Commit 2c7c88a412aa for kernel

commit 2c7c88a412aa6d09cd04b414211b4ef8553b5309
Merge: 6bad2e38fe7f f5089008f90c
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Jul 9 08:26:51 2026 -0700

    Merge tag 'net-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

    Pull networking fixes from Paolo Abeni:
     "Including fixes from netfilter, Bluetooth and batman-adv.

      Current release - regressions:

       - bluetooth: fix using chan->conn as indication to no remote netdev

      Current release - new code bugs:

       - netfilter: cap to maximum number of expectation per master on
         updates

      Previous releases - regressions:

       - bluetooth:
          - fix UAF of hci_conn_params in add_device_complete
          - fix null ptr deref in hci_abort_conn()

       - igmp: remove multicast group from hash table on device destruction

       - batman-adv: prevent TVLV OOB check overflow

       - eth: mlx5/mlx5e:
          - fix off-by-one in single-FDB error rollback
          - skip peer flow cleanup when LAG seq is unavailable
          - fix crashes in dynamic per-channel stats and HV VHCA agent

       - eth: mana: Sync page pool RX frags for CPU

      Previous releases - always broken:

       - netfilter:
          - mark malformed IPv6 extension headers for hotdrop
          - terminate table name before find_table_lock()
          - ipvs: use parsed transport offset in TCP state lookup

       - sched: act_pedit: fix TOCTOU heap OOB write in tc offload

       - ethtool: rss: fix hfunc and input_xfrm parsing on big endian

       - ipv4/ipv6: fix UAF and memory leak in IGMP/MLD

       - tls: consume empty data records in tls_sw_read_sock()

       - eth:
          - octeontx2-af: fix VF bringup affecting PF promiscuous state
          - gue: validate REMCSUM private option length"

    * tag 'net-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (94 commits)
      macsec: don't read an unset MAC header in macsec_encrypt()
      dibs: loopback: validate offset and size in move_data()
      octeontx2-af: fix VF bringup affecting PF promiscuous state
      ethtool: rss: Fix hfunc and input_xfrm parsing on big endian
      net/mlx5: Fix L3 tunnel entropy refcount leak
      net: macb: drop in-flight Tx SKBs on close
      net: mana: Sync page pool RX frags for CPU
      net: mana: Validate the packet length reported by the NIC
      selftests/net: fix EVP_MD_CTX leak in tcp_mmap
      ipvs: ensure inner headers in ICMP errors are in headroom
      ipvs: use parsed transport offset in SCTP state lookup
      ipvs: use parsed transport offset in TCP state lookup
      ipvs: pass parsed transport offset to state handlers
      netfilter: handle unreadable frags
      netfilter: flowtable: support IPIP tunnel with direct xmit
      netfilter: flowtable: IPIP tunnel hardware offload is not yet support
      netfilter: flowtable: use dst in this direction when pushing IPIP header
      netfilter: ipset: allocate the proper memory for the generic hash structure
      netfilter: ipset: cleanup the add/del backlog when resize failed
      netfilter: ipset: exclude gc when resize is in progress
      ...