Commit 453a4a5f97f0 for kernel

commit 453a4a5f97f0c95b7df458e6afb98d4ab057d90b
Merge: 75c78a4faa7e db472c34a747
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Mar 26 09:53:08 2026 -0700

    Merge tag 'net-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

    Pull networking fixes from Paolo Abeni:
     "Including fixes from Bluetooth, CAN, IPsec and Netfilter.

      Notably, this includes the fix for the Bluetooth regression that you
      were notified about. I'm not aware of any other pending regressions.

      Current release - regressions:

        - bluetooth:
           - fix stack-out-of-bounds read in l2cap_ecred_conn_req
           - fix regressions caused by reusing ident

        - netfilter: revisit array resize logic

        - eth: ice: set max queues in alloc_etherdev_mqs()

      Previous releases - regressions:

        - core: correctly handle tunneled traffic on IPV6_CSUM GSO fallback

        - bluetooth:
           - fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
           - fix deadlock in l2cap_conn_del()

        - sched: codel: fix stale state for empty flows in fq_codel

        - ipv6: remove permanent routes from tb6_gc_hlist when all exceptions expire.

        - xfrm: fix skb_put() panic on non-linear skb during reassembly

        - openvswitch:
           - avoid releasing netdev before teardown completes
           - validate MPLS set/set_masked payload length

        - eth: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()

      Previous releases - always broken:

        - bluetooth: fix null-ptr-deref on l2cap_sock_ready_cb

        - udp: fix wildcard bind conflict check when using hash2

        - netfilter: fix use of uninitialized rtp_addr in process_sdp

        - tls: Purge async_hold in tls_decrypt_async_wait()

        - xfrm:
           - prevent policy_hthresh.work from racing with netns teardown
           - fix skb leak with espintcp and async crypto

        - smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer

        - can:
           - add missing error handling to call can_ctrlmode_changelink()
           - fix OOB heap access in cgw_csum_crc8_rel()

        - eth:
           - mana: fix use-after-free in add_adev() error path
           - virtio-net: fix for VIRTIO_NET_F_GUEST_HDRLEN
           - bcmasp: fix double free of WoL irq"

    * tag 'net-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (90 commits)
      net: macb: use the current queue number for stats
      netfilter: ctnetlink: use netlink policy range checks
      netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
      netfilter: nf_conntrack_expect: skip expectations in other netns via proc
      netfilter: nf_conntrack_expect: store netns and zone in expectation
      netfilter: ctnetlink: ensure safe access to master conntrack
      netfilter: nf_conntrack_expect: use expect->helper
      netfilter: nf_conntrack_expect: honor expectation helper field
      netfilter: nft_set_rbtree: revisit array resize logic
      netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
      netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
      tls: Purge async_hold in tls_decrypt_async_wait()
      selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug
      netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
      Bluetooth: btusb: clamp SCO altsetting table indices
      Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
      Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
      Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock
      Bluetooth: L2CAP: Fix send LE flow credits in ACL link
      net: mana: fix use-after-free in add_adev() error path
      ...