-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 24 Aug 2026 22:05:50 +0200
Source: linux-signed-amd64
Architecture: source
Version: 6.12.105+1
Distribution: trixie-security
Urgency: high
Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Changes:
linux-signed-amd64 (6.12.105+1) trixie-security; urgency=high
.
* Sign kernel from linux 6.12.105-1
.
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.102
- [amd64] x86/bugs: Make Safe-RET robust against interrupt injection
(CVE-2026-68480)
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.103
- netfilter: nf_conntrack_expect: restore helper propagation via expectation
- netfilter: br_netfilter: Reallocate headroom if necessary in
neigh_hh_bridge()
- net: mpls: initialize rtm_tos in mpls_getroute()
- HID: logitech-dj: Standardise hid_report_enum variable nomenclature
- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB
write
- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report
- bpf: Reset register bounds before narrowing retval range in
check_mem_access()
- netconsole: avoid OOB reads, msg is not nul-terminated (CVE-2026-43197)
- [amd64] thunderbolt: Prevent XDomain delayed work use-after-free on
disconnect
- [arm64] pinctrl: qcom: Unconditionally mark gpio as wakeup enable
- [arm64] pinctrl: qcom: sc8280xp: Add missing wakeup entries for
GPIO143/151
- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
- [amd64] dmaengine: idxd: fix fdev setup failure cleanup in
idxd_cdev_open()
- gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe()
- ata: sata_mv: accept 1 or 2 resources in platform probe
- ata: libahci_platform: support non-consecutive port numbers
- ahci: Introduce ahci_ignore_port() helper
- ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup
- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup
- of: reserved_mem: Add code to dynamically allocate reserved_mem array
- of: reserved_mem: prevent OOB when too many dynamic regions are defined
- btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag
- btrfs: zoned: fix deadlock between metadata writeback and transaction
commit
- [arm64] phy-zynqmp: Postpone getting clock rate until actually needed
- [arm64] phy: zynqmp: fix clock error handling in xpsgtr_phy_init()
- [arm64] phy: zynqmp: fix runtime PM leak on probe allocation failure
- netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in
sip_help_tcp()
- [arm64] drm/mediatek: Check CRTC state before freeing
- Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep
annotation
- KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type
- keys: fix out-of-bounds read in keyring_get_key_chunk()
- keys: make keyring key-chunk byte order agree with keyring_diff_objects()
- assoc_array: trim the final shortcut word using the current chunk end
- netfilter: nf_tables: make nft_object rhltable per table
- netfilter: xt_hashlimit: validate hashtable supports
XT_HASHLIMIT_RATE_MATCH
- ipvs: fix the checksum validations
- ipvs: fix places with wrong packet offsets
- ipvs: do not mangle ICMP replies for non-first fragments
- netfilter: nft_payload: fix mask build for partial field offload
- rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled
(CVE-2026-68322)
- rds: tcp: hold the RCU lock across ipv6_chk_addr() in
rds_tcp_laddr_check()
- [amd64,arm64] pinctrl-amd: Don't clear S4 wake bits at probe
- scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
- scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection
buffer
- scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
- smb: client: fix buffer leaks in SMB1 read and write
- spi: spi-cadence: supports transmission with bits_per_word of 16 and 32
- spi: spi-cadence: Move TX FIFO full busy-wait into FIFO
- hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
- hwmon: (ina2xx) Add support for has_alerts configuration flag
- hwmon: (ina2xx) Add support for INA260
- hwmon: (ina226) Add support for SY24655
- hwmon: (ina2xx) Make it easier to add more devices
- hwmon: (ina2xx) Add support for INA234
- hwmon: (ina2xx) Shift INA234 shunt and current registers
- hwmon: (ina2xx) Fix various overflow issues
- hwmon: (ltc4282) Fix reading the minimum alarm voltage
- hwmon: (sht3x) Fix unaligned accesses
- hwmon: (lm90) Only report alarms if driver is ready
- hwmon: (nzxt-smart2) DMA-align output buffer
- net: do not send ICMP/NDISC Redirects when peer allocation fails
- hwmon: (nct6775-core) Prevent access to unsupported weight registers
- net: bridge: mrp: fix Option TLV length in MRP_Test frames
- forcedeth: fix UAF of txrx_stats in nv_remove
- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
- hwmon: (adt7470) Fix cache updated before hardware write on I2C error
- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()
- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks
- hwmon: (adt7470) Use cached PWM frequency value
- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
- hwmon: (adt7470) Fix PWM auto temp state array and bounds check
- rtase: fix double free of multi-frag skb on DMA map failure
- [powerpc*] boot: Fix simpleboot CPU node lookup check
- [powerpc*] boot: Fix treeboot-currituck CPU node lookup check
- [powerpc*] boot: Fix treeboot-akebono CPU node lookup check
- net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
- wifi: mac80211: validate individual TWT params before driver setup
- net: ethernet: mtk_eth_soc: support named IRQs
- net: ethernet: mtk_eth_soc: add consts for irq index
- net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in
poll_controller
- hwmon: (pmbus) Fix return value from pmbus_update_byte_data()
- [amd64,arm64] idpf: adjust TxQ ring count minimum
- [amd64,arm64] idpf: Fix mailbox IRQ name leak on request failure
- Bluetooth: ISO: clear iso_data always when detaching conn from hcon
- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos
- Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis()
- Bluetooth: ISO: fix leaking sk after socket release
- Bluetooth: ISO: avoid deadlocks in iso_sock_timeout
- Bluetooth: btintel: Validate length before parsing diagnostics TLV
- Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists
- Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
- Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync
- net: phylink: put link_gpio if phylink_create fails
- scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
- scsi: ufs: core: Cancel RTC work in active-active suspend
- scsi: zfcp: Fix memory leak during adapter release by destroying
gid_pn_req
- scsi: target: Clear cmd_cnt when initial counter enrollment fails
- net: sxgbe: free TX rings on RX allocation failure
- net: sxgbe: check descriptor ring allocation failures
- can: isotp: check register_netdevice_notifier() error in module init
- tracing/mmiotrace: Reset dropped_count in mmio_reset_data()
- tracing: Remove TRACE_EVENT_FL_FILTERED logic
- tracing/mmiotrace: Remove reference to unused per CPU data pointer
- tracing/mmiotrace: Add NULL check for mmio_trace_array in logging
functions
- [riscv64] mm: Fix out-of-bounds page-table walk during memory hot-remove
- [arm64] net: dsa: mt7530: check bus->read() errors in the MDIO regmap
backend
- [arm64] net: dsa: mt7530: error out on failed reads in MT7531 PHY polling
- net: libwx: fix FDIR ATR queue mismatch for software VLAN packets
- [arm64] octeontx2-pf: Set correct sequence for carrier off and tx queue
stop
- sched/deadline: Use revised wakeup rule only for running dl_server
- qede: sync udp_tunnel ports outside qede_lock in the recovery path
- ksmbd: return success for deferred final close
- ksmbd: fix use-after-free in __close_file_table_ids()
- pinctrl: devicetree: don't free uninitialized dev_name on error path
- erofs: cap LZMA stream pool size
- pinctrl: bm1880: add missing select GENERIC_PINCONF
- fortify: Disable -Wstringop-overread in tests
- mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
- fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes
- mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
- mm/hugetlb: fix list corruption in allocate_file_region_entries()
- mm/vmstat: fold stranded per-cpu node stats when a node comes online
- tracing/probes: Reject $arg0 in meta argument expansion
- [amd64] KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while
L2 is active
- [s390x] KVM: s390: pci: Reject adapter interrupt forwarding if already
enabled
- [s390x] KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
- [s390x] KVM: s390: pci: Validate AIBV and AISB before pinning guest pages
- sctp: validate Adaptation Indication parameter length
- audit: fix potential integer overflow in audit_log_n_string()
- audit: fix potential use-after-free in audit_del_rule()
- Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()
- Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()
- Bluetooth: mgmt: fix pending command UAF in EIR updates
- Bluetooth: mgmt: fix UAF in pair command cancellation
- Bluetooth: hci_sync: Fix advertising data UAFs
- Bluetooth: HIDP: reject frames without a transaction header
- Bluetooth: HIDP: validate numbered report payloads
- bpf: lwt: Fix dst reference leak on reroute failure
- ALSA: 6fire: Fix UAF at error handling during probe
- ALSA: lx6464es: fix period byte count for 16-bit streams
- ALSA: pcm: wake linked drain waiters on unlink
- ALSA: seq: Fix division by zero in initialize_timer()
- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes
- ALSA: ump: fix double free of out_cvts on rawmidi error
- ASoC: tas2562: fix DVC coefficient write order
- ASoC: tas2562: fix broken entries in the volume lookup table
- ata: libata-eh: Increase STANDBY IMMEDIATE timeout
- ata: libata-sata: fix ata_scsi_lpm_supported() iteration
- ALSA: usb-audio: fix use-after-free in ump_to_endpoint()
- ALSA: usb-audio: fix stack info leak in RME Digiface status
- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
- ALSA: usb-audio: Clamp frame size in implicit-feedback mode
- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
- e1000: fix memory leak in e1000_probe()
- igbvf: Fix leak in TX DMA error cleanup
- ipvs: do not propagate one-packet flag to synced conns
- net/smc: fix socket use-after-free during link group termination
- netfilter: ipset: do not update comments from kernel-side hash adds
- tipc: avoid use-after-free in poll trace queue dumps
- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames
- binfmt_misc: reject a flag character as the field delimiter
- binfmt_misc: don't let an 'F' entry pin its own instance
- mm/page_reporting: use system_freezable_wq to fix UAF during suspend
- mm: memcg: initialize *locked in memcg1_oom_prepare() stub
- net: bridge: stop fast-leave after deleting a port group
- net: ipv6: clear suppressed fib6 rule result
- [powerpc*] ps3: Fix map failure path in dma_ioc0_map_pages()
- veth: convert frag_list skbs before running XDP
- vxlan: re-fetch eth header after route_shortcircuit()
- vxlan: unclone skb head before modifying eth header in
route_shortcircuit()
- vxlan: use neigh_ha_snapshot() in route_shortcircuit()
- vxlan: use pskb_network_may_pull() in route_shortcircuit()
- ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()
- tracing: Check return value of __register_event() in
trace_module_add_events()
- tracing/filters: Fix false positive match in regex_match_full()
- spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure
- scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
- sctp: reject stale cookies with mismatched verification tags
- sctp: prevent peer transport count overflow
- hwmon: (npcm750-pwm-fan): stop fan timer on device detach
- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client
- i2c: amd-mp2: Unregister callback on adapter add failure
- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure
- cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
- cpufreq: schedutil: Publish util hooks only after all sg_cpu are
initialized
- power: supply: bq25890: fix the -10 C NTC lookup entry
- power: supply: max17040: handle missing status supplier
- [s390x] pci: Fix s390_pci_mmio_write syscall error return without MIO
- [s390x] qeth: Check CAP_NET_ADMIN for private ioctls
- [s390x] dasd: Fix potential NULL pointer dereference
- [s390x] dasd: Fix undersized format-check buffer
- [s390x] zcrypt: Fix wrong domain value verification with EP11 CPRBs
- [s390x] zcrypt: Validate length for CCA AES cipher key requests
- [s390x] zcrypt: Validate length for CCA ECC private key requests
- [arm64] phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
- [arm64] phy: zynqmp: use read-modify-write for SERDES scrambler bypass
- [arm64] phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
- net: openvswitch: fix potential UAF on meter attach failure
- net: openvswitch: fix skb leak on flow key update failure during
recirculation
- net: openvswitch: fix skb leak on flow key update failure during ct
- ice: wait for reset completion in ice_resume()
- ice: fix memory leak in ice_lbtest_prepare_rings()
- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock
deadlock
- i2c: iproc: reset bus after timeout if START_BUSY is stuck
- i2c: imx: Fix slave registration race and error handling
- i2c: imx: Cancel hrtimer before clearing slave pointer
- can: c_can: c_can_chip_config(): keep controller in init mode until
bittiming is configured
- can: ems_usb: validate CPC message lengths
- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB
resubmit failure
- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb
allocation failure
- can: j1939: transport: j1939_session_fresh_new(): initialize receive
buffer
- can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking
- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in
kvaser_usb_hydra_get_busparams()
- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received
command extents
- can: softing: fw_parse(): validate firmware record spans
- can: peak_usb: add bounds check for USB channel index
- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB
submit error
- can: peak_usb: validate uCAN receive record lengths
- can: ctucanfd: add missing MODULE_DEVICE_TABLE()
- can: ctucanfd: use self-test mode for PRESUME_ACK
- can: ctucanfd: unmap BAR0 using base address
- can: ctucanfd: handle bus error interrupts
- can: ctucanfd: mark error-active controller status valid
- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs
- [arm*] drm/vc4: Supply the overflow slot size in BPOS, not the whole bin
BO size
- [arm*] drm/vc4: Zero the tile state data array before each BIN job
- [arm64] drm/panthor: reject firmware sections with oversized data
- [arm64] drm/panthor: validate firmware interface structure sizes
- [arm64] drm/mediatek: ovl_adaptor: balance component registrations
- drm/amdgpu: restore UMD profile pstate after runtime resume
- drm/amdgpu: cap GTT size to physical RAM on APUs
- drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
- drm/amd/display: use proper context for logging
- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
- drm/amdkfd: fix QID bit leak in pqm_create_queue()
- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
- drm/amdkfd: Handle invalid event type in CRIU event restore
- drm/amdkfd: hold event_mutex while checkpointing CRIU events
- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
- drm/vmwgfx: reject DX_BIND_QUERY without a DX context
- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
- drm/vmwgfx: bound DMA command body size against suffix pointer
- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
- drm/vmwgfx: use check_add_overflow for shader size+offset bound
- drm/vmwgfx: validate external BO copy bounds for both stride paths
- spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX
- HID: logitech-dj: Fix maxfield check in DJ short report validation
- ata: libahci_platform: Do not set mask_port_map when not needed
- ata: ahci: Make ahci_ignore_port() handle empty mask_port_map
- of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array()
fails
- Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release
- drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting
- drm/xe: Introduce xe_gt_dbg_printer()
- drm/xe: Apply whitelist to engine save-restore
- drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists
(CVE-2026-68267)
- drm/xe/rtp: Maintain OA whitelists separately
- drm/xe/rtp: Keep track of non-OA nonpriv slots
- drm/xe/rtp: Generalize whitelist_apply_to_hwe
- drm/xe/rtp: Save OA nonpriv registers to register save/restore lists
- drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs
- drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt
- drm/xe/oa: (De-)whitelist OA registers on OA stream open/release
- drm/xe/rtp: Ensure locking/ref counting for OA whitelists
- mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
- fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes
- mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
- lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled()
- mm/slab: prevent unbounded recursion in free path with new kmalloc type
- gpio: pch: use raw_spinlock_t for the register lock
- usb: gadget: f_tcm: synchronize delayed set_alt with teardown
(CVE-2026-68367)
- usb: typec: ucsi: split connector lock classes
- usb: typec: ucsi: Fix race condition and ordering in port unregistration
- media: i2c: imx219: Rename VTS to FRM_LENGTH
- media: imx219: Fix maximum frame length in lines
- media: chips-media: wave5: Support CBP profile
- media: uapi: rkisp: Correct name version enum
- wifi: brcmfmac: drain bus_reset work on device removal (CVE-2026-64586)
- wifi: ath6kl: fix use-after-free in aggr_reset_state() (CVE-2026-68198)
- wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW)
- wifi: brcmfmac: set F2 blocksize to 256 for BCM43752
- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change
- mptcp: pm: avoid code duplication to lookup endp
- mptcp: add mptcp_userspace_pm_lookup_addr helper
- mptcp: pm: use addr entry for get_local_id
- mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)
- drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions
- drm/amdgpu: Fix context pstate override handling (CVE-2026-68273)
- drm/sched: Store the drm client_id in drm_sched_fence
- drm/amdgpu: give each kernel job a unique id
- drm/amdgpu/gfx: fix cleaner shader IB buffer overflow (CVE-2026-68276)
- drm/fb-helper: Allocate and release fb_info in single place
- drm/tegra: fbdev: Remove offset into framebuffer memory
- drm/exec: Remove the index parameter from
drm_exec_for_each_locked_obj[_reverse]
- drm/xe: Wait on external BO kernel fences in exec IOCTL
- [arm64] drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable()
- [arm64] drm/i915/vrr: require valid min/max vfreq for VRR (CVE-2026-68254)
- drm/xe: Rename ___xe_bo_create_locked()
- drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266)
- [arm64] drm/i915/hdcp: Move to using intel_display in intel_hdcp
- [arm64] drm/i915/hdcp: require monotonically increasing seq_num_v
- [arm64] drm/i915/hdcp: Skip inactive MST connectors when building stream
list
- [arm64] drm/i915/hdcp: check streams[] bounds before overflow
(CVE-2026-68253)
- drm/xe: Stub out new pagefault layer
- drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)
- rxrpc: Generate rtt_min
- rxrpc: Adjust the rxrpc_rtt_rx tracepoint
- rxrpc: Fix the calculation and use of RTO
- rxrpc: Manage RTT per-call rather than per-peer
- rxrpc: Fix irq-disabled in local_bh_enable() (CVE-2025-38525)
- can: use skb hash instead of private variable in headroom
- can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
- usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
- drm/fb-helper: Fix a locking bug in an error path
- [arm64,armhf] drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.104
- mount: honour SB_NOUSER in the new mount API
- drm/amd/display: Add AV mute wait frames to dce110_set_avmute
- drm/amd/display: Check for tg ops in dce110_set_avmute
- [s390x] zcrypt: Fix missing mem scrub at clear key import in
cca_clr2cipherkey()
- NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
- [arm64] dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer
- drm/bridge: ps8640: propagate AUX transfer register errors
- [arm64] net: hns3: fix speed configuration residue after driver reload
- Revert "net: thunderbolt: Enable end-to-end flow control also in transmit"
- bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
- enic: fix tx_hang_reset use-after-free on device removal
- net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock
- pds_core: keep the health thread stopped during reset
- pds_core: cancel pending PCI reset work on AER recovery
- netfilter: ipset: switch ext_size to atomic64_t
- ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
- ipvs: return the csum validation for forward hook
- watchdog: bd96801_wdt: Fix timeout for enabled WDG
- btrfs: fix memory leak in btrfs_do_encoded_write()
- bpf: Preserve pointer state for commuted arithmetic
- net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in
smc_llc_event_handler()
- net/sched: cls_route: fix fastmap use-after-free on filter
- [arm64] net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
- devlink: fix net namespace reference leak in reload
- net/mlx5: fw_tracer, return NULL on create error
- counter: microchip-tcb-capture: Fix DT channel validation
- bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch
- bpf: tcp: Make sure iter->batch always contains a full bucket snapshot
- bpf: tcp: Get rid of st_bucket_done
- bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items
- bpf: tcp: Avoid socket skips and repeats during iteration
- bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
- vhost/vdpa: reject overflowing PA map page counts on 32-bit
- vdpa/mlx5: Fix buffer length in create_direct_keys()
- tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss()
- xsk: require at least 16 bytes of TX metadata
- udp: fix potential use-after-free in tunnel segmentation
- net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
- net/openvswitch: check Ethernet header length in key_extract()
- net/sched: cls_api: Always acquire rtnl_lock when destroying locked
classifiers
- hwmon: (nzxt-smart2) Check return value of init_device() in probe
- hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations
- bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss()
- bnxt_en: Determine and store default RX ring in vnic structure
- bnxt_en: Refresh VNIC default ring on queue restart if needed
- bnxt_en: Fix PTP PPS setting bug
- sctp: fix addip_serial increment on ASCONF_ACK allocation failure
- tcp: fix TFO max_qlen accounting across reuseport migration
- net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
- net: prestera: validate firmware header length
- net: remove WARN_ON_ONCE() from sk_mc_loop()
- net/smc: fix TOCTOU race between smc_listen_out() and listener close
- [amd64] net: thunderbolt: Tear down DMA paths before stopping the rings
- ata: pata_sl82c105: fix bridge revision use-after-free
- net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
- sctp: clear control chunk transport if it is being removed
- tls: don't abort the connection on signal-interrupted sends
- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string
termination
- hwmon: (ads7828) Fix external VREF regulator handling
- hwmon: (ltc4282) Avoid overflow in maximum power calculation
- hwmon: (ltc4282) Clamp negative current limits
- hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt
- mm/vmscan: wake up flushers conditionally to avoid cgroup OOM
(Closes: #1143545)
- net: fec: do not release NULL pages when RX buffer allocation fails
- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
- mtd: spinand: fix direct mapping creation sizes
- mtd: spinand: try a regular dirmap if creating a dirmap for continuous
reading fails
- mtd: spinand: repeat reading in regular mode if continuous reading fails
- swapfile: call cond_resched() before locking si->lock
- Input: evdev - sanitize event type index when fetching event masks
- ALSA: usb-audio: fix OOB write on Type II inbound URBs
- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
- [amd64] thunderbolt: icm: Preserve USB4 proxy data-valid bit
- usb: cdnsp: fix incorrect endian conversions for APB timeout register
- usb: gadget: f_ncm: Use unsigned int for ndp_index
- net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
- net: usb: ipheth: fix carrier_work UAF on disconnect
- vt: add permission check for KDSKBMETA ioctl
- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
- Input: evdev - fix information leak in evdev_pass_values()
- ima: fix out-of-bounds read in xattr_verify()
- ipvs: stop estimator after disabled calc phase
- ipvs: add totalconns for dest
- ipvs: properly update the overload flag on dest edit
- ipvs: clear IPv4 options after rebasing tunnel ICMP errors
- packet: use consistent hard_header_len in non-ring send paths
- packet: use consistent hard_header_len in TX_RING send path
- net/packet: reset the MAC header on the packet-socket transmit path
- packet: synchronize pressure clearing with ring reconfiguration
- net: fix skb length accounting after generic XDP frag adjustment
- net: openvswitch: reallocate update replies for mismatched IDs
- net/sched: reject overly deep qdisc hierarchies
- net: octeontx2-pf: Fix UB in shift operation
- net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
- mac802154: fix netdev use-after-free in beacon worker
- netfilter: ebt_nflog: pin the NFLOG backend
- net: bridge: mrp: fix uninitialised bytes on the wire
- [s390x] KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
(CVE-2026-74514)
- [s390x] KVM: s390: pci: Fix missing error codes and memory unaccounting
- [s390x] KVM: s390: pci: Fix resource leak on IRQ registration failure
- [s390x] KVM: s390: pci: Fix aisb calculation
- block: Reorder the request allocation code in blk_mq_submit_bio()
- blk-mq: pop cached request if it is usable (CVE-2026-64017)
- blk-mq: reinsert cached request to the list
- dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk
- [amd64] crypto: ccp - Add new SEV/SNP platform shutdown API
- [amd64] KVM: SVM: Add support to initialize SEV/SNP functionality in KVM
- [amd64] crypto: ccp - Fix checks for SNP_VLEK_LOAD input buffer length
- [amd64] crypto: ccp - Abort doing SEV INIT if SNP INIT fails
- futex: Prevent robust futex exit race some more
- kunit/fortify: Replace "volatile" with OPTIMIZER_HIDE_VAR()
- kunit/fortify: Add back "volatile" for sizeof() constants
- pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
- ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
- ipv4: fix use-after-free in fib_nhc_update_mtu()
- mei: pull kvfree out of spinlock
- nvmem: layouts: Add fixed-layout driver
- serial: qcom-geni: fix TX DMA buffer flush
- serial: 8250_dma: Clear stale RX state on shutdown
- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
- staging: rtl8723bs: fix OOB read in WMM_param_handler()
- staging: rtl8723bs: fix missing shared-key auth challenge length check
- staging: rtl8723bs: validate monitor transmit frame lengths
- misc: fastrpc: fix channel ctx ref leak when session alloc fails
- misc: fastrpc: Remove buffer from list prior to unmap operation
- misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
- ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
- ALSA: usx2y: bound the hwdep mmap fault offset
- tracing: Fix race between update_event_fields and, event_define_fields
- fbdev: bitblit: bound-check glyph index in bit_cursor()
- ring-buffer: Prevent subbuf order change when resizing is disabled
- mm/huge_memory: fix huge_zero_pfn race
- net: smc: fix splice entry lifetime imbalance in smc_rx_splice
- ipv6: prevent in6_dev_get() from resurrecting inet6_dev
- netfilter: bridge: release template ct on non-IP path
- netfilter: nf_conntrack: defer invalid log until after unlock
- net: atlantic: free stranded TX buffers on ring deinit
- net: atlantic: free RX pages of consumed but not refilled buffers
- net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
- net/sched: act_gact, act_police: range check the fallback control action
- ovl: don't warn when the mount is completed from another user namespace
- binfmt_misc: don't warn when the mount is completed from another user
namespace
- Revert "drm/amdgpu: fix aperture mapping leak"
- xdp: reject clones that overrun skb_shared_info tailroom
- vxlan: do not arm the ageing timer on a device that is down
- vsock/virtio: read virtqueues under worker locks
- vsock/virtio: avoid refilling the RX queue after teardown
- veth: fix skb length accounting after XDP frag adjustment
- vhost: reset the vring metadata cache on vring reconfiguration
- tls: don't leave a full plaintext sk_msg ring unpushed
- tipc: read le->link under the node lock in tipc_node_link_down()
- smb: client: Fix use-after-free in cifs_try_adding_channels()
- [amd64] KVM: x86/mmu: WARN and clear role.invalid when creating a child
shadow page
- eventfs: Fix use-after-free in eventfs_remove_rec()
- Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
- ptp: ocp: Fix board ID over-read
- ipv6: fix Route Information option length validation
- ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
- fscrypt: use the mount idmap for the owner check in
fscrypt_ioctl_set_policy()
- sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
- ima: Instantiate file_truncate and path_truncate hooks
- fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
- fsverity: Fix silent truncation in bpf_get_fsverity_digest()
- bpf, sockmap: Fix sk_redir use-after-free in send verdict
- scsi: scsi_debug: Negate wrapped memcmp() result
- sctp: keep chunk->transport in step with the list it is queued on
- sctp: fix use-after-free of cached ASCONF chunk
- sctp: clear new_transport when removing a peer
- [amd64] thunderbolt: Bound the DROM dual link port number before indexing
sw->ports
- [amd64] thunderbolt: Fix bandwidth group reservation indexing
- bpf: tcp: fix double sock release on batch realloc
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.105
- block: stop the timeout timer when releasing a never added disk
- bpf: Fix linked reg delta tracking when src_reg == dst_reg
(CVE-2026-53092)
- bpf: Clear delta when clearing reg id for non-{add,sub} ops
- f2fs: fix UAF issue in f2fs_merge_page_bio() (CVE-2025-40054)
- mtd: ubi: skip programming unused bits in ubi headers
- ubi: fastmap: fix ubi->fm memory leak
- mm/damon/ops-common: putback folios on invalid migrate nid
(CVE-2026-74644)
- mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD}
- igc: fix netdev not re-attached after resume if interface is down
- ipvs: separate destination availability state
- net: mana: Fix EQ leak in mana_remove on NULL port
- [amd64] crypto: ccp: Add external API interface for PSP module
initialization
- [amd64] KVM: SVM: Ensure PSP module is initialized if KVM module is
built-in
- selinux: require every boolean value to be defined
- selinux: reject a class permission count below its inherited common
- selinux: do not cancel a policy conversion that never started
- selinux: reject an unclaimed class value in security_get_classes()
- mptcp: avoid combining some incoming suboptions
- mptcp: options: reset DSS fields in case of unexpected size
- mptcp: fastopen: only mark MPTFO subflows with SYN data
- [s390x] qeth: validate user buffer length in SNMP and ARP query ioctls
- [amd64] ASoC: SOF: sof-audio: Fix error path in
sof_widget_setup_unlocked()
- fbdev: core: Fix pointer desynchronization in fb_io_read()
- drm/panthor: skip zero-sized firmware sections
- drm/amdgpu: reject oversized IBs with per-ring packet limits
- drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12
- drm/amdgpu: fix aperture iounmap skipped on device removal
- [amd64] ASoC: SOF: topology: Use acpi mach from the machine driver
- Input: xpad - add support for ZENAIM LEVERLESS
- Input: cs40l50-vibra - validate custom data from user space
- [powerpc*] pseries: pci - logic bug
- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
- Input: psxpad-spi - set driver data before use
- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
- Input: iforce - validate input packet lengths
- [powerpc*] pseries: lparcfg - fix kbuf[] underflow
- Input: synaptics-rmi4 - zero report size on F54 work error
- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
- Input: synaptics-rmi4 - block s_input when F54 queue is busy
- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
- Input: hynitron_cstxxx - validate touch count and finger IDs
- [arm64] crypto: qce - fix error path in devm_qce_register_algs
- gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on
unbind
- [arm64] pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state
0
- libceph: fix multiple unsafe decodes in decode_locker()
- ftrace: Protect direct_functions in ftrace_find_rec_direct
- ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
- Input: sur40 - fix input device registration ordering
- Input: sur40 - fix V4L error path cleanup
- libceph: Avoid using invalid osd indices from primary_temp
- ceph: fix MDS random selection readiness predicate
- libceph: tolerate addrvecs with multiple entries of the same type
- [armhf] mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on
32-bit
- mmc: sdhci: unmap the bounce buffer before device release
- mmc: sdhci: make tuning_err a signed int
- drm/connector/hdmi: Fix out of bounds memory read
- drm/xe: Order ring writes before ring tail updates
- drm/radeon: fix autosuspend cleanup during teardown
- [s390x] vfio_ccw: Free all memory if cp_init() fails
- [s390x] vfio_ccw: Limit the number of channel program segments
- [s390x] vfio_ccw: Cancel existing workqueues
- [s390x] vfio_ccw: Ensure index for read/write regions are within range
- [s390x] vfio_ccw: Ensure first IDAW remains constant
- [s390x] vfio_ccw: Fix out of bounds check on CCW array
- [s390x] vfio_ccw: Move cp cleanup out of not operational
- [s390x] vfio_ccw: Selectively expand io_mutex
- [s390x] vfio_ccw: Calculate idal length based on idaw type
- [s390x] vfio_ccw: Implement a crw lock
- drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix
- drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE
- drm/amdgpu: Reject UVD message with invalid number of h265 refs
- drm/amdgpu: fix nbif 6.3.1 l1 low power not functional
- drm/amdgpu: check ASPM on the dGPU host link
- drm/amdgpu: validate GEM_CREATE domain combinations
- drm/amdgpu: Reject UVD message with dimensions above 4096
- drm/amdgpu: Implement insert_end for VCE 3
- drm/amdgpu: Fix UVD min buffer sizes
- drm/amdgpu: Fix UVD dpb min size calculation for H264
- drm/amdgpu: Fix UVD decode image min size calculation
- drm/amdgpu: disallow multiple FENCE chunks in one submit
- xfs: clear zapped attr fork state when bmap repair finds no attr fork
- xfs: zero i_nlink before repair puts inode on unlinked list
- xfs: only check mergeability of bnobt records
- xfs: don't double-lock when deleting a self-referential directory
- xfs: set the prev pointer when reinserting an inode on the unlinked list
- xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers
- xfs: nlink scrub must take IOLOCK before determining ILOCK state
- xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev
- xfs: fix ilock leak on error in xfs_dq_get_next_id
- xfs: don't zap the attr fork on repair when there are queued pptr updates
- xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair
- xfs: fix allocated inodes that show up in the unlinked list
- xfs: fix another iunlink infinite loop bug in online fsck
- xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers
- xfs: avoid UAF on sc->tempip in xrep_tempfile_create
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN
- xfs: don't swallow dquot recovery verification errors
- xfs: check xfarray iteration errors when committing unlinked inode lists
- xfs: check v5 superblock features early
- ceph: Remove ceph_writepage()
- ceph: Use a folio in ceph_page_mkwrite()
- ceph: Convert ceph_find_incompatible() to take a folio
- ceph: Convert writepage_nounlock() to write_folio_nounlock()
- ceph: fix writeback_count leak in write_folio_nounlock()
- ceph: avoid fs reclaim while using current->journal_info
- ceph: fix hanging __ceph_get_caps() with stale mds_wanted
- libceph: Amend checking to fix `make W=1` build breakage
- libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
(CVE-2026-68159)
- mm/khugepaged: guard is_zero_pfn() calls with pte_present()
- userfaultfd: prevent registration of special VMAs (CVE-2026-68166)
- libceph: fix two unsafe bare decodes in decode_lockers() (CVE-2026-68082)
- net/sched: serialize qdisc_rtab_list against concurrent get/put
(CVE-2026-68138)
- super: remove pointless s_root checks
- super: skip dying superblocks early
- super: use a common iterator (Part 1)
- super: use common iterator (Part 2)
- fs/super: fix emergency thaw double-unlock of s_umount
- super: fix emergency thaw deadlock on frozen block devices
(CVE-2026-68132)
- smb: move smb_version_values to common/smbglob.h
- smb: move get_rfc1002_len() to common/smbglob.h
- smb/server: rename include guard in smb_common.h
- ksmbd: rename smb2_get_msg to smb_get_msg
- smb/server: fix minimum SMB1 PDU size
- smb/server: fix minimum SMB2 PDU size
- ksmbd: validate minimum PDU size for transform requests (CVE-2026-68431)
- eventpoll: pin files while checking reverse paths
- tcp: Pass flags to __tcp_send_ack
- tcp: fast path functions later
- tcp: reorganize tcp_sock_write_txrx group for variables later
- tcp: challenge ACK for non-exact RST in SYN-RECEIVED (CVE-2026-68118)
- iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
- btrfs: add debug build only WARN
- btrfs: add space_info argument to btrfs_chunk_alloc()
- btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg()
- btrfs: zoned: fix missing chunk metadata reservation
- [amd64] KVM: x86: Cancel delayed I/O APIC EOI handling before destroying
vCPUs (CVE-2026-74517)
- [arm64] ASoC: tas2562: Validate values for volume writes
- ata: libata-scsi: terminate deferred commands on time out
- igc: remove napi_synchronize() in igc_down()
- ksmbd: conn lock to serialize smb2 negotiate
- ksmbd: reject repeated SMB2 NEGOTIATE requests (CVE-2026-74494)
- net: pktgen: fix code style (WARNING: Block comments)
- net: pktgen: fix proc entry use-after-free (CVE-2026-74479)
- binfmt_misc: don't leak the user namespace when the mount fails
(CVE-2026-74483)
- fsnotify, lsm: Decouple fsnotify from lsm
- fsnotify: opt-in for permission events at file open time
- fs: don't block write during exec on pre-content watched files
- binfmt_misc: restore write access when removing an entry (CVE-2026-74487)
- vrf: Make pcpu_dstats update functions available to other modules.
- vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS.
- vxlan: use pskb_network_may_pull() for transmit path header pulls
(CVE-2026-74474)
- ice: fix VF interrupts cleanup
- include/linux/fs.h: add inode_lock_killable()
- smb: client: fix race with fallocate(2) and AIO+DIO
- cifs: add fscache_resize_cookie() to cifs_setsize()
- can: rcar_canfd: change the initializing flow for clocks and resets
- drm/amd/pm: Use same metric table for APU
- drm/amd/pm: Use macro to initialize metrics table
- drm/amd/pm: fix torn gpu metrics reads
- drm/amdgpu: remove unused function parameter
- drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
- drm/amd/pm: adjust the visibility of pp_table sysfs node
- drm/amd/pm: fix pptable use-after-free (CVE-2026-74450)
- net: tap: set skb->dev before parsing virtio net header in
tap_get_user_xdp() (CVE-2026-74684)
- drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
- ring-buffer: Simplify functions with __free(kfree) to free allocations
- ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
(CVE-2026-74602)
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts
- mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
(CVE-2026-74672)
- mm/ptdump: always stabilise against page table freeing using init_mm
(CVE-2026-74599)
- KVM: SVM: Serialize accesses to the owner and mirror list with separate
lock (CVE-2026-74607)
- ring-buffer: Simplify ring_buffer_read_page() with guard()
- ring-buffer: Make ring_buffer_{un}map() simpler with guard(mutex)
- ring-buffer: Prevent resizing of persistent ring buffer
- [amd64] x86/mce: Remove __mcheck_cpu_init_early()
- [amd64] x86/mce: Set CR4.MCE last during init
- [amd64] x86/mce: Set up the polling timer before CMCI discovery
- [amd64] ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget
setup
- net/x25: fix use-after-free of the socket by its timers (CVE-2026-74628)
- [arm64] tegra: Add EL2 virtual timer interrupt for Tegra194
- crypto: ccm - Set rfc4309 maxauthsize from child
- netfilter: ipset: fix refcount race between list:set GC and swap
- netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort
path
- netfilter: flowtable: publish GC-visible tuple last
- netfilter: ipset: fix list type element drift bug
- netfilter: ipset: let destroy callbacks adjust ext mem size
- ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
- macvlan: inherit needed_headroom and needed_tailroom from lowerdev
- veth: fix queue index used to wake the peer txq in veth_poll
- tcp: fix icsk_ack.ato bitfield overflow
- net: packet: fix wrong transport_header when sending VLAN-tagged frame
- net/tls: Fail tls_sw_splice_read() after a failed async decrypt
- af_packet: Don't send zero-byte data in tpacket_snd().
- net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
- net/sched: cls_u32: skip hash tables in u32_bind_class()
- net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
- net/sched: cls_bpf: reject dev-bound programs bound to a different device
- drm/xe/oa: Fix sync entry leak on OA config emit failure
- erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
- perf: Unify perf_event_free_task() / perf_event_exit_task_context()
- perf/core: Fix group leader use-after-free after sibling detach
(CVE-2026-74637)
- fs: unlock the superblock during iterate_supers_type
- binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
- net: harmonize tstats and dstats
- ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS
- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu()
- ring-buffer: Use current_context for safe per-CPU buffer swap
(CVE-2026-74601)
- ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r
- net: ethernet: mtk_eth_soc: only use legacy mode on missing IRQ name
- net: ethernet: mtk_eth_soc: improve support for named interrupts
.
[ Salvatore Bonaccorso ]
* drivers/mmc/host: Enable MMC_ALCOR as module (Closes: #1142912)
* drivers/misc/cardreader: Enable MISC_ALCOR_PCI as module (Closes: #1142912)
Checksums-Sha1:
68f75826a283d2ee1ea60f4b3f6eb66ed2dfe78e 10935 linux-signed-amd64_6.12.105+1.dsc
9f608087a78a6f75c5fe51514cc47f634f2168fd 1004972 linux-signed-amd64_6.12.105+1.tar.xz
Checksums-Sha256:
f83f657ec49b2e7cc04f80a595db308286e657c16be8bdad0ef2c7d9e2775c9e 10935 linux-signed-amd64_6.12.105+1.dsc
776868f148358bf400be052d0db6392145f398e71b43dec64361aa351a00d309 1004972 linux-signed-amd64_6.12.105+1.tar.xz
Files:
6b43aa9f9fbf264ed952c25392cefdab 10935 kernel optional linux-signed-amd64_6.12.105+1.dsc
677187bc89773d028b1e71113cc2fee4 1004972 kernel optional linux-signed-amd64_6.12.105+1.tar.xz
-----BEGIN PGP SIGNATURE-----
iHUEARYKAB0WIQSInBJdRTWyTRy0ztFCTVFtUgONCgUCao1zmAAKCRBCTVFtUgON
CsM2AQDKnFmCVnfOQWvPcoNOH/VKlxDs421bwmeHSlYjKCZ5GQD+OnrCur9sKLlM
OjzmxlyFxCgmNFfKFQ6V9DCoFvaT6wg=
=FW89
-----END PGP SIGNATURE-----
