1. 6185475 UPSTREAM: nfc: llcp: Fix race condition in accept_queue lifecycle by Lee Jones · 5 days ago android14-6.1-2025-09
  2. 886603e UPSTREAM: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF by Lee Jones · 5 days ago
  3. 8096b8e UPSTREAM: x86/mm: Fix check/use ordering in switch_mm_irqs_off() by Stephen Dolan · 5 days ago
  4. f92a29b UPSTREAM: Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel by Lee Jones · 6 days ago
  5. 68be20d UPSTREAM: Bluetooth: RFCOMM: serialize security confirmation handling by Chengfeng Ye · 11 days ago android14-6.1-2025-09_r36
  6. 434ece6 UPSTREAM: Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept by Ali Ahmet Memis · 11 days ago
  7. 0c24cb1 UPSTREAM: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref by Marco Elver · 4 weeks ago android14-6.1-2025-09_r35
  8. ad2257b ANDROID: KMI fix: undo KMI changes from BT_HS removal by Todd Kjos · 4 weeks ago
  9. be1c13b UPSTREAM: Bluetooth: Remove BT_HS by Luiz Augusto von Dentz · 4 weeks ago
  10. 0d8cc1d UPSTREAM: Bluetooth: L2CAP: validate option length before reading conf opt value by Muhammad Bilal · 4 weeks ago
  11. b7b8cb9 FROMLIST: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 by Fuad Tabba · 4 weeks ago
  12. b99afb0 UPSTREAM: Bluetooth: hci_conn: fix potential UAF in create_big_sync by David Carlier · 4 weeks ago
  13. 49b82a8 UPSTREAM: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend by Yuqi Xu · 4 weeks ago
  14. a34aef7 UPSTREAM: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ by Luiz Augusto von Dentz · 4 weeks ago
  15. 6351cedd ANDROID: KVM: arm64: Prevent integer overflow in rb_cpu_fits checks by Vincent Donnefort · 4 weeks ago
  16. 6ede4c86 ANDROID: KVM: arm64: Fix page unpin on rb_cpu_init() error by Vincent Donnefort · 4 weeks ago
  17. e0d95c06 ANDROID: KVM: arm64: Reject empty backing in rb_setup_bpage_backing() by Vincent Donnefort · 4 weeks ago
  18. e989cb5 ANDROID: KVM: arm64: Fix rb_cpu_fits_pack() invocation from pKVM tracing by Will Deacon · 4 weeks ago
  19. 489c6de UPSTREAM: Bluetooth: ISO: fix UAF in iso_recv_frame by Muhammad Bilal · 4 weeks ago
  20. 885bb3f ANDROID: netfilter: xt_quota2: fix UAF in q2_get_counter error path by Todd Kjos · 4 weeks ago
  21. 6fefc95 UPSTREAM: af_unix: Give up GC if MSG_PEEK intervened. by Kuniyuki Iwashima · 4 weeks ago
  22. 50ac0ca ANDROID: fuse-bpf: atomic backing inode swap and refcount fix by Sandeep Dhavale · 5 weeks ago
  23. bf43e72 UPSTREAM: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows by Greg Kroah-Hartman · 6 weeks ago
  24. 3c9a068 UPSTREAM: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq by Benoît Sevens · 6 weeks ago
  25. b2b8c33 UPSTREAM: HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID by Lee Jones · 6 weeks ago
  26. 8bf8457 ANDROID: fuse-bpf: enforce stacking depth limits on backing files by Sandeep Dhavale · 6 weeks ago
  27. 1c60ca2 UPSTREAM: posix-cpu-timers: Prevent UAF caused by non-leader exec() race by Thomas Gleixner · 6 weeks ago
  28. e93db4c UPSTREAM: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup by Sebastian Andrzej Siewior · 7 weeks ago
  29. c6f9378 UPSTREAM: usb: gadget: uvc: fix NULL pointer dereference during unbind race by Jimmy Hu · 7 weeks ago
  30. abe1534 ANDROID: fuse-bpf: instantiate child dentry with correct child inode by Sandeep Dhavale · 7 weeks ago
  31. bb3cab4 ANDROID: fuse-bpf: Fix VFS locking in file creation by Sandeep Dhavale · 7 weeks ago
  32. 547242b ANDROID: FUSE: Clear inode after d_splice_alias() to prevent double iput by Sandeep Dhavale · 7 weeks ago
  33. 50d48ba UPSTREAM: nfc: llcp: bound the connect_sn TLV walk to the skb by Doruk Tan Ozturk · 7 weeks ago
  34. 140412d ANDROID: fuse-bpf: validate reply size for FUSE_CANONICAL_PATH by Sandeep Dhavale · 7 weeks ago
  35. a532d5d ANDROID: KVM: arm64: Check page alignment in __pkvm_guest_relinquish_to_host by Keir Fraser · 9 weeks ago
  36. 414e324 UPSTREAM: binder: fix UAF in binder_free_transaction() by Carlos Llamas · 9 weeks ago
  37. ff74d13 UPSTREAM: binder: fix UAF in binder_thread_release() by Carlos Llamas · 9 weeks ago
  38. 8271e7e ANDROID: dm-bow: Fix Use-After-free in dm_bow_dtr() by Vova Sharaienko · 2 months ago
  39. 0f62335 UPSTREAM: Bluetooth: SCO: hold sk properly in sco_conn_ready by Pauli Virtanen · 3 months ago android14-6.1-2025-09_r34
  40. 8a27638 UPSTREAM: Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready by Pauli Virtanen · 3 months ago
  41. ef39fe6 UPSTREAM: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued by Davidlohr Bueso · 3 months ago
  42. 6416f2d UPSTREAM: arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU by Will Deacon · 3 months ago
  43. a4af8b0 UPSTREAM: arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU by Shanker Donthineni · 3 months ago
  44. 57a2b9f UPSTREAM: arm64: errata: Mitigate TLBI errata on various Arm CPUs by Mark Rutland · 3 months ago
  45. ba9780b UPSTREAM: arm64: cputype: Add Neoverse-V3AE definitions by Mark Rutland · 3 months ago
  46. 3280cd3 UPSTREAM: arm64: cputype: Add C1-Premium definitions by Mark Rutland · 3 months ago android14-6.1-2025-09_r33
  47. bfe66e8 UPSTREAM: arm64: cputype: Add C1-Ultra definitions by Mark Rutland · 3 months ago
  48. afd9eee UPSTREAM: arm64: cputype: Add NVIDIA Olympus definitions by Shanker Donthineni · 3 months ago
  49. 78e7ff8 UPSTREAM: arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI by Mark Rutland · 3 months ago
  50. 2bbedc8 BACKPORT: arm64: tlb: Allow XZR argument to TLBI ops by Mark Rutland · 3 months ago
  51. bccf177 BACKPORT: KVM: arm64: Remove VPIPT I-cache handling by Marc Zyngier · 3 months ago
  52. 9ca49c5 UPSTREAM: eventpoll: fix ep_remove struct eventpoll / struct file UAF by Christian Brauner · 3 months ago
  53. eadbd11 UPSTREAM: eventpoll: move epi_fget() up by Christian Brauner · 3 months ago
  54. 3f11a85c UPSTREAM: eventpoll: rename ep_remove_safe() back to ep_remove() by Christian Brauner · 3 months ago
  55. 285377e UPSTREAM: eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() by Christian Brauner · 3 months ago
  56. 7110574 UPSTREAM: eventpoll: kill __ep_remove() by Christian Brauner · 3 months ago
  57. e8cf5a3 UPSTREAM: eventpoll: split __ep_remove() by Christian Brauner · 3 months ago
  58. cdf1e9a UPSTREAM: eventpoll: use hlist_is_singular_node() in __ep_remove() by Christian Brauner · 3 months ago
  59. 250328e UPSTREAM: file: add fput() cleanup helper by Christian Brauner · 3 months ago
  60. e4bae9b FROMGIT: HID: core: Fix OOB read in hid_get_report for numbered reports by Lee Jones · 3 months ago
  61. 070087c ANDROID: Fix ABI issues related to changed hid_report_raw_event() by Lee Jones · 4 months ago
  62. 850bc90 UPSTREAM: HID: core: Fix size_t specifier in hid_report_raw_event() by Nathan Chancellor · 4 months ago
  63. 098d511 UPSTREAM: HID: pass the buffer size to hid_report_raw_event by Benjamin Tissoires · 4 months ago
  64. 7105da3 UPSTREAM: HID: core: Add printk_ratelimited variants to hid_warn() etc by Vicki Pfau · 4 months ago
  65. d302797 UPSTREAM: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() by Zhang Cen · 4 months ago
  66. e7e7699 ANDROID: KVM: arm64: Remove rb_cpu_teardown from rb_cpu_init err path by Vincent Donnefort · 4 months ago
  67. 45cc69d ANDROID: KVM: arm64: Make the pvmfw primary slot permanent by Fuad Tabba · 4 months ago
  68. 1cbacf3 ANDROID: KVM: arm64: Commit vCPU power_state at the top of pkvm_reset_vcpu by Fuad Tabba · 4 months ago
  69. 3f1b3e1 ANDROID: KVM: arm64: Return SUCCESS to guest if CPU_ON target ran by Fuad Tabba · 4 months ago
  70. e1a8238 ANDROID: KVM: arm64: Make CPU_ON failure rollback atomic by Fuad Tabba · 4 months ago
  71. 21747d7 ANDROID: KVM: arm64: Treat non-protected vCPUs as always on at EL2 by Fuad Tabba · 4 months ago
  72. 9c0065e ANDROID: KVM: arm64: Remove MP state tracking from EL2 by Fuad Tabba · 4 months ago
  73. 17ee24b UPSTREAM: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() by Lee Jones · 4 months ago
  74. 017cff3 ANDROID: Add back l2tp_{session,tunnel}_{inc,dec}_refcount() for the ABI by Lee Jones · 4 months ago
  75. 76ff571 BACKPORT: l2tp: improve tunnel/session refcount helpers by James Chapman · 4 months ago
  76. ecc3e0e UPSTREAM: HID: wacom: Fix OOB write in wacom_hid_set_device_mode() by Lee Jones · 5 months ago
  77. 36de927 UPSTREAM: rtmutex: Use waiter::task instead of current in remove_waiter() by Keenan Dong · 5 months ago
  78. 281e560 UPSTREAM: net: skbuff: propagate shared-frag marker through frag-transfer helpers by Hyunwoo Kim · 5 months ago
  79. b190858 UPSTREAM: net: skbuff: preserve shared-frag marker during coalescing by William Bowling · 5 months ago
  80. fc8cffc4 ANDROID: GKI: Update the ABI symbol list by jongan.kim · 5 months ago android14-6.1-2025-09_r32
  81. 0768499 UPSTREAM: xfrm: esp: ipv4: fix up flags setting by Greg Kroah-Hartman · 5 months ago
  82. 5cad1cc UPSTREAM: xfrm: esp: avoid in-place decrypt on shared skb frags by Kuan-Ting Chen · 5 months ago
  83. ffb8d8e UPSTREAM: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() by Lee Jones · 5 months ago
  84. 60dfd8b UPSTREAM: nfc: llcp: Fix use-after-free in llcp_sock_release() by Lee Jones · 5 months ago
  85. 60e7f13 ANDROID: Compute dmabuf info for forks from scratch by T.J. Mercier · 6 months ago
  86. aa0f857 ANDROID: dma-buf: Hoist files_fdtable()->max_fds by T.J. Mercier · 6 months ago
  87. 228144d ANDROID: dmabuf: Fix task_dma_buf_info refcount and memory leaks by Sumanth Mothe · 6 months ago
  88. 2a340ba ANDROID: GKI: Update the ABI symbol list by Dongbum Kim · 6 months ago android14-6.1-2025-09_r31
  89. aa18ec4 ANDROID: 16K: skip fault-around in ELF segment padding holes by Kalesh Singh · 6 months ago
  90. 9f7328b UPSTREAM: tipc: fix double-free in tipc_buf_append() by Lee Jones · 6 months ago
  91. 540e326 UPSTREAM: nfc: llcp: add missing return after LLCP_CLOSED checks by Junxi Qian · 6 months ago
  92. be40433 ANDROID: 16K: Fix padding calculation during VMA split by Kalesh Singh · 6 months ago
  93. b5e53e0 ANDROID: 16K: Allow VMAs with all padding pages. by Kalesh Singh · 6 months ago
  94. f6fd6f8 ANDROID: read task_dma_buf_info under task lock and pin it by T.J. Mercier · 6 months ago
  95. ce0c4ca1 ANDROID: Introduce get_dmabuf_info() by T.J. Mercier · 6 months ago
  96. dbb1d4b ANDROID: fuse: Use vma_set_file() in fuse_backing_mmap() by Sandeep Dhavale · 6 months ago
  97. 9979205 ANDROID: Clear task dmabuf_info on unshare(CLONE_FILES) by T.J. Mercier · 6 months ago
  98. 1b92f80 FROMGIT: HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report by Benjamin Tissoires · 6 months ago
  99. 2d2174b FROMGIT: HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write by Lee Jones · 6 months ago
  100. 0bf651b FROMGIT: HID: logitech-dj: Standardise hid_report_enum variable nomenclature by Lee Jones · 6 months ago