* Update to upstream stable Linux 5.10.271 (from 5.10.270). * Bump kernel ABI to 50: ship the ELS kernel as 5.10.0-50-*, distinct from the prior 5.10.0-49. * CVE-2022-48816 - SUNRPC: lock against ->sock changing during sysfs read {CVE-2022-48816} * CVE-2022-49142 - net: preserve skb_end_offset() in skb_unclone_keeptruesize() {CVE-2022-49142} * CVE-2022-50406 - iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406} * CVE-2023-53707 - drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1 {CVE-2023-53707} * CVE-2024-41062 - Reapply "bluetooth/l2cap: sync sock recv cb and release" {CVE-2024-41062} * CVE-2024-47408 - net/smc: check smcd_v2_ext_offset when receiving proposal msg {CVE-2024-47408} * CVE-2024-49568 - net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg {CVE-2024-49568} * CVE-2024-56545 - HID: hyperv: streamline driver probe to avoid devres issues {CVE-2024-56545} * CVE-2025-21759 - ipv6: mcast: extend RCU protection in igmp6_send() {CVE-2025-21759} * CVE-2025-68190 - drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() {CVE-2025-68190} * CVE-2026-52988 - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase {CVE-2026-52988} * CVE-2026-68155 - libceph: Reject monmaps advertising zero monitors {CVE-2026-68155} * CVE-2026-68236 - drm/amd/display: set new_stream to NULL after release {CVE-2026-68236} * CVE-2026-74460 - can: ems_usb: validate CPC message lengths {CVE-2026-74460} * CVE-2026-74496 - fou: Fix use-after-free in fou_create() {CVE-2026-74496} * CVE-2026-74743 - macvlan: inherit needed_headroom and needed_tailroom from lowerdev {CVE-2026-74743} * CVE-2026-80833 - crypto: sun8i-ss - Remove crypto_rng interface {CVE-2026-80833} * CVE-2026-80834 - crypto: sun8i-ce - Remove crypto_rng interface {CVE-2026-80834} * CVE-2026-90304 - ARM: 9484/1: enable interrupts when unhandled user faults are triggered {CVE-2026-90304} * CVE-2026-93204 - batman-adv: dat: atomically update mac addresses {CVE-2026-93204} * CVE-2026-93286 - net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286} * CVE-2026-93287 - i2c: smbus: reject oversized block transfers in the common path {CVE-2026-93287} * CVE-2026-93782 - vhost-scsi: flush backend after device ioctls {CVE-2026-93782} * CVE-2026-93783 - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-93783} * CVE-2026-93784 - wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() {CVE-2026-93784} * CVE-2026-93785 - cifs: validate idmap key payload length {CVE-2026-93785} * CVE-2026-93789 - wifi: iwlwifi: bound aligned TLV advance in FW parser {CVE-2026-93789} * CVE-2026-93795 - blk-cgroup: fix leaks and online flag on radix_tree_insert failure {CVE-2026-93795} * CVE-2026-93797 - wifi: iwlwifi: mvm: fix an off-by-1 boundary check {CVE-2026-93797} * CVE-2026-93798 - btrfs: fix reloc root cleanup in merge_reloc_roots() {CVE-2026-93798} * CVE-2026-93800 - btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() {CVE-2026-93800} * CVE-2026-93802 - wifi: rsi: validate beacon length before fixed buffer copy {CVE-2026-93802} * CVE-2026-93803 - wifi: libipw: fix key index receive bound checks {CVE-2026-93803} * CVE-2026-93807 - wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers {CVE-2026-93807} * CVE-2026-93808 - ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808} * CVE-2026-93815 - net: au1000: move free_irq out of the close-time spinlocked section {CVE-2026-93815} * CVE-2026-93816 - f2fs: validate inline dentry name lengths before conversion {CVE-2026-93816} * CVE-2026-93819 - PCI: mediatek: Protect root bus removal with rescan lock {CVE-2026-93819} * CVE-2026-93820 - PCI: rockchip: Protect root bus removal with rescan lock {CVE-2026-93820} * CVE-2026-93821 - PCI: altera: Protect root bus removal with rescan lock {CVE-2026-93821} * CVE-2026-93822 - PCI: iproc: Protect root bus removal with rescan lock {CVE-2026-93822} * CVE-2026-93830 - net: stmmac: xgmac2: disable RBUE in default RX interrupt mask {CVE-2026-93830} * CVE-2026-97407 - ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt {CVE-2026-97407} * CVE-2026-97408 - Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408} * CVE-2026-97411 - net: ibm: emac: mal: fix potential system hang in mal_remove() {CVE-2026-97411} * CVE-2026-97416 - btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() {CVE-2026-97416} * CVE-2026-97417 - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417} * CVE-2026-97418 - ALSA: es18xx: check control allocation before private data setup {CVE-2026-97418} * CVE-2026-97419 - hsr: broadcast netlink notifications in the device's net namespace {CVE-2026-97419} * CVE-2026-97420 - bpf: NUL-terminate replaced sysctl value {CVE-2026-97420} * CVE-2026-97430 - xhci: Prevent queuing new commands if xhci is inaccessible {CVE-2026-97430} * CVE-2026-97435 - net: dsa: sja1105: flower: reject cross-chip redirect {CVE-2026-97435} * CVE-2026-97440 - net: qrtr: fix node refcount leak on ctrl packet alloc failure {CVE-2026-97440} * CVE-2026-97441 - ata: ahci: fail probe if BAR too small for claimed ports {CVE-2026-97441} * CVE-2026-97443 - perf/ftrace: Fix WARNING in __unregister_ftrace_function {CVE-2026-97443} * CVE-2026-97444 - ACPICA: add boundary checks in two places {CVE-2026-97444} * CVE-2026-97445 - ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445} * CVE-2026-97446 - ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() {CVE-2026-97446} * CVE-2026-97448 - ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448} * CVE-2026-97449 - ACPICA: Add package limit checks in parser functions {CVE-2026-97449} * CVE-2026-97450 - ACPICA: validate handler object type in two places {CVE-2026-97450} * CVE-2026-97451 - ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) {CVE-2026-97451} * CVE-2026-97452 - ACPICA: Prevent adding invalid references {CVE-2026-97452} * CVE-2026-97453 - ACPICA: validate byte_count in acpi_ps_get_next_package_length() {CVE-2026-97453} * CVE-2026-97454 - ACPICA: add boundary checks in acpi_ps_get_next_field() {CVE-2026-97454} * CVE-2026-97455 - ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455} * CVE-2026-97456 - ACPICA: Fix condition check in acpi_ps_parse_loop() {CVE-2026-97456} * CVE-2026-97472 - ipv6: addrconf: fix temp address generation after prefix deprecation {CVE-2026-97472} * CVE-2026-97475 - thermal/drivers/tegra/soctherma: Switch to devm cooling device registration {CVE-2026-97475} * CVE-2026-97476 - rds: filter RDS_INFO_* getsockopt by caller's netns {CVE-2026-97476} * CVE-2026-97481 - serial: 8250: fix possible ISR soft lockup {CVE-2026-97481} * CVE-2026-97482 - usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log {CVE-2026-97482} * CVE-2026-97483 - usb: core: hcd: fix possible deadlock in rh control transfers {CVE-2026-97483} * CVE-2026-97484 - usbip: vhci_hcd: fix NULL deref in status_show_vhci {CVE-2026-97484} * CVE-2026-97485 - omfs: handle set_blocksize failures {CVE-2026-97485} * CVE-2026-97486 - hpfs: handle set_blocksize failures {CVE-2026-97486} * CVE-2026-97487 - jfs: handle set_blocksize failures {CVE-2026-97487} * CVE-2026-97488 - qnx4: handle set_blocksize failures {CVE-2026-97488} * CVE-2026-97489 - bfs: handle set_blocksize failures {CVE-2026-97489} * CVE-2026-97490 - affs: handle set_blocksize failures {CVE-2026-97490} * CVE-2026-97491 - net/rds: Don't sleep inside rds_ib_conn_path_shutdown {CVE-2026-97491} * CVE-2026-97492 - wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed {CVE-2026-97492} * CVE-2026-97502 - mmc: davinci: avoid NULL deref of host->data in IRQ handler {CVE-2026-97502} * CVE-2026-97507 - media: dm1105: fix missing error check for dma_alloc_coherent {CVE-2026-97507} * CVE-2026-97508 - thunderbolt: Set tb->root_switch to NULL when domain is stopped {CVE-2026-97508} * CVE-2026-97510 - thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() {CVE-2026-97510} * CVE-2026-97523 - mptcp: close race between scheduler and state change {CVE-2026-97523} * CVE-2026-97524 - mptcp: avoid unneeded actions on subflow reset {CVE-2026-97524} * CVE-2026-97568 - mptcp: syncookies: remember the request backup flag {CVE-2026-97568} * CVE-2026-97572 - bnxt_en: Propagate RX ring init failures in bnxt_init_nic() {CVE-2026-97572} * CVE-2026-97573 - bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() {CVE-2026-97573} * CVE-2026-97592 - s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm {CVE-2026-97592} * CVE-2026-97596 - ipvs: reject invalid states in connection template sync records {CVE-2026-97596} * CVE-2026-97598 - ipv4: fib: bound automatic table ID allocation {CVE-2026-97598} * CVE-2026-97601 - ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink {CVE-2026-97601} * CVE-2026-97604 - fbdev: vfb: defer cleanup until the last reference {CVE-2026-97604} * CVE-2026-97611 - net: openvswitch: fix use-after-free of the flow table mask array {CVE-2026-97611} * CVE-2026-97612 - net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612} * CVE-2026-97899 - drm/i915: Fix memory leak in query_perf_config_list() {CVE-2026-97899} * CVE-2026-97904 - cpufreq: initialize policy rwsem before sysfs publication {CVE-2026-97904} * CVE-2026-97905 - cpufreq: zero-initialize policy cpumask before sysfs publication {CVE-2026-97905} * CVE-2026-97909 - ASoC: sti: initialize IRQ lock before requesting IRQ {CVE-2026-97909} * CVE-2026-97910 - ASoC: sprd: validate compress buffer sizes against fixed allocations {CVE-2026-97910} * CVE-2026-97923 - tracing: Free histogram the var ref when its initialization fails {CVE-2026-97923} * CVE-2026-97926 - ufs: validate cylinder group metadata before caching it {CVE-2026-97926} * CVE-2026-97927 - ufs: create the root dentry after loading cylinder metadata {CVE-2026-97927} * CVE-2026-97931 - ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931} * CVE-2026-97940 - ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940} * CVE-2026-97948 - powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver {CVE-2026-97948} * CVE-2026-97951 - scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands {CVE-2026-97951} * CVE-2026-97952 - sunvdc: unmap LDC cookies when the descriptor send fails {CVE-2026-97952} * CVE-2026-97954 - net/rds: fix tcp stream corruption with large pages {CVE-2026-97954} * CVE-2026-97957 - net: hinic: fix mailbox segment buffer overflow {CVE-2026-97957} * CVE-2026-97958 - net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). {CVE-2026-97958} * CVE-2026-97959 - net/sched: cls_route: free emptied bucket on filter move {CVE-2026-97959} * CVE-2026-97981 - net: ethernet: cortina: Count dropped frames as NAPI work {CVE-2026-97981} * CVE-2026-97982 - net: ethernet: cortina: Fix budget accounting {CVE-2026-97982} * CVE-2026-97993 - vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx {CVE-2026-97993} * CVE-2026-97995 - virtio_console: do not free control-out buffers on remove {CVE-2026-97995} * CVE-2026-97998 - netfilter: nfnetlink_log: cope with concurrent instance destruction {CVE-2026-97998} * CVE-2026-98006 - ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev {CVE-2026-98006} * CVE-2026-98009 - net/sched: ets: clamp quantum in parse and fallback paths {CVE-2026-98009} * CVE-2026-98010 - net/sched: drr: clamp quantum in change class {CVE-2026-98010} * CVE-2026-98011 - net/sched: hhf: clamp quantum in change and init paths {CVE-2026-98011} * CVE-2026-98012 - net/sched: sfq: clamp quantum in change path {CVE-2026-98012} * CVE-2026-98013 - net/sched: fq_pie: clamp quantum in change path {CVE-2026-98013} * CVE-2026-98015 - net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put {CVE-2026-98015} * CVE-2026-98022 - net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations {CVE-2026-98022} * CVE-2026-98023 - vxlan: reject dynamic fdb entries that reference a nexthop id {CVE-2026-98023} * CVE-2026-98025 - net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025} * CVE-2026-98027 - net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size {CVE-2026-98027} * CVE-2026-98030 - net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size {CVE-2026-98030} * CVE-2026-98063 - bpf: Fix NULL-ptr-deref in btf_var_show() {CVE-2026-98063} * CVE-2026-98064 - bpf: Fix NULL-ptr-deref when showing a void BTF type {CVE-2026-98064} * CVE-2026-98066 - ALSA: caiaq: Fix potential double-free at error path {CVE-2026-98066} * CVE-2026-98068 - net/rds: don't let rds_conn_shutdown() consume a concurrent drop {CVE-2026-98068} * CVE-2026-98069 - net/rds: acquire the fastpath locks in rds_conn_shutdown() {CVE-2026-98069} * CVE-2026-98070 - net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() {CVE-2026-98070} * CVE-2026-98071 - net/rds: clear cp_flags bits individually in rds_conn_path_reset() {CVE-2026-98071} * CVE-2026-98072 - net/rds: use wq_has_sleeper() in release_in_xmit() {CVE-2026-98072} * CVE-2026-98074 - bonding: do not clear curr_active_slave prematurely when releasing all slaves {CVE-2026-98074} * CVE-2026-98076 - tracing/probes: Fix use-after-free on field name/type of events with multiple probes {CVE-2026-98076} * CVE-2026-98077 - netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077} * CVE-2026-98078 - ipvs: fix reversed sequence option serialization {CVE-2026-98078} * CVE-2026-98080 - btrfs: do not force reloc root creation during qgroup_account_snapshot() {CVE-2026-98080} * CVE-2026-98091 - btrfs: detach failed sprout device from transaction update list {CVE-2026-98091} * CVE-2026-98094 - staging: fbtft: make dirty_lock IRQ-safe {CVE-2026-98094} * CVE-2026-98095 - af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). {CVE-2026-98095} * CVE-2026-98096 - ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096} * CVE-2026-98108 - Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan {CVE-2026-98108} * CVE-2026-98123 - sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration {CVE-2026-98123} * CVE-2026-98130 - sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130} * CVE-2026-98157 - EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation {CVE-2026-98157} * CVE-2026-98158 - ppp_async: drop the errored frame instead of resetting its headroom {CVE-2026-98158} * CVE-2026-98185 - wifi: mwifiex: validate scan response extents {CVE-2026-98185} * CVE-2026-98186 - wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length {CVE-2026-98186} * CVE-2026-98187 - wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST {CVE-2026-98187} * CVE-2026-98188 - wifi: p54: validate curve data length in the calibration curve converters {CVE-2026-98188} * CVE-2026-98189 - wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() {CVE-2026-98189} * CVE-2026-98190 - wifi: wilc1000: fix out-of-bounds read in P2P public action frames {CVE-2026-98190} * CVE-2026-98191 - wifi: wlcore: release runtime PM ref on regdomain config failure {CVE-2026-98191} * CVE-2026-98194 - wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194} * CVE-2026-98195 - wifi: iwlegacy: fix broadcast stations deallocation {CVE-2026-98195} * CVE-2026-98196 - wifi: brcmsmac: fix UAF in brcms_free_timer() {CVE-2026-98196} * CVE-2026-98197 - hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove {CVE-2026-98197} * CVE-2026-98201 - Input: zero ff_effect before compat copy in input_ff_effect_from_user {CVE-2026-98201} * CVE-2026-98202 - Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound {CVE-2026-98202} * CVE-2026-98203 - Input: soc_button_array - check btns_desc->package.count {CVE-2026-98203} * CVE-2026-98204 - Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() {CVE-2026-98204} * CVE-2026-98205 - Input: evdev - zero absinfo before partial copy in EVIOCSABS {CVE-2026-98205} * CVE-2026-98207 - mmc: spi: reset bytes_xfered before retrying CRC failures {CVE-2026-98207} * CVE-2026-98208 - mmc: sdio_uart: fix xmit_fifo leak when the port table is full {CVE-2026-98208} * CVE-2026-98209 - mmc: sdhci-of-aspeed: Remove children before releasing SDC resources {CVE-2026-98209} * CVE-2026-98210 - mmc: mxcmmc: cancel data work and watchdog on remove {CVE-2026-98210} * CVE-2026-98217 - IB/mlx4: Fix use-after-free on pkey sysfs registration failure {CVE-2026-98217} * CVE-2026-98233 - net/packet: clear RX owner on VNET header error {CVE-2026-98233} * CVE-2026-98234 - net/sched: hhf: cap hh_flows_limit at change time {CVE-2026-98234} * CVE-2026-98241 - ipv6: xfrm: use full sockets in local error paths {CVE-2026-98241} * CVE-2026-98251 - openvswitch: avoid reallocating confirmed conntrack labels {CVE-2026-98251} * CVE-2026-98252 - RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() {CVE-2026-98252} * CVE-2026-98253 - RDMA/ucma: Serialize join and leave on copy_to_user failure {CVE-2026-98253} * CVE-2026-98255 - tcp: exclude old ACKs from tcp fast path {CVE-2026-98255} * CVE-2026-98257 - rds: ib: use rds_conn_drop() on protocol version mismatch {CVE-2026-98257} * CVE-2026-98262 - ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY {CVE-2026-98262} * CVE-2026-98272 - net: mvpp2: prevent buffer overflow in page_pool allocation {CVE-2026-98272} * CVE-2026-98275 - net: ethernet: cortina: Ack RX overrun interrupt correctly {CVE-2026-98275} * CVE-2026-98276 - net: lock the socket in sock_gettstamp() {CVE-2026-98276} * CVE-2026-98282 - powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba {CVE-2026-98282} * CVE-2026-98298 - dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() {CVE-2026-98298} * CVE-2026-98299 - tcp: do not let tcp_rmem be set below 4096 {CVE-2026-98299} * CVE-2026-98300 - tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). {CVE-2026-98300} * CVE-2026-98302 - net: fddi: skfp: fix NULL deref when setting the MAC address while down {CVE-2026-98302} * CVE-2026-98306 - seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation {CVE-2026-98306} * CVE-2026-98308 - ALSA: hda: trace PCM open only after assigning a stream {CVE-2026-98308} * CVE-2026-98311 - wifi: virt_wifi: don't transfer operstate before register {CVE-2026-98311} * CVE-2026-98314 - ALSA: pcm: set timer->private_data before registering the PCM timer {CVE-2026-98314} * CVE-2026-98319 - drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr {CVE-2026-98319} * CVE-2026-98320 - netfilter: flowtable: hold reference on ct until flow is released {CVE-2026-98320} * CVE-2026-98322 - netfilter: nft_nat: fully initialise new_addr in netmap setup {CVE-2026-98322} * CVE-2026-98323 - RDMA/siw: Bound fragmented header copies by the remaining length {CVE-2026-98323} * CVE-2026-98339 - wifi: cfg80211: don't filter by BSS type when removing stale entries {CVE-2026-98339} * CVE-2026-98340 - wifi: cfg80211: only group hidden BSSes with beacon entries {CVE-2026-98340} * CVE-2026-98342 - dmaengine: wait for RCU readers before releasing dma_device {CVE-2026-98342} * CVE-2026-98343 - dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() {CVE-2026-98343} * CVE-2026-98344 - dmaengine: Fix device kref underflow in dma_chan_put() {CVE-2026-98344} * CVE-2026-98345 - wifi: cfg80211: check IP header size in cfg80211_classify8021d() {CVE-2026-98345} * CVE-2026-98347 - IB/IPoIB: Avoid restoring OPER_UP after multicast flush {CVE-2026-98347} * CVE-2026-98348 - wifi: libipw: reject too-short association responses {CVE-2026-98348} * CVE-2026-98349 - wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349} * CVE-2026-98351 - wifi: virt_wifi: free skb when disconnected {CVE-2026-98351} * CVE-2026-98354 - RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354} * CVE-2026-98357 - IB/isert: wait for deferred control PDU completions before releasing the connection {CVE-2026-98357} * CVE-2026-98358 - IB/iser: reject a remote invalidation of an unregistered direction {CVE-2026-98358} * CVE-2026-98362 - clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate {CVE-2026-98362} * CVE-2026-98363 - firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS {CVE-2026-98363} * CVE-2026-98367 - RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept {CVE-2026-98367} * CVE-2026-98370 - xfrm: fix compat ALLOCSPI request use-after-free {CVE-2026-98370} * CVE-2026-98379 - netfilter: ip6t_rpfilter: reject routes without inet6_dev {CVE-2026-98379} * CVE-2026-98380 - net/sched: reject IDR error pointers when deleting actions {CVE-2026-98380} * CVE-2026-98383 - bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL {CVE-2026-98383} * Miscellaneous upstream changes - ima: return error early if file xattr cannot be changed - tee: optee: Allow MT_NORMAL_TAGGED shared memory - PCI: Stop setting cached power state to 'unknown' on unbind - hfsplus: fix issue of direct writes beyond end-of-file - wifi: mac80211: always allow transmitting null-data on TXQs - kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access() - bridge: Do not suppress ARP probes and DAD NS unconditionally - soundwire: validate DT compatible before parsing it - media: rc: mceusb: Add support for 04eb:e033 - thunderbolt: Keep the domain reference while processing hotplug - net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family - net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family - media: em28xx-video: fix missing res_free() on init_usb_xfer failure - clk: renesas: cpg-mssr: Add number of clock cells check - ASoC: ti: omap3pandora: update board check to use DT compatible - drm/amd/display: Fix CRC open failure during active rendering - hfsplus: rework hfsplus_readdir() logic - scsi: pm8001: Reject firmware update in fatal error state - scsi: pm8001: Reject non-fatal dump when controller is crashed - crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y - crypto: atmel-ecc - add support for atecc608b - media: imon: Add iMON VFD HID OEM v1.2 key mappings - RDMA/mlx5: Use QP port when decoding responder CQEs - mailbox: Make mbox_send_message() return error code when tx fails - ALSA: usx2y: Drain pending US-428 pipe-4 output commands - 9p: invalidate readdir buffer on seek - arm64/daifflags: Make local_daif_*() helpers __always_inline - firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size - bitfield: wire __bf_shf to __builtin_ctzll - net: usb: qmi_wwan: add MeiG SRM813Q - net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() - net/sched: sch_drr: make cl->quantum lockless - befs: handle set_blocksize failures - minix: handle set_blocksize failures - isofs: handle set_blocksize failures - usb: host: add ARCH_AIROHA in XHCI MTK dependency - char/nvram: Remove redundant nvram_mutex - netlabel: fix IPv6 unlabeled address add error handling - rds: annotate data-race around rs_seen_congestion - s390/zcore: Removed unused variables - clk: socfpga: agilex: implement l3_main_free_clk - drm/panel: simple: Add AM-1280800W8TZQW-T00H - mips: cps: Assemble jr.hb with an R2 ISA level - iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind - irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed - ALSA: usb-audio: Add quirk for Novation Mininova - drm/amd/pm/si: Fix updating clock limits from power states - ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() - hfs: rework hfsplus_readdir() logic - scripts: modpost: detect and report truncated buf_printf() output - ASoC: Intel: catpt: Complete coredump handling - soundwire: only handle alert events when the peripheral is attached - mmc: davinci: fix mmc_add_host order in probe - iio: accel: mma8452: switch to non-devm request_threaded_irq() - net: ibm: emac: Reserve VLAN header in MJS limit - ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive - iommu/rockchip: disable fetch dte time limit - ASoC: codecs: rk3328: Use managed GPIO and clock helpers - ALSA: seq: oss: Reject reads that cannot fit the next event - clk: keystone: don't cache clock rate - ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP - ipmi: si: Use platform_get_irq_optional() to retrieve interrupt - wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications - RDMA/mlx5: Fix state and counter desync on loopback enable failure - net: cpsw_new: unregister devlink on port registration failure - xprtrdma: Add request-pool slack for delayed recycling - configfs_depend_prep(): pass configfs_dirent instead of dentry - platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table - wifi: mt76: transform aspm_conf for pci_disable_link_state - hwmon: (adt7462) Add of_match_table to support devicetree - ata: libata-pmp: add JMicron JMS562 quirk - platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table - sctp: Unwind address notifier registration on failure - PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems - hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i - ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence - ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure - sparc64: uprobes: add missing break - vsock: use sk_acceptq_is_full() helper in all transports - e1000e: limit endianness conversion to boundary words - net/sched: act_csum: don't mangle UDP tunnel GSO packets - sparc: Disable compat support with LLD - fuse: set ff->flock only on success - scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block() - gpio: pisosr: Read "ngpios" as u32 - ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 - leds: uleds: Return -EFAULT on copy_to_user() failure - leds: pca9532: Don't stop blinking for non-zero brightness - ALSA: usb-audio: Add quirk for YAMAHA CDS3000 - md/raid5: let stripe batch bm_seq comparison wrap-safe - rtc: aspeed: add AST2700 compatible - PCI/sysfs: Use kstrtobool() to parse the ROM attribute input - rtc: bq32000: add delay between RTC reads - fbdev: pm2fb: unwind WC setup on probe failure - drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend - netfilter: nf_conntrack_expect: zero at allocation time - drm/arm/komeda: fix error handling for clk_prepare_enable() and callers - xen/front-pgdir-shbuf: free grant reference head on errors - freevxfs: don't BUG() on unknown typed-extent type - xen/gntalloc: validate grant count before allocation - wifi: ralink: RT2X00: init EEPROM properly - wifi: mac80211: validate deauth frame length before reason access - wifi: libertas: reject short monitor TX frames - gpio: dwapb: Mask interrupts at hardware initialization - netfilter: ipset: mark the rcu locked areas properly - arm64: fixmap: Allow 256K early_ioremap() at any offset - arm64: kprobes: Allow reentering kprobes while single-stepping - drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized - wifi: mwifiex: replace one-element arrays with flexible array members - wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO - drm/gma500: return errors from Oaktrail HDMI I2C reads - phonet: check register_netdevice_notifier() error in phonet_device_init() - ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx - ice: pass the return value of skb_checksum_help() - powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash - ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) - ASoC: rt5645: Perform the initial jack detect at probe - clk: at91: pmc: #undef field_{get,prep}() before definition - Revert "Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU" - Revert "Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU" - drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() - selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter - net/sched: act_api: budget all shared attributes in notify skbs - net/sched: act_api: size the RTM_GETACTION reply from the actions - net: amd-xgbe: discard rx packets with bad FCS - OPP: of: Fix potential multiplication overflow when calculating freq - Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM - Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() - ASoC: ab8500: Reset the audio block before configuring it - ASoC: ab8500: Repair the DAPM capture graph - ASoC: ab8500: Update to modern clocking terminology - ASoC: ab8500: Correct digital interface format setup - ASoC: ab8500: Validate and program TDM slots correctly - tty: make tty_ldisc_ops::hangup return void - ppp: ppp_async: simplify tty disc_data access - ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits - ASoC: ux500: Fix MSP stream lifecycle handling - ASoC: ux500: remove platform_data support - ASoC: ux500: Propagate MSP setup errors - ASoC: ux500: Correct MSP frame and bit clock setup - ASoC: ux500: Validate MSP DAI configuration - ASoC: ux500: remove stedma40 references - ASoC: ux500: Request the MSP MMIO resource - ASoC: ux500: Program the MSP FIFO watermarks - btrfs: return an error from btrfs_record_root_in_trans - net/rds: use clear_bit_unlock() in release_refill() - net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown - net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset - bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit() - powerpc/kexec_file: Use inclusive range checks in add_usable_mem() - net/mlx5e: Fix setting RS FEC after remapping - net/mlx5e: Fix ETS zero BW reporting when one TC holds 100% - net_sched: sch_fq_pie: implement lockless fq_pie_dump() - net/sched: pie: clamp psched_mtu in pie_drop_early - ASoC: bcm: bcm63xx: Publish the OF module aliases - ASoC: Intel: SST: Publish the PCI module aliases - netfilter: ip6_tables: set F_PROTO when proto value is nonzero - ASoC: mt6351: Publish the OF module alias - virtio-console: call scheduler when we free unused buffs - virtio-pci: return IRQ_HANDLED after non-zero ISR - net: ethernet: cortina: Finish RX updates before NAPI completion - net: ethernet: cortina: No mapping is a dropped rx - net: ethernet: cortina: Count RX drops once per frame - net: ethernet: cortina: Count RX descriptors for freeq refill - hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown() - hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors - selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value - net: sun4i-emac: fix missing of_node_put() for phy_node - net/rds: Pass a pointer to virt_to_page() - Revert "bluetooth/l2cap: sync sock recv cb and release" - scsi: target: iscsi: Handle abort for WRITE_PENDING cmds - ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough - dm/amdgpu: fix malformed link_settings debugfs output - watchdog: sunxi_wdt: preserve boot-enabled watchdog - tunnels: Drop stale dst when building an ICMP error for PMTUD - exec: do_close_on_exec() before taking exec_update_lock - net: hso: fix TIOCMIWAIT race - netfilter: report NLM_F_DUMP_FILTERED when all is filtered out - KVM: PPC: Book3S HV: Set irqfd->producer only on success - s390/qeth: allow bridgeport queries despite OS_MISMATCH - hwmon: (applesmc) fix key backlight workqueue leak on register failure - hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS - media: hevc: add bounded tile-count helpers - media: v4l2-h264: Fix memcmp() size in B1 reference list comparison - netfilter: nft_set_pipapo_avx2: add missing vzeroupper - mptcp: hold mptcp socket before calling tcp_done - Bluetooth: L2CAP: Fix deadlock - ARM: fix hash_name() fault - ARM: fix branch predictor hardening - ARM: ensure interrupts are enabled in __do_user_fault() - sunvdc: fix -EIO issue due to lack of retries - media: video-i2c: fix buffer queue ordering - ipv6: Select best matching nexthop object in fib6_table_lookup() - ipv6: Honor oif when choosing nexthop for locally generated traffic - xfrm: propagate extack to all netlink doit handlers - xfrm: add extack to verify_sec_ctx_len - xfrm: add extack support to verify_newsa_info - xfrm: add extack to verify_one_alg, verify_auth_trunc, verify_aead - xfrm: avoid RCU warnings around the per-netns netlink socket - ARM: socfpga: select the PL310 erratum 753970 workaround - RDMA/siw: Introduce siw_cep_set_free_and_put - RDMA/siw: Cleanup siw_accept - IB/iser: Align coding style across driver - IB/iser: Remove iser_reg_data_sg helper function - IB/iser: Use iser_fr_desc as registration context - scsi: target: iscsi: Avoid in_interrupt() usage in iscsit_close_session() - scsi: target: iscsi: Avoid in_interrupt() usage in iscsit_check_session_usage_count() - scsi: target: iscsi: Redo iscsit_check_session_usage_count() return code - scsi: target: iscsi: Rename iscsi_cmd to iscsit_cmd - dmaengine: sprd: Fix runtime PM reference leak in probe - wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path - soundwire: cadence_master: wait and cancel cdns->work before clock stop - MIPS: Octeon: apply USB FDT fixups also when USB is modular - dma-mapping: simplify dma_init_coherent_memory - dma-coherent: Warn if OF reserved memory is beyond current coherent DMA mask - dma-coherent: report a failed reserved memory assignment - wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown - wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set - wifi: mac80211: don't access the TSF of a down interface - dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order - dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA - keys: fix lost wakeup when reaping a dead key type - Input: trackpoint - fix the inertia attribute name in the ABI document - btrfs: tree-checker: print dev extent offset in error message - wifi: brcmfmac: fix lost 802.1x TX completion wakeup - Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown - drop_monitor: synchronize tracepoint unregistration on error path - drop_monitor: fix out-of-bounds write in reset_per_cpu_data() - KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure - ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments - net: netsec: fix device_node reference leak on phy_np - Input: eeti_ts - publish the OF module alias - Input: xpad - add support for Victrix Pro BFG Controller - Input: xpad - fix PDP Marvel Xbox 360 controller - net: xfrm: reject unrepresentable espintcp transport headers - arm64: percpu: Fix this_cpu_write() casting - arm64: percpu: Fix this_cpu_and() mask generation - Bluetooth: btusb: fix NXP IW610 composite device handling - dmaengine: sun6i: fix non-atomic read of DMA position registers - dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status - dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() - net/packet: avoid truncating TPACKET_V3 private size - keys: translate request_key_auth pid for the reading procfs instance - i2c: at91: release DMA channels on remove and probe error - i2c: imx: release DMA channels on probe error - selinux: always fill AVC decision in avc_has_perm_noaudit() - mmc: core: Fix OF node reference leak on card add failure - mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt - mmc: sdhci_am654: Reset command and data lines on failed tuning - Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 - Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P - Input: soc_button_array - fix MS Surface Pro 11 probe failure - Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) - hwmon: (w83793) release probe data through kref - watchdog: digicolor: Avoid division by zero - watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() - wifi: rsi: fix heap OOB write on key removal - wifi: mwifiex: validate action frame fixed fields - wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver - drm/msm/adreno: fix autosuspend cleanup during teardown - drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure - HID: logitech-hidpp: fix race condition when accessing stale stack pointer - spi: zynqmp-gqspi: Use devm_spi_alloc_host() - bpf: Fix bpf_skb_change_tail wrt csum partial skbs - selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tc - bpf: Fix out-of-bounds read of rtt_min in sock_ops - squashfs: Add dictionary size range check to prevent shift-out-of-bounds - Bluetooth: SMP: reject Security Request over BR/EDR - s390/pci: expose UID uniqueness guarantee - Documentation: s390: correct spelling - docs: s390/pci: Improve and update PCI documentation - s390/pci/docs: Fix sriov_numvfs attribute name - xsk: Use a 32-bit compare in xsk_map_gen_lookup - netfilter: flowtable: allow unidirectional rules - netfilter: flowtable: publish HW_DEAD after worker is done - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation - netfilter: nfnetlink_queue: hold nfnl mutex in event notifier - netfilter: nft_synproxy: use the family-aware checksum helper - ipvs: revalidate ihl before icmp_send - ocfs2: make ocfs2_calc_xattr_init() return void - drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update - drm/nouveau/clk: don't clobber reclock status when restoring volt/fan - net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure - net: gue: reject invalid REMCSUM offsets - ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink(). - sctp: avoid livelock while updating retransmit path - net: usb: catc: bound the RX packet length in catc_rx_done() - net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget - drm/virtio: fix object leak when drm_gem_handle_create() fails - drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() - Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough - Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() - net: usb: sr9700: include receive overhead in the length check - tg3: clean up PHYLIB resources on probe failure - net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error - bpf: Fix bpf_sock context code generation - net: stmmac: selftests: Support running selftests on DSA conduits - net: stmmac: selftests: Check the dev->features for S-TAG offload testing - net: stmmac: selftests: Capture all packets for vlan checks - net: stmmac: Remove some unnecessary void pointers - net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K - nfc: nfcmrvl: validate helper command length before pull - nfc: st21nfca: remove redundant assignment to variable i - nfc: st21nfca: validate received frame size - nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() - nfc: llcp: Fix race condition in accept_queue lifecycle - nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure - nfc: st21nfca: validate ISO15693 inventory length - nfc: llcp: fix -ENOMEM on connect with zero-length service name - nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() - nfc: llcp: fix slab-out-of-bounds reads when logging service names - nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() - net/sched: act_gate: budget the per-entry list in get_fill_size - net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() - ip_gre: Reject enabling collect metadata through changelink - net: xps: reject an out of range traffic class - tipc: Fix a data race on mon->peer_cnt in mon_timeout() - llc: fix skb UAF and leaks on llc_mac_hdr_init() failure - bridge: check llc_mac_hdr_init() return value in br_send_bpdu() - net/sched: sch_teql: fix shadowed err in __teql_resolve() - vlan: ensure sufficient headroom in vlan_dev_hard_header() - autofs: fix sbi->pipe file reference leak in autofs_kill_sb() - rculist: add list_splice_rcu() for private lists - net: add and use skb_unclone_keeptruesize() helper - net: add skb_set_end_offset() helper - x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11 - tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow - sctp: discard the rest of the packet on a stale-cookie error - af_packet: fix integer overflow in prb_calc_retire_blk_tmo() - fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT - workqueue: Fix NULL current_pwq deref in flush dependency check - fsl/fman: Fix clk reference leak in read_dts_node() - ipv6: do not let ipv6_find_hdr() return an offset past the packet end - ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST - gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() - gpio: zynq: fix runtime PM leak on request error path - llc: reserve device headroom for allocated frames - rds: ib: Clear the sg list when mapping an MR fails - drm/nouveau: fix autosuspend cleanup during teardown - drm/nouveau: Fix bridge reference leak in nv1a_ram_new() - drm/nouveau: fix double-free in nvif_vmm_dtor - drm/nouveau: Fix gem reference leak in validate_init() - HID: alps: fix use-after-free on input2 registration failure - HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard - HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() - net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() - net: arp: terminate device name before lookup - net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read - net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy() - net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry - net: atl1c: fix soft lockup on out-of-range tpd_cons read - net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read - net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist - netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read - nfc: fix use-after-free in nfc_get_local_general_bytes - nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() - nfc: port100: reject frames whose declared length exceeds the received data - scsi: libiscsi_tcp: Check the data direction of a Data-In PDU - pinctrl: single: free the IRQ on domain creation failure - s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str() - Bluetooth: hci_sock: validate event length before filtering - Bluetooth: hci_sock: reject out-of-range OCF values - Bluetooth: L2CAP: validate frame length before control and FCS access - Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO - lan78xx: Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected - lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected - Linux 5.10.271