This is the start of the stable review cycle for the 6.18.58 release. There are 52 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Mon, 19 Oct 2026 15:50:51 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.58-rc1... or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below.

thanks,

greg k-h

------------- Pseudo-Shortlog of commits:

Greg Kroah-Hartman gregkh@linuxfoundation.org Linux 6.18.58-rc1

Toke Høiland-Jørgensen toke@toke.dk wifi: atk9k: Revert "wifi: ath9k: reject short WMI command responses"

Mattia Meleleo mattia.meleleo@coralogix.com bpf, sockmap: Account for receive queue in FIONREAD without a verdict program

Pratyush Yadav pratyush@kernel.org kho: free chunks using free_page() instead of kfree()

Jens Axboe axboe@kernel.dk io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK

Hengyu Liang hengyul@cs.unc.edu io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK

Bernard Pidoux bernard.f6bvp@gmail.com rose: hold a reference on incoming sockets queued for accept()

Alexander Lobakin aleksander.lobakin@intel.com ice: fix broken Rx on VFs

Johan Hovold johan@kernel.org USB: iowarrior: fix use-after-free on disconnect race

Oliver Neukum oneukum@suse.com usb: iowarrior: remove inherent race with minor number

Stephen Smalley stephen.smalley.work@gmail.com selinux: allow multiple opens of /sys/fs/selinux/policy

SeongJae Park sj@kernel.org mm/damon/core: fix damos_walk() vs kdamond_fn() exit race

SeongJae Park sj@kernel.org mm/damon/core: cancel damos_walk() before damon_ctx->kdamond reset

Long Li leo.lilong@huawei.com xfs: close crash window in attr dabtree inactivation

Long Li leo.lilong@huawei.com xfs: factor out xfs_attr3_leaf_init

Long Li leo.lilong@huawei.com xfs: factor out xfs_attr3_node_entry_remove

Larysa Zaremba larysa.zaremba@intel.com ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz

Larysa Zaremba larysa.zaremba@intel.com ice: fix rxq info registering in mbuf packets

Michal Schmidt mschmidt@redhat.com ice: fix crash in ethtool offline loopback test

Michal Kubiak michal.kubiak@intel.com ice: drop page splitting and recycling

Michal Kubiak michal.kubiak@intel.com ice: remove legacy Rx and construct SKB

Chris J Arges carges@cloudflare.com ima: Fix stack-out-of-bounds in is_bprm_creds_for_exec()

Coiby Xu coxu@redhat.com ima: Access decompressed kernel module to verify appended signature

Matteo Croce technoboy85@gmail.com fat: stop reading directory entries past the end-of-directory marker

Frank Sorenson sorenson@redhat.com cifs: fix time_last_write stamp placement in setattr/truncate paths

Fan Wu fanwu01@zju.edu.cn drm/xe/i2c: cancel the client work on remove

Stanley Jhu stanleyjhu@google.com scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock()

Bart Van Assche bvanassche@acm.org scsi: ufs: core: Add a comment block above ufshcd_mcq_compl_all_cqes_lock()

Peter Wang peter.wang@mediatek.com scsi: ufs: core: Add debug log for MCQ command timeout

Bart Van Assche bvanassche@acm.org scsi: ufs: core: Move an assignment in ufshcd_mcq_process_cqe()

Ahmed Abdelhaleem Ahmed ahmedhal@gmail.com scsi: ch: Do not keep references to data transfer element devices

Stanley Jhu stanleyjhu@google.com scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ

Wei-Jie Hung imbigking12@gmail.com riscv: patch: fix handling of bpf-jit execmem addresses

Vivian Wang wangruikang@iscas.ac.cn riscv: patch: Avoid early phys_to_page()

Hamza Mahfooz hamzamahfooz@linux.microsoft.com net: mana: reserve RX buffer headroom to fix forwarding performance

Suraj Gupta suraj.gupta2@amd.com net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop

Mikhail Gavrilov mikhail.v.gavrilov@gmail.com Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex

Tejun Heo tj@kernel.org sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler

Mikulas Patocka mpatocka@redhat.com dm-integrity: validate the superblock on resume

Mikulas Patocka mpatocka@redhat.com dm-integrity: fix NULL pointer dereference when the 'R' flag is used

Sean Wang sean.wang@mediatek.com wifi: mt76: connac: tolerate inactive BSS deactivation

Lubos Rendek l.rendek@proxmox.com nfsd: fix all-zero stateid in CB_OFFLOAD for async COPY

Lorenzo Stoakes (ARM) ljs@kernel.org mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge

Lorenzo Stoakes (ARM) ljs@kernel.org mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP

Jose Ignacio Tornos Martinez jtornosm@redhat.com iavf: send MAC change request synchronously

Corinna Vinschen vinschen@redhat.com iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test

Mario Limonciello mario.limonciello@amd.com drm/amd: Create a device link between APU display and XHCI devices

Daehyeon Ko 4ncienth@gmail.com ip6_gre: remove obsolete ERSPAN PMTU update

Manivannan Sadhasivam manivannan.sadhasivam@oss.qualcomm.com PCI: dwc: Return -EIO from dw_pcie_wait_for_link() if device is not active

Manivannan Sadhasivam manivannan.sadhasivam@oss.qualcomm.com PCI: dwc: Return -ENODEV from dw_pcie_wait_for_link() if device is not found

Cheng Xu chengyou@linux.alibaba.com RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables

Ethan Tidmore ethantidmore06@gmail.com usb: gadget: f_hid: Add missing error code

Johan Hovold johan@kernel.org spi: mpc52xx: clean up interrupt handling

-------------

Diffstat:

Makefile | 4 +- arch/riscv/kernel/patch.c | 21 +- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 12 ++ drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h | 10 + .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_0_ppt.c | 45 ++++ drivers/gpu/drm/xe/xe_i2c.c | 5 +- drivers/infiniband/hw/erdma/erdma_main.c | 4 +- drivers/infiniband/hw/erdma/erdma_verbs.c | 18 +- drivers/md/dm-integrity.c | 55 +++++ drivers/net/ethernet/intel/iavf/iavf.h | 11 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 85 ++++++-- drivers/net/ethernet/intel/iavf/iavf_virtchnl.c | 111 ++++++++-- drivers/net/ethernet/intel/ice/ice.h | 3 +- drivers/net/ethernet/intel/ice/ice_base.c | 79 ++----- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_lib.c | 15 +- drivers/net/ethernet/intel/ice/ice_main.c | 11 +- drivers/net/ethernet/intel/ice/ice_txrx.c | 233 ++------------------- drivers/net/ethernet/intel/ice/ice_txrx.h | 88 -------- drivers/net/ethernet/intel/ice/ice_xsk.c | 75 +------ drivers/net/ethernet/intel/ice/virt/queues.c | 6 +- drivers/net/ethernet/microsoft/mana/mana_bpf.c | 8 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 26 ++- drivers/net/ethernet/xilinx/xilinx_axienet.h | 7 +- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 53 ++++- drivers/net/wireless/ath/ath9k/wmi.c | 16 +- drivers/net/wireless/ath/ath9k/wmi.h | 1 - .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 9 +- .../net/wireless/mediatek/mt76/mt76_connac_mcu.h | 23 ++ drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 6 +- drivers/pci/controller/dwc/pcie-designware.c | 31 ++- drivers/scsi/ch.c | 30 +-- drivers/spi/spi-mpc52xx.c | 26 ++- drivers/ufs/core/ufs-mcq.c | 35 +++- drivers/ufs/core/ufshcd.c | 37 ++-- drivers/usb/gadget/function/f_hid.c | 4 +- drivers/usb/misc/iowarrior.c | 74 +++---- fs/fat/dir.c | 44 +++- fs/nfsd/nfs4proc.c | 2 + fs/smb/client/inode.c | 27 ++- fs/xfs/libxfs/xfs_attr_leaf.c | 22 ++ fs/xfs/libxfs/xfs_attr_leaf.h | 3 + fs/xfs/libxfs/xfs_da_btree.c | 53 ++++- fs/xfs/libxfs/xfs_da_btree.h | 2 + fs/xfs/xfs_attr_inactive.c | 99 +++++---- include/linux/damon.h | 1 + include/linux/kernel_read_file.h | 1 + include/linux/skmsg.h | 14 -- include/net/bluetooth/rfcomm.h | 1 + include/net/mana/mana.h | 4 +- io_uring/io_uring.c | 12 +- io_uring/kbuf.c | 6 +- io_uring/memmap.c | 29 ++- io_uring/memmap.h | 6 +- io_uring/register.c | 15 +- io_uring/zcrx.c | 4 +- kernel/kexec_handover.c | 2 +- kernel/module/main.c | 17 +- kernel/sched/ext.c | 29 ++- kernel/sched/sched.h | 5 +- mm/damon/core.c | 24 ++- mm/mremap.c | 38 +++- mm/vma.c | 21 +- mm/vma.h | 7 +- net/bluetooth/rfcomm/core.c | 134 ++++++++---- net/ipv4/tcp_bpf.c | 17 +- net/ipv6/ip6_gre.c | 7 - net/rose/af_rose.c | 44 +++- net/rose/rose_timer.c | 5 + security/integrity/ima/ima.h | 6 +- security/integrity/ima/ima_appraise.c | 16 +- security/integrity/ima/ima_main.c | 30 ++- security/integrity/ima/ima_policy.c | 3 +- security/ipe/hooks.c | 1 + security/selinux/hooks.c | 5 +- security/selinux/selinuxfs.c | 27 +-- tools/testing/vma/vma.c | 4 +- 77 files changed, 1160 insertions(+), 914 deletions(-)