Commit f66469d9905b for kernel

commit f66469d9905b39d2c260a15d7d6db450f4db67c1
Merge: 2d2200551ccc fafbc4051123
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Nov 5 18:00:16 2026 -0800

    Merge tag 'net-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

    Pull networking fixes from Paolo Abeni:
     "Including fixes from Bluetooth, IPsec, WiFi and CAN.

      Current release - regressions:

        - eth: wwan: mhi_wwan_ctrl: send a DTR drop before it can be coalesced

      Previous releases - regressions:

        - core:
           - use a dedicated flag to track disabled napi instances
           - frags: limit the truesize of a reassembly queue
           - reject a negative TCP header offset in qdisc_pkt_len_segs_init()y

        - tcp:
           - reject unhashed sockets during established lookups
           - free ireq->ipv6_opt after an RCU grace period

        - ipv6:
           - fix fib6 walker UAF on NLM_F_REPLACE
           - raw: fix use-after-free in rawv6_send_hdrinc()

        - wifi:
           - mac80211: reinstate IEEE80211_TX_CTL_AMPDU, fix ath9k stall
           - brcmfmac: map msgbuf RX packet IDs bidirectional, fix firmware
             crash loop

        - vsock: size receive SKBs from declared payload

        - xfrm: fix use-after-free of migrated state in xfrm_do_migrate_state()

        - bluetooth: hci_sync: copy the LE accept list under hdev->lock

        - ptp: fix use-after-free in extts_fifo_show() reading tsevqs unlocked

        - can: protect the receive lists with a per-device lock

        - eth:
           - bnxt: don't keep MSI-X vectors added before FW reserves them
           - vxlan: stop rejecting dynamic FDB entries with a nexthop ID

      Previous releases - always broken:

        - sched: sch_qfq: prevent aggregate self-replacement

        - bridge: disable MRP ports before the FDB flush in del_nbp()

        - mptcp: do not use fast open on MP_JOIN subflows

        - ipv6: serialize multicast router socket ownership

        - bluetooth: hci_core: keep link-key filtering inside RCU

        - eth:
           - atl1c: drop oversized RX frames instead of panicking
           - stmmac: a bunch of XDP path fixes
           - b53: enable IGMP and MLD control packet CPU copies"

    * tag 'net-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (170 commits)
      tcp: ipv6: free ireq->ipv6_opt after an RCU grace period
      mptcp: pm: kernel: use RCU to free endpoint listeners
      tcp: initialize send sequence numbers before deferring TFO
      net: bridge: disable MRP ports before the FDB flush in del_nbp()
      net: stmmac: set XDP metadata length on the page_pool RX path
      bonding: fix missing down path on speed/duplex failure after FAIL->UP
      ip6mr: Serialize multicast router socket ownership
      bonding: 3ad: don't set BOND_LINK_FAIL on a slave that is not up
      net: ethernet: ti: am65-cpsw-nuss: Enable timestamping of unicast PTP packets
      net: count last skb of each sk_backlog pass in __release_sock()
      net: 8139cp: keep Rx masked while NAPI is scheduled
      net/smc: don't spin in smc_rx_recvmsg() while a pipe holds spliced data
      net: dsa: b53: restore the NSP IMP port 2 Gbps mode
      net: ethernet: bgmac: preserve forced 2.5 Gbps link speed
      l2tp: only return sessions of the given tunnel in l2tp_session_get()
      tipc: raise the minimum bearer MTU to fit tunnel and crypto overhead
      mptcp: do not use Fast Open on MP_JOIN subflows
      tcp: ipv6: do not read ireq->pktopts from tcp_v6_send_synack()
      ipv4: Call rt_add_uncached_list() if !do_cache in ip_route_input_slow().
      ipv6: Flush rt->from in rt6_uncached_list_flush_dev().
      ...