-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 29 Aug 2026 06:19:09 +0200
Source: linux
Architecture: source
Version: 6.12.107-1
Distribution: trixie-security
Urgency: high
Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Changes:
linux (6.12.107-1) trixie-security; urgency=high
.
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.106
- PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
- ALSA: scarlett2: Use a private URB for the notification endpoint
- rndis_host: add overflow check in rndis_rx_fixup()
- gpio: ml-ioh: use raw_spinlock_t for the register lock (CVE-2026-80562)
- gve: fix zero-length skb frag with header-split
- hwmon: (ltc4286) Fix symbol namespace of MODULE_IMPORT_NS()
- netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
(CVE-2026-64216)
- inet: frags: add inet_frag_putn() helper
- ipv4: frags: remove ipq_put()
- inet: frags: change inet_frag_kill() to defer refcount updates
- inet: frags: save a pair of atomic operations in reassembly
- inet: frags: publish queues before arming timer (CVE-2026-74662)
- serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
(CVE-2026-74653)
- NTB: ntb_netdev: Preserve RX queue depth on allocation failure
(CVE-2026-74626)
- serial: amba-pl011: synchronize DMA teardown
- serial: sc16is7xx: rename EFR mutex with generic name
- serial: sc16is7xx: use guards for simple mutex locks
- serial: sc16is7xx: enable THRI before filling TX FIFO
- xfs: namespace the maximum length/refcount symbols
- xfs: don't use a xfs_log_iovec for ri_buf in log recovery
- xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)
- xfs: hoist per-bucket unlinked list check to helper
- xfs: don't livelock in scrub on a circular unlinked list
- ALSA: dummy: Check card index validity at probe
- ocfs2: fix missing metadata reservation for large xattrs
- null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows
- kcov: fix data corruption and race conditions on PREEMPT_RT
- ext4: stop retrying saturated xattr cache entries
- ext4: clear error before retrying inode xattr space fallback
- ext4: propagate errors from fast commit range replay
- xfs: validate attr entry pointer before field access
- libceph: fix OOB read in decode_watchers() via missing bounds check
(CVE-2026-80557)
- nfc: digital: clamp SENSF_RES length to the destination buffer
- nfc: fdp: bound the device-reported read length and fix an skb leak
- nfc: microread: validate target discovery payload lengths
- nfc: llcp: bound the connect_sn TLV walk to the skb
- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
- nfc: llcp: reject PDUs shorter than the LLCP header
- nfc: pn533: purge fragmented skbs during cleanup
- nfc: st21nfca: validate ATR_REQ length against the received frame
- nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
- nfc: nci: free destination parameters when closing a connection
- ndisc: ndisc_send_redirect() cleanup
- Input: byd - synchronize timer deletion before freeing private data
(CVE-2026-80572)
- ipv4: reject undersized MTUs in ip_do_fragment()
- ipv6: fix use-after-free in ip6_finish_output2()
- nvmet-auth: zero the AUTH_RECEIVE response buffer
- nvmet-fc: fix invalid free in LS IOD error path
- nvmet-tcp: bound SGL data length before allocating command buffers
- nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
- mptcp: pm: fix data race in add_addr timer callback
- [arm64] ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
(CVE-2026-80583)
- drm/xe: Fix DPT allocation paths.
- HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
- HID: magicmouse: re-enable multitouch after reset-resume
- HID: magicmouse: do not keep a stale msc->input if no input is claimed
- HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID
- HID: core: fix OOB read of field->usage in hid_set_field()
- net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
- xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (CVE-2026-64581)
- ipv4: start using dst_dev_rcu() (CVE-2025-40074)
- mptcp: pm: fix memory leak from alloc-during-teardown race
- Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard
- Input: atkbd - skip deactivate for HONOR ZQC-P
- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
- HID: nintendo: register input device after capabilities are set
- HID: nintendo: stop device IO before hid_hw_stop on probe failure
- HID: core: fix number/pointer type confusion on long items
- HID: sensor: custom: Fix use-after-free in enable_sensor
- HID: hyperv: validate initial device info bounds
- Bluetooth: hci_event: fix LE list UAF on reset
- Bluetooth: hci_event: validate LE Set CIG Parameters response
- Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync
- Bluetooth: hci_aml: validate firmware segment lengths
- net: gro: properly validate BIG TCP aggregation criteria
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.107
- inet: frags: strip GSO state from fragments before reassembly
(CVE-2026-80590)
Checksums-Sha1:
2a6386c57553606693484fdc2ccaf6ac3ebf8e11 290418 linux_6.12.107-1.dsc
b3363e415e6a3fb869b4d43a2e35eba07f0902f6 151398592 linux_6.12.107.orig.tar.xz
e13a94c08bb6e0c40fffb3e971e12344988cff45 1886412 linux_6.12.107-1.debian.tar.xz
d76e860c91446afa6cd469c1067cc86b424f9737 6895 linux_6.12.107-1_source.buildinfo
Checksums-Sha256:
00f5874a383295a3237321cf59a0f172495084f16cb3dac24ee5aae6649d809a 290418 linux_6.12.107-1.dsc
efc76d3c78a5d65f42724118c437d11db1c9f6309a5f024ee9a8b1978fdc6919 151398592 linux_6.12.107.orig.tar.xz
d8c003ecac7c54f59c69dc61258f93d937dce90e70f53bb5a34dd58db13028ed 1886412 linux_6.12.107-1.debian.tar.xz
44fec61de0e851cfefc890640c31d4b3f0c0d14997b8a35b11e8c4643ce29e05 6895 linux_6.12.107-1_source.buildinfo
Files:
59ebc75ef747abfe0bcbc201be05308f 290418 kernel optional linux_6.12.107-1.dsc
514e0f270adc2a24e805ed00d8206884 151398592 kernel optional linux_6.12.107.orig.tar.xz
fe61e4579a2549c092707cf90dc13a2e 1886412 kernel optional linux_6.12.107-1.debian.tar.xz
764958e9041a6e65ce5c1ac08b2c345d 6895 kernel optional linux_6.12.107-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmqSXm5fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89E1TAP/jHdoPkCaGcvGLGJg9OvsZme+FLz1c71
Fm8vXb3E4iBd36NITMaEGdyEpgUXTGnFz9X1lhHK4T8BuVum0kSYgxdG1+mZVAyh
VjZfaruixUlUU5BQF+aCcUsoh3Dv+S+w+JGKAlMcXVyh8DmmOoB+UV5u6p9Nuaf2
aobeYD6iPyflxsdxM5Q5TbD/Cx/EDqi2uX/D3ltaQJMqWmoCrl1NSvvAOHRCiSci
lau2je6A0fII4uvpASgcE0MLgdazKyQN6pB0wF/cnqwqVwfrkD2IkJm9LfYr+ncA
4fRkM78lHJY6F2K/ve+ih9ux4FGH3NzfwuQqMRRMeTMxBvEaOglnvJXYus748+fY
M4eaFMwfZnM6Ma4CumcgLJLupm26KZjS5T4jEd8s/WDnr6eoa4DnKxHFuVEEqYkx
Vo4Ej7cHwtDboy1bqy8P/9MI92AZhJmC8RuYkyW3xnqajtIfyK6rwN9t94FlMviY
0ItIp6F9tmtpjTPNPB7jCX16tq6Y+0r9ffuPDxONAKh5A+jxvmIa1ftn+cM1aeJO
+0YvS7NM34aW8PCO8yIW4dVRV0O/cIabUMV6McH6P+t8F1o/aTpBuUkd3LZD4a+a
E+wiGl2JJwjbNEdc8mGK3nhuy5JaoDY224q6Oc3+3yAZZnu1QoFZWRQo1C1YVdx0
Dw1aVqAlLR9F
=IU9Z
-----END PGP SIGNATURE-----
