Accepted linux-signed-arm64 6.12.90+1 (source) into proposed-updates

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 22 May 2026 21:01:16 +0200
Source: linux-signed-arm64
Architecture: source
Version: 6.12.90+1
Distribution: trixie-security
Urgency: high
Maintainer: Debian Kernel Team <[email protected]>
Changed-By: Salvatore Bonaccorso <[email protected]>
Changes:
 linux-signed-arm64 (6.12.90+1) trixie-security; urgency=high
 .
   * Sign kernel from linux 6.12.90-1
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.89
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.90
     - HID: playstation: Clamp num_touch_reports
     - media: uvcvideo: Enable VB2_DMABUF for metadata stream
     - [arm64] dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux
     - [arm64] regulator: mt6357: fix OF node reference imbalance
     - [arm64,armhf] regulator: rk808: fix OF node reference imbalance
     - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap
     - [amd64] media: intel/ipu6: fix error pointer dereference
     - media: saa7164: add ioremap return checks and cleanups
     - spi: aspeed-smc: fix controller deregistration
     - [amd64] platform/x86: hp-wmi: Ignore backlight and FnLock events
     - vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to
       copy
     - [arm64] drm/msm/gem: fix error handling in
       msm_ioctl_gem_info_get_metadata()
     - [amd64] drm/i915/psr: Init variable to avoid early exit from et alignment
       loop
     - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure
     - drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count.
     - drm/amdgpu: gate VM CPU HDP flush on reset lock
     - drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x
     - drm/amdkfd: Add upper bound check for num_of_nodes
     - drm/amdgpu: Add bounds checking to ib_{get,set}_value
     - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
     - drm/amdgpu/vce: Prevent partial address patches
     - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg
     - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
     - drm/amd/display: Change dither policy for 10 bpc output back to dithering
     - drm/gem: Fix inconsistent plane dimension calculation in
       drm_gem_fb_init_with_funcs()
     - drm/amdkfd: validate SVM ioctl nattr against buffer size
     - drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked()
     - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()
     - drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked()
     - drm/radeon: add missing revision check for CI
     - drm/amdgpu: zero-initialize GART table on allocation
     - drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds
     - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ
     - drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds
     - drm/amdkfd: Make all TLB-flushes heavy-weight
     - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
     - drm/amdgpu/pm: add missing revision check for CI
     - drm/amdgpu/pm: align Hawaii mclk workaround with radeon
     - [arm64] dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22
     - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
     - batman-adv: fix integer overflow on buff_pos
     - batman-adv: reject new tp_meter sessions during teardown
     - batman-adv: stop caching unowned originator pointers in BAT IV
     - batman-adv: bla: prevent use-after-free when deleting claims
     - batman-adv: bla: only purge non-released claims
     - batman-adv: bla: put backbone reference on failed claim hash insert
     - usb: typec: tcpm: reset internal port states on soft reset AMS
     - usb: dwc3: Move GUID programming after PHY initialization
     - ALSA: hda: cs35l56: Propagate ASP TX source control errors
     - ALSA: misc: Use guard() for spin locks
     - ALSA: core: Serialize deferred fasync state checks
     - ALSA: seq: Notify client and port info changes
     - ALSA: seq: Fix UMP group 16 filtering
     - Bluetooth: hci_conn: fix potential UAF in create_big_sync
     - [arm64,armhf] spi: tegra20-sflash: fix controller deregistration
     - [arm64,armhf] spi: tegra114: fix controller deregistration
     - mm/hugetlb_cma: round up per_node before logging it
     - block: cleanup blkdev_report_zones()
     - block: reorganize struct blk_zone_wplug
     - block: fix zone write plug removal
     - tracefs: Fix default permissions not being applied on initial mount
     - fbcon: Avoid OOB font access if console rotation fails
     - mm/damon/core: disallow time-quota setting zero esz
     - mm/damon/core: implement damon_kdamond_pid()
     - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values
     - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values
     - bonding: fix use-after-free due to enslave fail after slave array update
       (CVE-2026-23171)
     - io_uring/kbuf: support min length left for incremental buffers
     - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
     - btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type()
     - btrfs: fix double free in create_space_info_sub_group() error path
     - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to
       info-leak
     - tracing/probes: Limit size of event probe to 3K
     - batman-adv: stop tp_meter sessions during mesh teardown
     - batman-adv: tp_meter: fix tp_num leak on kmalloc failure
     - vsock: fix buffer size clamping order
     - vsock/virtio: fix length and offset in tap skb for split packets
     - vsock/virtio: fix empty payload in tap skb for non-linear buffers
     - vsock/virtio: fix accept queue count leak on transport mismatch
     - drm/amdgpu/vcn3: Avoid overflow on msg bound check
     - drm/amdgpu/vcn4: Avoid overflow on msg bound check
 .
   [ Salvatore Bonaccorso ]
   * Bluetooth: btmtk: accept too short WMT FUNC_CTRL events (Closes: #1136790)
   * net: skbuff: preserve shared-frag marker during coalescing (CVE-2026-46300)
   * net: skbuff: propagate shared-frag marker through frag-transfer helpers
Checksums-Sha1:
 3c125bc1fcdfdf2b72ac3c5a7f602e89aaf6d3a5 9588 linux-signed-arm64_6.12.90+1.dsc
 dcf9a7b45387311420a61227567aae05a334f148 933316 linux-signed-arm64_6.12.90+1.tar.xz
Checksums-Sha256:
 c7e863fbeb211125bd5ad0f561fceae42000118c03a7351f77135198f01ab9b5 9588 linux-signed-arm64_6.12.90+1.dsc
 58cfd7e4909f8815eee684c42cd77a5361ee24e29f6742138f44d7c6d62d3d17 933316 linux-signed-arm64_6.12.90+1.tar.xz
Files:
 dbd040dc26ea983d6194b937ff082d5e 9588 kernel optional linux-signed-arm64_6.12.90+1.dsc
 f6eaf7a45d821366ea92f0eefcfb366a 933316 kernel optional linux-signed-arm64_6.12.90+1.tar.xz

-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQSInBJdRTWyTRy0ztFCTVFtUgONCgUCahEB4gAKCRBCTVFtUgON
Cq+YAQCkU5g8ABRWfORzrj2KzmGBqvmXiYj1mds7jZ1VvWycLAD/dAr9I6lK5BCn
hXx1ustpimpdBF0ywdxqrDmPG+ifYAk=
=pEv6
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNATURE-----

iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCahK4MwAKCRCb9qggYcy5
ISynAP96VeU3COOn4TYyoDggzLyRJeI6UK0qjiXiqhXBLLrt9QEAyLY562VZVul/
6Um64a8RAy5oZcVOQlzBiS4wnyPfQg4=
=CJ96
-----END PGP SIGNATURE-----