Lkft-triage September 2026

lkft-triage@lists.linaro.org

28 participants
29 discussions

[PATCH 6.12 000/403] 6.12.109-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.109 release. There are 403 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 06 Sep 2026 04:56:59 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.109-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.109-rc1 Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: sensorhub: Fix dropped timestamp events and log spam Zhan Xusheng <zhanxusheng1024(a)gmail.com> udf: Fix i_lenExtents truncation on 32-bit kernels Thomas Gleixner <tglx(a)kernel.org> timer: Keep debugobjects state consistent in migrate_timer_list() Bradley Morgan <include(a)grrlz.net> taskstats: fix cpumask parsing cutting off the last character Jann Horn <jannh(a)google.com> smack: fix cred UAF in smack_file_send_sigiotask() Bradley Morgan <include(a)grrlz.net> signal: avoid shared siginfo namespace rewrites Helge Deller <deller(a)gmx.de> sticon/parisc: Detect default STI graphics card for console output Myeonghun Pak <mhun512(a)gmail.com> tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout Zi Yan <ziy(a)nvidia.com> xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() Maoyi Xie <maoyixie.tju(a)gmail.com> w1: ds28e17: reject an oversize length on an I2C block read Chengfeng Ye <nicoyip.dev(a)gmail.com> vsock/virtio: flush works in dependency order Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex Dawei Feng <dawei.feng(a)seu.edu.cn> wifi: rtw88: pci: fix resource leak on failed NAPI setup Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() Runyu Xiao <runyu.xiao(a)seu.edu.cn> wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids Stanislaw Gruszka <stf_xl(a)wp.pl> wifi: rtl818x: initialize eeprom_93cx6 struct to zero Fabio Estevam <festevam(a)nabladev.com> wifi: mwifiex: Detach sync cmd buffer on interrupted wait Eric Biggers <ebiggers(a)kernel.org> crypto: sun8i-ss - Remove crypto_rng interface Eric Biggers <ebiggers(a)kernel.org> crypto: sun8i-ce - Remove crypto_rng interface Fan Wu <fanwu01(a)zju.edu.cn> wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop Abdun Nihaal <nihaal(a)cse.iitm.ac.in> wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() Adrian Hunter <adrian.hunter(a)intel.com> i3c: master: Fix potential UAF in i3c_device_uevent() Maoyi Xie <maoyixie.tju(a)gmail.com> i3c: master: svc: bound IBI payload to the requested max_payload_len Adrian Hunter <adrian.hunter(a)intel.com> i3c: master: Fix info leak and UAF in device unregister path Haotian Zhang <vulab(a)iscas.ac.cn> dm-switch: use WRITE_ONCE() in switch_region_table_write() Mikulas Patocka <mpatocka(a)redhat.com> dm-stats: fix a crash if allocation of per-cpu data fails Nathan Chancellor <nathan(a)kernel.org> arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() Naman Jain <namjain(a)linux.microsoft.com> PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip Sean Christopherson <seanjc(a)google.com> KVM: selftests: Remove duplicate LAUNCH_UPDATE_VMSA call in SEV-ES migrate test Miguel Ojeda <ojeda(a)kernel.org> rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22 Ashish Kalra <ashish.kalra(a)amd.com> x86/sev: Fix broken SNP support with KVM module built-in Gao Shiyuan <gaoshiyuan(a)baidu.com> iommu/amd: remove return value of amd_iommu_detect Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Fix subbuf resize race with ring buffer readers Takashi Iwai <tiwai(a)suse.de> ALSA: virmidi: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: serial-u16550: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: portman2x4: Check card index validity at probe Runyu Xiao <runyu.xiao(a)seu.edu.cn> ALSA: pcxhr: initialize mutexes before requesting threaded IRQ Takashi Iwai <tiwai(a)suse.de> ALSA: mts64: Check card index validity at probe Takashi Iwai <tiwai(a)suse.de> ALSA: mpu401: Check card index validity at probe Baul Lee <baul.lee(a)xbow.com> ALSA: bcd2000: clear the URB pointers on disconnect Takashi Iwai <tiwai(a)suse.de> ALSA: aloop: Check card index validity at probe Baul Lee <baul.lee(a)xbow.com> ALSA: 6fire: bound the MIDI event length from the device Abdun Nihaal <nihaal(a)cse.iitm.ac.in> mfd: sm501: Fix potential memory leaks during remove Zhiling Zou <zhilinz(a)nebusec.ai> seg6: reset IP6CB after IPv6 decapsulation Norbert Szetei <norbert(a)doyensec.com> net: skbuff: don't touch shared zerocopy state in skb_tx_error() Breno Leitao <leitao(a)debian.org> net: fix spurious TX timeout after dev_activate() Zhiling Zou <zhilinz(a)nebusec.ai> net: cap advertised IP tunnel headroom Bryam Vargas <hexlabsecurity(a)proton.me> net/smc: unregister the connection before draining the rx tasklet Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: fix use-after-free in smc_rx_pipe_buf_release() Hidayath Khan <hidayath(a)linux.ibm.com> net/smc: fix socket refcount leak in smc_switch_conns() Bryam Vargas <hexlabsecurity(a)proton.me> net/smc: do not dereference an unset send buffer on the SMC-D teardown path Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Count packets dropped on RX refill failure Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Avoid double-accounting netif_rx() drops Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Reject oversized TX buffers Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Fail TX enqueue when the QP link is down Koichiro Den <den(a)valinux.co.jp> NTB: ntb_transport: Recycle TX entries before client callbacks Fan Ye <fy15309206903(a)gmail.com> net: thunderbolt: Mark the connection down when bringing it up fails Fan Ye <fy15309206903(a)gmail.com> net: thunderbolt: Release the Rx HopID that was handed out on mismatch Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net: ravb: serialize PTP clock teardown Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> net: ravb: avoid dereferencing an invalid PTP clock Ruoyu Wang <ruoyuw560(a)gmail.com> net: openvswitch: fix nf_connlabels leak in ovs_ct_init Ilya Maximets <i.maximets(a)ovn.org> net: openvswitch: fix flow mask use-after-free on flow deletion Zihan Xi <zihanx(a)nebusec.ai> net: l2tp: do not propagate multicast notification errors Jorijn van der Graaf <jorijnvdgraaf(a)catcrafts.net> net: ipa: fix stalled modem TX queue after runtime resume Ahmad Fatoum <a.fatoum(a)pengutronix.de> net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO Asim Viladi Oglu Manizada <manizada(a)pm.me> net: tun: bound receive headroom Fabio Porcedda <fabio.porcedda(a)gmail.com> net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition Aleksandr Khromov <haa(a)amicon.ru> slip: fix use-after-free in sl_sync() Weiming Shi <bestswngs(a)gmail.com> xdp: fix zero-copy frame layout Alexandra Winter <wintera(a)linux.ibm.com> net/iucv: filter frames in afiucv_hs_rcv() by ingress device Seiji Nishikawa <snishika(a)redhat.com> ipmi: si: Fix NULL pointer dereference after failed registration Yousef Alhouseen <alhouseenyousef(a)gmail.com> ipmi: ipmb: validate write message length Kuan-Wei Chiu <visitorckw(a)gmail.com> interconnect: Fix use after free in icc_get() and of_icc_get_by_index() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: warn on element type mismatch instead of failing Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: pass validated element count to package parsers Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix heap OOB read on empty password write Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: bound ordered-list parsing by the package count Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: advance elem past consumed array elements Muhammad Bilal <meatuni001(a)gmail.com> platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS Bryam Vargas <hexlabsecurity(a)proton.me> platform/chrome: sensorhub: Bound the EC-reported sensor number Ma Ke <make_ruc2021(a)163.com> platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Return error during profile addition Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate parameter for frequency and priority Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate parameter for core power state Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Validate logical CPU id and clos id Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Use PP level enable mask Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Just allow 2 bits for SST feature enable Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: ISST: Add a NULL check for sst_inst[] Fan Wu <fanwu01(a)zju.edu.cn> mmc: via-sdmmc: stop card-detect handling on probe failure HyeongJun An <sammiee5311(a)gmail.com> platform/x86: ISST: Validate socket ID in clos_assoc ioctl HyeongJun An <sammiee5311(a)gmail.com> platform/x86: ISST: Validate level in perf mask ioctls HyeongJun An <sammiee5311(a)gmail.com> platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer Kevin Tian <kevin.tian(a)intel.com> iommu/vt-d: Force requesting ACS when tboot is enabled Kevin Tian <kevin.tian(a)intel.com> iommu/vt-d: Fix no_iommu to disable platform opt-in Shameer Kolothum <skolothumtho(a)nvidia.com> iommu/arm-smmu-v3: Manage teardown with devm Shuai Xue <xueshuai(a)linux.alibaba.com> iommu/sva: Set handle->dev before the SVA handle is visible Shuai Xue <xueshuai(a)linux.alibaba.com> iommu/amd: Put PCI device after handling PPR faults Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Warn on writes to kernel-exclusive config space regions Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Use file_ns_capable() when checking config space read access Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/proc: Avoid spurious runtime PM wakeup on config space accesses Farhan Ali <alifm(a)linux.ibm.com> PCI/MSI: Enable memory decoding before restoring MSI-X messages Darshit Shah <darnshah(a)amazon.de> PCI/DPC: Allow DPC on all Downstream Ports when OS controls AER Max Lee <max.lee(a)canonical.com> PCI/ASPM: Avoid L0s for Realtek RTS525A Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Fix read byte order in pci_read_legacy_io() Tim Harvey <tharvey(a)gateworks.com> PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] Ali Tariq <alitariq45892(a)gmail.com> PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() Ali Tariq <alitariq45892(a)gmail.com> PCI: plda: Fix use-after-free of event IRQs during teardown Ronald Claveau <linux-kernel-dev(a)aliel.fr> PCI: meson: Fix GPIO state while requesting PERST# Mohamad Raizudeen <raizudeen.kerneldev(a)gmail.com> PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Propagate partial completion length across ERP recovery Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Guard sysfs discipline callbacks against unallocated private data Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: Do not complete a failed ESE read as successful Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks Jianing Li <m13940358460(a)163.com> power: supply: max17040: synchronize work cancellation on suspend Jianing Li <m13940358460(a)163.com> power: supply: max17040: drop incorrect I2C functionality check Jianing Li <m13940358460(a)163.com> power: supply: max17040: propagate register read errors Fan Wu <fanwu01(a)zju.edu.cn> power: supply: ucs1002: fix use-after-free on remove Maoyi Xie <maoyixie.tju(a)gmail.com> power: supply: twl4030_charger: cancel workers via devm Fan Wu <fanwu01(a)zju.edu.cn> power: supply: rt9455: quiesce delayed work before teardown HyeongJun An <sammiee5311(a)gmail.com> power: supply: qcom_battmgr: terminate the strings from firmware Fan Wu <fanwu01(a)zju.edu.cn> power: supply: lp8788-charger: fix use-after-free on remove Fan Wu <fanwu01(a)zju.edu.cn> power: supply: lp8727: fix use-after-free in lp8727_release_irq() Jameson Thies <jthies(a)google.com> power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Bryam Vargas <hexlabsecurity(a)proton.me> power: supply: cros_usbpd-charger: bound the EC-reported port count Fan Wu <fanwu01(a)zju.edu.cn> power: supply: charger-manager: register regulators before exposing sysfs Ma Ke <make_ruc2021(a)163.com> power: supply: bq25890: Fix power_supply reference leak Fan Wu <fanwu01(a)zju.edu.cn> power: supply: bq256xx: drain usb_work before freeing the charger Fan Wu <fanwu01(a)zju.edu.cn> power: supply: bq24257: fix use-after-free on remove Jun Yang <junvyyang(a)tencent.com> sctp: fix stream->outcnt underflow on duplicate RECONF responses Jun Yang <junvyyang(a)tencent.com> sctp: distinguish sequence zero from wildcard in reconf lookup Weiming Shi <bestswngs(a)gmail.com> sctp: fix NULL deref on untransmitted RECONF completion Hyunwoo Kim <imv4bel(a)gmail.com> sctp: drop a chunk if its transport was removed Hyunwoo Kim <imv4bel(a)gmail.com> sctp: stop processing a packet once its association is deleted Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: reject a read that transferred too few bytes Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: fix host memory disclosure on R2T for a read command Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone Myeonghun Pak <mhun512(a)gmail.com> nvme-pci: disable controller on admin queue IRQ setup failure Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> nvme: zero the discard fallback page Ewan D. Milne <emilne(a)redhat.com> nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> lockd: fix NULL dereference on lockowner allocation failure Michael Bommarito <michael.bommarito(a)gmail.com> lockd: pin next file across nlm_inspect_file lock-drop Cong Nguyen <congnt264(a)gmail.com> hwmon: (max6621) fix temperature clamp range Cong Nguyen <congnt264(a)gmail.com> hwmon: (max6621) fix negative temperature offset and crit readings Christopher Tolang <christophertolang(a)gmail.com> ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC Karl Mehltretter <kmehltretter(a)gmail.com> arm64: compat: Fix decrementing LDM/STM alignment emulation HyeongJun An <sammiee5311(a)gmail.com> ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion Norbert Szetei <norbert(a)doyensec.com> openvswitch: only skb_tx_error() a packet we are about to drop Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: fix arbitrary kernel memory access via or1k_atomic syscall Zhan Xusheng <zhanxusheng1024(a)gmail.com> ocfs2: fix readdir position truncation on 32-bit kernels Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: fix o2hb_dependent_users leak on pin failure Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() Ibrahim Hashimov <security(a)auditcode.ai> ocfs2: validate rl_used against rl_count in refcount block validator Bryam Vargas <hexlabsecurity(a)proton.me> ocfs2: validate lengths in dlm_mig_lockres_handler Bryam Vargas <hexlabsecurity(a)proton.me> ocfs2: bound namelen in dlm_migrate_request_handler Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: always run deallocs on copy-on-write completion Zhiling Zou <zhilinz(a)nebusec.ai> orangefs: skip leading spaces before parsing client debug masks Yifei Gao <gyf161023(a)gmail.com> orangefs: fix double-free of trailer_buf on readdir copy failure Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Hold cpu_buffer::lock when resizing a subbuf Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Free cpu_buffer::free_page with subbuf_order Kathiravan Thirumoorthy <kathiravan.thirumoorthy(a)oss.qualcomm.com> regulator: qcom-refgen: correct the regulator type to CURRENT WenTao Liang <vulab(a)iscas.ac.cn> regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata WenTao Liang <vulab(a)iscas.ac.cn> regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer Norbert Szetei <norbert(a)doyensec.com> RDMA/ucma: Lock the handler in ucma_set_ib_path() Fan Wu <fanwu01(a)zju.edu.cn> RDMA/cxgb4: Cancel reg_work before freeing device on remove Vaibhav Nagare <nagarevaibhav(a)gmail.com> qede: Fix NULL pointer dereference in TPA fragment processing Johan Hovold <johan(a)kernel.org> remoteproc: scp: Fix device reference leak on failed lookup Peixin Xie <peixin.xie(a)linux.spacemit.com> riscv: acpi: Handle LPI architectural context loss flags Fabio Estevam <festevam(a)nabladev.com> arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio Quentin Schulz <quentin.schulz(a)cherry.de> arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags Chunkai Deng <chunkai.deng(a)oss.qualcomm.com> rpmsg: glink: smem: order FIFO read after availability check Petr Vaganov <p.vaganov(a)ideco.ru> scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: media: tegra-video: vi: fix probe failure on skipped last port Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: media: tegra-video: fix of_node_put() on VIP parse errors Doruk Tan Ozturk <doruk(a)0sec.ai> wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets David Lee <david.lee(a)trailofbits.com> udf: reject VAT indexes equal to the entry count Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Validate Read chunk positions before reconstruction Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Use svc_xprt_put to free listener on create failure Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Reject inline replies that overflow the pull-up buffer Chuck Lever <chuck.lever(a)oracle.com> svcrdma: Reject connection when transport allocation fails Chris Mason <clm(a)meta.com> svcrdma: Fix unmatched rn_unregister on failed accept Chris Mason <clm(a)meta.com> svcrdma: Fix pcl_for_each_segment for empty chunks Chris Mason <clm(a)meta.com> svcrdma: Fix offset arithmetic in read_chunk_range Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> SUNRPC: wait for in-flight client TLS handshake callback Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field Chris Mason <clm(a)meta.com> SUNRPC: reject duplicate CREDS_VALUE options Chris Mason <clm(a)meta.com> sunrpc: init gssp_lock before publishing proc entry Chris Mason <clm(a)meta.com> SUNRPC: harden gss_unwrap_resp_priv length checks Chris Mason <clm(a)meta.com> SUNRPC: harden gss_krb5_unwrap_v2 against short tokens Chris Mason <clm(a)meta.com> SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Check svc pool percpu counter allocation Jeff Layton <jlayton(a)kernel.org> SUNRPC: always drain cache_cleaner before destroying a cache_detail Jeff Layton <jlayton(a)kernel.org> sunrpc: route to a populated pool in svc_pool_for_cpu() Chris Mason <clm(a)meta.com> SUNRPC: svcauth_gss: enforce krb5 token minimum length Chris Mason <clm(a)meta.com> SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry Chris Mason <clm(a)meta.com> SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow Jiacheng Yu <yujiacheng3(a)huawei.com> params: fix charp corruption on allocation failure Dave Airlie <airlied(a)redhat.com> nouveau/gem: reserve the bo in the info ioctl around the vma lookup Harshit Varu <harshitvaru666(a)gmail.com> mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction Qing Ming <a0yami(a)mailbox.org> mpls: reload header after pskb_may_pull() Coly Li <colyli(a)fygo.io> md: do overflow check for sb->bblog_shift in super_1_load() Yunye Zhao <yunye.zhao(a)linux.alibaba.com> md/raid10: fix still_degraded being inverted in raid10_sync_request() Anup Vishwakarma <anup.vishwakarma(a)oss.qualcomm.com> mailbox: qcom-ipcc: fix duplicate channel allocation across holes Bryam Vargas <hexlabsecurity(a)proton.me> libnvdimm/labels: Prevent integer overflow in __nd_label_validate() Yuyang Huang <sigefriedhyy(a)gmail.com> ipv6: use RCU iterator to dump route exceptions Zhiling Zou <zhilinz(a)nebusec.ai> ip6_gre: fix hardware header length for NBMA tunnels Zhiling Zou <zhilinz(a)nebusec.ai> ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() Anton Danilov <littlesmilingcloud(a)gmail.com> ipip: fix skb leak in collect_md mode when metadata_dst allocation fails Max Kellermann <max.kellermann(a)ionos.com> jbd2: check need_resched() when skipping busy checkpoint buffers Max Kellermann <max.kellermann(a)ionos.com> jbd2: bound shrinker scans by examined checkpoint buffers Hui Su <sh_def(a)163.com> kasan: fix cache shrink race with CPU hotplug Ibrahim Abdelkader <iabdelka(a)qti.qualcomm.com> Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative Valentin Kindschi <valentin.kindschi(a)fiveco.ch> Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection Xin Chen <xin.chen2(a)oss.qualcomm.com> Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb Valentin Kindschi <valentin.kindschi(a)fiveco.ch> Bluetooth: hci_conn: re-enable advertising only for peripheral role Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: RFCOMM: serialize security confirmation handling Hang Nan <2122295973(a)qq.com> Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready Gongwei Li <ligongwei(a)kylinos.cn> Bluetooth: hci_uart: Fix false success return in hci_uart_setup() Guangshuo Li <lgs201920130244(a)gmail.com> Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative Lorenzo Stoakes (ARM) <ljs(a)kernel.org> Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 Alison Schofield <alison.schofield(a)intel.com> cxl/pmem: Format the nvdimm serial number as unsigned decimal Hui Su <sh_def(a)163.com> cpufreq: schedutil: Fix rate limit overflow Kuan-Wei Chiu <visitorckw(a)gmail.com> coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior Bryam Vargas <hexlabsecurity(a)proton.me> dm array: reject an array block whose value size is not the caller's Bryam Vargas <hexlabsecurity(a)proton.me> dm array: validate array block headers on read Ilya Krutskih <devsec(a)tpz.ru> dm raid1: reserve space for NUL-terminator in build_constructor_string() liyouhong <liyouhong(a)kylinos.cn> dm-era: fix shadowed superblock leak on take-snap failure Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> bpf: Harden bloom filter sizing and indexing on 32-bit kernels Daniel Borkmann <borkmann(a)iogearbox.net> bpf: Disable preemption in __bpf_get_stack Vineet Gupta <vineet.gupta(a)linux.dev> bpf, x86: Fix per-CPU address resolution into an extended register Jiangshan Yi <yijiangshan(a)kylinos.cn> bnx2x: fix double free in bnx2x_init_firmware() error path HyeongJun An <sammiee5311(a)gmail.com> Bluetooth: eir: Fix OOB read in eir_get_service_data() Christoph Zwerschke <cito(a)online.de> Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU Christoph Zwerschke <cito(a)online.de> Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU 胡连勤 <hulianqin(a)vivo.com> block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead() Hongyan Xu <getshell(a)seu.edu.cn> auxdisplay: charlcd: cancel backlight work on registration failure Niklas Cassel <cassel(a)kernel.org> ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes Ethan Nelson-Moore <enelsonmoore(a)gmail.com> ARM: 9477/1: Disable broken eBPF JIT on the Risc PC Matt Turner <mattst88(a)gmail.com> alpha: marvel: Fix lock ordering in init_io7_irqs() Matt Turner <mattst88(a)gmail.com> alpha: marvel: Fix irq_set_status_flags to use correct IRQ number Krzysztof Wilczyński <kwilczynski(a)kernel.org> alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() Anirudh Prasad <icarus(a)a0rg.com> ACPI: pfr_update: fix stack buffer overflow in query_capability() TanZheng <tanzheng(a)kylinos.cn> ACPI: APEI: GHES: fix ARM section length accounting after header Nirmoy Das <nirmoyd(a)nvidia.com> ACPI: APEI: Fix ERST timeout unit conversion Ivaylo Dimitrov <ivo.g.dimitrov.75(a)gmail.com> hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device Tien Sung Ang <tien.sung.ang(a)altera.com> fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration Marek Czernohous <marek(a)czernohous.de> forcedeth: fix off-by-one when saving/restoring non-PCI config space Myeonghun Pak <mhun512(a)gmail.com> fbdev: uvesafb: unregister connector callback on init failure Hui Su <sh_def(a)163.com> fbdev: ssd1307fb: defer I2C transfers from damage callbacks Florian Fuchs <fuchsfl(a)gmail.com> fbdev: pvr2fb: correct user pointer annotation and sentinel initializer Runyu Xiao <runyu.xiao(a)seu.edu.cn> fbdev: omapfb: panel-dsi-cm: initialize lock before registering display Yemu Lu <prcups(a)krgm.moe> fat: restore original value when fat_ent_write failed Ard Biesheuvel <ardb(a)kernel.org> efivarfs: Rate limit statfs() handler Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: show filename encryption options Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: release message context on send failure Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: reject too-small tag 70 packets HanQuan <eilaimemedsnaimel(a)gmail.com> ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: pass packet set buffer size to parser Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: hold msg ctx list lock when cleaning daemon queue Yichong Chen <chenyichong(a)uniontech.com> ecryptfs: fix tag 11 packet exact-fit size check Pengpeng Hou <pengpeng(a)iscas.ac.cn> eCryptfs: bound the packet-length peek to the user buffer Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: bound page_lcns[] index by the log record Samuel Page <sam(a)bynar.io> fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() Xiang Mei <xmei5(a)asu.edu> fs/ntfs3: validate dirty page table on log replay Deepanshu Kartikey <kartikey406(a)gmail.com> eventfs: Initialize ei->children and ei->list in init_ei() Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: validate report size in mcp2221_raw_event() Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: mcp2221: stop device IO before hid_hw_stop Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix field sysfs group cleanup on failure Xu Rao <raoxu(a)uniontech.com> HID: roccat: free buffered reports when destroying device Ibrahim Hashimov <security(a)auditcode.ai> HID: picolcd: clamp eeprom debugfs read to bytes actually received Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: harden DFS cache against invalid target hints Frank Sorenson <sorenson(a)redhat.com> smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV Frank Sorenson <sorenson(a)redhat.com> smb: client: fix ALIGN() overflow in symlink_data() error context loop Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: clear ce->tgthint in free_tgts() Frank Sorenson <sorenson(a)redhat.com> cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> audit: avoid dropping live tree ref on fsnotify rule autoremove Guanghui Yang <3497809730(a)qq.com> btrfs: drop recovered reloc root refs on recovery failure Max Kellermann <max.kellermann(a)ionos.com> ceph: do not repeat ceph_trim_dentries() if no progress possible Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound xattr value length in __build_xattrs() Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound num_export_targets array for mds info v2/v3 Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound MDSCapAuth path and fs_name decode in handle_session() Michael Bommarito <michael.bommarito(a)gmail.com> ceph: bound copied dentry name length in NFS export get_name Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode Xiubo Li <xiubo.li(a)clyso.com> ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> libceph: reject buckets with mismatched CRUSH ids Michael Bommarito <michael.bommarito(a)gmail.com> libceph: validate OSD extent maps before cursor advance Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup Chuck Lever <chuck.lever(a)oracle.com> NFSD: Prevent lock owner use-after-free during client teardown Jeff Layton <jlayton(a)kernel.org> nfsd: revoke copy-notify stateids before dropping their reference Jeff Layton <jlayton(a)kernel.org> nfsd: reject reclaim LOCK after RECLAIM_COMPLETE Robbie Ko <robbieko(a)synology.com> nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE Robbie Ko <robbieko(a)synology.com> nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops Jeff Layton <jlayton(a)kernel.org> nfsd: initialize DRC hash table before registering shrinker Jeff Layton <jlayton(a)kernel.org> nfsd: initialize copy-notify stateid before publishing it Chris Mason <clm(a)meta.com> nfsd: gate nfs3 setacl by argp->mask Chuck Lever <chuck.lever(a)oracle.com> nfsd: gate nfs2 setacl by argp->mask Jeff Layton <jlayton(a)kernel.org> nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo Jeff Layton <jlayton(a)kernel.org> nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget Jeff Layton <jlayton(a)kernel.org> nfsd: fix version mismatch loops in nfsd_acl_init_request() Jeff Layton <jlayton(a)kernel.org> nfsd: fix reply size estimate for GET_DIR_DELEGATION Jeff Layton <jlayton(a)kernel.org> nfsd: fix nfsd_file leak on inter-server COPY setup failure Jeff Layton <jlayton(a)kernel.org> nfsd: fix dentry ref leak on V4ROOT export filehandle lookup Chris Mason <clm(a)meta.com> nfsd: fix cpntf publish race in nfs4_init_cp_state Jeff Layton <jlayton(a)kernel.org> nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke Jeff Layton <jlayton(a)kernel.org> nfsd: drop the stateid, not the stateowner, on seqid_op replay retry Jeff Layton <jlayton(a)kernel.org> nfsd: defer vfree of compound ops to fix rpc_status UAF Jeff Layton <jlayton(a)kernel.org> nfsd: clear opcnt on compound arg release to prevent OOB read Jeff Layton <jlayton(a)kernel.org> nfsd: check client ownership when cancelling a copy-notify stateid Jeff Layton <jlayton(a)kernel.org> nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref Jeff Layton <jlayton(a)kernel.org> nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry Jeff Layton <jlayton(a)kernel.org> nfsd: add filehandle match check to nfsd4_delegreturn() Jeff Layton <jlayton(a)kernel.org> nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() Jeff Layton <jlayton(a)kernel.org> nfsd: validate symlink target length in NFSv4 CREATE Chris Mason <clm(a)meta.com> nfsd: size fh_verify server sockaddr slot by xpt_locallen Zhenghang Xiao <kipreyyy(a)gmail.com> nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations Chuck Lever <chuck.lever(a)oracle.com> nfsd: sample writeback error cursor before async COPY loop Jeff Layton <jlayton(a)kernel.org> nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types Chuck Lever <chuck.lever(a)oracle.com> nfsd: Reset write verifier when async COPY writeback fails Chris Mason <clm(a)meta.com> nfsd: release path refs on follow_down() error Tim Menninger <tmenninger(a)everpuredata.com> pNFS: Fix EBUSY check in pnfs_layout_need_return Junrui Luo <moonafterrain(a)outlook.com> NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path Chris Mason <clm(a)meta.com> nfsd: guard nfsd_serv deref in nfsd_file_net_dispose Mike Snitzer <snitzer(a)kernel.org> NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check Michael Bommarito <michael.bommarito(a)gmail.com> NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock Chuck Lever <chuck.lever(a)oracle.com> NFSD: Fix off-by-one in DRC bucket pruning limit Chuck Lever <chuck.lever(a)oracle.com> NFSD: Encode only the status in NFS-ACL v2 GETACL error replies Chuck Lever <chuck.lever(a)oracle.com> NFSD: check truncate permission under inode lock Longlong Xia <xialonglong(a)kylinos.cn> zsmalloc: account for handle size in class lookup Ibrahim Hashimov <security(a)auditcode.ai> ubifs: fix out-of-bounds read in signature length check Krzysztof Wilczyński <kwilczynski(a)kernel.org> PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() Abdurrahman Hussain <abdurrahman(a)nexthop.ai> of: fix out-of-bounds read in of_alias_scan() stem parser Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Junrui Luo <moonafterrain(a)outlook.com> media: vicodec: fix out-of-bounds write in FWHT encoder Weigang He <geoffreyhe2(a)gmail.com> media: cec: stm32: prevent out-of-bounds write on RX overflow Vincent Mailhol <mailhol(a)kernel.org> lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Xingrui Li <baka9(a)bakabaka9.tech> HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature Daisuke Matsuda <matsuda(a)preferred.jp> fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write Neill Kapron <nkapron(a)google.com> usb: gadget: f_fs: Prevent deadlock during ep0 read loop Jeffin Philip <jeffinphilip14(a)gmail.com> usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() Yun Zhou <yun.zhou(a)windriver.com> usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() Joshua Crofts <joshua.crofts1(a)gmail.com> usb: gadget: midi2: remove default configfs groups on teardown Myeonghun Pak <mhun512(a)gmail.com> usb: gadget: snps_udc_plat: clean up PHY on probe deferral Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: u_audio: Fix use-after-free on sound card disconnect Huang Wei <huangwei(a)kylinos.cn> usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() Johan Hovold <johan(a)kernel.org> USB: phy: fsl-usb: fix missing static keywords Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed Francesco Lavra <flavra(a)baylibre.com> usb: dwc2: gadget: Exit partial power down state when changing USB pull-up Hao-Qun Huang <alvinhuang0603(a)gmail.com> staging: greybus: hid: fix SET_REPORT return value Karl Mehltretter <kmehltretter(a)gmail.com> serial: imx: serialize imx_uart_ports[] lifetime Hans Verkuil <hverkuil+cisco(a)kernel.org> Revert "media: v4l2-dev: fix error handling in __video_register_device()" James Kim <james010kim(a)gmail.com> rapidio: mport_cdev: fix use-after-free in dma_req_free() Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> powerpc/powermac: fix OF node refcount Bryam Vargas <hexlabsecurity(a)proton.me> misc: nsm: bound the device-reported response length Xu Yang <xu.yang_2(a)nxp.com> device property: fix infinite loop in fwnode_for_each_child_node() Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> cdx: Fix double free when sysfs file creation fails Hui Su <sh_def(a)163.com> tracing: Fix use-after-free with same-name named triggers Deepanshu Kartikey <kartikey406(a)gmail.com> tracing: Fix use-after-free in trace_pipe read on sub-buffer order change Vincent Donnefort <vdonnefort(a)google.com> tracing: Fix logged instance name on creation failure Hui Su <sh_def(a)163.com> tracing: Fix crash passing ERR_PTR to kthread_stop() Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> tracing/user_events: Clear copied tracing state before fork duplication Sanman Pradhan <psanman(a)juniper.net> hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/tdx: Fix zero-extension for 32-bit port I/O Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() Kiryl Shutsemau (Meta) <kas(a)kernel.org> x86/tdx: Fix off-by-one in port I/O handling Joy H.J. Lee <rkr0k0r(a)gmail.com> tools/compiler: match glibc 2.42 definition of __attribute_const__ Johannes Weiner <hannes(a)cmpxchg.org> mm: mempolicy: fix automatic numa balancing for shmem Guopeng Zhang <zhangguopeng(a)kylinos.cn> mm: memcg: stop reclaim when a limit update is superseded Hao Jia <jiahao1(a)lixiang.com> mm/zswap: fix global shrinker when memory cgroup is disabled Breno Leitao <leitao(a)debian.org> mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() Dev Jain <dev.jain(a)arm.com> mm/page_vma_mapped: use huge_ptep_get() for hugetlb Ye Liu <ye.liu(a)linux.dev> mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() Dev Jain <dev.jain(a)arm.com> mm/migrate: use huge_ptep_get() in remove_migration_pte() Breno Leitao <leitao(a)debian.org> mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() Breno Leitao <leitao(a)debian.org> mm/kmemleak: avoid soft lockup when scanning task stacks Jordan R Abrahams-Whitehead <ajordanr(a)google.com> include/linux/list.h: mark list_add and __list_add as __always_inline Hyunwoo Kim <imv4bel(a)gmail.com> apparmor: fix out-of-bounds write when null terminating a label vec Jann Horn <jannh(a)google.com> apparmor: fix cred UAF caused by begin_current_label_crit_section() Gary Guo <gary(a)garyguo.net> rust: cfi: disable function merging if CFI is enabled Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> timers/itimer: Zero-init old itimerval before copy to userspace Gaurav Batra <gbatra(a)linux.ibm.com> powerpc/pseries/iommu: switch to Default DMA window during kdump Baokun Li <libaokun(a)linux.alibaba.com> fs: fix user path of nested backing files Felix Yan <felixonmars(a)archlinux.org> clocksource/drivers/timer-sun4i: Advertise a real minimum delta Matt Turner <mattst88(a)gmail.com> alpha: don't leak hardware-fabricated FP exception bits to user space Matt Turner <mattst88(a)gmail.com> alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths Zilin Guan <zilin(a)seu.edu.cn> wifi: ath11k: fix memory leaks in beacon template setup Zilin Guan <zilin(a)seu.edu.cn> wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Fix die ID init and look up bugs Mario Limonciello <mario.limonciello(a)amd.com> drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 Ming Lei <tom.leiming(a)gmail.com> block: mark GFP_NOIO around sysfs ->store() Chao Yu <chao(a)kernel.org> f2fs: fix potential deadloop in prepare_compress_overwrite() Yang Erkun <yangerkun(a)huawei.com> md: make rdev_addable usable for rcu mode Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Mask the bd_cnt field in the TX BD properly ------------- Diffstat: Documentation/ABI/testing/sysfs-bus-nvdimm | 3 +- Makefile | 7 +- arch/alpha/include/uapi/asm/fpu.h | 8 +- arch/alpha/kernel/pci-sysfs.c | 6 +- arch/alpha/kernel/sys_marvel.c | 25 ++- arch/alpha/kernel/traps.c | 6 +- arch/alpha/math-emu/math.c | 88 +++++++- arch/arm/Kconfig | 2 +- arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts | 2 +- arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 2 +- .../arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts | 12 ++ arch/arm64/kernel/compat_alignment.c | 4 +- arch/openrisc/kernel/entry.S | 43 +++- arch/powerpc/kernel/pci-common.c | 9 +- arch/powerpc/platforms/powermac/low_i2c.c | 2 +- arch/powerpc/platforms/pseries/iommu.c | 23 ++- arch/riscv/include/asm/acpi.h | 19 ++ arch/s390/kernel/perf_cpum_cf.c | 221 ++++++++++++++------- arch/x86/coco/tdx/tdx.c | 10 +- arch/x86/events/intel/uncore.c | 1 + arch/x86/events/intel/uncore_snbep.c | 13 +- arch/x86/include/asm/insn-eval.h | 36 ++++ arch/x86/include/asm/sev.h | 2 + arch/x86/kvm/emulate.c | 26 +-- arch/x86/net/bpf_jit_comp.c | 2 +- arch/x86/virt/svm/sev.c | 21 +- block/blk-sysfs.c | 3 + block/genhd.c | 1 + drivers/acpi/apei/erst.c | 2 +- drivers/acpi/apei/ghes.c | 2 +- drivers/acpi/pfr_update.c | 45 +++-- drivers/ata/libata-scsi.c | 28 +-- drivers/auxdisplay/charlcd.c | 21 +- drivers/base/arch_numa.c | 12 ++ drivers/base/property.c | 19 +- drivers/bluetooth/btusb.c | 6 + drivers/bluetooth/hci_bcm.c | 1 + drivers/bluetooth/hci_bcm4377.c | 1 + drivers/bluetooth/hci_h5.c | 4 +- drivers/bluetooth/hci_intel.c | 1 + drivers/bluetooth/hci_ldisc.c | 2 +- drivers/bluetooth/hci_serdev.c | 2 +- drivers/cdx/cdx.c | 7 +- drivers/char/ipmi/ipmb_dev_int.c | 5 +- drivers/char/ipmi/ipmi_msghandler.c | 1 + drivers/char/tpm/tpm_i2c_nuvoton.c | 6 +- drivers/clocksource/timer-sun4i.c | 2 +- drivers/crypto/allwinner/Kconfig | 16 -- drivers/crypto/allwinner/sun8i-ce/Makefile | 1 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 57 ------ drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c | 159 --------------- drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h | 29 --- drivers/crypto/allwinner/sun8i-ss/Makefile | 1 - drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 39 ---- drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c | 177 ----------------- drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 23 --- drivers/cxl/core/pmem.c | 10 +- drivers/cxl/cxl.h | 3 +- drivers/cxl/pmem.c | 2 +- drivers/fpga/altera-cvp.c | 10 +- drivers/fpga/stratix10-soc.c | 21 +- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 10 +- .../amd/display/dc/dml2/dml2_translation_helper.c | 2 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 11 +- drivers/hid/hid-mcp2221.c | 9 + drivers/hid/hid-picolcd_debugfs.c | 9 + drivers/hid/hid-roccat.c | 13 +- drivers/hid/hid-sensor-custom.c | 9 +- drivers/hid/hid-sensor-hub.c | 46 +++-- drivers/hsi/controllers/omap_ssi_core.c | 6 + drivers/hwmon/max6621.c | 8 +- .../hwtracing/coresight/coresight-etm3x-sysfs.c | 15 +- drivers/hwtracing/ptt/hisi_ptt.c | 20 +- drivers/i3c/master.c | 12 +- drivers/i3c/master/svc-i3c-master.c | 10 +- drivers/infiniband/core/ucma.c | 5 +- drivers/infiniband/hw/cxgb4/device.c | 6 + drivers/interconnect/core.c | 7 +- drivers/iommu/amd/init.c | 36 +++- drivers/iommu/amd/ppr.c | 3 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 56 ++++-- drivers/iommu/intel/dmar.c | 15 +- drivers/iommu/intel/iommu.c | 8 +- drivers/iommu/intel/iommu.h | 2 + drivers/iommu/iommu-sva.c | 2 +- drivers/mailbox/qcom-ipcc.c | 17 +- drivers/md/dm-era-target.c | 5 + drivers/md/dm-log-userspace-base.c | 1 + drivers/md/dm-stats.c | 6 +- drivers/md/dm-switch.c | 2 +- drivers/md/md.c | 15 +- drivers/md/persistent-data/dm-array.c | 53 ++++- drivers/md/raid10.c | 2 +- drivers/media/cec/platform/stm32/stm32-cec.c | 3 +- drivers/media/test-drivers/vicodec/vicodec-core.c | 4 +- drivers/media/v4l2-core/v4l2-dev.c | 14 +- drivers/mfd/sm501.c | 2 + drivers/misc/nsm.c | 2 +- drivers/mmc/host/via-sdmmc.c | 8 +- drivers/net/dsa/realtek/rtl83xx.c | 4 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 + drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 3 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/ethernet/qlogic/qede/qede.h | 8 +- drivers/net/ethernet/qlogic/qede/qede_fp.c | 1 + drivers/net/ethernet/renesas/ravb.h | 3 + drivers/net/ethernet/renesas/ravb_main.c | 9 +- drivers/net/ethernet/renesas/ravb_ptp.c | 44 +++- drivers/net/ipa/ipa_modem.c | 18 +- drivers/net/ntb_netdev.c | 11 +- drivers/net/slip/slip.c | 11 +- drivers/net/thunderbolt/main.c | 12 ++ drivers/net/tun.c | 21 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/wireless/ath/ath11k/mac.c | 28 ++- drivers/net/wireless/ath/ath6kl/cfg80211.c | 5 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +- drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 12 ++ drivers/net/wireless/mediatek/mt76/mt7615/main.c | 5 +- .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 16 +- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 2 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 2 +- drivers/net/wireless/realtek/rtl8xxxu/core.c | 19 +- .../net/wireless/realtek/rtlwifi/rtl8192du/sw.c | 12 +- .../net/wireless/realtek/rtlwifi/rtl8192du/trx.c | 3 +- drivers/net/wireless/realtek/rtw88/pci.c | 4 +- drivers/net/wireless/realtek/rtw88/tx.c | 1 + drivers/ntb/ntb_transport.c | 38 ++-- drivers/nvdimm/label.c | 2 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/fc.c | 2 +- drivers/nvme/host/pci.c | 1 + drivers/nvme/host/tcp.c | 45 ++++- drivers/of/base.c | 2 +- drivers/pci/controller/dwc/pci-meson.c | 2 +- drivers/pci/controller/pci-hyperv.c | 1 + drivers/pci/controller/plda/pcie-plda-host.c | 52 ++++- drivers/pci/msi/msi.c | 10 + drivers/pci/pci-sysfs.c | 42 +++- drivers/pci/pcie/portdrv.c | 2 +- drivers/pci/proc.c | 16 +- drivers/pci/quirks.c | 9 +- drivers/platform/chrome/cros_ec_sensorhub_ring.c | 19 +- .../x86/dell/dell-wmi-sysman/biosattr-interface.c | 1 - drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 18 +- drivers/platform/x86/hp/hp-bioscfg/bioscfg.h | 8 + .../platform/x86/hp/hp-bioscfg/enum-attributes.c | 15 +- .../platform/x86/hp/hp-bioscfg/int-attributes.c | 6 +- .../x86/hp/hp-bioscfg/order-list-attributes.c | 14 +- .../x86/hp/hp-bioscfg/passwdobj-attributes.c | 14 +- .../platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 4 +- .../platform/x86/hp/hp-bioscfg/string-attributes.c | 6 +- drivers/platform/x86/intel/ishtp_eclite.c | 5 +- .../x86/intel/speed_select_if/isst_tpmi_core.c | 77 ++++++- drivers/power/supply/bq24257_charger.c | 16 +- drivers/power/supply/bq256xx_charger.c | 29 +-- drivers/power/supply/bq25890_charger.c | 12 ++ drivers/power/supply/charger-manager.c | 54 +++-- drivers/power/supply/cros_usbpd-charger.c | 17 +- drivers/power/supply/lp8727_charger.c | 4 +- drivers/power/supply/lp8788-charger.c | 2 +- drivers/power/supply/max17040_battery.c | 32 ++- drivers/power/supply/qcom_battmgr.c | 2 +- drivers/power/supply/rt9455_charger.c | 21 +- drivers/power/supply/twl4030_charger.c | 12 +- drivers/power/supply/ucs1002_power.c | 6 +- drivers/rapidio/devices/rio_mport_cdev.c | 10 +- drivers/regulator/as3722-regulator.c | 1 - drivers/regulator/max8998.c | 1 - drivers/regulator/qcom-refgen-regulator.c | 4 +- drivers/remoteproc/mtk_scp.c | 9 +- drivers/rpmsg/qcom_glink_smem.c | 7 + drivers/s390/block/dasd.c | 6 +- drivers/s390/block/dasd_eckd.c | 40 +++- drivers/s390/block/dasd_erp.c | 3 + drivers/scsi/scsi_lib.c | 2 + drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/tegra-video/vi.c | 9 +- drivers/staging/media/tegra-video/vip.c | 10 +- drivers/tty/serial/imx.c | 20 +- drivers/usb/dwc2/gadget.c | 11 +- drivers/usb/gadget/function/f_fs.c | 14 +- drivers/usb/gadget/function/f_midi2.c | 2 + drivers/usb/gadget/function/f_tcm.c | 23 ++- drivers/usb/gadget/function/f_uvc.c | 7 +- drivers/usb/gadget/function/u_audio.c | 24 ++- drivers/usb/gadget/udc/at91_udc.c | 20 +- drivers/usb/gadget/udc/snps_udc_plat.c | 5 +- drivers/usb/phy/phy-fsl-usb.c | 52 ++--- drivers/usb/phy/phy-fsl-usb.h | 6 +- drivers/usb/typec/tcpm/tcpci.c | 12 +- drivers/usb/typec/ucsi/ucsi.c | 3 +- .../fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 4 +- drivers/video/fbdev/pvr2fb.c | 4 +- drivers/video/fbdev/ssd1307fb.c | 72 ++++++- drivers/video/fbdev/uvesafb.c | 2 + drivers/video/sticore.c | 22 +- drivers/w1/slaves/w1_ds28e17.c | 8 + fs/backing-file.c | 2 +- fs/btrfs/relocation.c | 31 ++- fs/ceph/caps.c | 11 +- fs/ceph/dir.c | 10 +- fs/ceph/export.c | 26 ++- fs/ceph/mds_client.c | 8 +- fs/ceph/mdsmap.c | 11 +- fs/ceph/xattr.c | 1 + fs/ecryptfs/crypto.c | 2 +- fs/ecryptfs/ecryptfs_kernel.h | 3 +- fs/ecryptfs/keystore.c | 45 ++++- fs/ecryptfs/messaging.c | 11 +- fs/ecryptfs/miscdev.c | 5 +- fs/ecryptfs/super.c | 7 + fs/efivarfs/super.c | 30 ++- fs/f2fs/compress.c | 1 + fs/f2fs/data.c | 10 +- fs/fat/misc.c | 4 + fs/jbd2/checkpoint.c | 28 +-- fs/lockd/clntproc.c | 3 + fs/lockd/svcsubs.c | 53 ++--- fs/nfs/pnfs.c | 3 +- fs/nfsd/filecache.c | 15 +- fs/nfsd/flexfilelayoutxdr.c | 20 +- fs/nfsd/nfs2acl.c | 52 ++--- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs3proc.c | 40 ++++ fs/nfsd/nfs4layouts.c | 12 +- fs/nfsd/nfs4proc.c | 51 +++-- fs/nfsd/nfs4state.c | 215 +++++++++++++++----- fs/nfsd/nfs4xdr.c | 22 +- fs/nfsd/nfscache.c | 6 +- fs/nfsd/nfsctl.c | 11 +- fs/nfsd/nfsfh.c | 12 +- fs/nfsd/nfsproc.c | 7 + fs/nfsd/nfssvc.c | 4 +- fs/nfsd/nfsxdr.c | 32 ++- fs/nfsd/trace.h | 4 +- fs/nfsd/vfs.c | 34 ++-- fs/nilfs2/bmap.c | 2 +- fs/nilfs2/bmap.h | 2 +- fs/nilfs2/btree.c | 39 +++- fs/nilfs2/direct.c | 4 +- fs/ntfs3/frecord.c | 9 + fs/ntfs3/fslog.c | 34 ++++ fs/ocfs2/cluster/heartbeat.c | 150 +++++++++++--- fs/ocfs2/cluster/nodemanager.c | 6 + fs/ocfs2/cluster/nodemanager.h | 1 + fs/ocfs2/dir.c | 2 +- fs/ocfs2/dlm/dlmmaster.c | 6 + fs/ocfs2/dlm/dlmrecovery.c | 9 + fs/ocfs2/refcounttree.c | 47 +++-- fs/ocfs2/xattr.c | 5 +- fs/orangefs/devorangefs-req.c | 1 + fs/orangefs/orangefs-debugfs.c | 1 + fs/smb/client/cifsfs.c | 15 +- fs/smb/client/dfs_cache.c | 33 ++- fs/smb/client/smb1ops.c | 2 +- fs/smb/client/smb2file.c | 5 +- fs/tracefs/event_inode.c | 7 +- fs/ubifs/auth.c | 2 +- fs/udf/inode.c | 2 +- fs/udf/partition.c | 2 +- include/linux/amd-iommu.h | 4 +- include/linux/list.h | 15 +- include/linux/sunrpc/svc_rdma_pcl.h | 2 +- include/linux/usb/tcpci.h | 1 + include/net/ip_tunnels.h | 11 +- include/net/sctp/structs.h | 2 +- kernel/auditfilter.c | 6 +- kernel/bpf/bloom_filter.c | 19 +- kernel/bpf/stackmap.c | 3 + kernel/params.c | 14 +- kernel/sched/cpufreq_schedutil.c | 15 +- kernel/signal.c | 4 + kernel/taskstats.c | 3 +- kernel/time/itimer.c | 2 +- kernel/time/timer.c | 1 + kernel/trace/ring_buffer.c | 170 ++++++++++------ kernel/trace/trace.c | 6 +- kernel/trace/trace_events.c | 2 + kernel/trace/trace_events_hist.c | 4 +- kernel/trace/trace_events_user.c | 3 + lib/ucs2_string.c | 2 +- lib/xarray.c | 3 + mm/kasan/quarantine.c | 7 +- mm/kmemleak.c | 51 +++-- mm/memcontrol.c | 6 + mm/mempolicy.c | 21 +- mm/migrate.c | 8 +- mm/page_owner.c | 10 +- mm/page_vma_mapped.c | 8 +- mm/vmscan.c | 2 +- mm/zsmalloc.c | 11 +- mm/zswap.c | 13 +- net/bluetooth/eir.c | 3 +- net/bluetooth/hci_conn.c | 3 +- net/bluetooth/hci_core.c | 2 +- net/bluetooth/hci_event.c | 7 +- net/bluetooth/hci_sync.c | 2 + net/bluetooth/iso.c | 8 + net/bluetooth/rfcomm/core.c | 8 +- net/ceph/osd_client.c | 30 +++ net/ceph/osdmap.c | 2 + net/core/skbuff.c | 5 +- net/core/xdp.c | 4 +- net/ipv4/ip_tunnel.c | 2 +- net/ipv4/ipip.c | 2 +- net/ipv6/ip6_gre.c | 14 +- net/ipv6/ip6_tunnel.c | 22 +- net/ipv6/route.c | 2 +- net/ipv6/seg6_local.c | 9 + net/ipv6/sit.c | 2 +- net/iucv/af_iucv.c | 2 + net/l2tp/l2tp_netlink.c | 16 +- net/mpls/af_mpls.c | 2 + net/mptcp/syncookies.c | 1 + net/openvswitch/conntrack.c | 8 +- net/openvswitch/datapath.c | 50 ++--- net/sched/sch_generic.c | 2 +- net/sctp/inqueue.c | 7 +- net/sctp/sm_sideeffect.c | 4 + net/sctp/stream.c | 48 +++-- net/smc/af_smc.c | 3 +- net/smc/smc_core.c | 27 +-- net/smc/smc_rx.c | 11 +- net/smc/smc_tx.h | 6 +- net/sunrpc/auth_gss/auth_gss.c | 6 +- net/sunrpc/auth_gss/gss_krb5_wrap.c | 13 +- net/sunrpc/auth_gss/gss_rpc_upcall.c | 6 - net/sunrpc/auth_gss/gss_rpc_upcall.h | 1 - net/sunrpc/auth_gss/gss_rpc_xdr.c | 6 + net/sunrpc/auth_gss/svcauth_gss.c | 8 +- net/sunrpc/cache.c | 7 +- net/sunrpc/sunrpc_syms.c | 1 + net/sunrpc/svc.c | 74 ++++++- net/sunrpc/xdr.c | 2 +- net/sunrpc/xprtrdma/ib_client.c | 24 ++- net/sunrpc/xprtrdma/svc_rdma_rw.c | 47 ++++- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 47 +++-- net/sunrpc/xprtrdma/svc_rdma_transport.c | 52 +++-- net/sunrpc/xprtsock.c | 12 +- net/vmw_vsock/virtio_transport.c | 2 +- scripts/rust_is_available.sh | 14 ++ scripts/rust_is_available_bindgen_libclang_22.h | 5 + scripts/rust_is_available_test.py | 30 ++- security/apparmor/include/cred.h | 6 +- security/apparmor/include/label.h | 6 +- security/apparmor/include/task.h | 15 +- security/apparmor/task.c | 27 +++ security/smack/smack_lsm.c | 2 +- sound/core/ump_convert.c | 1 + sound/drivers/aloop.c | 6 + sound/drivers/mpu401/mpu401.c | 6 + sound/drivers/mts64.c | 6 + sound/drivers/portman2x4.c | 6 + sound/drivers/serial-u16550.c | 6 + sound/drivers/virmidi.c | 6 + sound/pci/pcxhr/pcxhr.c | 14 +- sound/soc/amd/yc/acp6x-mach.c | 7 + sound/usb/6fire/comm.c | 9 +- sound/usb/bcd2000/bcd2000.c | 11 +- tools/include/linux/compiler.h | 2 +- .../selftests/kvm/x86_64/sev_migrate_tests.c | 2 - 366 files changed, 3709 insertions(+), 1854 deletions(-)

3 weeks, 1 day

[PATCH 7.2 00/71] 7.2.3-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.2.3 release. There are 71 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 02 Sep 2026 13:32:19 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.2.3-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.2.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.2.3-rc1 Miguel Peñaranda <mig.penaranda07(a)gmail.com> usb: usbfs: fix use-after-free of usb_device in usbdev_release() Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> USB: c67x00: fix use-after-free in c67x00_add_iso_urb() Johan Hovold <johan(a)kernel.org> USB: serial: spcp8x5: drop broken carrier detect support Jiale Yao <yaojiale02(a)163.com> USB: serial: option: fix slab OOB read in interrupt URB callback Will Porter <mrwillporter(a)gmail.com> ALSA: usb-audio: Complete cleanup after system-resume errors Marouane El Moufid <eun0us(a)espilon.net> ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() Trevor Vorhees <vorhees-work(a)proton.me> ALSA: usb-audio: Fix sample rates for PreSonus AudioBox USB Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Strengthen error handling in hub_hub_status() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Add lock to usb_wakeup_notification() Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: vsie: zero stale crypto bits Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> crypto: qce - Remove unsafe/deprecated algorithms Thorsten Blum <thorsten.blum(a)linux.dev> crypto: mxs-dcp - fix source scatterlist length access Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: iaa - fall back to software for multi-entry scatterlists Md Sadre Alam <md.alam(a)oss.qualcomm.com> crypto: qce - fix CCM AAD buffer underallocation Jan Sebastian Götte <linux(a)jaseg.de> crypto: krb5 - use kfree_sensitive() for derived key buffers Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - use scatterlist length before DMA mapping Eric Biggers <ebiggers(a)kernel.org> crypto: sun8i-ss - Remove crypto_rng interface Eric Biggers <ebiggers(a)kernel.org> crypto: sun8i-ce - Remove crypto_rng interface Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Allow zero as a random number Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Remove crypto_rng interface Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Enable clock in hwrng case Bryam Vargas <hexlabsecurity(a)proton.me> crypto: virtio - bound the akcipher result length Eric Biggers <ebiggers(a)kernel.org> kunit: irq: Continue increasing hrtimer interval for longer Eric Biggers <ebiggers(a)kernel.org> mm/swap: reject swapon() on filesystem-level encrypted files Fourie Zhang <littleddfu(a)gmail.com> netfilter: nf_tables: don't queue packet path object notifications Eric Biggers <ebiggers(a)kernel.org> netfilter: nft_set_pipapo_avx2: add missing vzeroupper Kyle Zeng <kylebot(a)openai.com> vxlan: keep the last remote linked during FDB flush Kyle Zeng <kylebot(a)openai.com> batman-adv: reject unrepresentable multicast TVLV offsets Kyle Zeng <kylebot(a)openai.com> ipv6: seg6: clear IPv4 control block on IPIP decapsulation Kyle Zeng <kylebot(a)openai.com> net/packet: defer vmalloc TX_RING free until skbs finish Eric Dumazet <edumazet(a)google.com> vlan: fix skb_under_panic and races when toggling HW VLAN offload Norbert Szetei <norbert(a)doyensec.com> net: bridge: mcast: fix use-after-free of a master VLAN's multicast context Zihan Xi <zihanx(a)nebusec.ai> xfrm: bound nat keepalive state collection Zihan Xi <zihanx(a)nebusec.ai> xfrm: fix xfrm_state_construct() auth-trunc leak Asim Viladi Oglu Manizada <manizada(a)pm.me> xfrm: ah6: validate routing header segments_left Zihan Xi <xizh2024(a)lzu.edu.cn> xfrm: avoid lock inversion in nat keepalive work Zhiling Zou <roxy520tt(a)gmail.com> xfrm: drop ESP-in-TCP packets with no ingress device Yong Wang <edragain(a)163.com> tcp: clamp route advmss to TCP_MIN_MSS Sabrina Dubroca <sd(a)queasysnail.net> xfrm: espintcp: fix UAF during close Jiayuan Chen <jiayuan.chen(a)linux.dev> net: advertise TCP MSS from the configured MTU, not the learned PMTU Hyunwoo Kim <imv4bel(a)gmail.com> net/tcp-ao: fix use-after-free of current_key on reconnect to another peer Qing Ming <a0yami(a)mailbox.org> tcp: fix AO info use-after-free in tcp_ao_connect_init() Rastislav Szabo <rastislav.szabo(a)isovalent.com> net/tcp: fix TCP-AO key deletion in VRFs Qing Ming <a0yami(a)mailbox.org> gtp: serialize PDP context updates Jiayuan Chen <jiayuan.chen(a)linux.dev> tls: device: fix out-of-bounds write in tls_append_frag() Sean Christopherson <seanjc(a)google.com> KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y Sean Christopherson <seanjc(a)google.com> KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable Sean Christopherson <seanjc(a)google.com> KVM: SEV: Extract loading of guest-provided VMSA to a separate helper Sean Christopherson <seanjc(a)google.com> KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests Pankaj Gupta <pankaj.gupta(a)amd.com> KVM: SEV: Drop FOLL_WRITE for encrypted region registration Sean Christopherson <seanjc(a)google.com> KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> usb: gadget: f_tcm: keep port count until LUN teardown completes Aleksandr Nogikh <nogikh(a)google.com> usb: usbtest: disable dynamic ID support Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on open O_TRUNC DAX failure Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on setattr writeback failure Rochan Avlur <rochan.avlur(a)gmail.com> fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free Joanne Koong <joannelkoong(a)gmail.com> fuse: publish io-uring queues with release semantics Joanne Koong <joannelkoong(a)gmail.com> fuse: fix missing barrier when checking io-uring readiness Miklos Szeredi <mszeredi(a)redhat.com> fuse: fix race between interrupt and resend Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_alloc_driver() failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_register_driver() failure Breno Leitao <leitao(a)debian.org> usb: xhci: bail out of setup if the controller is inaccessible Semih Baskan <strst.gs(a)gmail.com> usb: xhci: Handle USB3 port events when there is one roothub Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Handle bogus TRB pointers in Missed Service Error events Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> accessibility: speakup: unregister tty ldisc on later init failures Griffin Kroah-Hartman <griffin(a)kroah.com> fpga: dfl: fme: add error handling Jiayuan Chen <jiayuan.chen(a)linux.dev> selftests/bpf: Fix test_maps sockmap failure Dmitry Bogdanov <d.bogdanov(a)yadro.com> nvme-tcp: fix usage of page_frag_cache Peiyang He <peiyang_he(a)smail.nju.edu.cn> RDMA/rxe: Fix OOB in free_rd_atomic_resources() Ibrahim Hashimov <security(a)auditcode.ai> RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp ------------- Diffstat: Documentation/filesystems/fscrypt.rst | 4 + Makefile | 4 +- arch/s390/kvm/vsie.c | 1 + arch/x86/kvm/svm/sev.c | 99 ++++++++---- arch/x86/kvm/svm/svm.c | 8 +- arch/x86/kvm/svm/svm.h | 13 +- crypto/krb5/krb5_api.c | 8 +- drivers/accessibility/speakup/main.c | 1 + drivers/crypto/Kconfig | 1 - drivers/crypto/allwinner/Kconfig | 16 -- drivers/crypto/allwinner/sun8i-ce/Makefile | 1 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 63 -------- drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c | 159 ------------------ drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h | 29 ---- drivers/crypto/allwinner/sun8i-ss/Makefile | 1 - drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 45 ------ drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c | 177 --------------------- drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 23 --- drivers/crypto/atmel-tdes.c | 5 +- drivers/crypto/intel/iaa/iaa_crypto_main.c | 111 +++++++------ drivers/crypto/intel/iaa/iaa_crypto_stats.c | 9 ++ drivers/crypto/intel/iaa/iaa_crypto_stats.h | 2 + drivers/crypto/mxs-dcp.c | 2 +- drivers/crypto/qce/aead.c | 58 +------ drivers/crypto/qce/common.c | 55 ++----- drivers/crypto/qce/common.h | 16 +- drivers/crypto/qce/regs-v5.h | 4 - drivers/crypto/qce/sha.c | 30 +--- drivers/crypto/qce/sha.h | 1 - drivers/crypto/qce/skcipher.c | 97 +---------- drivers/crypto/qcom-rng.c | 156 +++--------------- .../crypto/virtio/virtio_crypto_akcipher_algs.c | 3 +- drivers/fpga/dfl-fme-perf.c | 2 + drivers/infiniband/sw/rxe/rxe_qp.c | 18 ++- drivers/net/gtp.c | 21 ++- drivers/net/vxlan/vxlan_core.c | 11 +- drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 4 + drivers/nvme/host/tcp.c | 8 + drivers/target/target_core_fabric_configfs.c | 8 + drivers/usb/c67x00/c67x00-sched.c | 4 +- drivers/usb/core/devio.c | 2 +- drivers/usb/core/hub.c | 7 +- drivers/usb/gadget/function/f_tcm.c | 2 +- drivers/usb/host/xhci-dbgtty.c | 15 +- drivers/usb/host/xhci-ring.c | 20 ++- drivers/usb/host/xhci.c | 11 +- drivers/usb/misc/usbtest.c | 1 + drivers/usb/serial/option.c | 20 ++- drivers/usb/serial/spcp8x5.c | 13 -- fs/fuse/dev.c | 41 ++--- fs/fuse/dev_uring.c | 20 +-- fs/fuse/dir.c | 9 +- fs/fuse/file.c | 4 +- include/kunit/run-in-irq-context.h | 10 +- include/linux/skbuff.h | 24 +++ include/net/ip.h | 25 +++ include/net/ip6_route.h | 37 +++++ include/net/tcp.h | 5 + include/target/target_core_fabric.h | 2 + mm/swapfile.c | 7 + net/8021q/vlan_dev.c | 39 +---- net/batman-adv/tvlv.c | 5 +- net/bridge/br_multicast.c | 4 +- net/ipv4/route.c | 4 +- net/ipv4/tcp_ao.c | 19 ++- net/ipv4/tcp_ipv4.c | 2 +- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 6 +- net/ipv6/ah6.c | 29 ++-- net/ipv6/route.c | 2 +- net/ipv6/seg6_local.c | 7 + net/ipv6/tcp_ipv6.c | 2 +- net/netfilter/nf_tables_api.c | 36 +++-- net/netfilter/nft_set_pipapo_avx2.c | 17 +- net/packet/af_packet.c | 96 +++++++++-- net/tls/tls_device.c | 3 +- net/xfrm/espintcp.c | 9 +- net/xfrm/xfrm_nat_keepalive.c | 53 ++++-- net/xfrm/xfrm_user.c | 2 +- sound/usb/card.c | 14 +- sound/usb/midi.c | 2 + sound/usb/quirks-table.h | 10 ++ .../selftests/bpf/progs/sockmap_verdict_prog.c | 14 +- 83 files changed, 748 insertions(+), 1182 deletions(-)

3 weeks, 5 days

[PATCH 6.18 00/83] 6.18.49-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.49 release. There are 83 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 02 Sep 2026 13:32:19 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.49-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.49-rc1 Miguel Peñaranda <mig.penaranda07(a)gmail.com> usb: usbfs: fix use-after-free of usb_device in usbdev_release() Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> USB: c67x00: fix use-after-free in c67x00_add_iso_urb() Johan Hovold <johan(a)kernel.org> USB: serial: spcp8x5: drop broken carrier detect support Jiale Yao <yaojiale02(a)163.com> USB: serial: option: fix slab OOB read in interrupt URB callback Will Porter <mrwillporter(a)gmail.com> ALSA: usb-audio: Complete cleanup after system-resume errors Marouane El Moufid <eun0us(a)espilon.net> ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Strengthen error handling in hub_hub_status() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Add lock to usb_wakeup_notification() Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: vsie: zero stale crypto bits Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> crypto: qce - Remove unsafe/deprecated algorithms Thorsten Blum <thorsten.blum(a)linux.dev> crypto: mxs-dcp - fix source scatterlist length access Md Sadre Alam <md.alam(a)oss.qualcomm.com> crypto: qce - fix CCM AAD buffer underallocation Jan Sebastian Götte <linux(a)jaseg.de> crypto: krb5 - use kfree_sensitive() for derived key buffers Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - use scatterlist length before DMA mapping Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Allow zero as a random number Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Remove crypto_rng interface Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Enable clock in hwrng case Bryam Vargas <hexlabsecurity(a)proton.me> crypto: virtio - bound the akcipher result length Eric Biggers <ebiggers(a)kernel.org> kunit: irq: Continue increasing hrtimer interval for longer Eric Biggers <ebiggers(a)kernel.org> mm/swap: reject swapon() on filesystem-level encrypted files Fourie Zhang <littleddfu(a)gmail.com> netfilter: nf_tables: don't queue packet path object notifications Eric Biggers <ebiggers(a)kernel.org> netfilter: nft_set_pipapo_avx2: add missing vzeroupper Kyle Zeng <kylebot(a)openai.com> vxlan: keep the last remote linked during FDB flush Kyle Zeng <kylebot(a)openai.com> batman-adv: reject unrepresentable multicast TVLV offsets Kyle Zeng <kylebot(a)openai.com> ipv6: seg6: clear IPv4 control block on IPIP decapsulation Norbert Szetei <norbert(a)doyensec.com> net: bridge: mcast: fix use-after-free of a master VLAN's multicast context Zihan Xi <zihanx(a)nebusec.ai> xfrm: bound nat keepalive state collection Zihan Xi <zihanx(a)nebusec.ai> xfrm: fix xfrm_state_construct() auth-trunc leak Asim Viladi Oglu Manizada <manizada(a)pm.me> xfrm: ah6: validate routing header segments_left Zihan Xi <xizh2024(a)lzu.edu.cn> xfrm: avoid lock inversion in nat keepalive work Zhiling Zou <roxy520tt(a)gmail.com> xfrm: drop ESP-in-TCP packets with no ingress device Sabrina Dubroca <sd(a)queasysnail.net> xfrm: espintcp: fix UAF during close Hyunwoo Kim <imv4bel(a)gmail.com> net/tcp-ao: fix use-after-free of current_key on reconnect to another peer Qing Ming <a0yami(a)mailbox.org> tcp: fix AO info use-after-free in tcp_ao_connect_init() Rastislav Szabo <rastislav.szabo(a)isovalent.com> net/tcp: fix TCP-AO key deletion in VRFs Pratik Vishwakarma <Pratik.Vishwakarma(a)amd.com> x86/CPU/AMD: Carve out a Zen5 models range Qing Ming <a0yami(a)mailbox.org> gtp: serialize PDP context updates Jiayuan Chen <jiayuan.chen(a)linux.dev> tls: device: fix out-of-bounds write in tls_append_frag() Sean Christopherson <seanjc(a)google.com> KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y Sean Christopherson <seanjc(a)google.com> KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable Sean Christopherson <seanjc(a)google.com> KVM: SEV: Extract loading of guest-provided VMSA to a separate helper Sean Christopherson <seanjc(a)google.com> KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests Pankaj Gupta <pankaj.gupta(a)amd.com> KVM: SEV: Drop FOLL_WRITE for encrypted region registration Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> usb: gadget: f_tcm: keep port count until LUN teardown completes Aleksandr Nogikh <nogikh(a)google.com> usb: usbtest: disable dynamic ID support Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on open O_TRUNC DAX failure Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on setattr writeback failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_alloc_driver() failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_register_driver() failure Semih Baskan <strst.gs(a)gmail.com> usb: xhci: Handle USB3 port events when there is one roothub Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Handle bogus TRB pointers in Missed Service Error events Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> accessibility: speakup: unregister tty ldisc on later init failures Griffin Kroah-Hartman <griffin(a)kroah.com> fpga: dfl: fme: add error handling DaeMyung Kang <charsyam(a)gmail.com> ksmbd: harden file lifetime during session teardown Raman Varabets <kernel-linux-20260610-80b7ab08(a)raman.v1.sg> HID: ft260: fix stack-use-after-return write in I2C read race Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: validate i2c input report length Jann Horn <jannh(a)google.com> HID: asus: fix missing hid_is_usb() check Antheas Kapenekakis <lkml(a)antheas.dev> HID: asus: simplify RGB init sequence Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() Jens Axboe <axboe(a)kernel.dk> io_uring: defer eventfd signaling when queued from a wakeup handler Pavel Begunkov <asml.silence(a)gmail.com> io_uring/rsrc: improve regbuf iov validation Caleb Sander Mateos <csander(a)purestorage.com> io_uring: simplify IORING_SETUP_DEFER_TASKRUN && !SQPOLL check Jens Axboe <axboe(a)kernel.dk> io_uring/futex: only mark private futex waits as inflight Aboorva Devarajan <aboorvad(a)linux.ibm.com> powerpc/hv-gpci: fix preempt count leak in sysfs show paths Jesper Dangaard Brouer <hawk(a)kernel.org> veth: fix OOB txq access in veth_poll() with asymmetric queue counts Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: switch two allocations to use kzalloc_objs() Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> ASoC: nau8821: Cancel pending work before suspend Michael Neuling <mikey(a)neuling.org> riscv: Fix register corruption from uninitialized cregs on error Jiayuan Chen <jiayuan.chen(a)linux.dev> bpf: Fix use-after-free in offloaded map/prog info fill Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> ASoC: nau8821: Cancel delayed work on component remove Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require a class's permission values to cover its permission count Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a permission value exceeding the class permission count Christian Göttsche <cgzones(a)googlemail.com> selinux: more strict policy parsing Christian Göttsche <cgzones(a)googlemail.com> selinux: use u16 for security classes Wentao Guan <guanwentao(a)uniontech.com> Revert "selinux: reject a permission value exceeding the class permission count" Dmitry Bogdanov <d.bogdanov(a)yadro.com> nvme-tcp: fix usage of page_frag_cache Jinu Kim <kimjw04271234(a)gmail.com> KVM: x86/mmu: Check write tracking in all address spaces Jia Yao <jia.yao(a)intel.com> drm/xe/guc_ads: use uncached mapping for UM queue BO Jia Yao <jia.yao(a)intel.com> drm/xe/guc_ads: allocate UM queues in VRAM on dGFX Jia Yao <jia.yao(a)intel.com> drm/xe/guc_ads: allocate UM queues in a separate BO Peiyang He <peiyang_he(a)smail.nju.edu.cn> RDMA/rxe: Fix OOB in free_rd_atomic_resources() Ibrahim Hashimov <security(a)auditcode.ai> RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp ------------- Diffstat: Documentation/filesystems/fscrypt.rst | 4 + Makefile | 4 +- arch/powerpc/perf/hv-gpci.c | 24 +- arch/riscv/kernel/compat_signal.c | 2 + arch/riscv/kernel/ptrace.c | 4 +- arch/s390/kvm/vsie.c | 1 + arch/x86/kernel/cpu/amd.c | 1 + arch/x86/kvm/mmu/page_track.c | 32 ++- arch/x86/kvm/svm/sev.c | 76 +++--- arch/x86/kvm/svm/svm.c | 8 +- arch/x86/kvm/svm/svm.h | 13 +- crypto/krb5/krb5_api.c | 8 +- drivers/accessibility/speakup/main.c | 1 + drivers/crypto/Kconfig | 1 - drivers/crypto/atmel-tdes.c | 5 +- drivers/crypto/mxs-dcp.c | 2 +- drivers/crypto/qce/aead.c | 58 +---- drivers/crypto/qce/common.c | 55 +---- drivers/crypto/qce/common.h | 16 +- drivers/crypto/qce/regs-v5.h | 4 - drivers/crypto/qce/sha.c | 30 +-- drivers/crypto/qce/sha.h | 1 - drivers/crypto/qce/skcipher.c | 97 +------- drivers/crypto/qcom-rng.c | 156 ++----------- .../crypto/virtio/virtio_crypto_akcipher_algs.c | 3 +- drivers/fpga/dfl-fme-perf.c | 2 + drivers/gpu/drm/xe/xe_bo.h | 14 ++ drivers/gpu/drm/xe/xe_guc_ads.c | 92 +++++--- drivers/gpu/drm/xe/xe_guc_ads_types.h | 5 + drivers/hid/hid-asus.c | 52 ++--- drivers/hid/hid-ft260.c | 41 +++- drivers/hid/hid-magicmouse.c | 25 +- drivers/infiniband/sw/rxe/rxe_qp.c | 18 +- drivers/net/gtp.c | 21 +- drivers/net/veth.c | 3 +- drivers/net/vxlan/vxlan_core.c | 11 +- drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 4 + drivers/nvme/host/tcp.c | 8 + drivers/target/target_core_fabric_configfs.c | 8 + drivers/usb/c67x00/c67x00-sched.c | 4 +- drivers/usb/core/devio.c | 2 +- drivers/usb/core/hub.c | 7 +- drivers/usb/gadget/function/f_tcm.c | 2 +- drivers/usb/host/xhci-dbgtty.c | 15 +- drivers/usb/host/xhci-ring.c | 20 +- drivers/usb/misc/usbtest.c | 1 + drivers/usb/serial/option.c | 20 +- drivers/usb/serial/spcp8x5.c | 13 -- fs/fuse/dir.c | 9 +- fs/fuse/file.c | 4 +- fs/smb/server/smb2pdu.c | 6 +- fs/smb/server/vfs_cache.c | 179 +++++++++++++-- fs/smb/server/vfs_cache.h | 4 +- include/kunit/run-in-irq-context.h | 10 +- include/linux/io_uring_types.h | 8 + include/linux/skbuff.h | 24 ++ include/target/target_core_fabric.h | 2 + io_uring/eventfd.c | 8 +- io_uring/eventfd.h | 2 +- io_uring/futex.c | 21 +- io_uring/io_uring.c | 7 +- io_uring/poll.c | 23 +- io_uring/rsrc.c | 31 +-- io_uring/waitid.c | 2 +- kernel/bpf/offload.c | 10 +- mm/swapfile.c | 7 + net/batman-adv/tvlv.c | 5 +- net/bridge/br_multicast.c | 4 +- net/ipv4/tcp_ao.c | 19 +- net/ipv6/ah6.c | 29 ++- net/ipv6/seg6_local.c | 7 + net/netfilter/nf_tables_api.c | 36 +-- net/netfilter/nft_set_pipapo_avx2.c | 17 +- net/tls/tls_device.c | 3 +- net/xfrm/espintcp.c | 9 +- net/xfrm/xfrm_nat_keepalive.c | 53 ++++- net/xfrm/xfrm_user.c | 2 +- security/selinux/include/security.h | 1 + security/selinux/ss/avtab.c | 35 ++- security/selinux/ss/avtab.h | 13 ++ security/selinux/ss/conditional.c | 25 +- security/selinux/ss/constraint.h | 1 + security/selinux/ss/policydb.c | 254 +++++++++++++++++---- security/selinux/ss/policydb.h | 31 ++- security/selinux/ss/services.c | 8 +- sound/soc/codecs/nau8821.c | 13 ++ sound/usb/card.c | 14 +- sound/usb/midi.c | 2 + 88 files changed, 1156 insertions(+), 776 deletions(-)

3 weeks, 5 days

[PATCH 5.15 00/69] 5.15.220-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.220 release. There are 69 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 02 Sep 2026 13:32:19 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.220-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.220-rc1 Miguel Peñaranda <mig.penaranda07(a)gmail.com> usb: usbfs: fix use-after-free of usb_device in usbdev_release() Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> USB: c67x00: fix use-after-free in c67x00_add_iso_urb() Johan Hovold <johan(a)kernel.org> USB: serial: spcp8x5: drop broken carrier detect support Jiale Yao <yaojiale02(a)163.com> USB: serial: option: fix slab OOB read in interrupt URB callback Will Porter <mrwillporter(a)gmail.com> ALSA: usb-audio: Complete cleanup after system-resume errors Marouane El Moufid <eun0us(a)espilon.net> ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Strengthen error handling in hub_hub_status() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Add lock to usb_wakeup_notification() Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: vsie: zero stale crypto bits Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> crypto: qce - Remove unsafe/deprecated algorithms Thorsten Blum <thorsten.blum(a)linux.dev> crypto: mxs-dcp - fix source scatterlist length access Md Sadre Alam <md.alam(a)oss.qualcomm.com> crypto: qce - fix CCM AAD buffer underallocation Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - use scatterlist length before DMA mapping Eric Biggers <ebiggers(a)kernel.org> mm/swap: reject swapon() on filesystem-level encrypted files Kyle Zeng <kylebot(a)openai.com> ipv6: seg6: clear IPv4 control block on IPIP decapsulation Norbert Szetei <norbert(a)doyensec.com> net: bridge: mcast: fix use-after-free of a master VLAN's multicast context Zihan Xi <zihanx(a)nebusec.ai> xfrm: fix xfrm_state_construct() auth-trunc leak Asim Viladi Oglu Manizada <manizada(a)pm.me> xfrm: ah6: validate routing header segments_left Zhiling Zou <roxy520tt(a)gmail.com> xfrm: drop ESP-in-TCP packets with no ingress device Sabrina Dubroca <sd(a)queasysnail.net> xfrm: espintcp: fix UAF during close Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> usb: gadget: f_tcm: keep port count until LUN teardown completes Aleksandr Nogikh <nogikh(a)google.com> usb: usbtest: disable dynamic ID support Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on open O_TRUNC DAX failure Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on setattr writeback failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_alloc_driver() failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_register_driver() failure Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> accessibility: speakup: unregister tty ldisc on later init failures Griffin Kroah-Hartman <griffin(a)kroah.com> fpga: dfl: fme: add error handling Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: input: read battery capacity from its actual report offset Raman Varabets <kernel-linux-20260610-80b7ab08(a)raman.v1.sg> HID: ft260: fix stack-use-after-return write in I2C read race Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: validate i2c input report length Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: missed NACK from busy device Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: wake up device from power saving mode Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: skip unexpected HID input reports Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: improve i2c large reads performance Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: improve i2c write performance Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: fix i2c probing for hwmon devices Ibrahim Hashimov <security(a)auditcode.ai> HID: uclogic: fix use-after-free of inrange_timer on remove Ibrahim Hashimov <security(a)auditcode.ai> nvmet-tcp: bound SGL data length before allocating command buffers Weiwen Hu <huweiwen(a)linux.alibaba.com> nvme: rename CDR/MORE/DNR to NVME_STATUS_* Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() Bryam Vargas <hexlabsecurity(a)proton.me> nfc: nci: add data_len bound checks to activation parameter extractors Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: reject invalid block index in GC ioctl Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: correct return value kernel-doc descriptions for ioctl functions Guanghui Yang <3497809730(a)qq.com> ext4: propagate errors from fast commit range replay Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> kcov: fix data corruption and race conditions on PREEMPT_RT Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> kcov: replace local_irq_save() with a local_lock_t Eric Dumazet <edumazet(a)google.com> ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams Mehul Rao <mehulrao(a)gmail.com> ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() Jon Hunter <jonathanh(a)nvidia.com> ASoC: tegra: Fix Master Volume Control Oswald Buddenhagen <oswald.buddenhagen(a)gmx.de> ALSA: pcm: fix wait_time calculations Sasha Levin <sashal(a)kernel.org> Revert "smb: client: use kvzalloc() for megabyte buffer in simple fallocate" Sasha Levin <sashal(a)kernel.org> Revert "mtd: maps: vmu-flash: fix fault in unaligned fixup" Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: switch two allocations to use kzalloc_objs() Kuniyuki Iwashima <kuniyu(a)google.com> smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk(). Sasha Levin <sashal(a)kernel.org> Revert "PM: sleep: Use complete() in device_pm_sleep_init()" Jiayuan Chen <jiayuan.chen(a)linux.dev> bpf: Fix use-after-free in offloaded map/prog info fill Oliver Upton <oliver.upton(a)linux.dev> KVM: arm64: Prevent access to vCPU events before init Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: make j1939_sk_bind() fail if device is no longer registered Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: add missing calls in NETDEV_UNREGISTER notification handler Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: implement NETDEV_UNREGISTER notification handler Vasiliy Kovalev <kovalev(a)altlinux.org> jfs: add check read-only before txBeginAnon() call Vasiliy Kovalev <kovalev(a)altlinux.org> jfs: add check read-only before truncation in jfs_truncate_nolock() Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> bpf: Remove tst_run from lwt_seg6local_prog_ops. Florian Westphal <fw(a)strlen.de> ipvs: reload ip header after head reallocation Vishnu Razdan <vrazdan(a)openai.com> io_uring/io-wq: fix worker accounting when canceling creation callbacks Eric Biggers <ebiggers(a)kernel.org> ext4: don't enable DAX on new encrypted files Peiyang He <peiyang_he(a)smail.nju.edu.cn> RDMA/rxe: Fix OOB in free_rd_atomic_resources() ------------- Diffstat: Documentation/filesystems/fscrypt.rst | 4 + Makefile | 4 +- arch/arm64/kvm/arm.c | 6 + arch/s390/kvm/vsie.c | 1 + drivers/accessibility/speakup/main.c | 1 + drivers/base/power/main.c | 6 +- drivers/crypto/atmel-tdes.c | 5 +- drivers/crypto/mxs-dcp.c | 2 +- drivers/crypto/qce/aead.c | 58 +------ drivers/crypto/qce/common.c | 55 ++---- drivers/crypto/qce/common.h | 16 +- drivers/crypto/qce/regs-v5.h | 4 - drivers/crypto/qce/sha.c | 30 +--- drivers/crypto/qce/sha.h | 1 - drivers/crypto/qce/skcipher.c | 97 +---------- drivers/fpga/dfl-fme-perf.c | 2 + drivers/hid/hid-ft260.c | 162 +++++++++++++---- drivers/hid/hid-input.c | 17 +- drivers/hid/hid-magicmouse.c | 25 ++- drivers/hid/hid-uclogic-core.c | 12 +- drivers/infiniband/sw/rxe/rxe_qp.c | 3 +- drivers/mtd/maps/vmu-flash.c | 8 +- drivers/nvme/host/core.c | 12 +- drivers/nvme/host/fabrics.c | 8 +- drivers/nvme/host/fault_inject.c | 2 +- drivers/nvme/host/fc.c | 8 +- drivers/nvme/target/admin-cmd.c | 20 +-- drivers/nvme/target/core.c | 42 ++--- drivers/nvme/target/discovery.c | 14 +- drivers/nvme/target/fabrics-cmd.c | 32 ++-- drivers/nvme/target/io-cmd-bdev.c | 12 +- drivers/nvme/target/nvmet.h | 2 +- drivers/nvme/target/passthru.c | 10 +- drivers/nvme/target/rdma.c | 10 +- drivers/nvme/target/tcp.c | 17 +- drivers/nvme/target/zns.c | 30 ++-- drivers/target/target_core_fabric_configfs.c | 8 + drivers/usb/c67x00/c67x00-sched.c | 4 +- drivers/usb/core/devio.c | 2 +- drivers/usb/core/hub.c | 7 +- drivers/usb/gadget/function/f_tcm.c | 2 +- drivers/usb/host/xhci-dbgtty.c | 15 +- drivers/usb/misc/usbtest.c | 1 + drivers/usb/serial/option.c | 20 ++- drivers/usb/serial/spcp8x5.c | 13 -- fs/cifs/smb2ops.c | 4 +- fs/ext4/fast_commit.c | 10 +- fs/ext4/ialloc.c | 4 + fs/ext4/super.c | 40 ++--- fs/fuse/dir.c | 9 +- fs/fuse/file.c | 4 +- fs/jfs/inode.c | 2 +- fs/jfs/jfs_extent.c | 10 ++ fs/nilfs2/ioctl.c | 251 ++++++++++++--------------- include/linux/hid.h | 1 + include/linux/inetdevice.h | 5 + include/linux/nvme.h | 4 +- include/linux/sched.h | 8 + include/target/target_core_fabric.h | 2 + io_uring/io-wq.c | 9 +- kernel/bpf/offload.c | 10 +- kernel/kcov.c | 126 +++++++------- lib/Kconfig.debug | 5 +- mm/swapfile.c | 7 + net/bridge/br_multicast.c | 4 +- net/can/j1939/j1939-priv.h | 1 + net/can/j1939/main.c | 5 + net/can/j1939/socket.c | 55 ++++++ net/core/filter.c | 1 - net/ipv4/igmp.c | 14 +- net/ipv6/ah6.c | 29 ++-- net/ipv6/seg6_local.c | 7 + net/netfilter/ipvs/ip_vs_xmit.c | 6 +- net/nfc/nci/ntf.c | 26 ++- net/smc/smc_core.c | 27 ++- net/xfrm/espintcp.c | 9 +- net/xfrm/xfrm_user.c | 2 +- security/selinux/ss/conditional.c | 12 +- sound/core/pcm_lib.c | 11 +- sound/core/pcm_native.c | 32 ++-- sound/soc/tegra/tegra_pcm.c | 3 + sound/usb/card.c | 14 +- sound/usb/midi.c | 2 + 83 files changed, 839 insertions(+), 742 deletions(-)

3 weeks, 5 days

[PATCH 6.6 00/91] 6.6.156-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.156 release. There are 91 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 02 Sep 2026 13:32:19 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.156-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.156-rc1 Miguel Peñaranda <mig.penaranda07(a)gmail.com> usb: usbfs: fix use-after-free of usb_device in usbdev_release() Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> USB: c67x00: fix use-after-free in c67x00_add_iso_urb() Johan Hovold <johan(a)kernel.org> USB: serial: spcp8x5: drop broken carrier detect support Jiale Yao <yaojiale02(a)163.com> USB: serial: option: fix slab OOB read in interrupt URB callback Will Porter <mrwillporter(a)gmail.com> ALSA: usb-audio: Complete cleanup after system-resume errors Marouane El Moufid <eun0us(a)espilon.net> ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Strengthen error handling in hub_hub_status() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Add lock to usb_wakeup_notification() Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: vsie: zero stale crypto bits Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> crypto: qce - Remove unsafe/deprecated algorithms Thorsten Blum <thorsten.blum(a)linux.dev> crypto: mxs-dcp - fix source scatterlist length access Md Sadre Alam <md.alam(a)oss.qualcomm.com> crypto: qce - fix CCM AAD buffer underallocation Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - use scatterlist length before DMA mapping Eric Biggers <ebiggers(a)kernel.org> mm/swap: reject swapon() on filesystem-level encrypted files Kyle Zeng <kylebot(a)openai.com> ipv6: seg6: clear IPv4 control block on IPIP decapsulation Norbert Szetei <norbert(a)doyensec.com> net: bridge: mcast: fix use-after-free of a master VLAN's multicast context Zihan Xi <zihanx(a)nebusec.ai> xfrm: fix xfrm_state_construct() auth-trunc leak Asim Viladi Oglu Manizada <manizada(a)pm.me> xfrm: ah6: validate routing header segments_left Zhiling Zou <roxy520tt(a)gmail.com> xfrm: drop ESP-in-TCP packets with no ingress device Sabrina Dubroca <sd(a)queasysnail.net> xfrm: espintcp: fix UAF during close Pratik Vishwakarma <Pratik.Vishwakarma(a)amd.com> x86/CPU/AMD: Carve out a Zen5 models range Perry Yuan <perry.yuan(a)amd.com> x86/CPU/AMD: Add models 0x60-0x6f to the Zen5 range Wenkuan Wang <Wenkuan.Wang(a)amd.com> x86/CPU/AMD: Add models 0x10-0x1f to the Zen5 range Mario Limonciello <mario.limonciello(a)amd.com> x86/CPU/AMD: Add more models to X86_FEATURE_ZEN5 Borislav Petkov (AMD) <bp(a)alien8.de> x86/CPU/AMD: Add X86_FEATURE_ZEN5 Jiayuan Chen <jiayuan.chen(a)linux.dev> tls: device: fix out-of-bounds write in tls_append_frag() Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> usb: gadget: f_tcm: keep port count until LUN teardown completes Aleksandr Nogikh <nogikh(a)google.com> usb: usbtest: disable dynamic ID support Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on open O_TRUNC DAX failure Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on setattr writeback failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_alloc_driver() failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_register_driver() failure Semih Baskan <strst.gs(a)gmail.com> usb: xhci: Handle USB3 port events when there is one roothub Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> accessibility: speakup: unregister tty ldisc on later init failures Griffin Kroah-Hartman <griffin(a)kroah.com> fpga: dfl: fme: add error handling Darrick J. Wong <djwong(a)kernel.org> xfs: remove file_path tracepoint data Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix accept list UAF during suspend Zijun Hu <zijun.hu(a)oss.qualcomm.com> Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() Baul Lee <baul.lee(a)xbow.com> HID: pidff: fix OOB write when hid->inputs is empty Tomasz Pakuła <tomasz.pakula.oficjalny(a)gmail.com> HID: pidff: clang-format pass Tomasz Pakuła <tomasz.pakula.oficjalny(a)gmail.com> HID: pidff: Support device error response from PID_BLOCK_LOAD Ibrahim Hashimov <security(a)auditcode.ai> HID: uclogic: fix use-after-free of inrange_timer on remove Raman Varabets <kernel-linux-20260610-80b7ab08(a)raman.v1.sg> HID: ft260: fix stack-use-after-return write in I2C read race Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: validate i2c input report length Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: stop device IO before hid_hw_stop on probe failure Ibrahim Hashimov <security(a)auditcode.ai> nvmet-tcp: bound SGL data length before allocating command buffers Weiwen Hu <huweiwen(a)linux.alibaba.com> nvme: rename CDR/MORE/DNR to NVME_STATUS_* Weiwen Hu <huweiwen(a)linux.alibaba.com> nvme: fix status magic numbers Weiwen Hu <huweiwen(a)linux.alibaba.com> nvme: rename nvme_sc_to_pr_err to nvme_status_to_pr_err Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() Christopher Kodama <ckhordiasma(a)gmail.com> HID: magicmouse: re-enable multitouch after reset-resume Bryam Vargas <hexlabsecurity(a)proton.me> nfc: nci: add data_len bound checks to activation parameter extractors Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: reject invalid block index in GC ioctl Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: correct return value kernel-doc descriptions for ioctl functions Guanghui Yang <3497809730(a)qq.com> ext4: propagate errors from fast commit range replay Baokun Li <libaokun1(a)huawei.com> ext4: make some fast commit functions reuse extents path Kemeng Shi <shikemeng(a)huaweicloud.com> ext4: make state in ext4_mb_mark_bb to be bool DaeMyung Kang <charsyam(a)gmail.com> ksmbd: harden file lifetime during session teardown Jia Jie Ho <jiajie.ho(a)starfivetech.com> crypto: starfive - Do not free stack buffer Aboorva Devarajan <aboorvad(a)linux.ibm.com> powerpc/hv-gpci: fix preempt count leak in sysfs show paths Johannes Berg <johannes.berg(a)intel.com> net/sched: initialize noop_qdisc owner Eric Dumazet <edumazet(a)google.com> net/sched: Fix mirred deadlock on device recursion Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: switch two allocations to use kzalloc_objs() Kuniyuki Iwashima <kuniyu(a)google.com> smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk(). Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> ASoC: nau8821: Cancel pending work before suspend Sasha Levin <sashal(a)kernel.org> Revert "PM: sleep: Use complete() in device_pm_sleep_init()" Michael Neuling <mikey(a)neuling.org> riscv: Fix register corruption from uninitialized cregs on error Jiayuan Chen <jiayuan.chen(a)linux.dev> bpf: Fix use-after-free in offloaded map/prog info fill Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> ASoC: nau8821: Cancel delayed work on component remove Kuniyuki Iwashima <kuniyu(a)google.com> smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). Kuniyuki Iwashima <kuniyu(a)google.com> smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). Oliver Upton <oliver.upton(a)linux.dev> KVM: arm64: Prevent access to vCPU events before init Kuniyuki Iwashima <kuniyu(a)google.com> smc: Fix use-after-free in __pnet_find_base_ndev(). Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: make j1939_sk_bind() fail if device is no longer registered Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: add missing calls in NETDEV_UNREGISTER notification handler Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: implement NETDEV_UNREGISTER notification handler Vladimir Riabchun <ferr.lambarginio(a)gmail.com> mISDN: hfcpci: Fix warning when deleting uninitialized timer Wentao Liang <vulab(a)iscas.ac.cn> media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() Namjae Jeon <linkinjeon(a)kernel.org> exfat: fix double free in delayed_free Dylan Wolff <wolffd(a)comp.nus.edu.sg> jfs: Fix null-ptr-deref in jfs_ioc_trim Nick Child <nnac123(a)linux.ibm.com> ibmvnic: Use kernel helpers for hex dumps Vasiliy Kovalev <kovalev(a)altlinux.org> jfs: add check read-only before txBeginAnon() call Vasiliy Kovalev <kovalev(a)altlinux.org> jfs: add check read-only before truncation in jfs_truncate_nolock() Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> bpf: Remove tst_run from lwt_seg6local_prog_ops. Kyle Zeng <kylebot(a)openai.com> perf: Reject exited events as group leaders Tao Lyu <tao.lyu(a)epfl.ch> bpf: Ensure reg is PTR_TO_STACK in process_iter_arg Ralf Lici <ralf(a)mandelbit.com> Revert "usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal" Vishnu Razdan <vrazdan(a)openai.com> io_uring/io-wq: fix worker accounting when canceling creation callbacks Eric Biggers <ebiggers(a)kernel.org> ext4: don't enable DAX on new encrypted files Jinu Kim <kimjw04271234(a)gmail.com> KVM: x86/mmu: Check write tracking in all address spaces Peiyang He <peiyang_he(a)smail.nju.edu.cn> RDMA/rxe: Fix OOB in free_rd_atomic_resources() ------------- Diffstat: Documentation/filesystems/fscrypt.rst | 4 + Makefile | 4 +- arch/arm64/kvm/arm.c | 6 + arch/powerpc/perf/hv-gpci.c | 24 +- arch/riscv/kernel/compat_signal.c | 2 + arch/riscv/kernel/ptrace.c | 4 +- arch/s390/kvm/vsie.c | 1 + arch/x86/include/asm/cpufeatures.h | 4 +- arch/x86/kernel/cpu/amd.c | 28 ++- arch/x86/kvm/mmu/page_track.c | 32 ++- drivers/accessibility/speakup/main.c | 1 + drivers/base/power/main.c | 6 +- drivers/crypto/atmel-tdes.c | 5 +- drivers/crypto/mxs-dcp.c | 2 +- drivers/crypto/qce/aead.c | 58 +---- drivers/crypto/qce/common.c | 55 +---- drivers/crypto/qce/common.h | 16 +- drivers/crypto/qce/regs-v5.h | 4 - drivers/crypto/qce/sha.c | 30 +-- drivers/crypto/qce/sha.h | 1 - drivers/crypto/qce/skcipher.c | 97 +------- drivers/crypto/starfive/jh7110-rsa.c | 1 - drivers/fpga/dfl-fme-perf.c | 2 + drivers/hid/hid-ft260.c | 41 +++- drivers/hid/hid-magicmouse.c | 44 +++- drivers/hid/hid-nintendo.c | 13 +- drivers/hid/hid-uclogic-core.c | 12 +- drivers/hid/usbhid/hid-pidff.c | 21 +- drivers/infiniband/sw/rxe/rxe_qp.c | 3 +- drivers/isdn/hardware/mISDN/hfcpci.c | 12 +- .../platform/samsung/exynos4-is/fimc-is-regs.c | 1 + drivers/net/ethernet/ibm/ibmvnic.c | 30 ++- drivers/nvme/host/constants.c | 2 +- drivers/nvme/host/core.c | 32 +-- drivers/nvme/host/fabrics.c | 8 +- drivers/nvme/host/fault_inject.c | 2 +- drivers/nvme/host/fc.c | 8 +- drivers/nvme/host/multipath.c | 2 +- drivers/nvme/host/nvme.h | 4 +- drivers/nvme/host/pr.c | 10 +- drivers/nvme/target/admin-cmd.c | 24 +- drivers/nvme/target/core.c | 46 ++-- drivers/nvme/target/discovery.c | 14 +- drivers/nvme/target/fabrics-cmd-auth.c | 16 +- drivers/nvme/target/fabrics-cmd.c | 36 +-- drivers/nvme/target/io-cmd-bdev.c | 12 +- drivers/nvme/target/passthru.c | 10 +- drivers/nvme/target/rdma.c | 10 +- drivers/nvme/target/tcp.c | 17 +- drivers/nvme/target/zns.c | 30 +-- drivers/target/target_core_fabric_configfs.c | 8 + drivers/usb/c67x00/c67x00-sched.c | 4 +- drivers/usb/core/devio.c | 2 +- drivers/usb/core/hub.c | 7 +- drivers/usb/gadget/function/f_tcm.c | 2 +- drivers/usb/host/xhci-dbgtty.c | 15 +- drivers/usb/host/xhci-ring.c | 2 +- drivers/usb/misc/usbtest.c | 1 + drivers/usb/phy/phy-fsl-usb.c | 1 - drivers/usb/serial/option.c | 20 +- drivers/usb/serial/spcp8x5.c | 13 -- fs/exfat/nls.c | 1 + fs/ext4/crypto.c | 40 ++-- fs/ext4/ext4.h | 2 +- fs/ext4/extents.c | 55 ++--- fs/ext4/fast_commit.c | 35 ++- fs/ext4/ialloc.c | 4 + fs/ext4/mballoc.c | 4 +- fs/fuse/dir.c | 9 +- fs/fuse/file.c | 4 +- fs/jfs/inode.c | 2 +- fs/jfs/jfs_discard.c | 3 +- fs/jfs/jfs_extent.c | 10 + fs/nilfs2/ioctl.c | 251 ++++++++++----------- fs/smb/server/smb2pdu.c | 6 +- fs/smb/server/vfs_cache.c | 179 +++++++++++++-- fs/smb/server/vfs_cache.h | 4 +- fs/xfs/scrub/trace.h | 12 +- include/linux/nvme.h | 16 +- include/net/sch_generic.h | 1 + include/target/target_core_fabric.h | 2 + io_uring/io-wq.c | 9 +- kernel/bpf/offload.c | 10 +- kernel/bpf/verifier.c | 5 + kernel/events/core.c | 10 + mm/swapfile.c | 7 + net/bluetooth/hci_sync.c | 48 +++- net/bridge/br_multicast.c | 4 +- net/can/j1939/j1939-priv.h | 1 + net/can/j1939/main.c | 5 + net/can/j1939/socket.c | 55 +++++ net/core/dev.c | 6 + net/core/filter.c | 1 - net/ipv6/ah6.c | 29 ++- net/ipv6/seg6_local.c | 7 + net/nfc/nci/ntf.c | 26 ++- net/sched/sch_generic.c | 2 + net/smc/smc_clc.c | 67 +++--- net/smc/smc_core.c | 27 +-- net/smc/smc_pnet.c | 43 ++-- net/tls/tls_device.c | 3 +- net/xfrm/espintcp.c | 9 +- net/xfrm/xfrm_user.c | 2 +- security/selinux/ss/conditional.c | 12 +- sound/soc/codecs/nau8821.c | 13 ++ sound/usb/card.c | 14 +- sound/usb/midi.c | 2 + 107 files changed, 1133 insertions(+), 846 deletions(-)

3 weeks, 5 days

[PATCH 6.12 00/99] 6.12.108-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.108 release. There are 99 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 02 Sep 2026 13:32:19 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.108-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.108-rc1 Miguel Peñaranda <mig.penaranda07(a)gmail.com> usb: usbfs: fix use-after-free of usb_device in usbdev_release() Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> USB: c67x00: fix use-after-free in c67x00_add_iso_urb() Johan Hovold <johan(a)kernel.org> USB: serial: spcp8x5: drop broken carrier detect support Jiale Yao <yaojiale02(a)163.com> USB: serial: option: fix slab OOB read in interrupt URB callback Will Porter <mrwillporter(a)gmail.com> ALSA: usb-audio: Complete cleanup after system-resume errors Marouane El Moufid <eun0us(a)espilon.net> ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Strengthen error handling in hub_hub_status() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Add lock to usb_wakeup_notification() Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: vsie: zero stale crypto bits Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> crypto: qce - Remove unsafe/deprecated algorithms Thorsten Blum <thorsten.blum(a)linux.dev> crypto: mxs-dcp - fix source scatterlist length access Md Sadre Alam <md.alam(a)oss.qualcomm.com> crypto: qce - fix CCM AAD buffer underallocation Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - use scatterlist length before DMA mapping Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Remove crypto_rng interface Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Allow zero as a random number Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Enable clock in hwrng case Eric Biggers <ebiggers(a)kernel.org> mm/swap: reject swapon() on filesystem-level encrypted files Fourie Zhang <littleddfu(a)gmail.com> netfilter: nf_tables: don't queue packet path object notifications Kyle Zeng <kylebot(a)openai.com> vxlan: keep the last remote linked during FDB flush Kyle Zeng <kylebot(a)openai.com> batman-adv: reject unrepresentable multicast TVLV offsets Kyle Zeng <kylebot(a)openai.com> ipv6: seg6: clear IPv4 control block on IPIP decapsulation Norbert Szetei <norbert(a)doyensec.com> net: bridge: mcast: fix use-after-free of a master VLAN's multicast context Zihan Xi <zihanx(a)nebusec.ai> xfrm: bound nat keepalive state collection Zihan Xi <zihanx(a)nebusec.ai> xfrm: fix xfrm_state_construct() auth-trunc leak Asim Viladi Oglu Manizada <manizada(a)pm.me> xfrm: ah6: validate routing header segments_left Zihan Xi <xizh2024(a)lzu.edu.cn> xfrm: avoid lock inversion in nat keepalive work Zhiling Zou <roxy520tt(a)gmail.com> xfrm: drop ESP-in-TCP packets with no ingress device Sabrina Dubroca <sd(a)queasysnail.net> xfrm: espintcp: fix UAF during close Hyunwoo Kim <imv4bel(a)gmail.com> net/tcp-ao: fix use-after-free of current_key on reconnect to another peer Qing Ming <a0yami(a)mailbox.org> tcp: fix AO info use-after-free in tcp_ao_connect_init() Rastislav Szabo <rastislav.szabo(a)isovalent.com> net/tcp: fix TCP-AO key deletion in VRFs Pratik Vishwakarma <Pratik.Vishwakarma(a)amd.com> x86/CPU/AMD: Carve out a Zen5 models range Qing Ming <a0yami(a)mailbox.org> gtp: serialize PDP context updates Jiayuan Chen <jiayuan.chen(a)linux.dev> tls: device: fix out-of-bounds write in tls_append_frag() Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> usb: gadget: f_tcm: keep port count until LUN teardown completes Aleksandr Nogikh <nogikh(a)google.com> usb: usbtest: disable dynamic ID support Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on open O_TRUNC DAX failure Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on setattr writeback failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_alloc_driver() failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_register_driver() failure Semih Baskan <strst.gs(a)gmail.com> usb: xhci: Handle USB3 port events when there is one roothub Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> accessibility: speakup: unregister tty ldisc on later init failures Griffin Kroah-Hartman <griffin(a)kroah.com> fpga: dfl: fme: add error handling Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix accept list UAF during suspend Zijun Hu <zijun.hu(a)oss.qualcomm.com> Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() Ibrahim Hashimov <security(a)auditcode.ai> HID: uclogic: fix use-after-free of inrange_timer on remove Raman Varabets <kernel-linux-20260610-80b7ab08(a)raman.v1.sg> HID: ft260: fix stack-use-after-return write in I2C read race Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: validate i2c input report length Jann Horn <jannh(a)google.com> HID: asus: fix missing hid_is_usb() check Antheas Kapenekakis <lkml(a)antheas.dev> HID: asus: simplify RGB init sequence Baul Lee <baul.lee(a)xbow.com> HID: pidff: fix OOB write when hid->inputs is empty Tomasz Pakuła <tomasz.pakula.oficjalny(a)gmail.com> HID: pidff: clang-format pass Tomasz Pakuła <tomasz.pakula.oficjalny(a)gmail.com> HID: pidff: Use ARRAY_SIZE macro instead of sizeof Tomasz Pakuła <tomasz.pakula.oficjalny(a)gmail.com> HID: pidff: Rework pidff_set_time() to fix warnings Bryam Vargas <hexlabsecurity(a)proton.me> nfc: nci: add data_len bound checks to activation parameter extractors Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: reject invalid block index in GC ioctl Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: correct return value kernel-doc descriptions for ioctl functions DaeMyung Kang <charsyam(a)gmail.com> ksmbd: harden file lifetime during session teardown Aboorva Devarajan <aboorvad(a)linux.ibm.com> powerpc/hv-gpci: fix preempt count leak in sysfs show paths Jesper Dangaard Brouer <hawk(a)kernel.org> veth: fix OOB txq access in veth_poll() with asymmetric queue counts Ankit Khushwaha <ankitkhushwaha.linux(a)gmail.com> ring buffer: Propagate __rb_map_vma return value to caller Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: switch two allocations to use kzalloc_objs() Kuniyuki Iwashima <kuniyu(a)google.com> smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk(). Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> ASoC: nau8821: Cancel pending work before suspend Sasha Levin <sashal(a)kernel.org> Revert "PM: sleep: Use complete() in device_pm_sleep_init()" Michael Neuling <mikey(a)neuling.org> riscv: Fix register corruption from uninitialized cregs on error Jiayuan Chen <jiayuan.chen(a)linux.dev> bpf: Fix use-after-free in offloaded map/prog info fill Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> ASoC: nau8821: Cancel delayed work on component remove Kuniyuki Iwashima <kuniyu(a)google.com> smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). Kuniyuki Iwashima <kuniyu(a)google.com> smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). Oliver Upton <oliver.upton(a)linux.dev> KVM: arm64: Prevent access to vCPU events before init Kuniyuki Iwashima <kuniyu(a)google.com> smc: Fix use-after-free in __pnet_find_base_ndev(). Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: make j1939_sk_bind() fail if device is no longer registered Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: add missing calls in NETDEV_UNREGISTER notification handler Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: implement NETDEV_UNREGISTER notification handler Vladimir Riabchun <ferr.lambarginio(a)gmail.com> mISDN: hfcpci: Fix warning when deleting uninitialized timer Wentao Liang <vulab(a)iscas.ac.cn> media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() Namjae Jeon <linkinjeon(a)kernel.org> exfat: fix double free in delayed_free Dylan Wolff <wolffd(a)comp.nus.edu.sg> jfs: Fix null-ptr-deref in jfs_ioc_trim Nick Child <nnac123(a)linux.ibm.com> ibmvnic: Use kernel helpers for hex dumps Vasiliy Kovalev <kovalev(a)altlinux.org> jfs: add check read-only before txBeginAnon() call Vasiliy Kovalev <kovalev(a)altlinux.org> jfs: add check read-only before truncation in jfs_truncate_nolock() Kyle Zeng <kylebot(a)openai.com> perf: Reject exited events as group leaders Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require a class's permission values to cover its permission count Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a permission value exceeding the class permission count Christian Göttsche <cgzones(a)googlemail.com> selinux: more strict policy parsing Christian Göttsche <cgzones(a)googlemail.com> selinux: use u16 for security classes Christian Göttsche <cgzones(a)googlemail.com> selinux: make more use of str_read() when loading the policy Christian Göttsche <cgzones(a)googlemail.com> selinux: avoid unnecessary indirection in struct level_datum Christian Göttsche <cgzones(a)googlemail.com> selinux: use known type instead of void pointer Carlos Llamas <cmllamas(a)google.com> HID: uhid: convert to hid_safe_input_report() Dmitry Bogdanov <d.bogdanov(a)yadro.com> nvme-tcp: fix usage of page_frag_cache Vishnu Razdan <vrazdan(a)openai.com> io_uring/io-wq: fix worker accounting when canceling creation callbacks Eric Biggers <ebiggers(a)kernel.org> ext4: don't enable DAX on new encrypted files Jinu Kim <kimjw04271234(a)gmail.com> KVM: x86/mmu: Check write tracking in all address spaces Peiyang He <peiyang_he(a)smail.nju.edu.cn> RDMA/rxe: Fix OOB in free_rd_atomic_resources() Ibrahim Hashimov <security(a)auditcode.ai> RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp ------------- Diffstat: Documentation/filesystems/fscrypt.rst | 4 + Makefile | 4 +- arch/arm64/kvm/arm.c | 6 + arch/powerpc/perf/hv-gpci.c | 24 +- arch/riscv/kernel/compat_signal.c | 2 + arch/riscv/kernel/ptrace.c | 4 +- arch/s390/kvm/vsie.c | 1 + arch/x86/kernel/cpu/amd.c | 1 + arch/x86/kvm/mmu/page_track.c | 32 +- drivers/accessibility/speakup/main.c | 1 + drivers/base/power/main.c | 6 +- drivers/crypto/Kconfig | 1 - drivers/crypto/atmel-tdes.c | 5 +- drivers/crypto/mxs-dcp.c | 2 +- drivers/crypto/qce/aead.c | 58 +--- drivers/crypto/qce/common.c | 55 +-- drivers/crypto/qce/common.h | 16 +- drivers/crypto/qce/regs-v5.h | 4 - drivers/crypto/qce/sha.c | 30 +- drivers/crypto/qce/sha.h | 1 - drivers/crypto/qce/skcipher.c | 97 +----- drivers/crypto/qcom-rng.c | 156 ++------- drivers/fpga/dfl-fme-perf.c | 2 + drivers/hid/hid-asus.c | 52 ++- drivers/hid/hid-ft260.c | 41 ++- drivers/hid/hid-magicmouse.c | 25 +- drivers/hid/hid-uclogic-core.c | 12 +- drivers/hid/uhid.c | 8 +- drivers/hid/usbhid/hid-pidff.c | 106 +++--- drivers/infiniband/sw/rxe/rxe_qp.c | 18 +- drivers/isdn/hardware/mISDN/hfcpci.c | 12 +- .../platform/samsung/exynos4-is/fimc-is-regs.c | 1 + drivers/net/ethernet/ibm/ibmvnic.c | 30 +- drivers/net/gtp.c | 21 +- drivers/net/veth.c | 3 +- drivers/net/vxlan/vxlan_core.c | 11 +- drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 4 + drivers/nvme/host/tcp.c | 8 + drivers/target/target_core_fabric_configfs.c | 8 + drivers/usb/c67x00/c67x00-sched.c | 4 +- drivers/usb/core/devio.c | 2 +- drivers/usb/core/hub.c | 7 +- drivers/usb/gadget/function/f_tcm.c | 2 +- drivers/usb/host/xhci-dbgtty.c | 15 +- drivers/usb/host/xhci-ring.c | 2 +- drivers/usb/misc/usbtest.c | 1 + drivers/usb/serial/option.c | 20 +- drivers/usb/serial/spcp8x5.c | 13 - fs/exfat/nls.c | 1 + fs/ext4/crypto.c | 40 +-- fs/ext4/ialloc.c | 4 + fs/fuse/dir.c | 9 +- fs/fuse/file.c | 4 +- fs/jfs/inode.c | 2 +- fs/jfs/jfs_discard.c | 3 +- fs/jfs/jfs_extent.c | 10 + fs/nilfs2/ioctl.c | 251 +++++++------- fs/smb/server/smb2pdu.c | 6 +- fs/smb/server/vfs_cache.c | 179 ++++++++-- fs/smb/server/vfs_cache.h | 4 +- include/linux/skbuff.h | 24 ++ include/target/target_core_fabric.h | 2 + io_uring/io-wq.c | 9 +- kernel/bpf/offload.c | 10 +- kernel/events/core.c | 10 + kernel/trace/ring_buffer.c | 2 +- mm/swapfile.c | 7 + net/batman-adv/tvlv.c | 5 +- net/bluetooth/hci_sync.c | 48 ++- net/bridge/br_multicast.c | 4 +- net/can/j1939/j1939-priv.h | 1 + net/can/j1939/main.c | 5 + net/can/j1939/socket.c | 55 +++ net/ipv4/tcp_ao.c | 19 +- net/ipv6/ah6.c | 29 +- net/ipv6/seg6_local.c | 7 + net/netfilter/nf_tables_api.c | 36 +- net/nfc/nci/ntf.c | 26 +- net/smc/smc_clc.c | 67 ++-- net/smc/smc_core.c | 27 +- net/smc/smc_pnet.c | 43 +-- net/tls/tls_device.c | 3 +- net/xfrm/espintcp.c | 9 +- net/xfrm/xfrm_nat_keepalive.c | 53 ++- net/xfrm/xfrm_user.c | 2 +- security/selinux/include/security.h | 1 + security/selinux/ss/avtab.c | 43 ++- security/selinux/ss/avtab.h | 21 +- security/selinux/ss/conditional.c | 47 +-- security/selinux/ss/conditional.h | 6 +- security/selinux/ss/constraint.h | 1 + security/selinux/ss/ebitmap.c | 4 +- security/selinux/ss/ebitmap.h | 5 +- security/selinux/ss/mls.c | 6 +- security/selinux/ss/policydb.c | 375 +++++++++++++++------ security/selinux/ss/policydb.h | 51 ++- security/selinux/ss/services.c | 8 +- sound/soc/codecs/nau8821.c | 13 + sound/usb/card.c | 14 +- sound/usb/midi.c | 2 + 100 files changed, 1484 insertions(+), 1067 deletions(-)

3 weeks, 5 days

[PATCH 7.1 00/76] 7.1.13-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.1.13 release. There are 76 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 02 Sep 2026 13:32:19 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.13-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.1.13-rc1 Miguel Peñaranda <mig.penaranda07(a)gmail.com> usb: usbfs: fix use-after-free of usb_device in usbdev_release() Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> USB: c67x00: fix use-after-free in c67x00_add_iso_urb() Johan Hovold <johan(a)kernel.org> USB: serial: spcp8x5: drop broken carrier detect support Jiale Yao <yaojiale02(a)163.com> USB: serial: option: fix slab OOB read in interrupt URB callback Will Porter <mrwillporter(a)gmail.com> ALSA: usb-audio: Complete cleanup after system-resume errors Marouane El Moufid <eun0us(a)espilon.net> ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() Trevor Vorhees <vorhees-work(a)proton.me> ALSA: usb-audio: Fix sample rates for PreSonus AudioBox USB Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Strengthen error handling in hub_hub_status() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Add lock to usb_wakeup_notification() Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: vsie: zero stale crypto bits Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> crypto: qce - Remove unsafe/deprecated algorithms Thorsten Blum <thorsten.blum(a)linux.dev> crypto: mxs-dcp - fix source scatterlist length access Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: iaa - fall back to software for multi-entry scatterlists Md Sadre Alam <md.alam(a)oss.qualcomm.com> crypto: qce - fix CCM AAD buffer underallocation Jan Sebastian Götte <linux(a)jaseg.de> crypto: krb5 - use kfree_sensitive() for derived key buffers Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - use scatterlist length before DMA mapping Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Allow zero as a random number Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Remove crypto_rng interface Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Enable clock in hwrng case Bryam Vargas <hexlabsecurity(a)proton.me> crypto: virtio - bound the akcipher result length Eric Biggers <ebiggers(a)kernel.org> kunit: irq: Continue increasing hrtimer interval for longer Eric Biggers <ebiggers(a)kernel.org> mm/swap: reject swapon() on filesystem-level encrypted files Fourie Zhang <littleddfu(a)gmail.com> netfilter: nf_tables: don't queue packet path object notifications Eric Biggers <ebiggers(a)kernel.org> netfilter: nft_set_pipapo_avx2: add missing vzeroupper Kyle Zeng <kylebot(a)openai.com> vxlan: keep the last remote linked during FDB flush Kyle Zeng <kylebot(a)openai.com> batman-adv: reject unrepresentable multicast TVLV offsets Kyle Zeng <kylebot(a)openai.com> ipv6: seg6: clear IPv4 control block on IPIP decapsulation Kyle Zeng <kylebot(a)openai.com> net/packet: defer vmalloc TX_RING free until skbs finish Norbert Szetei <norbert(a)doyensec.com> net: bridge: mcast: fix use-after-free of a master VLAN's multicast context Zihan Xi <zihanx(a)nebusec.ai> xfrm: bound nat keepalive state collection Zihan Xi <zihanx(a)nebusec.ai> xfrm: fix xfrm_state_construct() auth-trunc leak Asim Viladi Oglu Manizada <manizada(a)pm.me> xfrm: ah6: validate routing header segments_left Zihan Xi <xizh2024(a)lzu.edu.cn> xfrm: avoid lock inversion in nat keepalive work Zhiling Zou <roxy520tt(a)gmail.com> xfrm: drop ESP-in-TCP packets with no ingress device Yong Wang <edragain(a)163.com> tcp: clamp route advmss to TCP_MIN_MSS Sabrina Dubroca <sd(a)queasysnail.net> xfrm: espintcp: fix UAF during close Jiayuan Chen <jiayuan.chen(a)linux.dev> net: advertise TCP MSS from the configured MTU, not the learned PMTU Hyunwoo Kim <imv4bel(a)gmail.com> net/tcp-ao: fix use-after-free of current_key on reconnect to another peer Qing Ming <a0yami(a)mailbox.org> tcp: fix AO info use-after-free in tcp_ao_connect_init() Rastislav Szabo <rastislav.szabo(a)isovalent.com> net/tcp: fix TCP-AO key deletion in VRFs Qing Ming <a0yami(a)mailbox.org> gtp: serialize PDP context updates Jiayuan Chen <jiayuan.chen(a)linux.dev> tls: device: fix out-of-bounds write in tls_append_frag() Sean Christopherson <seanjc(a)google.com> KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y Sean Christopherson <seanjc(a)google.com> KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable Sean Christopherson <seanjc(a)google.com> KVM: SEV: Extract loading of guest-provided VMSA to a separate helper Sean Christopherson <seanjc(a)google.com> KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests Pankaj Gupta <pankaj.gupta(a)amd.com> KVM: SEV: Drop FOLL_WRITE for encrypted region registration Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> usb: gadget: f_tcm: keep port count until LUN teardown completes Aleksandr Nogikh <nogikh(a)google.com> usb: usbtest: disable dynamic ID support Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on open O_TRUNC DAX failure Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on setattr writeback failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_alloc_driver() failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_register_driver() failure Breno Leitao <leitao(a)debian.org> usb: xhci: bail out of setup if the controller is inaccessible Semih Baskan <strst.gs(a)gmail.com> usb: xhci: Handle USB3 port events when there is one roothub Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Handle bogus TRB pointers in Missed Service Error events Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> accessibility: speakup: unregister tty ldisc on later init failures Griffin Kroah-Hartman <griffin(a)kroah.com> fpga: dfl: fme: add error handling Zhang Yi <yi.zhang(a)huawei.com> ext4: zero out whole block for clean edges in WRITE_ZEROES Zhang Yi <yi.zhang(a)huawei.com> ext4: track partial-zero outcome per edge in ext4_zero_partial_blocks() Zhang Yi <yi.zhang(a)huawei.com> ext4: write back partial-zeroed edges in WRITE_ZEROES Zhang Yi <yi.zhang(a)huawei.com> ext4: move partial block zeroing earlier in ext4_zero_range() Zhang Yi <yi.zhang(a)huawei.com> ext4: protect WRITE_ZEROES written extents with orphan list Zhang Yi <yi.zhang(a)huawei.com> ext4: export converted block count from ext4_convert_unwritten_extents() Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: switch two allocations to use kzalloc_objs() Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require a class's permission values to cover its permission count Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a permission value exceeding the class permission count Christian Göttsche <cgzones(a)googlemail.com> selinux: more strict policy parsing Christian Göttsche <cgzones(a)googlemail.com> selinux: use u16 for security classes Wentao Guan <guanwentao(a)uniontech.com> Revert "selinux: reject a permission value exceeding the class permission count" Dmitry Bogdanov <d.bogdanov(a)yadro.com> nvme-tcp: fix usage of page_frag_cache Jinu Kim <kimjw04271234(a)gmail.com> KVM: x86/mmu: Check write tracking in all address spaces Peiyang He <peiyang_he(a)smail.nju.edu.cn> RDMA/rxe: Fix OOB in free_rd_atomic_resources() Ibrahim Hashimov <security(a)auditcode.ai> RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp Taegu Ha <hataegu0826(a)gmail.com> bpf: reject overlarge global subprog argument sizes ------------- Diffstat: Documentation/filesystems/fscrypt.rst | 4 + Makefile | 4 +- arch/s390/kvm/vsie.c | 1 + arch/x86/kvm/mmu/page_track.c | 32 ++- arch/x86/kvm/svm/sev.c | 76 +++--- arch/x86/kvm/svm/svm.c | 8 +- arch/x86/kvm/svm/svm.h | 13 +- crypto/krb5/krb5_api.c | 8 +- drivers/accessibility/speakup/main.c | 1 + drivers/crypto/Kconfig | 1 - drivers/crypto/atmel-tdes.c | 5 +- drivers/crypto/intel/iaa/iaa_crypto_main.c | 111 ++++----- drivers/crypto/intel/iaa/iaa_crypto_stats.c | 9 + drivers/crypto/intel/iaa/iaa_crypto_stats.h | 2 + drivers/crypto/mxs-dcp.c | 2 +- drivers/crypto/qce/aead.c | 58 +---- drivers/crypto/qce/common.c | 55 +---- drivers/crypto/qce/common.h | 16 +- drivers/crypto/qce/regs-v5.h | 4 - drivers/crypto/qce/sha.c | 30 +-- drivers/crypto/qce/sha.h | 1 - drivers/crypto/qce/skcipher.c | 97 +------- drivers/crypto/qcom-rng.c | 156 ++----------- .../crypto/virtio/virtio_crypto_akcipher_algs.c | 3 +- drivers/fpga/dfl-fme-perf.c | 2 + drivers/infiniband/sw/rxe/rxe_qp.c | 18 +- drivers/net/gtp.c | 21 +- drivers/net/vxlan/vxlan_core.c | 11 +- drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 4 + drivers/nvme/host/tcp.c | 8 + drivers/target/target_core_fabric_configfs.c | 8 + drivers/usb/c67x00/c67x00-sched.c | 4 +- drivers/usb/core/devio.c | 2 +- drivers/usb/core/hub.c | 7 +- drivers/usb/gadget/function/f_tcm.c | 2 +- drivers/usb/host/xhci-dbgtty.c | 15 +- drivers/usb/host/xhci-ring.c | 20 +- drivers/usb/host/xhci.c | 11 +- drivers/usb/misc/usbtest.c | 1 + drivers/usb/serial/option.c | 20 +- drivers/usb/serial/spcp8x5.c | 13 -- fs/ext4/ext4.h | 8 +- fs/ext4/extents.c | 168 +++++++++++--- fs/ext4/file.c | 3 +- fs/ext4/inode.c | 36 ++- fs/fuse/dir.c | 9 +- fs/fuse/file.c | 4 +- include/kunit/run-in-irq-context.h | 10 +- include/linux/skbuff.h | 24 ++ include/net/ip.h | 25 ++ include/net/ip6_route.h | 37 +++ include/net/tcp.h | 5 + include/target/target_core_fabric.h | 2 + kernel/bpf/verifier.c | 6 + mm/swapfile.c | 7 + net/batman-adv/tvlv.c | 5 +- net/bridge/br_multicast.c | 4 +- net/ipv4/route.c | 4 +- net/ipv4/tcp_ao.c | 19 +- net/ipv4/tcp_ipv4.c | 2 +- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 6 +- net/ipv6/ah6.c | 29 ++- net/ipv6/route.c | 2 +- net/ipv6/seg6_local.c | 7 + net/ipv6/tcp_ipv6.c | 2 +- net/netfilter/nf_tables_api.c | 36 +-- net/netfilter/nft_set_pipapo_avx2.c | 17 +- net/packet/af_packet.c | 96 +++++++- net/tls/tls_device.c | 3 +- net/xfrm/espintcp.c | 9 +- net/xfrm/xfrm_nat_keepalive.c | 53 ++++- net/xfrm/xfrm_user.c | 2 +- security/selinux/include/security.h | 1 + security/selinux/ss/avtab.c | 35 ++- security/selinux/ss/avtab.h | 13 ++ security/selinux/ss/conditional.c | 22 +- security/selinux/ss/constraint.h | 1 + security/selinux/ss/policydb.c | 254 +++++++++++++++++---- security/selinux/ss/policydb.h | 31 ++- security/selinux/ss/services.c | 8 +- sound/usb/card.c | 14 +- sound/usb/midi.c | 2 + sound/usb/quirks-table.h | 10 + .../selftests/bpf/progs/verifier_global_subprogs.c | 17 ++ 85 files changed, 1186 insertions(+), 728 deletions(-)

3 weeks, 5 days

[PATCH 5.10 00/43] 5.10.269-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.269 release. There are 43 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 02 Sep 2026 13:32:19 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.269-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.269-rc1 Miguel Peñaranda <mig.penaranda07(a)gmail.com> usb: usbfs: fix use-after-free of usb_device in usbdev_release() Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> USB: c67x00: fix use-after-free in c67x00_add_iso_urb() Johan Hovold <johan(a)kernel.org> USB: serial: spcp8x5: drop broken carrier detect support Jiale Yao <yaojiale02(a)163.com> USB: serial: option: fix slab OOB read in interrupt URB callback Marouane El Moufid <eun0us(a)espilon.net> ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Strengthen error handling in hub_hub_status() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Add lock to usb_wakeup_notification() Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: vsie: zero stale crypto bits Thorsten Blum <thorsten.blum(a)linux.dev> crypto: mxs-dcp - fix source scatterlist length access Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - use scatterlist length before DMA mapping Eric Biggers <ebiggers(a)kernel.org> mm/swap: reject swapon() on filesystem-level encrypted files Kyle Zeng <kylebot(a)openai.com> ipv6: seg6: clear IPv4 control block on IPIP decapsulation Zihan Xi <zihanx(a)nebusec.ai> xfrm: fix xfrm_state_construct() auth-trunc leak Asim Viladi Oglu Manizada <manizada(a)pm.me> xfrm: ah6: validate routing header segments_left Zhiling Zou <roxy520tt(a)gmail.com> xfrm: drop ESP-in-TCP packets with no ingress device Sabrina Dubroca <sd(a)queasysnail.net> xfrm: espintcp: fix UAF during close Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> usb: gadget: f_tcm: keep port count until LUN teardown completes Aleksandr Nogikh <nogikh(a)google.com> usb: usbtest: disable dynamic ID support Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> accessibility: speakup: unregister tty ldisc on later init failures Griffin Kroah-Hartman <griffin(a)kroah.com> fpga: dfl: fme: add error handling Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: input: read battery capacity from its actual report offset Ibrahim Hashimov <security(a)auditcode.ai> nvmet-tcp: bound SGL data length before allocating command buffers Bryam Vargas <hexlabsecurity(a)proton.me> nfc: nci: add data_len bound checks to activation parameter extractors Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: do not keep a stale msc->input if no input is claimed Samuel Page <sam(a)bynar.io> nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: reject invalid block index in GC ioctl Guanghui Yang <3497809730(a)qq.com> ext4: propagate errors from fast commit range replay Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> kcov: fix data corruption and race conditions on PREEMPT_RT Eric Dumazet <edumazet(a)google.com> ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() Sasha Levin <sashal(a)kernel.org> Revert "smb: client: use kvzalloc() for megabyte buffer in simple fallocate" Sasha Levin <sashal(a)kernel.org> Revert "mtd: maps: vmu-flash: fix fault in unaligned fixup" Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: switch two allocations to use kzalloc_objs() Sasha Levin <sashal(a)kernel.org> Revert "PM: sleep: Use complete() in device_pm_sleep_init()" Jiayuan Chen <jiayuan.chen(a)linux.dev> bpf: Fix use-after-free in offloaded map/prog info fill Oliver Upton <oliver.upton(a)linux.dev> KVM: arm64: Prevent access to vCPU events before init Vasiliy Kovalev <kovalev(a)altlinux.org> jfs: add check read-only before txBeginAnon() call Vasiliy Kovalev <kovalev(a)altlinux.org> jfs: add check read-only before truncation in jfs_truncate_nolock() Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> bpf: Remove tst_run from lwt_seg6local_prog_ops. Vishnu Razdan <vrazdan(a)openai.com> io_uring/io-wq: fix worker accounting when canceling creation callbacks Florian Westphal <fw(a)strlen.de> ipvs: reload ip header after head reallocation Eric Biggers <ebiggers(a)kernel.org> ext4: don't enable DAX on new encrypted files Ido Schimmel <idosch(a)nvidia.com> ipv6: mcast: Fix use-after-free when processing MLD queries Peiyang He <peiyang_he(a)smail.nju.edu.cn> RDMA/rxe: Fix OOB in free_rd_atomic_resources() ------------- Diffstat: Documentation/filesystems/fscrypt.rst | 4 ++ Makefile | 4 +- arch/arm64/kvm/arm.c | 6 ++ arch/s390/kvm/vsie.c | 1 + drivers/accessibility/speakup/main.c | 1 + drivers/base/power/main.c | 6 +- drivers/crypto/atmel-tdes.c | 5 +- drivers/crypto/mxs-dcp.c | 2 +- drivers/fpga/dfl-fme-perf.c | 2 + drivers/hid/hid-input.c | 17 +++-- drivers/hid/hid-magicmouse.c | 10 +++ drivers/infiniband/sw/rxe/rxe_qp.c | 3 +- drivers/mtd/maps/vmu-flash.c | 8 ++- drivers/nvme/target/tcp.c | 13 ++++ drivers/target/target_core_fabric_configfs.c | 8 +++ drivers/usb/c67x00/c67x00-sched.c | 4 +- drivers/usb/core/devio.c | 2 +- drivers/usb/core/hub.c | 7 ++- drivers/usb/gadget/function/f_tcm.c | 2 +- drivers/usb/misc/usbtest.c | 1 + drivers/usb/serial/option.c | 20 +++++- drivers/usb/serial/spcp8x5.c | 13 ---- fs/cifs/smb2ops.c | 4 +- fs/ext4/fast_commit.c | 10 ++- fs/ext4/ialloc.c | 4 ++ fs/ext4/super.c | 40 ++++++------ fs/jfs/inode.c | 2 +- fs/jfs/jfs_extent.c | 10 +++ fs/nilfs2/ioctl.c | 21 ++++++- include/linux/hid.h | 1 + include/linux/inetdevice.h | 5 ++ include/linux/sched.h | 8 +++ include/target/target_core_fabric.h | 2 + io_uring/io-wq.c | 9 ++- kernel/bpf/offload.c | 10 ++- kernel/kcov.c | 93 ++++++++++++++-------------- lib/Kconfig.debug | 5 +- mm/swapfile.c | 7 +++ net/core/filter.c | 1 - net/ipv4/igmp.c | 14 +++-- net/ipv6/ah6.c | 29 +++++---- net/ipv6/mcast.c | 8 +-- net/ipv6/seg6_local.c | 7 +++ net/netfilter/ipvs/ip_vs_xmit.c | 6 +- net/nfc/nci/ntf.c | 32 ++++++++-- net/xfrm/espintcp.c | 9 ++- net/xfrm/xfrm_user.c | 2 +- security/selinux/ss/conditional.c | 12 ++-- sound/usb/midi.c | 2 + 49 files changed, 326 insertions(+), 166 deletions(-)

3 weeks, 5 days

[PATCH 6.1 00/92] 6.1.187-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.1.187 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 02 Sep 2026 13:32:19 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.187-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.1.187-rc1 Miguel Peñaranda <mig.penaranda07(a)gmail.com> usb: usbfs: fix use-after-free of usb_device in usbdev_release() Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> USB: c67x00: fix use-after-free in c67x00_add_iso_urb() Johan Hovold <johan(a)kernel.org> USB: serial: spcp8x5: drop broken carrier detect support Jiale Yao <yaojiale02(a)163.com> USB: serial: option: fix slab OOB read in interrupt URB callback Will Porter <mrwillporter(a)gmail.com> ALSA: usb-audio: Complete cleanup after system-resume errors Marouane El Moufid <eun0us(a)espilon.net> ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Strengthen error handling in hub_hub_status() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Add lock to usb_wakeup_notification() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_core: Fix hci_conn_hash_lookup_cis Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: vsie: zero stale crypto bits Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> crypto: qce - Remove unsafe/deprecated algorithms Thorsten Blum <thorsten.blum(a)linux.dev> crypto: mxs-dcp - fix source scatterlist length access Md Sadre Alam <md.alam(a)oss.qualcomm.com> crypto: qce - fix CCM AAD buffer underallocation Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - use scatterlist length before DMA mapping Eric Biggers <ebiggers(a)kernel.org> mm/swap: reject swapon() on filesystem-level encrypted files Kyle Zeng <kylebot(a)openai.com> ipv6: seg6: clear IPv4 control block on IPIP decapsulation Norbert Szetei <norbert(a)doyensec.com> net: bridge: mcast: fix use-after-free of a master VLAN's multicast context Zihan Xi <zihanx(a)nebusec.ai> xfrm: fix xfrm_state_construct() auth-trunc leak Asim Viladi Oglu Manizada <manizada(a)pm.me> xfrm: ah6: validate routing header segments_left Zhiling Zou <roxy520tt(a)gmail.com> xfrm: drop ESP-in-TCP packets with no ingress device Sabrina Dubroca <sd(a)queasysnail.net> xfrm: espintcp: fix UAF during close Jiayuan Chen <jiayuan.chen(a)linux.dev> tls: device: fix out-of-bounds write in tls_append_frag() Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> usb: gadget: f_tcm: keep port count until LUN teardown completes Aleksandr Nogikh <nogikh(a)google.com> usb: usbtest: disable dynamic ID support Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on open O_TRUNC DAX failure Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on setattr writeback failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_alloc_driver() failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_register_driver() failure Semih Baskan <strst.gs(a)gmail.com> usb: xhci: Handle USB3 port events when there is one roothub Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> accessibility: speakup: unregister tty ldisc on later init failures Griffin Kroah-Hartman <griffin(a)kroah.com> fpga: dfl: fme: add error handling Eric Dumazet <edumazet(a)google.com> ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_event: validate LE Set CIG Parameters response Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_event: fix Set CIG Parameters error status handling Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: use correct CIS order in Set CIG Parameters event Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_conn: Fix not matching by CIS ID Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix accept list UAF during suspend Zijun Hu <zijun.hu(a)oss.qualcomm.com> Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() Raman Varabets <kernel-linux-20260610-80b7ab08(a)raman.v1.sg> HID: ft260: fix stack-use-after-return write in I2C read race Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: validate i2c input report length Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: missed NACK from busy device Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: wake up device from power saving mode Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: skip unexpected HID input reports Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: improve i2c large reads performance Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: improve i2c write performance Ibrahim Hashimov <security(a)auditcode.ai> HID: uclogic: fix use-after-free of inrange_timer on remove Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: stop device IO before hid_hw_stop on probe failure Ibrahim Hashimov <security(a)auditcode.ai> nvmet-tcp: bound SGL data length before allocating command buffers Weiwen Hu <huweiwen(a)linux.alibaba.com> nvme: rename CDR/MORE/DNR to NVME_STATUS_* Christopher Kodama <ckhordiasma(a)gmail.com> HID: magicmouse: re-enable multitouch after reset-resume Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() Andrei Fed <andfed.net(a)gmail.com> HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C Bryam Vargas <hexlabsecurity(a)proton.me> nfc: nci: add data_len bound checks to activation parameter extractors Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: reject invalid block index in GC ioctl Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: correct return value kernel-doc descriptions for ioctl functions Guanghui Yang <3497809730(a)qq.com> ext4: propagate errors from fast commit range replay Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: pm: fix memory leak from alloc-during-teardown race Christoph Hellwig <hch(a)lst.de> block: make bio_check_eod work for zero sized devices Jon Hunter <jonathanh(a)nvidia.com> ASoC: tegra: Fix Master Volume Control Sasha Levin <sashal(a)kernel.org> Revert "smb: client: use kvzalloc() for megabyte buffer in simple fallocate" Sasha Levin <sashal(a)kernel.org> Revert "mtd: maps: vmu-flash: fix fault in unaligned fixup" Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: switch two allocations to use kzalloc_objs() Kuniyuki Iwashima <kuniyu(a)google.com> smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk(). Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> ASoC: nau8821: Cancel pending work before suspend Sasha Levin <sashal(a)kernel.org> Revert "PM: sleep: Use complete() in device_pm_sleep_init()" Michael Neuling <mikey(a)neuling.org> riscv: Fix register corruption from uninitialized cregs on error Jiayuan Chen <jiayuan.chen(a)linux.dev> bpf: Fix use-after-free in offloaded map/prog info fill Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> ASoC: nau8821: Cancel delayed work on component remove Kuniyuki Iwashima <kuniyu(a)google.com> smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). Kuniyuki Iwashima <kuniyu(a)google.com> smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). Oliver Upton <oliver.upton(a)linux.dev> KVM: arm64: Prevent access to vCPU events before init Kuniyuki Iwashima <kuniyu(a)google.com> smc: Fix use-after-free in __pnet_find_base_ndev(). Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: make j1939_sk_bind() fail if device is no longer registered Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: add missing calls in NETDEV_UNREGISTER notification handler Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: implement NETDEV_UNREGISTER notification handler Vladimir Riabchun <ferr.lambarginio(a)gmail.com> mISDN: hfcpci: Fix warning when deleting uninitialized timer Wentao Liang <vulab(a)iscas.ac.cn> media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() Namjae Jeon <linkinjeon(a)kernel.org> exfat: fix double free in delayed_free Dylan Wolff <wolffd(a)comp.nus.edu.sg> jfs: Fix null-ptr-deref in jfs_ioc_trim Nick Child <nnac123(a)linux.ibm.com> ibmvnic: Use kernel helpers for hex dumps Vasiliy Kovalev <kovalev(a)altlinux.org> jfs: add check read-only before txBeginAnon() call Vasiliy Kovalev <kovalev(a)altlinux.org> jfs: add check read-only before truncation in jfs_truncate_nolock() Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> bpf: Remove tst_run from lwt_seg6local_prog_ops. Ben Skeggs <bskeggs(a)redhat.com> drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP Ziyang Huang <hzyitc(a)outlook.com> wifi: ath11k: Add missing hw_ops->get_ring_selector() for IPQ5018 Ralf Lici <ralf(a)mandelbit.com> Revert "usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal" Florian Westphal <fw(a)strlen.de> ipvs: reload ip header after head reallocation Vishnu Razdan <vrazdan(a)openai.com> io_uring/io-wq: fix worker accounting when canceling creation callbacks Eric Biggers <ebiggers(a)kernel.org> ext4: don't enable DAX on new encrypted files Jinu Kim <kimjw04271234(a)gmail.com> KVM: x86/mmu: Check write tracking in all address spaces Eric Dumazet <edumazet(a)google.com> inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Peiyang He <peiyang_he(a)smail.nju.edu.cn> RDMA/rxe: Fix OOB in free_rd_atomic_resources() ------------- Diffstat: Documentation/filesystems/fscrypt.rst | 4 + Makefile | 4 +- arch/arm64/kvm/arm.c | 6 + arch/riscv/kernel/compat_signal.c | 2 + arch/riscv/kernel/ptrace.c | 4 +- arch/s390/kvm/vsie.c | 1 + arch/x86/kvm/mmu/page_track.c | 28 ++- block/blk-core.c | 2 +- drivers/accessibility/speakup/main.c | 1 + drivers/base/power/main.c | 6 +- drivers/crypto/atmel-tdes.c | 5 +- drivers/crypto/mxs-dcp.c | 2 +- drivers/crypto/qce/aead.c | 58 +---- drivers/crypto/qce/common.c | 55 +---- drivers/crypto/qce/common.h | 16 +- drivers/crypto/qce/regs-v5.h | 4 - drivers/crypto/qce/sha.c | 30 +-- drivers/crypto/qce/sha.h | 1 - drivers/crypto/qce/skcipher.c | 97 +------- drivers/fpga/dfl-fme-perf.c | 2 + drivers/gpu/drm/nouveau/dispnv50/disp.c | 4 + drivers/hid/hid-ft260.c | 157 ++++++++++--- drivers/hid/hid-input.c | 3 + drivers/hid/hid-magicmouse.c | 63 +++++- drivers/hid/hid-nintendo.c | 13 +- drivers/hid/hid-uclogic-core.c | 12 +- drivers/infiniband/sw/rxe/rxe_qp.c | 3 +- drivers/isdn/hardware/mISDN/hfcpci.c | 12 +- .../platform/samsung/exynos4-is/fimc-is-regs.c | 1 + drivers/mtd/maps/vmu-flash.c | 8 +- drivers/net/ethernet/ibm/ibmvnic.c | 30 ++- drivers/net/wireless/ath/ath11k/hw.c | 2 +- drivers/nvme/host/core.c | 18 +- drivers/nvme/host/fabrics.c | 8 +- drivers/nvme/host/fault_inject.c | 2 +- drivers/nvme/host/fc.c | 8 +- drivers/nvme/target/admin-cmd.c | 22 +- drivers/nvme/target/core.c | 46 ++-- drivers/nvme/target/discovery.c | 14 +- drivers/nvme/target/fabrics-cmd-auth.c | 16 +- drivers/nvme/target/fabrics-cmd.c | 36 +-- drivers/nvme/target/io-cmd-bdev.c | 12 +- drivers/nvme/target/nvmet.h | 2 +- drivers/nvme/target/passthru.c | 10 +- drivers/nvme/target/rdma.c | 10 +- drivers/nvme/target/tcp.c | 17 +- drivers/nvme/target/zns.c | 30 +-- drivers/target/target_core_fabric_configfs.c | 8 + drivers/usb/c67x00/c67x00-sched.c | 4 +- drivers/usb/core/devio.c | 2 +- drivers/usb/core/hub.c | 7 +- drivers/usb/gadget/function/f_tcm.c | 2 +- drivers/usb/host/xhci-dbgtty.c | 15 +- drivers/usb/host/xhci-ring.c | 2 +- drivers/usb/misc/usbtest.c | 1 + drivers/usb/phy/phy-fsl-usb.c | 1 - drivers/usb/serial/option.c | 20 +- drivers/usb/serial/spcp8x5.c | 13 -- fs/exfat/nls.c | 1 + fs/ext4/crypto.c | 40 ++-- fs/ext4/fast_commit.c | 10 +- fs/ext4/ialloc.c | 4 + fs/fuse/dir.c | 9 +- fs/fuse/file.c | 4 +- fs/jfs/inode.c | 2 +- fs/jfs/jfs_discard.c | 3 +- fs/jfs/jfs_extent.c | 10 + fs/nilfs2/ioctl.c | 251 ++++++++++----------- fs/smb/client/smb2ops.c | 4 +- include/linux/inetdevice.h | 5 + include/linux/nvme.h | 6 +- include/net/bluetooth/hci_core.h | 15 +- include/target/target_core_fabric.h | 2 + io_uring/io-wq.c | 9 +- kernel/bpf/offload.c | 10 +- mm/swapfile.c | 7 + net/bluetooth/hci_conn.c | 3 +- net/bluetooth/hci_event.c | 46 ++-- net/bluetooth/hci_sync.c | 48 +++- net/bridge/br_multicast.c | 4 +- net/can/j1939/j1939-priv.h | 1 + net/can/j1939/main.c | 5 + net/can/j1939/socket.c | 55 +++++ net/core/filter.c | 1 - net/ipv4/icmp.c | 14 +- net/ipv4/igmp.c | 14 +- net/ipv6/ah6.c | 29 ++- net/ipv6/icmp.c | 3 + net/ipv6/seg6_local.c | 7 + net/mptcp/pm_netlink.c | 3 + net/mptcp/pm_userspace.c | 10 +- net/mptcp/protocol.c | 5 + net/mptcp/protocol.h | 7 +- net/netfilter/ipvs/ip_vs_xmit.c | 6 +- net/nfc/nci/ntf.c | 26 ++- net/smc/smc_clc.c | 67 +++--- net/smc/smc_core.c | 27 +-- net/smc/smc_pnet.c | 43 ++-- net/tls/tls_device.c | 3 +- net/xfrm/espintcp.c | 9 +- net/xfrm/xfrm_user.c | 2 +- security/selinux/ss/conditional.c | 12 +- sound/soc/codecs/nau8821.c | 13 ++ sound/soc/tegra/tegra_pcm.c | 3 + sound/usb/card.c | 14 +- sound/usb/midi.c | 2 + 106 files changed, 1028 insertions(+), 808 deletions(-)

3 weeks, 5 days

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage September 2026