release
    - Revert "vfio/platform: check the bounds of read/write syscalls"

  [ Marcin Juszkiewicz ]
  * [arm64] Enable SND_SOC_RT5616 for FriendlyElec NanoPC-T6.

  [ Bastian Blank ]
  * Support BTF id generation for external modules:
    - Install resolve_btfid tool. (closes: #1093655)
    - Copy base BTF ids into headers package.

  [ Salvatore Bonaccorso ]
  * sound/pci/hda: Set SND_HDA_POWER_SAVE_DEFAULT value to 10 (Closes: #1094755)
  * [x86] drivers/misc/mei: Enable INTEL_MEI_GSC_PROXY as module
    (Closes: #1096058)
  * drivers/usb/gadget/legacy: Enable USB_MASS_STORAGE as module
    (Closes: #962708)

linux (6.12.15-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.14
    - btrfs: fix assertion failure when splitting ordered extent after
      transaction abort
    - btrfs: do not output error message if a qgroup has been already cleaned up
    - btrfs: fix use-after-free when attempting to join an aborted transaction
    - [arm64] mm: Ensure adequate HUGE_MAX_HSTATE
    - exec: fix up /proc/pid/comm in the execveat(AT_EMPTY_PATH) case
    - [s390x] stackleak: Use exrl instead of ex in __stackleak_poison()
    - btrfs: fix data race when accessing the inode's disk_i_size at
      btrfs_drop_extents()
    - btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error handling
    - sched: Don't try to catch up excess steal time.
    - [x86] Convert unreachable() to BUG()
    - locking/ww_mutex/test: Use swap() macro
    - lockdep: Fix upper limit for LOCKDEP_*_BITS configs
    - [x86] amd_nb: Restrict init function to AMD-based systems
    - drm/virtio: New fence for every plane update
    - drm: Add panel backlight quirks
    - drm: panel-backlight-quirks: Add Framework 13 matte panel
    - drm: panel-backlight-quirks: Add Framework 13 glossy and 2.8k panels
    - nvkm/gsp: correctly advance the read pointer of GSP message queue
    - nvkm: correctly calculate the available space of the GSP cmdq buffer
    - drm/amd/display: Populate chroma prefetch parameters, DET buffer fix
    - drm/amd/display: Overwriting dualDPP UBF values before usage
    - printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX
    - drm/connector: add mutex to protect ELD from concurrent access
    - [arm64] drm/bridge: anx7625: use eld_mutex to protect access to
      connector->eld
    - drm/amd/display: use eld_mutex to protect access to connector->eld
    - [armhf] drm/exynos: hdmi: use eld_mutex to protect access to
      connector->eld
    - drm/radeon: use eld_mutex to protect access to connector->eld
    - [arm*] drm/vc4: hdmi: use eld_mutex to protect access to connector->eld
    - drm/amd/display: Fix Mode Cutoff in DSC Passthrough to DP2.1 Monitor
    - drm/amdgpu: Don't enable sdma 4.4.5 CTXEMPTY interrupt
    - drm/amdkfd: Queue interrupt work to different CPU
    - [arm64] drm/bridge: it6505: Change definition MAX_HDCP_DOWN_STREAM_COUNT
    - [arm64] drm/bridge: it6505: fix HDCP Bstatus check
    - [arm64] drm/bridge: it6505: fix HDCP encryption when R0 ready
    - [arm64] drm/bridge: it6505: fix HDCP CTS compare V matching
    - [arm64] drm/bridge: it6505: fix HDCP CTS KSV list wait timer
    - safesetid: check size of policy writes
    - drm/amd/display: Increase sanitizer frame larger than limit when compile
      testing with clang
    - drm/amd/display: Limit Scaling Ratio on DCN3.01
    - ring-buffer: Make reading page consistent with the code logic
    - wifi: rtw89: add crystal_cap check to avoid setting as overflow value
    - tun: fix group permission check
    - mmc: core: Respect quirk_max_rate for non-UHS SDIO card
    - mmc: sdhci-esdhc-imx: enable 'SDHCI_QUIRK_NO_LED' quirk for S32G
    - wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
    - tomoyo: don't emit warning in tomoyo_write_control()
    - mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id
    - wifi: rtw88: add __packed attribute to efuse layout struct
    - clk: qcom: Make GCC_8150 depend on QCOM_GDSC
    - HID: multitouch: Add quirk for Hantick 5288 touchpad
    - HID: Wacom: Add PCI Wacom device support
    - net/mlx5: use do_aux_work for PHC overflow checks
    - wifi: brcmfmac: Check the return value of of_property_read_string_index()
    - wifi: iwlwifi: pcie: Add support for new device ids
    - wifi: iwlwifi: avoid memory leak
    - i2c: Force ELAN06FA touchpad I2C bus freq to 100KHz
    - APEI: GHES: Have GHES honor the panic= setting
    - Bluetooth: btusb: Add new VID/PID 13d3/3610 for MT7922
    - Bluetooth: btusb: Add new VID/PID 13d3/3628 for MT7925
    - Bluetooth: MGMT: Fix slab-use-after-free Read in
      mgmt_remove_adv_monitor_sync
    - net: wwan: iosm: Fix hibernation by re-binding the driver around it
    - HID: hid-asus: Disable OOBE mode on the ProArt P16
    - mmc: sdhci-msm: Correctly set the load for the regulator
    - tipc: re-order conditions in tipc_crypto_key_rcv()
    - net: ethernet: ti: am65-cpsw: ensure proper channel cleanup in error path
    - [x86] ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params
    - [x86] kexec: Allocate PGD for x86_64 transition page tables separately
    - [x86] ASoC: Intel: sof_sdw: Correct quirk for Lenovo Yoga Slim 7
    - [arm64] iommu/arm-smmu-qcom: add sdm670 adreno iommu compatible
    - [arm64] iommu/arm-smmu-v3: Clean up more on probe failure
    - [x86] platform/x86: int3472: Check for adev == NULL
    - [x86] platform/x86: acer-wmi: Add support for Acer PH14-51
    - ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback
    - [x86] platform/x86: acer-wmi: Add support for Acer Predator PH16-72
    - [amd64] ASoC: amd: Add ACPI dependency to fix build error
    - Input: allocate keycode for phone linking
    - [x86] platform/x86: acer-wmi: add support for Acer Nitro AN515-58
    - [x86] platform/x86: acer-wmi: Ignore AC events
    - [powerpc*] KVM: PPC: e500: Mark "struct page" dirty in
      kvmppc_e500_shadow_map()
    - [powerpc*] KVM: PPC: e500: Mark "struct page" pfn accessed before dropping
      mmu_lock
    - [powerpc*] KVM: PPC: e500: Use __kvm_faultin_pfn() to handle page faults
    - [powerpc*] KVM: e500: always restore irqs
    - drm/amdgpu: Fix Circular Locking Dependency in AMDGPU GFX Isolation
    - xfs: report realtime block quota limits on realtime directories
    - xfs: don't over-report free space or inodes in statvfs
    - tty: xilinx_uartps: split sysrq handling
    - tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN
    - [x86] platform/x86: serdev_helpers: Check for serial_ctrl_uid == NULL
    - sched/fair: Fix inaccurate h_nr_runnable accounting with delayed dequeue
    - nvme: handle connectivity loss in nvme_set_queue_count
    - firmware: iscsi_ibft: fix ISCSI_IBFT Kconfig entry
    - gpu: drm_dp_cec: fix broken CEC adapter properties check
    - ice: put Rx buffers after being done with current frame
    - ice: gather page_count()'s of each frag right before XDP prog call
    - ice: stop storing XDP verdict within ice_rx_buf
    - nvme: make nvme_tls_attrs_group static
    - nvme-fc: use ctrl state getter
    - net: bcmgenet: Correct overlaying of PHY and MAC Wake-on-LAN
    - ice: Add check for devm_kzalloc()
    - vmxnet3: Fix tx queue race condition with XDP
    - tg3: Disable tg3 PCIe AER on system reboot
    - udp: gso: do not drop small packets when PMTU reduces
    - [amd64] drm/i915/dp: fix the Adaptive sync Operation mode for SDP
    - ethtool: rss: fix hiding unsupported fields in dumps
    - rxrpc: Fix the rxrpc_connection attend queue handling
    - gpio: pca953x: Improve interrupt support
    - net: atlantic: fix warning during hot unplug
    - net: rose: lock the socket in rose_bind()
    - gpio: sim: lock hog configfs items if present
    - [x86] xen: fix xen_hypercall_hvm() to not clobber %rbx (Closes: #1095435)
    - [x86] xen: add FRAME_END to xen_hypercall_hvm()
    - ACPI: property: Fix return value for nval == 0 in acpi_data_prop_read()
    - pfifo_tail_enqueue: Drop new packet when sch->limit == 0
    - netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
    - tun: revert fix group permission check
    - net: sched: Fix truncation of offloaded action statistics
    - rxrpc: Fix call state set to not include the SERVER_SECURING state
    - cpufreq: fix using cpufreq-dt as module
    - cpufreq: s3c64xx: Fix compilation warning
    - leds: lp8860: Write full EEPROM, not only half of it
    - ALSA: hda/realtek: Enable Mute LED on HP Laptop 14s-fq1xxx
    - cifs: Remove intermediate object of failed create SFU call
    - drm/modeset: Handle tiled displays in pan_display_atomic.
    - drm/client: Handle tiled displays better
    - smb: client: fix order of arguments of tracepoints
    - smb: client: change lease epoch type from unsigned int to __u16
    - md: reintroduce md-linear
    - [s390x] futex: Fix FUTEX_OP_ANDN implementation
    - [arm64] Filter out SVE hwcaps when FEAT_SVE isn't implemented
    - fs/proc: do_task_stat: Fix ESP not readable during coredump
    - binfmt_flat: Fix integer overflow bug on 32 bit systems
    - accel/ivpu: Fix Qemu crash when running in passthrough
    - [arm64] kvm: Configure HYP TCR.PS/DS based on host stage1
    - [arm64] mm: Override PARange for !LPA2 and use it consistently
    - [arm64] sme: Move storage of reg_smidr to __cpuinfo_store_cpu()
    - [arm64] mm: Reduce PA space to 48 bits when LPA2 is not enabled
    - [arm64] KVM: arm64: timer: Always evaluate the need for a soft timer
    - [arm64] drm/rockchip: cdn-dp: Use drm_connector_helper_hpd_irq_event()
    - [arm64] dts: rockchip: increase gmac rx_delay on rk3399-puma
    - remoteproc: omap: Handle ARM dma_iommu_mapping
    - KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
    - kvm: defer huge page recovery vhost task to later
    - [s390x] KVM: s390: vsie: fix some corner-cases when grabbing vsie pages
    - ksmbd: fix integer overflows on 32 bit systems
    - drm/amd/display: Optimize cursor position updates
    - drm/amd/pm: Mark MM activity as unsupported
    - drm/amd/amdgpu: change the config of cgcg on gfx12
    - drm/amdkfd: only flush the validate MES contex
    - drm/amdkfd: Block per-queue reset when halt_if_hws_hang=1
    - Revert "drm/amd/display: Use HW lock mgr for PSR1"
    - [amd64] drm/i915/guc: Debug print LRC state entries only if the context is
      pinned
    - [amd64] drm/i915: Fix page cleanup on DMA remap failure
    - drm/xe/devcoredump: Move exec queue snapshot to Contexts section
    - [amd64] drm/i915/dp: Iterate DSC BPP from high to low on all platforms
    - [amd64] drm/i915: Drop 64bpp YUV formats from ICL+ SDR planes
    - drm/amdgpu: add a BO metadata flag to disable write compression for Vulkan
    - drm/amd/display: Fix seamless boot sequence
    - Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
    - Bluetooth: L2CAP: accept zero as a special value for MTU auto-selection
    - KEYS: trusted: dcp: fix improper sg use with CONFIG_VMAP_STACK=y
    - [arm64] clk: sunxi-ng: a100: enable MMC clock reparenting
    - [armhf] clk: mmp2: call pm_genpd_init() only after genpd.name is set
    - media: i2c: ds90ub960: Fix UB9702 refclk register access
    - [arm64] clk: qcom: clk-alpha-pll: fix alpha mode configuration
    - [arm64] clk: qcom: gcc-sm8550: Do not turn off PCIe GDSCs during
      gdsc_disable()
    - [arm64] clk: qcom: gcc-sm8650: Do not turn off PCIe GDSCs during
      gdsc_disable()
    - [arm64] clk: qcom: gcc-sm6350: Add missing parent_map for two clocks
    - [arm64] clk: qcom: dispcc-sm6350: Add missing parent_map for a clock
    - [arm64] clk: qcom: gcc-mdm9607: Fix cmd_rcgr offset for blsp1_uart6 rcg
    - [arm64] clk: qcom: clk-rpmh: prevent integer overflow in recalc_rate
    - seccomp: passthrough uretprobe systemcall without filtering
    - blk-cgroup: Fix class @block_class's subsystem refcount leakage
    - efi: libstub: Use '-std=gnu11' to fix build with GCC 15
    - perf bench: Fix undefined behavior in cmpworker()
    - scsi: ufs: core: Fix the HIGH/LOW_TEMP Bit Definitions
    - of: Correct child specifier used as input of the 2nd nexus node
    - of: address: Fix empty resource handling in __of_address_resource_bounds()
    - of: Fix of_find_node_opts_by_path() handling of alias+path+options
    - of: reserved-memory: Fix using wrong number of cells to get property
      'alignment'
    - Input: bbnsm_pwrkey - add remove hook
    - HID: hid-sensor-hub: don't use stale platform-data on remove
    - ring-buffer: Do not allow events in NMI with generic atomic64 cmpxchg()
    - atomic64: Use arch_spin_locks instead of raw_spin_locks
    - wifi: rtlwifi: rtl8821ae: Fix media status report
    - wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()
    - wifi: mt76: mt7921u: Add VID/PID for TP-Link TXE50UH
    - wifi: rtw88: sdio: Fix disconnection after beacon loss
    - wifi: mt76: mt7915: add module param to select 5 GHz or 6 GHz on MT7916
    - wifi: rtw88: 8703b: Fix RX/TX issues
    - usb: gadget: f_tcm: Translate error to sense
    - usb: gadget: f_tcm: Decrement command ref count on cleanup
    - usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint
    - usb: gadget: f_tcm: Don't prepare BOT write request twice
    - usbnet: ipheth: fix possible overflow in DPE length check
    - usbnet: ipheth: use static NDP16 location in URB
    - usbnet: ipheth: check that DPE points past NCM header
    - usbnet: ipheth: refactor NCM datagram loop
    - usbnet: ipheth: break up NCM header size computation
    - usbnet: ipheth: fix DPE OoB read
    - usbnet: ipheth: document scope of NCM implementation
    - [arm64] dts: qcom: x1e80100-asus-vivobook-s15: Fix USB QMP PHY supplies
    - [arm64] dts: qcom: x1e80100-qcp: Fix USB QMP PHY supplies
    - [arm64] dts: qcom: x1e78100-lenovo-thinkpad-t14s: Fix USB QMP PHY supplies
    - [arm64] dts: qcom: x1e80100-crd: Fix USB QMP PHY supplies
    - [arm64] dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix USB QMP PHY supplies
    - [arm64] dts: qcom: x1e80100-microsoft-romulus: Fix USB QMP PHY supplies
    - [arm64] dts: qcom: x1e80100: Fix usb_2 controller interrupts
    - ASoC: acp: Support microphone from Lenovo Go S
    - [arm64] soc: qcom: socinfo: Avoid out of bounds read of serial number
    - serial: sh-sci: Drop __initdata macro for port_cfg
    - serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is
      in use
    - [powerpc*] pseries/eeh: Fix get PE state translation
    - dm-crypt: don't update io->sector after kcryptd_crypt_write_io_submit()
    - dm-crypt: track tag_offset in convert_context
    - mips/math-emu: fix emulation of the prefx instruction (Closes: #1091858)
    - [mips*] pci-legacy: Override pci_address_to_pio
    - Revert "MIPS: csrc-r4k: Select HAVE_UNSTABLE_SCHED_CLOCK if SMP && 64BIT"
    - block: don't revert iter for -EIOCBQUEUED
    - Revert "media: uvcvideo: Require entities to have a non-zero unique ID"
    - [arm64] firmware: qcom: scm: Fix missing read barrier in
      qcom_scm_is_available()
    - [arm64] firmware: qcom: scm: Fix missing read barrier in
      qcom_scm_get_tzmem_pool()
    - ALSA: hda/realtek: Enable headset mic on Positivo C6400
    - ALSA: hda/realtek: Fix quirk matching for Legion Pro 7
    - ALSA: hda: Fix headset detection failure due to unstable sort
    - [arm64] tegra: Fix Tegra234 PCIe interrupt-map
    - [s390x] pci: Fix SR-IOV for PFs initially in standby
    - PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1
    - PCI: endpoint: Finish virtual EP removal in pci_epf_remove_vepf()
    - PCI: dwc: ep: Write BAR_MASK before iATU registers in pci_epc_set_bar()
    - PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()
    - nvme-pci: Add TUXEDO InfinityFlex to Samsung sleep quirk
    - nvme-pci: Add TUXEDO IBP Gen9 to Samsung sleep quirk
    - [x86] KVM: x86/mmu: Ensure NX huge page recovery thread is alive before
      waking
    - scsi: st: Don't set pos_unknown just after device recognition
    - scsi: qla2xxx: Move FCE Trace buffer allocation to user control
    - scsi: ufs: qcom: Fix crypto key eviction
    - scsi: ufs: core: Fix use-after free in init error and remove paths
    - scsi: storvsc: Set correct data length for sending SCSI command without
      payload
    - scsi: core: Do not retry I/Os during depopulation
    - kbuild: Move -Wenum-enum-conversion to W=2
    - [x86] acpi: Fix LAPIC/x2APIC parsing order
    - [x86] boot: Use '-std=gnu11' to fix build with GCC 15
    - ubi: Add a check for ubi_num
    - [arm64] dts: mediatek: mt8183: Disable DPI display output by default
    - [arm64] dts: qcom: sdx75: Fix MPSS memory length
    - [arm64] dts: qcom: x1e80100: Fix ADSP memory base and length
    - [arm64] dts: qcom: x1e80100: Fix CDSP memory length
    - [arm64] dts: qcom: sm6115: Fix MPSS memory length
    - [arm64] dts: qcom: sm6115: Fix CDSP memory length
    - [arm64] dts: qcom: sm6115: Fix ADSP memory base and length
    - [arm64] dts: qcom: sm6350: Fix ADSP memory length
    - [arm64] dts: qcom: sm6350: Fix MPSS memory length
    - [arm64] dts: qcom: sm6350: Fix uart1 interconnect path
    - [arm64] dts: qcom: sm6375: Fix ADSP memory length
    - [arm64] dts: qcom: sm6375: Fix CDSP memory base and length
    - [arm64] dts: qcom: sm6375: Fix MPSS memory base and length
    - [arm64] dts: qcom: sm8350: Fix ADSP memory base and length
    - [arm64] dts: qcom: sm8350: Fix CDSP memory base and length
    - [arm64] dts: qcom: sm8350: Fix MPSS memory length
    - [arm64] dts: qcom: sm8450: Fix ADSP memory base and length
    - [arm64] dts: qcom: sm8450: Fix CDSP memory length
    - [arm64] dts: qcom: sm8450: Fix MPSS memory length
    - [arm64] dts: qcom: sm8550: Fix ADSP memory base and length
    - [arm64] dts: qcom: sm8550: Fix CDSP memory length
    - [arm64] dts: qcom: sm8550: Fix MPSS memory length
    - [arm64] dts: qcom: sm8650: Fix ADSP memory base and length
    - [arm64] dts: qcom: sm8650: Fix CDSP memory length
    - [arm64] dts: qcom: sm8650: Fix MPSS memory length
    - [arm64] dts: qcom: sm8550: correct MDSS interconnects
    - [arm64] dts: qcom: sm8650: correct MDSS interconnects
    - crypto: qce - fix priority to be less than ARMv8 CE
    - [arm64] tegra: Fix typo in Tegra234 dce-fabric compatible
    - [arm64] tegra: Disable Tegra234 sce-fabric node
    - pwm: microchip-core: fix incorrect comparison with max period
    - xfs: don't call remap_verify_area with sb write protection held
    - xfs: Propagate errors from xfs_reflink_cancel_cow_range in
      xfs_dax_write_iomap_end
    - xfs: Add error handling for xfs_reflink_cancel_cow_range
    - accel/ivpu: Clear runtime_error after pm_runtime_resume_and_get() fails
    - ACPI: PRM: Remove unnecessary strict handler address checks
    - tpm: Change to kvalloc() in eventlog/acpi.c
    - rv: Reset per-task monitors also for idle tasks
    - hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING
    - iommufd: Fix struct iommu_hwpt_pgfault init and padding
    - kfence: skip __GFP_THISNODE allocations on NUMA systems
    - media: ccs: Clean up parsed CCS static data on parse failure
    - mm/hugetlb: fix avoid_reserve to allow taking folio from subpool
    - iio: light: as73211: fix channel handling in only-color triggered buffer
    - iommufd/fault: Destroy response and mutex in iommufd_fault_destroy()
    - iommufd/fault: Use a separate spinlock to protect fault->deliver list
    - [arm64,armhf] soc: samsung: exynos-pmu: Fix uninitialized ret in
      tensor_set_bits_atomic()
    - [arm64] soc: mediatek: mtk-devapc: Fix leaking IO map on error paths
    - [arm64] soc: mediatek: mtk-devapc: Fix leaking IO map on driver remove
    - [arm64] soc: qcom: llcc: Enable LLCC_WRCACHE at boot on X1
    - [arm64] soc: qcom: smem_state: fix missing of_node_put in error path
    - media: mmp: Bring back registration of the device
    - media: mc: fix endpoint iteration
    - media: nuvoton: Fix an error check in npcm_video_ece_init()
    - media: imx296: Add standby delay during probe
    - media: intel/ipu6: remove cpu latency qos request on error
    - media: ov5640: fix get_light_freq on auto
    - media: stm32: dcmipp: correct dma_set_mask_and_coherent mask value
    - media: ccs: Fix CCS static data parsing for large block sizes
    - media: ccs: Fix cleanup order in ccs_probe()
    - media: i2c: ds90ub9x3: Fix extra fwnode_handle_put()
    - media: i2c: ds90ub960: Fix use of non-existing registers on UB9702
    - media: i2c: ds90ub960: Fix UB9702 VC map
    - media: i2c: ds90ub960: Fix logging SP & EQ status only for UB9702
    - media: uvcvideo: Fix crash during unbind if gpio unit is in use
    - media: uvcvideo: Fix event flags in uvc_ctrl_send_events
    - media: uvcvideo: Support partial control reads
    - media: uvcvideo: Only save async fh if success
    - media: uvcvideo: Remove redundant NULL assignment
    - media: uvcvideo: Remove dangling pointers
    - mm: kmemleak: fix upper boundary check for physical address objects
    - mm: gup: fix infinite loop within __get_longterm_locked
    - mm/vmscan: accumulate nr_demoted for accurate demotion statistics
    - mm/hugetlb: fix hugepage allocation for interleaved memory nodes
    - mm/compaction: fix UBSAN shift-out-of-bounds warning
    - ata: libata-sff: Ensure that we cannot write outside the allocated buffer
    - irqchip/irq-mvebu-icu: Fix access to msi_data from irq_domain::host_data
    - crypto: qce - fix goto jump in error path
    - crypto: qce - unregister previously registered algos in error path
    - ceph: fix memory leak in ceph_mds_auth_match()
    - nvmem: qcom-spmi-sdam: Set size in struct nvmem_config
    - nvmem: core: improve range check for nvmem_cell_write()
    - nvmem: imx-ocotp-ele: simplify read beyond device check
    - nvmem: imx-ocotp-ele: fix MAC address byte order
    - nvmem: imx-ocotp-ele: fix reading from non zero offset
    - nvmem: imx-ocotp-ele: set word length to 1
    - io_uring: fix multishots with selected buffers
    - io_uring/net: don't retry connect operation on EPOLLERR
    - vfio/platform: check the bounds of read/write syscalls
    - pnfs/flexfiles: retry getting layout segment for reads
    - ocfs2: fix incorrect CPU endianness conversion causing mount failure
    - ocfs2: handle a symlink read error correctly
    - nilfs2: fix possible int overflows in nilfs_fiemap()
    - nfs: Make NFS_FSCACHE select NETFS_SUPPORT instead of depending on it
    - NFSD: Encode COMPOUND operation status on page boundaries
    - NFC: nci: Add bounds checking in nci_hci_create_pipe()
    - fgraph: Fix set_graph_notrace with setting TRACE_GRAPH_NOTRACE_BIT
    - i3c: master: Fix missing 'ret' assignment in set_speed()
    - irqchip/apple-aic: Only handle PMC interrupt as FIQ when configured so
    - mtd: onenand: Fix uninitialized retlen in do_otp_read()
    - misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors
    - misc: fastrpc: Deregister device nodes properly in error scenarios
    - misc: fastrpc: Fix registered buffer page address
    - misc: fastrpc: Fix copy buffer page size
    - net/ncsi: wait for the last response to Deselect Package before
      configuring channel
    - net: phy: c45-tjaxx: add delay between MDIO write and read in soft_reset
    - maple_tree: simplify split calculation
    - scripts/gdb: fix aarch64 userspace detection in get_current_task
    - tracing/osnoise: Fix resetting of tracepoints
    - rtla/osnoise: Distinguish missing workload option
    - rtla/timerlat_hist: Set OSNOISE_WORKLOAD for kernel threads
    - rtla/timerlat_top: Set OSNOISE_WORKLOAD for kernel threads
    - rtla: Add trace_instance_stop
    - rtla/timerlat_hist: Stop timerlat tracer on signal
    - rtla/timerlat_top: Stop timerlat tracer on signal
    - pinctrl: samsung: fix fwnode refcount cleanup if
      platform_get_irq_optional() fails
    - pinctrl: renesas: rzg2l: Fix PFC_MASK for RZ/V2H and RZ/G3E
    - ptp: Ensure info->enable callback is always set
    - RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error
    - rtc: zynqmp: Fix optional clock name property
    - timers/migration: Fix off-by-one root mis-connection
    - [s390x] fpu: Add fpc exception handler / remove fixup section again
    - [mips*] ftrace: Declare ftrace_get_parent_ra_addr() as static
    - xfs: avoid nested calls to __xfs_trans_commit
    - xfs: don't lose solo superblock counter update transactions
    - xfs: separate dquot buffer reads from xfs_dqflush
    - xfs: clean up log item accesses in xfs_qm_dqflush{,_done}
    - xfs: attach dquot buffer to dquot log item buffer
    - xfs: convert quotacheck to attach dquot buffers
    - xfs: release the dquot buf outside of qli_lock
    - xfs: lock dquot buffer before detaching dquot from b_li_list
    - xfs: fix mount hang during primary superblock recovery failure
    - spi: atmel-quadspi: Create `atmel_qspi_ops` to support newer SoC families
    - spi: atmel-qspi: Memory barriers after memory-mapped I/O
    - Revert "btrfs: avoid monopolizing a core when activating a swap file"
    - btrfs: avoid monopolizing a core when activating a swap file
    - mptcp: prevent excessive coalescing on receive
    - [x86] mm: Convert unreachable() to BUG()
    - md/md-linear: Fix a NULL vs IS_ERR() bug in linear_add()
    - md: Fix linear_set_limits()
    - Revert "drm/amd/display: Fix green screen issue after suspend"
    - drm/xe: Fix and re-enable xe_print_blob_ascii85()
    - fs: prepend statmount.mnt_opts string with security_sb_mnt_opts()
    - fs: fix adding security options to statmount.mnt_opt
    - statmount: let unset strings be empty
    - [arm64] dts: rockchip: add reset-names for combphy on rk3568
    - ocfs2: check dir i_size in ocfs2_find_entry
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.15
    - xfs: don't lose solo dquot update transactions

  [ Sebastian Siewior ]
  * Enable RCU_LAZY to not wake up the CPU for RCU callbacks

  [ Yoann Congal ]
  * [arm64/rt] Re-enable KVM

  [ Salvatore Bonaccorso ]
  * [mips*] Increase RELOCATION_TABLE_SIZE to 0x00280000 (fixes FTBFS)
  * nfsd: validate the nfsd_serv pointer before calling svc_wake_up
    (Closes: #1093734)
  * [x86] xen: allow larger contiguous memory regions in PV guests
    (Closes: #1093371, #1088159, #1087807)
  * xen/swiotlb: relax alignment requirements
    (Closes: #1093371, #1088159, #1087807)
  * USB: Add USB_QUIRK_NO_LPM quirk for sony xperia xz1 smartphone
    (Closes: #1091517)

  [ Bastian Blank ]
  * [amd64, arm64] Enable NITRO_ENCLAVES, NSM. (closes: #1095647)
  * Support zstd for firmware loader, enable FW_LOADER_COMPRESS_ZSTD

  [ Luca Boccassi ]
  * linux-bpf-dev: mark as MA: same

linux (6.12.13-1) unstable; urgency=medium

  * New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.13
    - coredump: Do not lock during 'comm' reporting
    - [powerpc*] book3s64/hugetlb: Fix disabling hugetlb when fadump is active
    - dlm: fix removal of rsb struct that is master and dir record
    - dlm: fix srcu_read_lock() return type to int
    - afs: Fix EEXIST error returned from afs_rmdir() to be ENOTEMPTY
    - afs: Fix directory format encoding struct
    - afs: Fix cleanup of immediately failed async calls
    - fs: fix proc_handler for sysctl_nr_open
    - block: copy back bounce buffer to user-space correctly in case of split
    - block: retry call probe after request_module in blk_request_module
    - ps3disk: Do not use dev->bounce_size before it is set
    - nbd: don't allow reconnect after disconnect
    - pstore/blk: trivial typo fixes
    - block: check BLK_FEAT_POLL under q_usage_count
    - block: don't update BLK_FEAT_POLL in __blk_mq_update_nr_hw_queues
    - nvme-tcp: Fix I/O queue cpu spreading for multiple controllers
    - nvme: Add error check for xa_store in nvme_get_effects_log
    - [powerpc*] pseries/iommu: IOMMU incorrectly marks MMIO range in DDW
    - nvme: Add error path for xa_store in nvme_init_effects
    - btrfs: improve the warning and error message for btrfs_remove_qgroup()
    - partitions: ldm: remove the initial kernel-doc notation
    - btrfs: subpage: fix the bitmap dump of the locked flags
    - select: Fix unbalanced user_access_end()
    - nvme: fix bogus kzalloc() return check in nvme_init_effects_log()
    - afs: Fix the fallback handling for the YFS.RemoveFile2 RPC call
    - perf/core: Save raw sample data conditionally based on sample type
    - sched/fair: Untangle NEXT_BUDDY and pick_next_task()
    - sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat
    - sched: Fix race between yield_to() and try_to_wake_up()
    - [x86] cpu: Enable SD_ASYM_PACKING for PKG domain on AMD
    - [x86] topology: Use x86_sched_itmt_flags for PKG domain unconditionally
    - sched: Split out __schedule() deactivate task logic into a helper
    - sched: psi: pass enqueue/dequeue flags to psi callbacks directly
    - psi: Fix race when task wakes up before psi_sched_switch() adjusts flags
    - [arm64] drm/v3d: Fix performance counter source settings on V3D 7.x
    - [arm64] drm/rockchip: vop2: fix rk3588 dp+dsi maxclk verification
    - [arm64] drm/msm/dp: set safe_to_exit_level before printing it
    - [arm64] drm/msm/hdmi: simplify code in pll_get_integloop_gain
    - [arm64,armhf] drm/etnaviv: Fix page property being used for non
      writecombine buffers
    - HID: core: Fix assumption that Resolution Multipliers must be in Logical
      Collections
    - drm/amd/pm: Fix an error handling path in
      vega10_enable_se_edc_force_stall_config()
    - drm/amdgpu: Fix potential NULL pointer dereference in
      atomctrl_get_smc_sclk_range_table
    - [arm64] drm/rockchip: vop2: Fix cluster windows alpha ctrl regsiters
      offset
    - [arm64] drm/rockchip: vop2: Fix the mixer alpha setup for layer 0
    - [arm64] drm/panthor: Preserve the result returned by panthor_fw_resume()
    - [arm64] drm/rockchip: vop2: Fix the windows switch between different
      layers
    - printk: Defer legacy printing when holding printk_cpu_sync
    - drm/connector: Allow clearing HDMI infoframes
    - [arm64] drm/rockchip: vop2: Set AXI id for rk3588
    - [arm64] drm/rockchip: vop2: Setup delay cycle for Esmart2/3
    - [arm64] drm/rockchip: vop2: Check linear format for Cluster windows on
      rk3566/8
    - [arm64] drm/rockchip: vop2: Add check for 32 bpp format for rk3588
    - [arm64] drm/rockchip: vop2: include rockchip_drm_drv.h
    - drm/amdgpu/vcn: reset fw_shared under SRIOV
    - OPP: add index check to assert to avoid buffer overflow in _read_freq()
    - OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized
    - [arm64] drm/msm/dpu: provide DSPP and correct LM config for SDM670
    - [arm64] drm/msm/dpu: link DSPP_2/_3 blocks on SM8150
    - [arm64] drm/msm/dpu: link DSPP_2/_3 blocks on SC8180X
    - [arm64] drm/msm/dpu: link DSPP_2/_3 blocks on SM8250
    - [arm64] drm/msm/dpu: link DSPP_2/_3 blocks on SM8350
    - [arm64] drm/msm/dpu: link DSPP_2/_3 blocks on SM8550
    - [arm64] drm/msm/dpu: link DSPP_2/_3 blocks on SM8650
    - [arm64] drm/msm/dpu: link DSPP_2/_3 blocks on X1E80100
    - [arm64] drm/msm: Check return value of of_dma_configure()
    - [arm64] drm/msm: don't clean up priv->kms prematurely
    - [arm64] drm/msm/mdp4: correct LCDC regulator name
    - drm/bridge: it6505: Change definition of AUX_FIFO_MAX_SIZE
    - drm/amdgpu: tear down ttm range manager for doorbell in amdgpu_ttm_fini()
    - Revert "drm/amdgpu/gfx9: put queue resets behind a debug option"
    - drm/amdgpu: fix gpu recovery disable with per queue reset
    - genirq: Make handle_enforce_irqctx() unconditionally available
    - ipmi: ipmb: Add check devm_kasprintf() returned value
    - wifi: ath11k: Fix unexpected return buffer manager error for
      WCN6750/WCN6855
    - wifi: rtlwifi: rtl8821ae: phy: restore removed code to fix infinite loop
    - wifi: rtlwifi: do not complete firmware loading needlessly
    - wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last step
    - wifi: rtlwifi: wait for firmware loading before releasing memory
    - wifi: rtlwifi: fix init_sw_vars leak when probe fails
    - wifi: rtlwifi: usb: fix workqueue leak when probe fails
    - wifi: wcn36xx: fix channel survey memory allocation size
    - clk: renesas: cpg-mssr: Fix 'soc' node handling in
      cpg_mssr_reserved_init()
    - wifi: cfg80211: tests: Fix potential NULL dereference in
      test_cfg80211_parse_colocated_ap()
    - net_sched: sch_sfq: handle bigger packets
    - net_sched: sch_sfq: don't allow 1 packet limit
    - spi: zynq-qspi: Add check for clk_enable()
    - rxrpc: Fix handling of received connection abort
    - dt-bindings: mmc: controller: clarify the address-cells description
    - clk: fix an OF node reference leak in of_clk_get_parent_name()
    - dt-bindings: leds: class-multicolor: Fix path to color definitions
    - wifi: rtlwifi: remove unused check_buddy_priv
    - wifi: rtlwifi: destroy workqueue at rtl_deinit_core
    - wifi: rtlwifi: fix memory leaks and invalid access at probe error path
    - wifi: rtlwifi: pci: wait for firmware loading before releasing memory
    - HID: multitouch: fix support for Goodix PID 0x01e9
    - regulator: dt-bindings: mt6315: Drop regulator-compatible property
    - wifi: brcmfmac: add missing header include for brcmf_dbg
    - module: Convert default symbol namespace to string literal
    - hwmon: (nct6775): Actually make use of the HWMON_NCT6775 symbol namespace
    - ACPI: fan: cleanup resources in the error path of .probe()
    - cpupower: fix TSC MHz calculation
    - dt-bindings: mfd: bd71815: Fix rsense and typos
    - leds: netxbig: Fix an OF node reference leak in
      netxbig_leds_get_of_pdata()
    - inetpeer: remove create argument of inet_getpeer_v[46]()
    - inetpeer: remove create argument of inet_getpeer()
    - inetpeer: update inetpeer timestamp in inet_getpeer()
    - inetpeer: do not get a refcount in inet_getpeer()
    - pwm: stm32-lp: Add check for clk_enable()
    - cpufreq: schedutil: Fix superfluous updates caused by need_freq_update
    - ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()
    - net: airoha: Fix error path in airoha_probe()
    - gpio: pca953x: log an error when failing to get the reset GPIO
    - [arm64] cpufreq: qcom: Fix qcom_cpufreq_hw_recalc_rate() to query LUT if
      LMh IRQ is not available
    - [arm64] cpufreq: qcom: Implement clk_ops::determine_rate() for
      qcom_cpufreq* clocks
    - udp: Deal with race between UDP socket address change and rehash
    - clk: imx8mp: Fix clkout1/2 support
    - dt-bindings: clock: imx93: Drop IMX93_CLK_END macro definition
    - dt-bindings: clock: Add i.MX91 clock support
    - dt-bindings: clock: imx93: Add SPDIF IPG clk
    - clk: imx93: Move IMX93_CLK_END macro to clk driver
    - clk: imx: add i.MX91 clk
    - clk: imx93: Add IMX93_CLK_SPDIF_IPG clock
    - [arm64] dts: imx93: Use IMX93_CLK_SPDIF_IPG as SPDIF IPG clock
    - clk: imx: Apply some clks only for i.MX93
    - [arm64] clk: qcom: camcc-x1e80100: Set titan_top_gdsc as the parent GDSC
      of subordinate GDSCs
    - team: prevent adding a device which is already a team device lower
    - dt-bindings: clock: sunxi: Export PLL_VIDEO_2X and PLL_MIPI
    - clk: sunxi-ng: a64: drop redundant CLK_PLL_VIDEO0_2X and CLK_PLL_MIPI
    - clk: sunxi-ng: a64: stop force-selecting PLL-MIPI as TCON0 parent
    - regulator: of: Implement the unwind path of of_regulator_match()
    - ax25: rcu protect dev->ax25_ptr
    - net/mlx5: HWS, fix definer's HWS_SET32 macro for negative offset
    - OPP: OF: Fix an OF node leak in _opp_add_static_v2()
    - ipmi: ssif_bmc: Fix new request loss when bmc ready for a response
    - wifi: ath12k: fix tx power, max reg power update to firmware
    - clk: qcom: gcc-sdm845: Do not use shared clk_ops for QUPs
    - HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding
      endpoint check
    - HID: fix generic desktop D-Pad controls
    - leds: cht-wcove: Use devm_led_classdev_register() to avoid memory leak
    - mfd: syscon: Fix race in device_node_get_regmap()
    - wifi: mt76: mt7996: fix invalid interface combinations
    - wifi: wlcore: fix unbalanced pm_runtime calls
    - wifi: rtw89: handle entity active flag per PHY
    - wifi: rtw89: chan: manage active interfaces
    - wifi: rtw89: tweak setting of channel and TX power for MLO
    - wifi: rtw89: fix proceeding MCC with wrong scanning state after sequence
      changes
    - wifi: rtw89: chan: fix soft lockup in rtw89_entity_recalc_mgnt_roles()
    - wifi: rtw89: avoid to init mgnt_entry list twice when WoWLAN failed
    - wifi: rtw89: mcc: consider time limits not divisible by 1024
    - wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion
    - hwmon: Fix help text for aspeed-g6-pwm-tach
    - wifi: mt76: mt7925: fix off by one in mt7925_load_clc()
    - wifi: mt76: mt7915: Fix mesh scan on MT7916 DBDC
    - wifi: iwlwifi: fw: read STEP table from correct UEFI var
    - wifi: iwlwifi: mvm: avoid NULL pointer dereference
    - wifi: iwlwifi: mvm: don't count mgmt frames as MPDU
    - wifi: mac80211: prohibit deactivating all links
    - wifi: cfg80211: Move cfg80211_scan_req_add_chan() n_channels increment
      earlier
    - wifi: mac80211: fix tid removal during mesh forwarding
    - wifi: mac80211: Fix common size calculation for ML element
    - wifi: mac80211: don't flush non-uploaded STAs
    - clk: ralink: mtmips: remove duplicated 'xtal' clock for Ralink SoC RT3883
    - clk: thead: Fix clk gate registration to pass flags
    - clk: thead: Add CLK_IGNORE_UNUSED to fix TH1520 boot
    - clk: thead: Fix cpu2vp_clk for TH1520 AP_SUBSYS clocks
    - net/smc: fix data error when recvmsg with MSG_PEEK flag
    - landlock: Handle weird files
    - wifi: mt76: mt76u_vendor_request: Do not print error messages when -EPROTO
    - wifi: mt76: mt7921: fix using incorrect group cipher after disconnection.
    - wifi: mt76: mt7915: Fix an error handling path in mt7915_add_interface()
    - wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links
    - wifi: mt76: mt7925: fix wrong band_idx setting when enable sniffer mode
    - wifi: mt76: mt7925: fix get wrong chip cap from incorrect pointer
    - wifi: mt76: mt7925: fix the invalid ip address for arp offload
    - wifi: mt76: mt7996: fix overflows seen when writing limit attributes
    - wifi: mt76: mt7915: fix overflows seen when writing limit attributes
    - wifi: mt76: connac: Extend mt76_connac_mcu_uni_add_dev for MLO
    - wifi: mt76: mt7925: Fix incorrect MLD address in bss_mld_tlv for MLO
      support
    - wifi: mt76: mt7925: Fix incorrect WCID assignment for MLO
    - wifi: mt76: mt7925: Fix incorrect WCID phy_idx assignment
    - wifi: mt76: mt7925: fix wrong parameter for related cmd of chan info
    - wifi: mt76: mt7925: Fix CNM Timeout with Single Active Link in MLO
    - wifi: mt76: mt7925: Enhance mt7925_mac_link_bss_add to support MLO
    - wifi: mt76: Enhance mt7925_mac_link_sta_add to support MLO
    - wifi: mt76: mt7925: Update mt7925_mcu_sta_update for BC in ASSOC state
    - wifi: mt76: mt7925: Update mt792x_rx_get_wcid for per-link STA
    - wifi: mt76: mt7925: Update mt7925_unassign_vif_chanctx for per-link BSS
    - wifi: mt76: mt7925: Update secondary link PS flow
    - wifi: mt76: mt7925: Init secondary link PM state
    - wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO
    - wifi: mt76: mt7925: Cleanup MLO settings post-disconnection
    - wifi: mt76: mt7925: Properly handle responses for commands with events
    - wifi: mt76: mt7996: fix rx filter setting for bfee functionality
    - wifi: mt76: only enable tx worker after setting the channel
    - wifi: mt76: mt7915: firmware restart on devices with a second pcie link
    - wifi: mt76: mt7915: fix omac index assignment after hardware reset
    - wifi: mt76: mt7915: fix register mapping
    - wifi: mt76: mt7996: fix register mapping
    - wifi: mt76: mt7996: add max mpdu len capability
    - wifi: mt76: mt7996: fix the capability of reception of EHT MU PPDU
    - wifi: mt76: mt7996: fix HE Phy capability
    - wifi: mt76: mt7996: fix incorrect indexing of MIB FW event
    - wifi: mt76: mt7996: fix definition of tx descriptor
    - wifi: mt76: mt7996: fix ldpc setting
    - i2c: designware: Actually make use of the I2C_DW_COMMON and I2C_DW symbol
      namespaces
    - cpufreq: ACPI: Fix max-frequency computation
    - wifi: cfg80211: adjust allocation of colocated AP data
    - Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name()
    - Bluetooth: btrtl: check for NULL in btrtl_setup_realtek()
    - inet: ipmr: fix data-races
    - clk: analogbits: Fix incorrect calculation of vco rate delta
    - dev: Acquire netdev_rename_lock before restoring dev->name in
      dev_change_name().
    - pwm: stm32: Add check for clk_enable()
    - net: let net.core.dev_weight always be non-zero
    - octeon_ep: remove firmware stats fetch in ndo_get_stats64
    - octeon_ep_vf: remove firmware stats fetch in ndo_get_stats64
    - net: avoid race between device unregistration and ethnl ops
    - net: sched: Disallow replacing of child qdisc from one parent to another
    - netfilter: nf_tables: fix set size with rbtree backend
    - netfilter: nft_flow_offload: update tcp state flags under lock
    - net: sched: refine software bypass handling in tc_run
    - net: ethernet: ti: am65-cpsw: fix freeing IRQ in
      am65_cpsw_nuss_remove_tx_chns()
    - tcp_cubic: fix incorrect HyStart round start detection
    - net/rose: prevent integer overflows in rose_setsockopt()
    - platform/mellanox: mlxbf-pmc: incorrect type in assignment
    - [x86] platform/x86: x86-android-tablets: make platform data be static
    - pinctrl: samsung: Fix irq handling if an error occurs in
      exynos_irq_demux_eint16_31()
    - libbpf: don't adjust USDT semaphore address if .stapsdt.base addr is
      missing
    - ASoC: cs40l50: Use *-y for Makefile
    - ASoC: mediatek: mt8365: Use *-y for Makefile
    - ASoC: wcd937x: Use *-y for Makefile
    - [x86] ASoC: Intel: sof_sdw: correct mach_params->dmic_num
    - ASoC: sun4i-spdif: Add clock multiplier settings
    - [arm64] iommu/arm-smmuv3: Update comments about ATS and bypass
    - crypto: tegra - do not transfer req when tegra init fails
    - crypto: api - Fix boot-up self-test race
    - crypto: caam - use JobR's space to access page 0 regs
    - perf header: Fix one memory leakage in process_bpf_btf()
    - perf header: Fix one memory leakage in process_bpf_prog_info()
    - perf bpf: Fix two memory leakages when calling
      perf_env__insert_bpf_prog_info()
    - ASoC: renesas: rz-ssi: Use only the proper amount of dividers
    - perf expr: Initialize is_test value in expr__ctx_new()
    - pinctrl: nomadik: Add check for clk_enable()
    - bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT
    - rhashtable: Fix potential deadlock by moving schedule_work outside lock
    - crypto: ixp4xx - fix OF node reference leaks in init_ixp_crypto()
    - crypto: iaa - Fix IAA disabling that occurs when sync_mode is set to
      'async'
    - bpf: Use refcount_t instead of atomic_t for mmap_count
    - ALSA: seq: Make dependency on UMP clearer
    - bpf: Reject struct_ops registration that uses module ptr and the module
      btf_id is missing
    - padata: fix sysfs store callback check
    - perf top: Don't complain about lack of vmlinux when not resolving some
      kernel samples
    - perf maps: Fix display of kernel symbols
    - perf machine: Don't ignore _etext when not a text symbol
    - perf namespaces: Introduce nsinfo__set_in_pidns()
    - perf namespaces: Fixup the nsinfo__in_pidns() return type, its bool
    - [x86] ASoC: Intel: avs: Do not readq() u32 registers
    - [x86] ASoC: Intel: avs: Fix the minimum firmware version numbers
    - [x86] ASoC: Intel: avs: Fix theoretical infinite loop
    - [x86] ASoC: Intel: avs: Fix init-config parsing
    - perf MANIFEST: Add arch/*/include/uapi/asm/bpf_perf_event.h to the perf
      tarball
    - ALSA: hda: Fix compilation of snd_hdac_adsp_xxx() helpers
    - perf report: Fix misleading help message about --demangle
    - pinctrl: stm32: Add check for clk_enable()
    - pinctrl: amd: Take suspend type into consideration which pins are non-wake
    - perf inject: Fix use without initialization of local variables
    - [x86] ASoC: Intel: sof_sdw: Fix DMI match for Lenovo 83LC
    - [x86] ASoC: Intel: sof_sdw: Fix DMI match for Lenovo 83JX, 83MC and 83NM
    - bpf: Send signals asynchronously if !preemptible
    - libbpf: Fix return zero when elf_begin failed
    - libbpf: Fix incorrect traversal end type ID when marking BTF_IS_EMBEDDED
    - bpf: tcp: Mark bpf_load_hdr_opt() arg2 as read-write
    - [amd64] iommu/amd: Remove unused amd_iommu_domain_update()
    - ALSA: hda/realtek - Fixed headphone distorted sound on Acer Aspire A115-31
      laptop
    - tools: Sync if_xdp.h uapi tooling header
    - perf lock: Fix parse_lock_type which only retrieve one lock flag
    - padata: fix UAF in padata_reorder
    - padata: add pd get/put refcnt helper
    - padata: avoid UAF for reorder_work
    - rhashtable: Fix rhashtable_try_insert test
    - smb: client: fix oops due to unset link speed
    - cifs: Use cifs_autodisable_serverino() for disabling
      CIFS_MOUNT_SERVER_INUM in readdir.c
    - bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT
    - soc: atmel: fix device_node release in atmel_soc_device_init()
    - [arm64] dts: mediatek: mt8186: Move wakeup to MTU3 to get working suspend
    - [arm64] dts: mt8183: set DMIC one-wire mode on Damu
    - [arm64] dts: mediatek: mt8516: fix GICv2 range
    - [arm64] dts: mediatek: mt8516: fix wdt irq type
    - [arm64] dts: mediatek: mt8516: add i2c clock-div property
    - [arm64] dts: mediatek: mt8516: reserve 192 KiB for TF-A
    - RDMA/mlx4: Avoid false error about access to uninitialized gids array
    - [arm64] dts: renesas: rzg3s-smarc: Fix the debug serial alias
    - rdma/cxgb4: Prevent potential integer overflow on 32bit
    - [arm64] dts: mediatek: mt8173-evb: Drop regulator-compatible property
    - [arm64] dts: mediatek: mt8173-elm: Drop regulator-compatible property
    - [arm64] dts: mediatek: mt8192-asurada: Drop regulator-compatible property
    - [arm64] dts: mediatek: mt8195-cherry: Drop regulator-compatible property
    - [arm64] dts: mediatek: mt8195-demo: Drop regulator-compatible property
    - [arm64] dts: medaitek: mt8395-nio-12l: Drop regulator-compatible property
    - [arm64] dts: mediatek: mt8395-genio-1200-evk: Drop regulator-compatible
      property
    - [arm64] dts: mediatek: mt8173-elm: Fix MT6397 PMIC sub-node names
    - [arm64] dts: mediatek: mt8173-evb: Fix MT6397 PMIC sub-node names
    - [armhf] dts: aspeed: yosemite4: correct the compatible string of adm1272
    - [armhf] dts: aspeed: yosemite4: Add required properties for IOE on fan
      boards
    - [armhf] dts: aspeed: yosemite4: correct the compatible string for max31790
    - RDMA/rxe: Fix mismatched max_msg_sz
    - [arm64] dts: mediatek: mt8183: kenzo: Support second source touchscreen
    - [arm64] dts: mediatek: mt8183: willow: Support second source touchscreen
    - RDMA/srp: Fix error handling in srp_add_port
    - [arm64] dts: mediatek: mt8195: Remove suspend-breaking reset from pcie1
    - memory: tegra20-emc: fix an OF node reference bug in
      tegra_emc_find_node_by_ram_code()
    - [arm64] dts: mediatek: mt8183-kukui-jacuzzi: Drop pp3300_panel voltage
      settings
    - [arm64] dts: qcom: msm8996-xiaomi-gemini: Fix LP5562 LED1 reg property
    - [arm64] dts: qcom: sa8775p: Update sleep_clk frequency
    - [arm64] defconfig: remove obsolete CONFIG_SM_DISPCC_8650
    - [arm64] dts: qcom: msm8996: Fix up USB3 interrupts
    - [arm64] dts: qcom: msm8994: Describe USB interrupts
    - [arm64] dts: qcom: sm7225-fairphone-fp4: Drop extra qcom,msm-id value
    - [arm64] dts: qcom: msm8916: correct sleep clock frequency
    - [arm64] dts: qcom: msm8939: correct sleep clock frequency
    - [arm64] dts: qcom: msm8994: correct sleep clock frequency
    - [arm64] dts: qcom: qcs404: correct sleep clock frequency
    - [arm64] dts: qcom: q[dr]u1000: correct sleep clock frequency
    - [arm64] dts: qcom: qrb4210-rb2: correct sleep clock frequency
    - [arm64] dts: qcom: sc7280: correct sleep clock frequency
    - [arm64] dts: qcom: sdx75: correct sleep clock frequency
    - [arm64] dts: qcom: sm4450: correct sleep clock frequency
    - [arm64] dts: qcom: sm6125: correct sleep clock frequency
    - [arm64] dts: qcom: sm6375: correct sleep clock frequency
    - [arm64] dts: qcom: sm8250: correct sleep clock frequency
    - [arm64] dts: qcom: sm8350: correct sleep clock frequency
    - [arm64] dts: qcom: sm8450: correct sleep clock frequency
    - [arm64] dts: qcom: sm8550: correct sleep clock frequency
    - [arm64] dts: qcom: sm8650: correct sleep clock frequency
    - [arm64] dts: qcom: x1e80100: correct sleep clock frequency
    - [arm64] dts: qcom: sm8650: Fix CDSP context banks unit addresses
    - [arm64] dts: ti: k3-am62: Remove duplicate GICR reg
    - [arm64] dts: ti: k3-am62a: Remove duplicate GICR reg
    - [arm64] dts: rockchip: Fix sdmmc access on rk3308-rock-s0 v1.1 boards
    - [arm64] dts: allwinner: a64: explicitly assign clock parent for TCON0
    - RDMA/bnxt_re: Fix to drop reference to the mmap entry in case of error
    - RDMA/rtrs: Add missing deinit() call
    - [arm64] RDMA/hns: Clean up the legacy CONFIG_INFINIBAND_HNS
    - [arm64] dts: qcom: qcm6490-shift-otter: remove invalid orientation-switch
    - [arm64] dts: qcom: sdm845-db845c-navigation-mezzanine: Convert mezzanine
      riser to dtso
    - [arm64] dts: qcom: sdm845-db845c-navigation-mezzanine: remove disabled
      ov7251 camera
    - [arm64] dts: qcom: sc7180-trogdor-quackingstick: add missing avee-supply
    - [arm64] dts: qcom: sc7180-trogdor-pompom: rename 5v-choke thermal zone
    - [arm64] dts: qcom: sc7180: change labels to lower-case
    - [arm64] dts: qcom: sc7180: fix psci power domain node names
    - [arm64] dts: qcom: sm8150-microsoft-surface-duo: fix typos in da7280
      properties
    - [arm64] dts: qcom: sc8280xp: Fix up remoteproc register space sizes
    - [arm64] firmware: qcom: scm: Cleanup global '__scm' on probe failures
    - [arm64] dts: mediatek: mt7988: Add missing clock-div property for i2c
    - [arm64] dts: arm64: mediatek: mt8195: Remove MT8183 compatible for OVL
    - [arm64] dts: mediatek: add per-SoC compatibles for keypad nodes
    - [arm64] dts: qcom: sc8280xp: Fix interrupt type of camss interrupts
    - [arm64] dts: qcom: sdm845: Fix interrupt types of camss interrupts
    - [arm64] dts: qcom: sm8250: Fix interrupt types of camss interrupts
    - [arm64] dts: marvell: cn9131-cf-solidwan: fix cp1 comphy links
    - [arm64] dts: rockchip: fix num-channels property of wolfvision pf5 mic
    - [arm64] dts: ti: k3-am642-hummingboard-t: Convert overlay to board dts
    - fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device()
    - [arm64] tegra: Fix DMA ID for SPI2
    - [arm64] dts: qcom: x1e80100-romulus: Update firmware nodes
    - i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition
    - RDMA/mlx5: Fix indirect mkey ODP page count
    - of: property: Avoiding using uninitialized variable @imaplen in
      parse_interrupt_map()
    - of: reserved-memory: Do not make kmemleak ignore freed address
    - efi: sysfb_efi: fix W=1 warnings when EFI is not set
    - RDMA/cxgb4: Notify rdma stack for IB_EVENT_QP_LAST_WQE_REACHED event
    - RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]"
    - [amd64] iommu: iommufd: fix WARNING in iommufd_device_unbind
    - [amd64] iommufd/iova_bitmap: Fix shift-out-of-bounds in
      iova_bitmap_offset_to_index()
    - spi: omap2-mcspi: Correctly handle devm_clk_get_optional() errors
    - of: reserved_mem: Restructure how the reserved memory regions are
      processed
    - of/fdt: Restore possibility to use both ACPI and FDT from bootloader
    - media: rc: iguanair: handle timeouts
    - media: lmedm04: Handle errors for lme2510_int_read
    - PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy()
    - remoteproc: mtk_scp: Only populate devices for SCP cores
    - media: marvell: Add check for clk_enable()
    - media: i2c: imx290: Register 0x3011 varies between imx327 and imx290
    - media: i2c: imx412: Add missing newline to prints
    - media: i2c: ov9282: Correct the exposure offset
    - media: mipi-csis: Add check for clk_enable()
    - media: camif-core: Add check for clk_enable()
    - media: uvcvideo: Propagate buf->error to userspace
    - mtd: rawnand: brcmnand: fix status read of brcmnand_waitfunc
    - mtd: hyperbus: hbmc-am654: fix an OF node reference leak
    - media: nxp: imx8-isi: fix v4l2-compliance test errors
    - watchdog: rti_wdt: Fix an OF node leak in rti_wdt_probe()
    - staging: media: imx: fix OF node leak in imx_media_add_of_subdevs()
    - media: dvb-usb-v2: af9035: fix ISO C90 compilation error on
      af9035_i2c_master_xfer
    - PCI: rcar-ep: Fix incorrect variable used when calling
      devm_request_mem_region()
    - PCI: imx6: Configure PHY based on Root Complex or Endpoint mode
    - PCI: imx6: Skip controller_id generation logic for i.MX7D
    - PCI: imx6: Deassert apps_reset in imx_pcie_deassert_core_reset()
    - PCI: imx6: Add missing reference clock disable logic
    - PCI: qcom: Update ICC and OPP values after Link Up event
    - PCI: dwc: Always stop link in the dw_pcie_suspend_noirq
    - PCI: endpoint: pci-epf-test: Set dma_chan_rx pointer to NULL on error
    - PCI: endpoint: pci-epf-test: Fix check for DMA MEMCPY test
    - PCI: microchip: Add support for using either Root Port 1 or 2
    - PCI: microchip: Set inbound address translation for coherent or
      non-coherent mode
    - scsi: mpt3sas: Set ioc->manu_pg11.EEDPTagMode directly to 1
    - scsi: ufs: bsg: Delete bsg_dev when setting up bsg fails
    - scsi: mpi3mr: Fix possible crash when setting up bsg fails
    - firewire: test: Fix potential null dereference in firewire kunit test
    - erofs: get rid of erofs_{find,insert}_workgroup
    - erofs: move erofs_workgroup operations into zdata.c
    - erofs: sunset `struct erofs_workgroup`
    - erofs: fix potential return value overflow of z_erofs_shrink_scan()
    - ocfs2: mark dquot as inactive if failed to start trans while releasing
      dquot
    - nilfs2: do not force clear folio if buffer is referenced
    - nilfs2: protect access to buffers with no active references
    - nilfs2: handle errors that nilfs_prepare_chunk() may return
    - module: Extend the preempt disabled section in
      dereference_symbol_descriptor().
    - module: Don't fail module loading when setting ro_after_init section RO
      failed
    - driver core: class: Fix wild pointer dereferences in API
      class_dev_iter_next()
    - tty: mips_ejtag_fdc: fix one more u8 warning
    - serial: 8250: Adjust the timeout for FIFO mode
    - nfs: fix incorrect error handling in LOCALIO
    - NFSv4.2: fix COPY_NOTIFY xdr buf size calculation
    - NFSv4.2: mark OFFLOAD_CANCEL MOVEABLE
    - xfrm: replay: Fix the update of replay_esn->oseq_hi for GSO
    - xfrm: Add support for per cpu xfrm state handling.
    - xfrm: Cache used outbound xfrm states at the policy.
    - xfrm: Add an inbound percpu state cache.
    - xfrm: state: fix out-of-bounds read during lookup
    - dmaengine: ti: edma: fix OF node reference leaks in edma_driver
    - xfrm: delete intermediate secpath entry in packet offload mode
    - rtc: tps6594: Fix integer overflow on 32bit systems
    - rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read
    - rtc: loongson: clear TOY_MATCH0_REG in loongson_rtc_isr()
    - ubifs: skip dumping tnc tree when zroot is null
    - regulator: core: Add missing newline character
    - net: airoha: Fix wrong GDM4 register definition
    - [arm64] net: hns3: fix oops when unload drivers paralleling
    - gpio: mxc: remove dead code after switch to DT-only
    - net: phy: marvell-88q2xxx: Fix temperature measurement with reset-gpios
    - net: fec: implement TSO descriptor cleanup
    - ipmr: do not call mr_mfc_uses_dev() for unres entries
    - PM: hibernate: Add error handling for syscore_suspend()
    - perf trace: Fix BPF loading failure (-E2BIG)
    - xfrm: Don't disable preemption while looking up cache state.
    - idpf: add read memory barrier when checking descriptor done bit
    - idpf: fix transaction timeouts on reset
    - idpf: Acquire the lock before accessing the xn->salt
    - idpf: convert workqueues to unbound
    - ice: fix ice_parser_rt::bst_key array size
    - ice: rework of dump serdes equalizer values feature
    - ice: extend dump serdes equalizer values feature
    - ice: remove invalid parameter of equalizer
    - iavf: allow changing VLAN state without calling PF
    - [s390x] mm: Allow large pages for KASAN shadow mapping
    - net/ncsi: use dev_set_mac_address() for Get MC MAC Address handling
    - net: rose: fix timer races against user threads
    - net: netdevsim: try to close UDP port harness races
    - tools: ynl: c: correct reverse decode of empty attrs
    - rxrpc, afs: Fix peer hash locking vs RCU callback
    - vxlan: Fix uninit-value in vxlan_vnifilter_dump()
    - net: davicom: fix UAF in dm9000_drv_remove
    - ptp: Properly handle compat ioctls
    - net: ethtool: only allow set_rxnfc with rss + ring_cookie if driver opts
      in
    - ethtool: Fix set RXNFC command with symmetric RSS hash
    - net: stmmac: Limit the number of MTL queues to hardware capability
    - net: stmmac: Limit FIFO size by hardware capability
    - [s390x] sclp: Initialize sclp subsystem via arch_cpu_finalize_init()
    - perf trace: Fix runtime error of index out of bounds
    - perf test: Skip syscall enum test if no landlock syscall
    - Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()
    - Bluetooth: btnxpuart: Fix glitches seen in dual A2DP streaming
    - vsock: Allow retrying on connect() failure
    - bgmac: reduce max frame size to support just MTU 1500
    - tcp: correct handling of extreme memory squeeze
    - net: xdp: Disallow attaching device-bound programs in generic mode
    - net: ravb: Fix missing rtnl lock in suspend/resume path
    - net: sh_eth: Fix missing rtnl lock in suspend/resume path
    - net: hsr: fix fill_frame_info() regression vs VLAN packets
    - genksyms: fix memory leak when the same symbol is added from source
    - genksyms: fix memory leak when the same symbol is read from *.symref file
    - hostfs: fix string handling in __dentry_name()
    - [riscv64] Mark riscv_v_init() as __init
    - ASoC: rockchip: i2s_tdm: Re-add the set_sysclk callback
    - io_uring/uring_cmd: use cached cmd_op in io_uring_cmd_sock()
    - ASoC: amd: acp: Fix possible deadlock
    - tools/power turbostat: Fix forked child affinity regression
    - cifs: Validate EAs for WSL reparse points
    - cifs: Fix getting and setting SACLs over SMB1
    - kconfig: fix file name in warnings when loading KCONFIG_DEFCONFIG_LIST
    - kconfig: fix memory leak in sym_warn_unmet_dep()
    - f2fs: Introduce linear search for dentries
    - md/md-bitmap: factor behind write counters out from
      bitmap_{start/end}write()
    - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite()
    - md: add a new callback pers->bitmap_sector()
    - md/raid5: implement pers->bitmap_sector()
    - md/md-bitmap: move bitmap_{start, end}write to md upper layer
    - Revert "SUNRPC: Reduce thread wake-up rate when receiving large RPC
      messages"
    - netfilter: nf_tables: reject mismatching sum of field_len with set key
      length
    - drm/amd/display: Reduce accessing remote DPCD overhead
    - xfs: check for dead buffers in xfs_buf_find_insert
    - xfs: don't shut down the filesystem for media failures beyond end of log
    - ALSA: usb-audio: Add delay quirk for iBasso DC07 Pro
    - net: usb: rtl8150: enable basic endpoint checking
    - usb: xhci: Fix NULL pointer dereference on certain command aborts
    - drivers/card_reader/rtsx_usb: Restore interrupt based detection
    - usb: gadget: f_tcm: Fix Get/SetInterface return value
    - usb: dwc3-am62: Fix an OF node leak in phy_syscon_pll_refclk()
    - usb: dwc3: core: Defer the probe until USB power supply ready
    - usb: dwc3: Skip resume if pm_runtime_set_active() fails
    - usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to
      PD_T_SENDER_RESPONSE
    - usb: typec: tcpci: Prevent Sink disconnection before vPpsShutdown in SPR
      PPS
    - clk: qcom: gcc-x1e80100: Do not turn off usb_2 controller GDSC
    - mptcp: consolidate suboption status
    - mptcp: pm: only set fullmesh for subflow endp
    - mptcp: handle fastopen disconnect correctly
    - mptcp: blackhole only if 1st SYN retrans w/o MPC is accepted
    - RDMA/mlx5: Fix implicit ODP use after free
    - remoteproc: core: Fix ida_free call while not allocated
    - media: uvcvideo: Fix double free in error path
    - pps: Fix a use-after-free
    - usb: gadget: f_tcm: Don't free command immediately
    - staging: media: max96712: fix kernel oops when removing module
    - media: imx-jpeg: Fix potential error pointer dereference in detach_pm()
    - [powerpc*] pseries/iommu: Don't unset window if it was never set
    - md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime
    - btrfs: output the reason for open_ctree() failure
    - of: reserved-memory: Warn for missing static reserved memory regions
    - dma-mapping: save base/size instead of pointer to shared DMA pool
    - xfrm: Add error handling when nla_put_u32() returns an error
    - xfrm: Fix acquire state insertion.
    - ethtool: Fix access to uninitialized fields in set RXNFC command
    - Revert "s390/mm: Allow large pages for KASAN shadow mapping"
    - ASoC: da7213: Initialize the mutex
    - [s390x] Add '-std=gnu11' to decompressor and purgatory CFLAGS
    - drm/amd/display: Add hubp cache reset when powergating
    - [x86] KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update()
    - memcg: fix soft lockup in the OOM process
    - btrfs: do proper folio cleanup when run_delalloc_nocow() failed
    - ethtool: ntuple: fix rss + ring_cookie check

  [ Emanuele Rocca ]
  * [amd64, arm64] Add pmem modules to amd64 and arm64 kernel-image udeb
    to support UEFI HTTP boot (or u-boot) in debian-installer

f22d639e72e6b6a6693a116d99c2d459 215033 kernel optional linux_6.12.22-1~bpo12+1.dsc
486597d4496c9890422dd167bb94adc8 1608936 kernel optional linux_6.12.22-1~bpo12+1.debian.tar.xz
657fcf9503991d18bdfa05618c22b9ed 6317 kernel optional linux_6.12.22-1~bpo12+1_source.buildinfo