This is the start of the stable review cycle for the 7.0.1 release. There are 76 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Wed, 22 Apr 2026 15:38:50 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.1-rc1.g... or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y and the diffstat can be found below.

thanks,

greg k-h

------------- Pseudo-Shortlog of commits:

Greg Kroah-Hartman gregkh@linuxfoundation.org Linux 7.0.1-rc1

Jianhui Zhou jianhuizzzzz@gmail.com mm/userfaultfd: fix hugetlb fault mutex hash calculation

Jeongjun Park aha310510@gmail.com media: hackrf: fix to not free memory after the device is registered in hackrf_probe()

Abd-Alrhman Masalkhi abd.masalkhi@gmail.com media: vidtv: fix pass-by-value structs causing MSAN warnings

Deepanshu Kartikey kartikey406@gmail.com nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map

Jeongjun Park aha310510@gmail.com media: as102: fix to not free memory after the device is registered in as102_usb_probe()

Shardul Bankar shardul.b@mpiricsoftware.com wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit

Mingzhe Zou mingzhe.zou@easystack.cn bcache: fix cached_dev.sb_bio use-after-free and crash

Berk Cem Goksel berkcgoksel@gmail.com ALSA: 6fire: fix use-after-free on disconnect

Sanman Pradhan psanman@juniper.net hwmon: (powerz) Fix use-after-free on USB disconnect

Abhishek Kumar abhishek_sts8@yahoo.com media: em28xx: fix use-after-free in em28xx_v4l2_open()

Fan Wu fanwu01@zju.edu.cn media: mediatek: vcodec: fix use-after-free in encoder release path

Ruslan Valiyev linuxoid@gmail.com media: vidtv: fix nfeeds state corruption on start_streaming failure

Breno Leitao leitao@debian.org mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()

Ritesh Harjani (IBM) ritesh.list@gmail.com mm/kasan: fix double free for kasan pXds

Srinivas Kandagatla srinivas.kandagatla@oss.qualcomm.com ASoC: qcom: q6apm: move component registration to unmanaged version

Sean Christopherson seanjc@google.com KVM: x86: Use scratch field in MMIO fragment to hold small write values

Linus Torvalds torvalds@linux-foundation.org x86-64/arm64/powerpc: clean up and rename __copy_from_user_flushcache

Linus Torvalds torvalds@linux-foundation.org x86: rename and clean up __copy_from_user_inatomic_nocache()

Linus Torvalds torvalds@linux-foundation.org x86-64: rename misleadingly named '__copy_user_nocache()' function

Sasha Levin sashal@kernel.org checkpatch: add support for Assisted-by tag

Matthew Wilcox (Oracle) willy@infradead.org mm: call ->free_folio() directly in folio_unmap_invalidate()

Sean Christopherson seanjc@google.com KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION

Sean Christopherson seanjc@google.com KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish

Sean Christopherson seanjc@google.com KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created

Sean Christopherson seanjc@google.com KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock

Sean Christopherson seanjc@google.com KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU

Sean Christopherson seanjc@google.com KVM: selftests: Remove duplicate LAUNCH_UPDATE_VMSA call in SEV-ES migrate test

Koichiro Den den@valinux.co.jp PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown

Koichiro Den den@valinux.co.jp PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup

ZhengYuan Huang gality369@gmail.com ocfs2: handle invalid dinode in ocfs2_group_extend

Tejas Bharambe tejas.bharambe@outlook.com ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY

Joseph Qi joseph.qi@linux.alibaba.com ocfs2: fix possible deadlock between unlink and dio_end_io_write

Ruslan Valiyev linuxoid@gmail.com media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections

Ryan Roberts ryan.roberts@arm.com arm64: mm: Handle invalid large leaf mappings correctly

Michał Winiarski michal.winiarski@intel.com vfio/xe: Reorganize the init to decouple migration from reset

Zhihao Cheng chengzhihao1@huawei.com dcache: Limit the minimal number of bucket to two

Harin Lee me@harin.net ALSA: ctxfi: Limit PTP to a single page

SeongJae Park sj@kernel.org Docs/admin-guide/mm/damon/lru_sort: warn commit_inputs vs param updates race

SeongJae Park sj@kernel.org Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race

Fabio Porcedda fabio.porcedda@gmail.com USB: serial: option: add Telit Cinterion FN990A MBIM composition

Alistair Popple apopple@nvidia.com selftests/mm: hmm-tests: don't hardcode THP size to 2MB

Junrui Luo moonafterrain@outlook.com staging: sm750fb: fix division by zero in ps_to_hz()

Johan Hovold johan@kernel.org wifi: rtw88: fix device leak on probe failure

Tamir Duberstein tamird@kernel.org scripts: generate_rust_analyzer.py: avoid FD leak

Benjamin Berg benjamin.berg@intel.com scripts/gdb/symbols: handle module path parameters

Greg Kroah-Hartman gregkh@linuxfoundation.org fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO

Xu Yang xu.yang_2@nxp.com usb: port: add delay after usb_hub_set_port_power()

Michael Zimmermann sigmaepsilon92@gmail.com usb: gadget: f_hid: don't call cdev_init while cdev in use

Dave Carey carvsdriver@gmail.com USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen

Daniel Brát danek.brat@gmail.com usb: storage: Expand range of matched versions for VL817 quirks entry

Alexey Charkov alchark@flipper.net usb: typec: fusb302: Switch to threaded IRQ handler

Nathan Rebello nathan.c.rebello@gmail.com usbip: validate number_of_packets in usbip_pack_ret_submit()

Stefan Metzmacher metze@samba.org smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list()

Stefan Metzmacher metze@samba.org smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()

Greg Kroah-Hartman gregkh@linuxfoundation.org ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc

Greg Kroah-Hartman gregkh@linuxfoundation.org ksmbd: require 3 sub-authorities before reading sub_auth[2]

Greg Kroah-Hartman gregkh@linuxfoundation.org ksmbd: validate EaNameLength in smb2_get_ea()

Greg Kroah-Hartman gregkh@linuxfoundation.org smb: client: fix OOB reads parsing symlink error response

Greg Kroah-Hartman gregkh@linuxfoundation.org smb: client: fix off-by-8 bounds check in check_wsl_eas()

Greg Kroah-Hartman gregkh@linuxfoundation.org usb: gadget: renesas_usb3: validate endpoint index in standard request handlers

Greg Kroah-Hartman gregkh@linuxfoundation.org usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()

Greg Kroah-Hartman gregkh@linuxfoundation.org usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()

Greg Kroah-Hartman gregkh@linuxfoundation.org fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO

Greg Kroah-Hartman gregkh@linuxfoundation.org ALSA: fireworks: bound device-supplied status before string array lookup

Greg Kroah-Hartman gregkh@linuxfoundation.org ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0

Greg Kroah-Hartman gregkh@linuxfoundation.org bnge: return after auxiliary_device_uninit() in error path

Greg Kroah-Hartman gregkh@linuxfoundation.org drm/vc4: platform_get_irq_byname() returns an int

Greg Kroah-Hartman gregkh@linuxfoundation.org NFC: digital: Bounds check NFC-A cascade depth in SDD response handler

Greg Kroah-Hartman gregkh@linuxfoundation.org net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()

Greg Kroah-Hartman gregkh@linuxfoundation.org HID: core: clamp report_size in s32ton() to avoid undefined shift

Greg Kroah-Hartman gregkh@linuxfoundation.org HID: alps: fix NULL pointer dereference in alps_raw_event()

Lin YuChen starpt.official@gmail.com staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()

Greg Kroah-Hartman gregkh@linuxfoundation.org i2c: s3c24xx: check the size of the SMBUS message before using it

Samuel Page sam@bynar.io can: raw: fix ro->uniq use-after-free in raw_rcv()

Borislav Petkov (AMD) bp@alien8.de x86/CPU: Fix FPDSS on Zen1

Junxi Qian qjx1298677004@gmail.com nfc: llcp: add missing return after LLCP_CLOSED checks

-------------

Diffstat:

Documentation/admin-guide/mm/damon/lru_sort.rst | 4 ++ Documentation/admin-guide/mm/damon/reclaim.rst | 4 ++ Makefile | 4 +- arch/arm64/include/asm/pgtable-prot.h | 2 + arch/arm64/include/asm/pgtable.h | 9 ++- arch/arm64/include/asm/uaccess.h | 2 +- arch/arm64/mm/mmu.c | 4 ++ arch/arm64/mm/pageattr.c | 50 +++++++------ arch/arm64/mm/trans_pgd.c | 42 ++--------- arch/powerpc/include/asm/uaccess.h | 3 +- arch/powerpc/lib/pmem.c | 11 +-- arch/x86/include/asm/msr-index.h | 3 + arch/x86/include/asm/uaccess.h | 2 +- arch/x86/include/asm/uaccess_32.h | 8 +-- arch/x86/include/asm/uaccess_64.h | 16 +++-- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kvm/svm/sev.c | 46 ++++++++---- arch/x86/kvm/x86.c | 14 +++- arch/x86/lib/copy_user_uncached_64.S | 6 +- arch/x86/lib/usercopy_32.c | 9 +-- arch/x86/lib/usercopy_64.c | 12 ++-- drivers/gpu/drm/i915/i915_gem.c | 2 +- drivers/gpu/drm/qxl/qxl_ioctl.c | 2 +- drivers/gpu/drm/vc4/vc4_hdmi.c | 14 ++-- drivers/hid/hid-alps.c | 3 + drivers/hid/hid-core.c | 3 + drivers/hwmon/powerz.c | 8 ++- drivers/i2c/busses/i2c-s3c2410.c | 7 +- drivers/infiniband/sw/rdmavt/qp.c | 8 +-- drivers/md/bcache/super.c | 7 ++ .../mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c | 9 +++ drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_channel.c | 4 ++ drivers/media/test-drivers/vidtv/vidtv_mux.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_ts.c | 48 ++++++------- drivers/media/test-drivers/vidtv/vidtv_ts.h | 4 +- drivers/media/usb/as102/as102_usb_drv.c | 2 + drivers/media/usb/em28xx/em28xx-video.c | 14 ++-- drivers/media/usb/hackrf/hackrf.c | 7 +- drivers/net/ethernet/broadcom/bnge/bnge_auxr.c | 1 + drivers/net/usb/cdc-phonet.c | 7 +- drivers/net/wireguard/device.c | 8 +-- drivers/net/wireless/realtek/rtw88/usb.c | 3 +- drivers/ntb/ntb_transport.c | 7 +- drivers/pci/endpoint/functions/pci-epf-vntb.c | 20 +----- drivers/staging/rtl8723bs/core/rtw_security.c | 2 +- drivers/staging/sm750fb/sm750.c | 3 + drivers/usb/class/cdc-acm.c | 53 ++++++++++++-- drivers/usb/core/port.c | 1 + drivers/usb/gadget/function/f_hid.c | 15 ++-- drivers/usb/gadget/function/f_ncm.c | 4 +- drivers/usb/gadget/function/f_phonet.c | 9 +++ drivers/usb/gadget/udc/renesas_usb3.c | 7 +- drivers/usb/serial/option.c | 2 + drivers/usb/storage/unusual_devs.h | 7 +- drivers/usb/typec/tcpm/fusb302.c | 5 +- drivers/usb/usbip/usbip_common.c | 12 ++++ drivers/vfio/pci/xe/main.c | 43 ++++++----- drivers/video/fbdev/tdfxfb.c | 3 + drivers/video/fbdev/udlfb.c | 3 + fs/dcache.c | 4 +- fs/nilfs2/dat.c | 3 + fs/ocfs2/aops.c | 3 +- fs/ocfs2/mmap.c | 7 +- fs/ocfs2/ocfs2_trace.h | 10 ++- fs/ocfs2/resize.c | 10 ++- fs/smb/client/smb2file.c | 20 +++--- fs/smb/client/smb2inode.c | 2 +- fs/smb/client/smbdirect.c | 8 +++ fs/smb/server/connection.c | 1 + fs/smb/server/smb2pdu.c | 7 +- fs/smb/server/smbacl.c | 3 +- fs/smb/server/transport_rdma.c | 8 ++- include/linux/hugetlb.h | 17 +++++ include/linux/kvm_host.h | 10 ++- include/linux/uaccess.h | 11 ++- lib/iov_iter.c | 4 +- mm/backing-dev.c | 5 +- mm/filemap.c | 3 +- mm/internal.h | 1 - mm/kasan/init.c | 8 +-- mm/truncate.c | 6 +- mm/userfaultfd.c | 2 +- net/can/raw.c | 11 ++- net/nfc/digital_technology.c | 6 ++ net/nfc/llcp_core.c | 2 + scripts/checkpatch.pl | 10 +++ scripts/gdb/linux/symbols.py | 2 +- scripts/generate_rust_analyzer.py | 3 +- sound/firewire/fireworks/fireworks_command.c | 5 +- sound/pci/ctxfi/ctvmem.h | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 14 +++- sound/usb/6fire/chip.c | 17 +++-- sound/usb/usx2y/us144mkii.c | 6 +- tools/objtool/check.c | 2 +- .../testing/selftests/kvm/x86/sev_migrate_tests.c | 2 - tools/testing/selftests/mm/hmm-tests.c | 83 +++++----------------- 97 files changed, 579 insertions(+), 358 deletions(-)