This is the start of the stable review cycle for the 7.0.14 release.
There are 49 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat, 27 Jun 2026 12:54:50 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.14-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 7.0.14-rc1
Miklos Szeredi <mszeredi(a)redhat.com>
virtiofs: fix UAF on submount umount
Ruslan Valiyev <linuxoid(a)gmail.com>
media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
Gil Portnoy <dddhkts1(a)gmail.com>
ksmbd: reject non-VALID session in compound request branch
Georgi Djakov <georgi.djakov(a)oss.qualcomm.com>
drivers/base/memory: set mem->altmap after successful device registration
Stepan Ionichev <sozdayvek(a)gmail.com>
serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com>
serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
Yi Yang <yiyang13(a)huawei.com>
vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
Giovanni Cabiddu <giovanni.cabiddu(a)intel.com>
crypto: qat - remove unused character device and IOCTLs
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Input: rmi4 - fix bit count in bitmap_copy()
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Input: rmi4 - iterative IRQ handler
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Input: rmi4 - fix memory leak in rmi_set_attn_data()
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Input: rmi4 - fix num_subpackets overflow in register descriptor
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Input: rmi4 - fix type overflow in register counts
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Input: rmi4 - refactor register descriptor parsing
Dmitry Torokhov <dmitry.torokhov(a)gmail.com>
Input: rmi4 - fix register descriptor address calculation
Sam Daly <sam(a)samdaly.ie>
iio: adc: ti-ads1298: add bounds check to pga_settings index
Sam Daly <sam(a)samdaly.ie>
iio: light: veml6075: add bounds check to veml6075_it_ms index
Faicker Mo <faicker.mo(a)gmail.com>
net: net_failover: Fix the deadlock in slave register
Mike Marciniszyn (Meta) <mike.marciniszyn(a)gmail.com>
net: export netif_open for self_test usage
Bernard Pidoux <bernard.f6bvp(a)gmail.com>
rose: don't free fd-owned sockets when reaping in the heartbeat
Bernard Pidoux <bernard.f6bvp(a)gmail.com>
rose: clear neighbour pointer in rose_kill_by_device()
Bernard Pidoux <bernard.f6bvp(a)gmail.com>
rose: cancel neighbour timers in rose_neigh_put() before freeing
Bernard Pidoux <bernard.f6bvp(a)gmail.com>
rose: drop CALL_REQUEST in loopback timer when device is not running
Bernard Pidoux <bernard.f6bvp(a)gmail.com>
rose: release netdev ref and destroy orphaned incoming sockets
Bernard Pidoux <bernard.f6bvp(a)gmail.com>
rose: fix netdev double-hold in rose_make_new()
Bernard Pidoux <bernard.f6bvp(a)gmail.com>
rose: disconnect orphaned STATE_2 sockets when device is gone
Bernard Pidoux <bernard.f6bvp(a)gmail.com>
rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup
Bernard Pidoux <bernard.f6bvp(a)gmail.com>
rose: fix notifier unregistered too early in rose_exit()
Bernard Pidoux <bernard.f6bvp(a)gmail.com>
rose: fix netdev double-hold in rose_rx_call_request()
Bernard Pidoux <bernard.f6bvp(a)gmail.com>
rose: guard rose_neigh_put() against NULL in timer expiry
Bernard Pidoux <bernard.f6bvp(a)gmail.com>
rose: clear neighbour pointer after rose_neigh_put() in state machines
Bernard Pidoux <bernard.f6bvp(a)gmail.com>
rose: fix race between loopback timer and module removal
Bernard Pidoux <bernard.f6bvp(a)gmail.com>
rose: hold loopback neighbour reference across timer callback
Bernard Pidoux <bernard.f6bvp(a)gmail.com>
rose: fix dev_put() leak in rose_loopback_timer()
Mingyu Wang <25181214217(a)stu.xidian.edu.cn>
agp/amd64: Fix broken error propagation in agp_amd64_probe()
Weiming Shi <bestswngs(a)gmail.com>
net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
Weiming Shi <bestswngs(a)gmail.com>
i2c: stub: Reject I2C block transfers with invalid length
Weiming Shi <bestswngs(a)gmail.com>
bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths
Lord Ulf Henrik Holmberg <henrik.holmberg(a)defensify.se>
RDMA/bnxt_re: zero shared page before exposing to userspace
Yang Erkun <yangerkun(a)huawei.com>
Revert "NFSD: Defer sub-object cleanup in export put callbacks"
Joanne Koong <joannelkoong(a)gmail.com>
fuse: re-lock request before replacing page cache folio
Tudor Ambarus <tudor.ambarus(a)linaro.org>
firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator
Tudor Ambarus <tudor.ambarus(a)linaro.org>
firmware: samsung: acpm: Fix false timeouts and Use-After-Free in polling
Tudor Ambarus <tudor.ambarus(a)linaro.org>
firmware: samsung: acpm: Fix cross-thread RX length corruption
Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com>
firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr
Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com>
firmware: exynos-acpm: Count number of commands in acpm_xfer
NeilBrown <neil(a)brown.name>
lockd: fix TEST handling when not all permissions are available.
Mark Rutland <mark.rutland(a)arm.com>
arm64/entry: Fix arm64-specific rseq brokenness
Gabriel Krisman Bertazi <krisman(a)suse.de>
io_uring/net: Avoid msghdr on op_connect/op_bind async data
-------------
Diffstat:
Documentation/userspace-api/ioctl/ioctl-number.rst | 1 -
Makefile | 4 +-
arch/arm64/kernel/entry-common.c | 29 +-
drivers/base/memory.c | 3 +-
drivers/char/agp/amd64-agp.c | 2 +-
drivers/crypto/intel/qat/qat_common/adf_cfg.c | 10 -
drivers/crypto/intel/qat/qat_common/adf_cfg.h | 1 -
.../crypto/intel/qat/qat_common/adf_cfg_common.h | 32 --
drivers/crypto/intel/qat/qat_common/adf_cfg_user.h | 38 --
.../crypto/intel/qat/qat_common/adf_common_drv.h | 3 -
drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 404 +--------------------
drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 70 ----
drivers/firmware/samsung/exynos-acpm-dvfs.c | 12 +-
drivers/firmware/samsung/exynos-acpm-pmic.c | 14 +-
drivers/firmware/samsung/exynos-acpm.c | 109 ++++--
drivers/firmware/samsung/exynos-acpm.h | 8 +-
drivers/i2c/i2c-stub.c | 5 +
drivers/iio/adc/ti-ads1298.c | 7 +-
drivers/iio/light/veml6075.c | 8 +-
drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +-
drivers/input/rmi4/rmi_driver.c | 171 +++++----
drivers/input/rmi4/rmi_driver.h | 4 +-
drivers/input/rmi4/rmi_f12.c | 7 +
drivers/media/test-drivers/vidtv/vidtv_mux.c | 8 +-
drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 +-
drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 1 +
drivers/net/net_failover.c | 12 +-
drivers/tty/serial/8250/8250_dw.c | 4 +-
drivers/tty/serial/qcom_geni_serial.c | 9 +-
drivers/tty/vt/vc_screen.c | 2 +-
fs/fuse/dev.c | 19 +-
fs/fuse/file.c | 8 +-
fs/lockd/svc4proc.c | 13 +-
fs/lockd/svclock.c | 4 +-
fs/lockd/svcproc.c | 15 +-
fs/lockd/svcsubs.c | 35 +-
fs/nfsd/export.c | 67 +---
fs/nfsd/export.h | 7 +-
fs/nfsd/nfsctl.c | 8 +-
fs/smb/server/smb2pdu.c | 5 +
include/linux/irq-entry-common.h | 8 -
include/linux/lockd/lockd.h | 2 +-
include/linux/rseq_entry.h | 19 -
include/net/rose.h | 12 +
io_uring/net.c | 36 +-
io_uring/opdef.c | 4 +-
net/core/bpf_sk_storage.c | 13 +-
net/core/dev.c | 1 +
net/core/failover.c | 6 +-
net/rose/af_rose.c | 49 ++-
net/rose/rose_in.c | 6 +
net/rose/rose_loopback.c | 61 +++-
net/rose/rose_timer.c | 87 ++++-
53 files changed, 567 insertions(+), 906 deletions(-)
