This is the start of the stable review cycle for the 6.6.135 release. There are 50 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.135-rc1... or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below.
thanks,
greg k-h
------------- Pseudo-Shortlog of commits:
Greg Kroah-Hartman gregkh@linuxfoundation.org Linux 6.6.135-rc1
Manivannan Sadhasivam manivannan.sadhasivam@oss.qualcomm.com Revert "PCI: Enable ACS after configuring IOMMU for OF platforms"
David Howells dhowells@redhat.com rxrpc: Fix missing error checks for rxkad encryption/decryption failure
David Howells dhowells@redhat.com rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)
Luxiao Xu rakukuip@gmail.com rxrpc: fix reference count leak in rxrpc_server_keyring()
Yuqi Xu xuyuqiabc@gmail.com rxrpc: reject undecryptable rxkad response tickets
Douya Le ldy3087146292@gmail.com rxrpc: Only put the call ref if one was acquired
Anderson Nascimento anderson@allelesecurity.com rxrpc: Fix key reference count leak from call->key
David Howells dhowells@redhat.com rxrpc: Fix call removal to use RCU safe deletion
David Carlier devnexen@gmail.com net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()
Baolin Wang baolin.wang@linux.alibaba.com mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()
Tyllis Xu livelycarpet87@gmail.com net: stmmac: fix integer underflow in chain mode
Pengpeng Hou pengpeng@iscas.ac.cn net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure
Johan Hovold johan@kernel.org mmc: vub300: fix NULL-deref on disconnect
Jacky Bai ping.bai@nxp.com pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled
Michael Guralnik michaelgur@nvidia.com net/mlx5: Update the list of the PCI supported devices
Sebastian Brzezinka sebastian.brzezinka@intel.com drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat
Haoze Xie royenheart@gmail.com batman-adv: hold claim backbone gateways by reference
David Carlier devnexen@gmail.com net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()
Muhammad Alifa Ramdhan ramdhan@starlabs.sg net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
Borislav Petkov (AMD) bp@alien8.de EDAC/mc: Fix error path ordering in edac_mc_alloc()
Lukas Wunner lukas@wunner.de X.509: Fix out-of-bounds access when parsing extensions
Ruide Cao caoruide123@gmail.com batman-adv: reject oversized global TT response buffers
Pengpeng Hou pengpeng@iscas.ac.cn nfc: pn533: allocate rx skb before consuming bytes
Shawn Guo shawnguo@kernel.org arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges
Shawn Guo shawnguo@kernel.org arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity
Sebastian Krzyszkowiak sebastian.krzyszkowiak@puri.sm arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V
Sebastian Krzyszkowiak sebastian.krzyszkowiak@puri.sm Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower"
Thomas Fourier fourier.thomas@gmail.com wifi: brcmsmac: Fix dma_free_coherent() size
Oleh Konko security@1seal.org tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
Yasuaki Torimaru yasuakitorimaru@gmail.com xfrm: clear trailing padding in build_polexpire()
Tuan Do tuan@calif.io netfilter: nft_ct: fix use-after-free in timeout object destroy
Maarten Lankhorst dev@lankhorst.se Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug"
Florian Westphal fw@strlen.de netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR
Andrea Mayer andrea.mayer@uniroma2.it seg6: separate dst_cache for input and output paths in seg6 lwtunnel
Matthieu Baerts (NGI0) matttbe@kernel.org Revert "mptcp: add needs_id for netlink appending addr"
Michael Zimmermann sigmaepsilon92@gmail.com usb: gadget: f_hid: move list and spinlock inits from bind to alloc
Li Xiasong lixiasong1@huawei.com mptcp: fix soft lockup in mptcp_recvmsg()
Srujana Challa schalla@marvell.com virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN
André Draszik andre.draszik@linaro.org scsi: ufs: core: Fix use-after free in init error and remove paths
Kuninori Morimoto kuninori.morimoto.gx@renesas.com ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai()
Maciej W. Rozycki macro@orcam.me.uk MIPS: mm: Rewrite TLB uniquification for the hidden bit feature
Maciej W. Rozycki macro@orcam.me.uk MIPS: mm: Suppress TLB uniquification on EHINV hardware
Maciej W. Rozycki macro@orcam.me.uk MIPS: Always record SEGBITS in cpu_data.vmbits
Dmitry Torokhov dmitry.torokhov@gmail.com Input: uinput - take event lock when submitting FF request "event"
Mikhail Gavrilov mikhail.v.gavrilov@gmail.com Input: uinput - fix circular locking dependency with ff-core
Jiayuan Chen jiayuan.chen@linux.dev mptcp: fix slab-use-after-free in __inet_lookup_established
Greg Kroah-Hartman gregkh@linuxfoundation.org net: rfkill: prevent unlimited numbers of rfkill events from being created
Greg Kroah-Hartman gregkh@linuxfoundation.org xfrm_user: fix info leak in build_report()
Johan Hovold johan@kernel.org wifi: rt2x00usb: fix devres lifetime
Eric Biggers ebiggers@kernel.org lib/crypto: chacha: Zeroize permuted_state before it leaves scope
-------------
Diffstat:
Makefile | 4 +- .../arm64/boot/dts/freescale/imx8mq-librem5-r3.dts | 2 +- arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi | 24 +- .../boot/dts/hisilicon/hi3798cv200-poplar.dts | 2 +- arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi | 1 + arch/mips/include/asm/cpu-features.h | 1 - arch/mips/include/asm/cpu-info.h | 2 - arch/mips/include/asm/mipsregs.h | 2 + arch/mips/kernel/cpu-probe.c | 13 +- arch/mips/kernel/cpu-r3k-probe.c | 2 + arch/mips/mm/tlb-r4k.c | 285 +++++++++++++++++---- crypto/asymmetric_keys/x509_cert_parser.c | 8 +- drivers/edac/edac_mc.c | 6 +- drivers/gpu/drm/drm_file.c | 5 +- drivers/gpu/drm/drm_mode_config.c | 9 +- drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c | 26 +- drivers/input/misc/uinput.c | 35 ++- drivers/mmc/host/vub300.c | 2 +- drivers/net/ethernet/altera/altera_tse_main.c | 1 + drivers/net/ethernet/mellanox/mlx5/core/main.c | 1 + .../net/ethernet/microchip/lan966x/lan966x_fdma.c | 2 + drivers/net/ethernet/qualcomm/qca_uart.c | 2 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 11 +- drivers/net/virtio_net.c | 16 +- .../net/wireless/broadcom/brcm80211/brcmsmac/dma.c | 2 +- drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | 2 +- drivers/nfc/pn533/uart.c | 11 +- drivers/pci/pci-driver.c | 8 - drivers/pci/pci.c | 10 +- drivers/pci/pci.h | 1 - drivers/pmdomain/imx/imx8mp-blk-ctrl.c | 8 +- drivers/ufs/core/ufshcd.c | 31 ++- drivers/ufs/host/ufshcd-pci.c | 2 - drivers/ufs/host/ufshcd-pltfrm.c | 25 +- drivers/usb/gadget/function/f_hid.c | 11 +- include/net/netfilter/nf_conntrack_timeout.h | 1 + include/trace/events/rxrpc.h | 2 +- include/ufs/ufshcd.h | 1 - lib/crypto/chacha.c | 4 + mm/filemap.c | 11 +- net/batman-adv/bridge_loop_avoidance.c | 27 +- net/batman-adv/translation-table.c | 9 +- net/ipv6/seg6_iptunnel.c | 41 ++- net/mptcp/pm_netlink.c | 24 +- net/mptcp/protocol.c | 13 +- net/mptcp/protocol.h | 1 + net/mptcp/subflow.c | 15 +- net/netfilter/nft_ct.c | 2 +- net/netfilter/nft_set_pipapo.c | 20 +- net/rfkill/core.c | 35 ++- net/rxrpc/af_rxrpc.c | 6 - net/rxrpc/call_object.c | 25 +- net/rxrpc/io_thread.c | 3 +- net/rxrpc/key.c | 2 +- net/rxrpc/rxkad.c | 63 +++-- net/rxrpc/server_key.c | 3 + net/tipc/group.c | 6 +- net/tls/tls_sw.c | 10 + net/xfrm/xfrm_user.c | 3 + sound/soc/generic/simple-card-utils.c | 7 +- 60 files changed, 599 insertions(+), 308 deletions(-)