-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 31 Oct 2026 15:51:21 +0100
Source: linux-signed-amd64
Architecture: source
Version: 6.12.115+1
Distribution: trixie-security
Urgency: high
Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Changes:
linux-signed-amd64 (6.12.115+1) trixie-security; urgency=high
.
* Sign kernel from linux 6.12.115-1
.
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.114
- spi: mpc52xx: clean up interrupt handling
- usb: gadget: f_hid: Add missing error code
- [amd64] iommu/amd: Disable AMD IOMMU if CMPXCHG16B feature is not
supported
- [amd64] iommu/amd: Fix ivrs_base memleak in early_amd_iommu_init()
- ice: fix use-after-free in dynamic port cleanup
- xfs: stop exchanging reflink flags when exchanging mappings
- xfs: fix exchange-range-to-eof file size exchange
- ip6_gre: remove obsolete ERSPAN PMTU update
- xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock
- xfs: catch stale AGF/AGF metadata
- xfs: avoid dquot buffer pin deadlock
- xfs: rearrange code in xfs_buf_item.c
- xfs: factor out stale buffer item completion
- xfs: fix unmount hang with unflushable inodes stuck in the AIL
- drm/amd: Create a device link between APU display and XHCI devices
- ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands
- mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP
- mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge
- wifi: mt76: connac: tolerate inactive BSS deactivation
- net: team: Remove unused team_mode_op, port_enabled
- net: team: Rename port_disabled team mode op to port_tx_disabled
- net: team: fix NULL pointer dereference in team_xmit during mode change
(CVE-2026-64190)
- net: team: stop reusing skb after queue override
- sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF
scheduler
- Bluetooth: hci_sync: Fix command skb lifetime during scan setup
- Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex
- drm/vmwgfx: Stop using dev_private to store driver data.
- drm/vmwgfx: validate pitch coming from userspace
- namespace: don't inherit MNT_UMOUNT in clone_mnt()
- namespace: check the mounts before reading their parents in pivot_root()
- dm-integrity: use internal variable for digestsize
- dm-integrity: rename internal_hash
- dm-integrity: fix buffer overflow in inline mode with large tag size
- net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop
- [riscv64] patch: Avoid early phys_to_page()
- [riscv64] patch: fix handling of bpf-jit execmem addresses
- scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ
- scsi: ch: Do not keep references to data transfer element devices
- scsi: ufs: core: Move an assignment in ufshcd_mcq_process_cqe()
- scsi: ufs: core: Add debug log for MCQ command timeout
- scsi: ufs: core: Add a comment block above
ufshcd_mcq_compl_all_cqes_lock()
- scsi: ufs: core: Avoid unsafe MMIO reads in
ufshcd_mcq_compl_all_cqes_lock()
- drm/vc4: Use video aperture helpers
- drm/vc4: Fix firmware reference leak in vc4_drm_bind()
- namespace: unhash a dentry before detaching the mounts on it
- namespace: check the target before walking it in do_mount_setattr()
- fcntl: refuse F_SET_RW_HINT on an immutable inode
- namespace: handle mount locking for automounts correctly
- smb: client: improve compound padding in encryption
- smb: client: get rid of bounds check in SMB2_ioctl_init()
- smb: client: fix compound alignment with encryption
- [amd64] drm/i915/display: pass display to intel_crtc_for_pipe()
- [amd64] drm/i915/vga: Convert VGA code to intel_display
- [amd64] drm/i915/display: convert I915_STATE_WARN() to struct
intel_display
- [amd64] drm/i915/gmbus: convert to struct intel_display
- [amd64] drm/i915/crt: convert to struct intel_display
- [amd64] drm/i915: Grab intel_display from the encoder to avoid potential
oopsies (CVE-2024-58074)
- ax25: Remove broken autobind (CVE-2025-22109)
- f2fs: quota: fix to avoid warning in dquot_writeback_dquots()
(CVE-2025-23132)
- [riscv64] KVM: Teardown riscv specific bits after kvm_exit
(CVE-2025-23135)
- wifi: ath12k: fix struct hal_rx_phyrx_rssi_legacy_info
- wifi: ath12k: fix incorrect TID updation in DP monitor status path
- wifi: ath12k: Avoid explicit type cast in monitor status parse handler
- wifi: ath12k: Avoid memory leak while enabling statistics (CVE-2025-37743)
- perf/dwc_pcie: Qualify RAS DES VSEC Capability by Vendor, Revision
- perf/dwc_pcie: fix duplicate pci_dev devices (CVE-2025-37746)
- ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd
(CVE-2025-37906)
- kasan: avoid sleepable page allocation from atomic context
(CVE-2025-38029)
- clk: sunxi-ng: h616: Reparent CPU clock during frequency changes
- clk: sunxi-ng: h616: Reparent GPU clock during frequency changes
(CVE-2025-38041)
- net: ethernet: ti: am65-cpsw: streamline RX queue creation and cleanup
- dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from
k3_udma_glue_reset_rx_chn (CVE-2025-38042)
- virtio: break and reset virtio devices on device_shutdown()
(CVE-2025-38064)
- coresight: holding cscfg_csdev_lock while removing cscfg from csdev
(CVE-2025-38132)
- PCI/pwrctl: Use of_platform_device_create() to create pwrctl devices
- PCI/pwrctl: Create pwrctl device only if at least one power supply is
present
- PCI/pwrctrl: Cancel outstanding rescan work when unregistering
(CVE-2025-38137)
- drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() (CVE-2025-38187)
- wifi: ath12k: convert struct ath12k_sta::update_wk to use struct
wiphy_work
- wifi: ath12k: ath12k_mac_op_sta_state(): clean up update_wk cancellation
- wifi: ath12k: prepare vif data structure for MLO handling
- wifi: ath12k: Fix memory leak due to multiple rx_stats allocation
(CVE-2025-38199)
- mm: fix uprobe pte be overwritten when expanding vma (CVE-2025-38207)
- [riscv64] Enable cbo.zero only when all harts support Zicboz
- [riscv64] Add support for per-thread envcfg CSR values
- [riscv64] save the SR_SUM status over switches (CVE-2025-38261)
- wifi: rtw89: pci: configure manual DAC mode via PCI config API only
(CVE-2025-38284)
- [s390x] entry: Remove __GMAP_ASCE and use _PIF_GUEST_FAULT again
- [s390x] kvm: Remove kvm_arch_fault_in_page()
- [s390x] mm/fault: Handle guest-related program interrupts in KVM
- [s390x] mm: Simplify get_fault_type()
- [s390x] mm: Get rid of fault type switch statements
- [s390x] mm: Fix in_atomic() handling in do_secure_storage_access()
(CVE-2025-38359)
- [amd64] platform/x86/amd/pmf: Switch to platform_get_resource() and
devm_ioremap_resource()
- [amd64] platform/x86/amd: pmf: Use device managed allocations
(CVE-2025-38421)
- drm/rockchip: vop2: Consistently use dev_err_probe()
- drm/rockchip: vop2: Register the primary plane and overlay plane
separately
- drm/rockchip: vop2: fail cleanly if missing a primary plane for a
video-port (CVE-2025-38597)
- wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()
(CVE-2025-38605)
- rv: Remove trailing whitespace from tracepoint string
- rv: Use strings in da monitors tracepoints (CVE-2025-38636)
- wifi: iwlwifi: return ERR_PTR from opmode start()
- wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() (CVE-2025-38656)
- net/sched: Fix backlog accounting in qdisc_dequeue_internal
(CVE-2025-39677)
- mm/mremap: fix WARN with uffd that has remap events disabled
(CVE-2025-39775)
- [amd64] crypto: x86/aegis128 - eliminate some indirect calls
- [amd64] crypto: x86/aegis128 - optimize length block preparation using
SSE4.1
- [amd64] crypto: x86/aegis128 - improve assembly function prototypes
- [amd64] crypto: x86/aegis - Fix sleeping when disallowed on PREEMPT_RT
- [amd64] crypto: x86/aegis - Add missing error checks (CVE-2025-39789)
- net/mlx5: HWS, denote how refcounts are protected
- net/mlx5: HWS, simplify allocations as we support only FDB
- net/mlx5: HWS, handle returned error value in pool alloc
- net/mlx5: HWS, update flow - remove the use of dual RTCs
- net/mlx5: HWS, Remove unused element array
- net/mlx5: HWS, Make pool single resource
- net/mlx5: HWS, Refactor pool implementation
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path
(CVE-2025-39830)
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow
(CVE-2025-39834)
- ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog
(CVE-2025-39859)
- wifi: mt76: mt7915: fix list corruption after hardware restart
(CVE-2025-39862)
- mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()
(CVE-2025-39910)
- smb: client: let recv_done verify data_offset, data_length and
remaining_data_length (CVE-2025-39933)
- [s390x] iommu/s390: handle IOAT registration based on domain
- [s390x] iommu/s390: set appropriate IOTA region type
- [s390x] iommu/s390: Make attach succeed when the device was surprise
removed (CVE-2025-39958)
- [riscv64] KVM: Write hgatp register with valid mode bits (CVE-2025-40065)
- drm/xe: Don't allow evicting of BOs in same VM in array of VM binds
(CVE-2025-40086)
- remoteproc: Switch back to struct platform_driver::remove()
- remoteproc: qcom: pas: Make remoteproc name human friendly
- remoteproc: qcom_q6v5_pas: Simplify with dev_err_probe()
- remoteproc: qcom: pas: Conclude the rename from adsp
- remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E (CVE-2025-40113)
- scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
(CVE-2025-40130)
- crypto: hisilicon/hpre - enable all clusters clock gating
- crypto: hisilicon/qm - request reserved interrupt for virtual function
(CVE-2025-40136)
- [amd64] ASoC: Intel: avs: Use topology information for endpoint numbers
- [amd64] ASoC: Intel: avs: Do not share the name pointer between components
(CVE-2025-40338)
- sysfs: check visibility before changing group attribute ownership
(CVE-2025-40355)
- amd/amdkfd: enhance kfd process check in switch partition (CVE-2025-68174)
- drm/xe/guc: Add devm release action to safely tear down CT
(CVE-2025-68193)
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage
- net/mlx5: HWS, fix bad parameter in CQ creation
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET
- net/mlx5: Store the global doorbell in mlx5_priv
- net/mlx5e: Prepare for using different CQ doorbells
- mlx5: Fix default values in create CQ (CVE-2025-68209)
- scsi: ufs: qcom : Refactor phy_power_on/off calls
- scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)
(CVE-2025-68236)
- clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL
(CVE-2025-68318)
- netconsole: Acquire su_mutex before navigating configs hierarchy
(CVE-2025-68319)
- net: vxlan: prevent NULL deref in vxlan_xmit_one (CVE-2025-68353)
- btrfs: fix double free of qgroup record after failure to add delayed ref
head (CVE-2025-68359)
- wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks
(CVE-2025-68360)
- md: init bioset in mddev_init (CVE-2025-68368)
- coresight-tmc: change tmc_drvdata spinlock's type to raw_spinlock_t
- coresight: ETR: Fix ETR buffer use-after-free issue (CVE-2025-68376)
- wifi: ath12k: Fix MSDU buffer types handling in RX error path
(CVE-2025-68729)
- accel/ivpu: Allow to import single buffer into multiple contexts
- accel/ivpu: Rework bind/unbind of imported buffers
- accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context()
(CVE-2025-68730)
- drm/panthor: Prevent potential UAF in group creation (CVE-2025-68735)
- scsi: qla2xxx: Clear cmds after chip reset (CVE-2025-68745)
- staging: most: remove broken i2c driver (CVE-2025-68755)
- wifi: mac80211: fix typo in HE MCS check
- wifi: mac80211: log link information in ieee80211_determine_chan_mode
- wifi: mac80211: don't WARN for connections on invalid channels
(CVE-2025-71227)
- accel/qaic: Add config structs for supported cards
- net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels
(CVE-2025-71285)
- PCI: endpoint: Add missing NULL check for alloc_workqueue()
(CVE-2025-71313)
- bpf: Mark bpf_refcount field as unique (CVE-2026-100074)
- staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error
paths (CVE-2026-100076)
- drm/msm: Recover HW before retire hung submit (CVE-2026-100077)
- block: zero non-PI portion of auto integrity buffer (CVE-2026-23007)
- idpf: fix error handling in the init_task on load (CVE-2026-23017)
- stddef: Introduce TRAILING_OVERLAP() helper macro
- virtio_net: Fix misalignment bug in struct virtnet_info (CVE-2026-23143)
- ALSA: usb-audio: Prevent excessive number of frames (CVE-2026-23208)
- riscv: trace: fix snapshot deadlock with sbi ecall (CVE-2026-23217)
- io_uring/rw: free potentially allocated iovec on cache put failure
(CVE-2026-23259)
- cxl/mbox: validate payload size before accessing contents in
cxl_payload_from_user_allowed() (CVE-2026-23327)
- sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting
(CVE-2026-23371)
- ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz
(CVE-2026-23377)
- netfilter: nf_tables: clone set on flush only (CVE-2026-23385)
- serial: rename local uart_port_lock() -> uart_port_ref_lock()
- serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN
(CVE-2026-23472)
- RDMA/efa: Fix use of completion ctx after free (CVE-2026-31493)
- bpf: Fix exception exit lock checking for subprogs (CVE-2026-31526)
- drm/mediatek: dsi: Store driver data before invoking
mipi_dsi_host_register (CVE-2026-31562)
- [s390x] mm: Add missing secure storage access fixups for donated memory
(CVE-2026-31568)
- dm: limit swapping tables for devices with zone write plugs
(CVE-2025-38140)
- drm/tilcdc: Fix removal actions in case of failed probe (CVE-2025-71141)
- net: Factorise setup_net() and cleanup_net().
- net: Add ops_undo_single for module load/unload.
- net: Add ->exit_rtnl() hook to struct pernet_operations.
- wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in
pre_exit (CVE-2026-31579)
- [amd64] KVM: SEV: Use long-term pin when registering encrypted memory
regions
- [amd64] KVM: SEV: Protect *all* of sev_mem_enc_register_region() with
kvm->lock (CVE-2026-31592)
- rxrpc: proc: size address buffers for %pISpc output (CVE-2026-31630)
- Bluetooth: hci_event: move wake reason storage into validated event
handlers (CVE-2026-31771)
- bpf: Factor out atomic_ptr_type_ok()
- bpf: Factor out check_atomic_rmw()
- bpf: Factor out check_load_mem() and check_store_reg()
- bpf: Fix incorrect pruning due to atomic fetch precision tracking
(CVE-2026-43009)
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
(CVE-2026-43022)
- bnxt_en: Update firmware interface spec to 1.10.3.85
- bnxt_en: set backing store type from query type (CVE-2026-43034)
- mpls: Hold dev refcnt for mpls_nh.
- mpls: Unify return paths in mpls_dev_notify().
- mpls: Add mpls_dev_rcu().
- mpls: Pass net to mpls_dev_get().
- mpls: Add mpls_route_input().
- mpls: Convert mpls_dump_routes() to RCU.
- mpls: Protect net->mpls.platform_label with a per-netns mutex.
- mpls: add seqcount to protect the platform_label{,s} pair (CVE-2026-43042)
- HID: core: Add reserved item tag for main items
- HID: rate-limit hid_warn to prevent log flooding
- HID: core: Mitigate potential OOB by removing bogus memset()
(CVE-2026-43048)
- xfs: remove bp->b_error check in xfs_attr3_root_inactive
- xfs: factor out xfs_attr3_node_entry_remove
- xfs: close crash window in attr dabtree inactivation (CVE-2026-43053)
- net: ioam6: fix OOB and missing lock (CVE-2026-43083)
- ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()
(CVE-2026-43101)
- types: move struct rcuwait into types.h
- irqwork: Move data struct to a types header
- srcu: Use irq_work to start GP in tiny SRCU (CVE-2026-43115)
- btrfs: tree-log: don't use token set/get accessors in fill_inode_item()
- btrfs: fix zero size inode with non-zero size after log replay
(CVE-2026-43118)
- fs/ntfs3: Accumulated refactoring changes
- ntfs3: fix circular locking dependency in run_unpack_ex (CVE-2026-43127)
- wifi: iwlwifi: fix 22000 series SMEM parsing (CVE-2026-43172)
- ksmbd: fix signededness bug in smb_direct_prepare_negotiation()
(CVE-2026-43185)
- drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on
DCN35 (CVE-2026-43191)
- ASoC: qcom: q6asm: handle the responses after closing
- ASoC: qcom: q6asm: drop DSP responses for closed data streams
(CVE-2026-43204)
- wifi: rtw89: pci: validate sequence number of TX release report
(CVE-2026-43213)
- team: avoid NETDEV_CHANGEMTU event when unregistering slave
(CVE-2026-43234)
- media: chips-media: wave5: Fix Null reference while testing fluster
(CVE-2026-43263)
- ring-buffer: Fix possible dereference of uninitialized pointer
(CVE-2026-43272)
- drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some
panels (CVE-2026-43294)
- drm/amdgpu: Skip vcn poison irq release on VF (CVE-2026-43298)
- btrfs: do not ASSERT() when the fs flips RO inside
btrfs_repair_io_failure() (CVE-2026-43299)
- btrfs: remove 'reserved' argument from btrfs_pin_extent()
- btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref()
(CVE-2026-43308)
- md raid: fix hang when stopping arrays with metadata through dm-raid
(CVE-2026-43309)
- media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure
- media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC
(CVE-2026-43310)
- KVM: Export hardware virtualization enabling/disabling functions
- syscore: Pass context data to callbacks
- soc/tegra: pmc: Fix unsafe generic_handle_irq() call (CVE-2026-43311)
- wifi: iwlwifi: mvm: don't send a 6E related command when not supported
(CVE-2026-43325)
- drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw()
(CVE-2026-43337)
- ice: ptp: don't WARN when controlling PF is unavailable (CVE-2026-43346)
- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue
(CVE-2026-43352)
- i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (CVE-2026-43353)
- scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)
- [amd64] ASoC: amd: acp-mach-common: Add missing error check for clock
acquisition (CVE-2026-43443)
- rxrpc: kdoc: Update function descriptions and add link from rxrpc.rst
- rxrpc, afs: Fix missing error pointer check after
rxrpc_kernel_lookup_peer() (CVE-2026-43463)
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ
(CVE-2026-43464)
- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ
(CVE-2026-43465)
- nouveau/gsp: drop WARN_ON in ACPI probes (CVE-2026-43485)
- bpf: Fix tcx/netkit detach permissions when prog fd isn't given
(CVE-2026-45932)
- btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation
(CVE-2026-45934)
- net: stmmac: fix oops when split header is enabled (CVE-2026-45940)
- drm/exynos: vidi: use priv->vidi_dev for ctx lookup in
vidi_connection_ioctl() (CVE-2026-45956)
- gfs2: fix memory leaks in gfs2_fill_super error path (CVE-2026-45961)
- [amd64] KVM: SVM: Add missing save/restore handling of LBR MSRs
(CVE-2026-46014)
- ipmi:ssif: Clean up kthread on errors (CVE-2026-46044)
- [amd64] KVM: x86: Rename "governed features" helpers to use
"guest_cpu_cap"
- [amd64] KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2
VMRUN (CVE-2026-46059)
- ceph: Remove call to PagePrivate2()
- ceph: extend ceph_writeback_ctl for ceph_writepages_start() refactoring
- ceph: introduce ceph_process_folio_batch() method
- ceph: Remove uses of page from ceph_process_folio_batch()
- ceph: fix num_ops off-by-one when crypto allocation fails (CVE-2026-46066)
- [amd64] KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (CVE-2026-46071)
- dm-verity-fec: fix reading parity bytes split across blocks (take 3)
(CVE-2026-46130)
- spi: microchip-core-qspi: Support per spi-mem operation frequency switches
- spi: microchip-core-qspi: set min_speed_hz during probe
- spi: microchip-core-qspi: remove unused param from
mchp_coreqspi_write_op()
- spi: microchip-core-qspi: control built-in cs manually (CVE-2026-46148)
- [riscv64] kvm: fix vector context allocation leak (CVE-2026-46171)
- f2fs: fix fsck inconsistency caused by FGGC of node block (CVE-2026-46175)
- refcount: provide ops for cases when object's memory can be reused
- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)
- spi: ch341: switch to use devm_spi_alloc_host()
- spi: ch341: fix devres lifetime (CVE-2026-46228)
- drm/amd/display: Fix dc_link NULL handling in HPD init (CVE-2026-46245)
- NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages
(CVE-2026-46256)
- coresight: tmc-etr: Fix race condition between sysfs and perf mode
(CVE-2026-46272)
- selinux: allow multiple opens of /sys/fs/selinux/policy (CVE-2026-46302)
- netfilter: nf_tables: use list_del_rcu for netlink hooks (CVE-2026-46324)
- RDMA/rxe: Move some code to rxe_loc.h in preparation for ODP
- RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE
(CVE-2026-46325)
- Revert "net/smc: Introduce TCP ULP support" (CVE-2026-46330)
- tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (CVE-2026-52937)
- libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()
(CVE-2026-52956)
- net: airoha: fix BQL imbalance in TX path (CVE-2026-52983)
- sched/psi: fix race between file release and pressure write
(CVE-2026-52991)
- netfilter: nat: use kfree_rcu to release ops (CVE-2026-53000)
- ice: fix double-free of tx_buf skb (CVE-2026-53009)
- f2fs: fix data loss caused by incorrect use of nat_entry flag
(CVE-2026-53017)
- f2fs: avoid reading already updated pages during GC (CVE-2026-53018)
- greybus: raw: fix use-after-free on cdev close (CVE-2026-53025)
- net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)
- wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync
(CVE-2026-53103)
- wifi: mt76: Fix memory leak destroying device (CVE-2026-53104)
- [powerpc*] 64s: Fix unmap race with PMD migration entries (CVE-2026-53108)
- [powerpc*] pgtable-frag: Fix bad page state in pte_frag_destroy
(CVE-2026-53109)
- vdpa: use generic driver_override infrastructure (CVE-2026-53118)
- staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length
subtraction (CVE-2026-53178)
- sctp: validate embedded INIT chunk and address list lengths in cookie
(CVE-2026-53224)
- wifi: fix leak if split 6 GHz scanning fails (CVE-2026-53258)
- [arm64] KVM: arm64: Take the SRCU lock for page table walks in fault
injection and AT emulation (CVE-2026-53277)
- [amd64] iommu/vt-d: Avoid NULL pointer dereference or refcount corruption
(CVE-2026-53281)
- btrfs: only release the dirty pages io tree after successful writes
(CVE-2026-53284)
- drm/amd/display: Wrap DCN32 phantom-plane allocation in
DC_RUN_WITH_PREEMPTION_ENABLED (CVE-2026-53285)
- net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind
(CVE-2026-53292)
- net: mana: Guard mana_remove against double invocation (CVE-2026-53297)
- io_uring/napi: protect concurrent io_napi_entry timeout accesses
- io_uring/napi: improve __io_napi_add
- io_uring/napi: Use lock guards
- io_uring/napi: clean up __io_napi_do_busy_loop
- io_uring/napi: cap busy_poll_to 10 msec (CVE-2026-53321)
- drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()
(CVE-2026-53330)
- f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage
(CVE-2026-53368)
- drm/msm: always recover the gpu (CVE-2026-53377)
- fbdev: omap2: fix inconsistent lock returns in omapfb_mmap
- fbdev: omap2: fix use-after-free in omapfb_mmap (CVE-2026-53401)
- f2fs: read COW data with the original inode during atomic write
(CVE-2026-63811)
- gcov: use atomic counter updates to fix concurrent access crashes
(CVE-2026-63825)
- wifi: mt76: add wcid publish check in mt76_sta_add (CVE-2026-63832)
- drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring (CVE-2026-63853)
- net: airoha: Do not read uninitialized fragment address in
airoha_dev_xmit() (CVE-2026-63857)
- net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()
(CVE-2026-63859)
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)
- net/handshake: hand off the pinned file reference to accept_doit
(CVE-2026-63979)
- ethtool: module: call ethnl_ops_complete() on module flash errors
(CVE-2026-63998)
- ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
(CVE-2026-63999)
- netfilter: nf_tables: fix dst corruption in same register operation
(CVE-2026-64006)
- tcp: Remove sk->sk_prot->orphan_count.
- tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
(CVE-2026-64024)
- cgroup/rstat: validate cpu before css_rstat_cpu() access (CVE-2026-64036)
- hwmon: (lm90) Stop work before releasing hwmon device (CVE-2026-64038)
- netfs: Fix leak of request in netfs_write_begin() error handling
(CVE-2026-64060)
- netfs: Fix missing locking around retry adding new subreqs
(CVE-2026-64068)
- netfilter: bridge: eb_tables: close module init race (CVE-2026-64076)
- netfilter: ebtables: move to two-stage removal scheme (CVE-2026-64077)
- netfilter: x_tables: allow initial table replace without emitting audit
log message
- netfilter: x_tables: allocate hook ops while under mutex (CVE-2026-64079)
- wifi: mac80211: fix missing RX bitrate update for mesh forwarding path
- wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
(CVE-2026-64117)
- erofs: fix metabuf leak in inode xattr initialization (CVE-2026-64146)
- drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (CVE-2026-64154)
- netfs: Fix zeropoint update where i_size > remote_i_size (CVE-2026-64159)
- hwmon: (lm90) Add lock protection to lm90_alert (CVE-2026-64213)
- KVM: guest_memfd: Treat memslot binding offset+size as unsigned values
(CVE-2026-64283)
- smb/client: fix chown/chgrp with SMB3 POSIX Extensions (CVE-2026-64388)
- ksmbd: validate NTLMv2 response before updating session key
(CVE-2026-64389)
- ksmbd: prevent path traversal bypass by restricting caseless retry
(CVE-2026-64400)
- [amd64] KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting
APIC state
- [amd64] KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from
x86.c)
- [amd64] KVM: x86: Rename APIC base setters to better capture their
relationship
- [amd64] KVM: x86: Move update_cr8_intercept() to lapic.c
- [amd64] KVM: x86: Unconditionally recompute CR8 intercept on PPR update
(CVE-2026-64513)
- [amd64] KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to
invalid guest state (CVE-2026-68081)
- drm/amdgpu: Fix kernel panic during driver load failure (CVE-2026-68105)
- media: stm32: dcmipp: use v4l2_subdev_is_streaming
- media: stm32: dcmipp: replace s_stream with enable/disable_streams
- media: stm32-dcmipp: Return queued buffers on start_streaming() failure
(CVE-2026-68211)
- drm/vc4: Shut down BO cache timer before teardown (CVE-2026-68233)
- drm/amdgpu: Use dbg level for VBIOS check messages
- drm/amdgpu: Add wrapper for freeing vbios memory
- drm/amdgpu: Release VFCT ACPI table reference (CVE-2026-68238)
- [amd64] drm/i915/mst: limit DP MST ESI service loop (CVE-2026-68241)
- [amd64] drm/i915/gt: Fix NULL deref on sched_engine alloc failure
(CVE-2026-68242)
- drm/amdkfd: Check bounds on CRIU restore queue type and mqd size
(CVE-2026-68258)
- idpf: fix max_vport related crash on allocation error during init
(CVE-2026-68291)
- LoongArch: BPF: Zero-extend signed ALU32 div/mod results (CVE-2026-68295)
- cifs: prevent readdir from changing file size due to stale directory
metadata
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain
paths (CVE-2026-68312)
- tipc: serialize udp bearer replicast list updates (CVE-2026-68323)
- fwctl/bnxt_en: Refactor aux bus functions to be more generic
- bnxt_en: Handle partially initialized auxiliary devices (CVE-2026-68375)
- drm/xe/guc: Keep scheduler timeline name alive (CVE-2026-68383)
- Bluetooth: hci_sync: extend conn_hash lookup critical sections
(CVE-2026-68393)
- bpf: Disable migration when destroying sock storage
- bpf: Disable migration when cloning sock storage
- rcu: add rcu_read_lock_dont_migrate()
- bpf: Use rcu_read_lock_dont_migrate in bpf_sk_storage.c
- bpf: Fix UAF in sock clone early bailouts (CVE-2026-68399)
- firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()
(CVE-2026-68401)
- wifi: cfg80211: use wiphy work for socket owner autodisconnect
(CVE-2026-68404)
- wifi: mac80211: refactor populating mesh related fields in sinfo
- wifi: cfg80211: add link_station_info structure to support MLO statistics
- wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)
- wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()
(CVE-2026-68412)
- RDMA/irdma: Prevent user-triggered null deref on QP create
(CVE-2026-68418)
- sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()
(CVE-2026-68421)
- xfrm: fix stale skb->prev after async crypto steals a GSO segment
(CVE-2026-68426)
- drm/amd/display: use kvzalloc to allocate struct dc (CVE-2026-68436)
- net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains
(CVE-2026-68441)
- drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size
(CVE-2026-68447)
- ovl: check access to copy_file_range source with src mounter creds
(CVE-2026-68448)
- [s390x] zcrypt: Fix buffer over-read in cca_cipher2protkey
(CVE-2026-68453)
- wifi: mac80211: validate extension-frame layout before RX (CVE-2026-68470)
- wifi: ieee80211: validate MLE common info length (CVE-2026-68471)
- ata: libata-core: Disable LPM on Silicon Motion MD619{H,G}XCLDE3TC
- ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD (CVE-2026-72031)
- mmc: vub300: Use devm_mmc_alloc_host() helper
- mmc: vub300: fix use-after-free on disconnect
- mmc: vub300: rename probe error labels
- mmc: vub300: fix use-after-free on probe failure (CVE-2026-72073)
- dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)
- ocfs2: correct l_next_free_rec in online check
- ocfs2: add suballoc slot check in ocfs2_validate_inode_block()
- ocfs2: add extra consistency checks for chain allocator dinodes
- ocfs2: validate i_refcount_loc when refcount flag is set
- ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec
(CVE-2026-72162)
- [arm64] KVM: arm64: vgic: Handle race between interrupt affinity change
and LPI disabling (CVE-2026-72288)
- ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and
igmp_stop_timer() (CVE-2026-72321)
- net/liquidio: drop cached VF pci_dev LUT (CVE-2026-72329)
- Bluetooth: 6lowpan: avoid untracked enable work (CVE-2026-72337)
- net/mlx5e: Fix publication race for priv->channel_stats[] (CVE-2026-72341)
- netfs: Clean up some whitespace in trace header
- netfs: Use a folio_queue allocation and free functions
- netfs: Add a tracepoint to log the lifespan of folio_queue structs
- netfs: Abstract out a rolling folio buffer implementation
- netfs: Drop the was_async arg from netfs_read_subreq_terminated()
- netfs: Fix netfs_create_write_req() to handle async cache object creation
(CVE-2026-72366)
- iomap: guard io_size EOF trim against concurrent truncate underflow
(CVE-2026-72367)
- afs: Fix reinitialisation of the inode, in particular ->lock_work
(CVE-2026-72375)
- xen/pvcalls: bound backend response req_id before indexing rsp[]
(CVE-2026-72380)
- sctp: fix addr_wq_timer race in sctp_free_addr_wq() (CVE-2026-72383)
- drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock
(CVE-2026-72388)
- hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()
(CVE-2026-72397)
- sctp: add INIT verification after cookie unpacking (CVE-2026-72398)
- tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()
(CVE-2026-72404)
- bpf: Guard conntrack opts error writes (CVE-2026-72423)
- md/raid10: fix writes_pending leak on write request failures
(CVE-2026-72439)
- md/raid1: fix writes_pending and barrier reference leaks on write failures
(CVE-2026-72440)
- soundwire: fix bug in sdw_add_element_group_count found by syzkaller
(CVE-2026-72488)
- net: serialize netif_running() check in enqueue_to_backlog()
(CVE-2026-72493)
- RDMA/irdma: Replace waitqueue and flag with completion (CVE-2026-72494)
- RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
(CVE-2026-72495)
- RDMA/bnxt_re: Add a max slot check for SQ (CVE-2026-72497)
- RDMA/bnxt_re: Free CQ toggle page after firmware teardown (CVE-2026-72499)
- RDMA/bnxt_re: Fix budget handling of notification queue
- RDMA/bnxt_re: Remove unusable nq variable
- RDMA/bnxt_re: Free SRQ toggle page after firmware teardown
(CVE-2026-72500)
- RDMA/bnxt_re: Initialize dpi variable to zero (CVE-2026-72501)
- sockmap: Fix use-after-free in udp_bpf_recvmsg() (CVE-2026-74257)
- ALSA: seq: Clean up fifo locking with guard
- ALSA: seq: avoid stale FIFO cells during resize (CVE-2026-74261)
- net: watchdog: fix refcount tracking races (CVE-2026-74264)
- bnxt: fix head underflow on XDP head-grow (CVE-2026-74269)
- cxl/region: Block region delete during region creation (CVE-2026-74273)
- ixgbe: do not configure xps for XDP queues (CVE-2026-74317)
- bpf: Reject sleepable BPF_LSM_CGROUP programs at load time
(CVE-2026-74338)
- ocfs2: validate fast symlink target during inode read (CVE-2026-74350)
- wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()
(CVE-2026-74368)
- md: replace wait loop with wait_event() in md_handle_request()
- md/raid1,raid10: fix deadlock in read error recovery path (CVE-2026-74375)
- md/raid1,raid10: fix bio accounting for split md cloned bios
(CVE-2026-74373)
- md/raid1,raid10: fix error-path detection with md_cloned_bio()
(CVE-2026-74374)
- nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (CVE-2026-74385)
- ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data
(CVE-2026-74388)
- OPP: Fix race between OPP addition and lookup (CVE-2026-74405)
- wifi: ath11k: cancel SSR work items during PCI shutdown (CVE-2026-74407)
- drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero
viewport (CVE-2026-74449)
- [s390x] ap: Move response_type struct into ap_msg struct
- [s390x] ap/zcrypt: Rework AP message buffer allocation
- [s390x] ap: Introduce ap message buffer pool
- [s390x] ap/zcrypt: New xflag parameter
- [s390x] zcrypt: Move inline function rng_type6cprb_msgx from header to
code
- [s390x] zcrypt: Rework domain processing within zcrypt device driver
- [s390x] zcrypt: Close speculative mem read possibility (CVE-2026-74466)
- afs: Fix UAF when sending a message (CVE-2026-74506)
- dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister
(CVE-2026-74513)
- [amd64] iommu/iommufd: Fix IOPF group ownership UAF (CVE-2026-74520)
- octeontx2-af: Block VFs from clobbering special CGX PKIND state
(CVE-2026-74527)
- Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback
(CVE-2026-74529)
- Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
(CVE-2026-74530)
- Bluetooth: ISO: hold sk properly in iso_conn_ready (CVE-2026-74537)
- Bluetooth: ISO: lock sk in iso_connect_ind (CVE-2026-74538)
- netfs: Fix folio_queue ENOMEM in writeback by adding a mempool
(CVE-2026-74542)
- net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
(CVE-2026-74544)
- xsk: drain continuation descs after overflow in xsk_build_skb()
(CVE-2026-74559)
- xsk: provide sufficient space in pool->tx_descs
- xsk: reclaim invalid Tx descriptors in ZC batch path (CVE-2026-74558)
- btrfs: skip global block reserve accounting for rescue mounts
(CVE-2026-74571)
- mm/page_table_check: skip special zero mappings (CVE-2026-74600)
- eventfs: Use children field for rcu head and add memory barriers
(CVE-2026-74605)
- tls: rx: restore msg_iter before TLS 1.3 optimistic retry (CVE-2026-74611)
- watchdog: at91sam9_wdt: prevent timer rearm during teardown
(CVE-2026-74687)
- [s390x] ism: Fix UAF of sba and ieq during ism_dev_exit() (CVE-2026-74690)
- netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
(CVE-2026-74695)
- bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
(CVE-2026-74697)
- hwmon: (pmbus) Fix type confusion in notification logic (CVE-2026-74711)
- vhost_iotlb: bound map allocation in add_range (CVE-2026-74713)
- bpf: Fix netns reference imbalance in conntrack kfuncs (CVE-2026-74715)
- btrfs: lzo: reject inline extents without valid headers (CVE-2026-74723)
- xfs: handle NULL b_addr in xfs_buf_free (CVE-2026-74728)
- soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
(CVE-2026-74729)
- gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
(CVE-2026-74733)
- firewire: ohci: fix NULL pointer dereference in ar_context_release
(CVE-2026-74734)
- ipvs: revalidate ihl to prevent out-of-bounds access (CVE-2026-74747)
- sctp: validate cookie AUTH state before use (CVE-2026-74752)
- scsi: core: pair EH runtime PM get and put (CVE-2026-74754)
- ASoC: SOF: Relocate and rework functionality for PCM stream freeing
- ASoC: SOF: pcm: Move period/buffer configuration print after platform open
- ASoC: SOF: pcm: Add snd_sof_pcm specific wrappers for dev_dbg() and
dev_err()
- ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout
(CVE-2026-80581)
- tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg (CVE-2026-80607)
- net: ibm: emac: use devm_platform_ioremap_resource
- net: ibm: emac: use platform_get_irq
- net: emac: Fix NULL pointer dereference in emac_probe (CVE-2026-80614)
- ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns()
(CVE-2026-80616)
- coresight: ete: Always save state on power down (CVE-2026-80623)
- ALSA: seq: oss: Serialize readq reset state with q->lock (CVE-2026-80628)
- btrfs: lzo: reject compressed segment that overflows the compressed input
(CVE-2026-80631)
- netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag
(CVE-2026-80634)
- EDAC/igen6: Initialize edac_op_state according to the configuration data
- EDAC/igen6: Add polling support
- EDAC/igen6: Skip absent memory controllers
- EDAC/igen6: Fix call trace due to missing release() (CVE-2026-80643)
- scsi: hisi_sas: Add slave_destroy interface for v3 hw (CVE-2026-80653)
- soc: xilinx: Fix race condition in event registration (CVE-2026-80655)
- cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size (CVE-2026-80662)
- netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
(CVE-2026-80668)
- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
(CVE-2026-80692)
- idpf: bound interrupt-vector register fill to the allocated array
(CVE-2026-80693)
- dmaengine: idxd: fix double free of wq, engine, and group structs
(CVE-2026-80698)
- drm/amd/display: check if dml21_add_phantom_plane() is successful
(CVE-2026-80705)
- btrfs: initialize inode mapping flags for cached inodes (CVE-2026-80734)
- bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
(CVE-2026-80738)
- drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length
- drm/amdkfd: Add bounds check for CRAT subtype length (CVE-2026-80747)
- Bluetooth: ISO: zero the sockaddr before returning it in getname
(CVE-2026-80761)
- fbdev: Wrap user-invoked calls to fb_set_var() in helper (CVE-2026-80786)
- tipc: avoid busy looping in tipc_exit_net() (CVE-2026-80866)
- NTB: core: Add .get_dma_dev() callback to ntb_dev_ops
- NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers
- ntb: Store original DMA address for future release (CVE-2026-80884)
- tap: Keep hdr_len in tap_get_user()
- net: tap: fix wrong transport_header when sending VLAN-tagged frame
(CVE-2026-80905)
- io_uring: defer eventfd signaling when queued from a wakeup handler
(CVE-2026-80920)
- wifi: iwlwifi: dvm: pair transport op-mode enter/leave
- wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()
(CVE-2026-80948)
- svcrdma: Reject Read lists that exceed the page budget (CVE-2026-89528)
- svcrdma: Add Write chunk WRs to the RPC's Send WR chain
- svcrdma: wake sq waiters when the transport closes
- svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails
(CVE-2026-89534)
- SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2
(CVE-2026-89537)
- ext2: Fix lost inode updates for IS_SYNC inodes (CVE-2026-89601)
- smb: client: reject a tree connect response whose byte count is too small
(CVE-2026-89631)
- cifs: call pagecache_isize_extended() in cifs_setsize() when extending
(CVE-2026-89642)
- ceph: cap delegated inode count in ceph_parse_deleg_inos()
(CVE-2026-89648)
- ceph: fix UAF in check_new_map() on session freed during unlock
(CVE-2026-89654)
- nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net
(CVE-2026-89682)
- nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths
(CVE-2026-89705)
- lockd, nfsd: RCU-protect nlmsvc_ops dispatch (CVE-2026-89709)
- mm/mglru: reset page lru tier bits when activating
- mm/mglru: use the common routine for dirty/writeback reactivation
- mm/mglru: fix and remove redundant unevictable folio handling
(CVE-2026-89757)
- ksmbd: fix tree connection use-after-free in smb2_tree_connect()
(CVE-2026-89788)
- drm/amdkfd: Fix partial migrate issue
- drm/amdkfd: return migration pages from copy function
- Revert "drm/amdkfd: return migration pages from copy function"
- drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
(CVE-2026-89808)
- drm/amdkfd: return migration pages from copy function - again
- drm/amdkfd: Fix error path at svm_migrate_copy_to_ram (CVE-2026-89810)
- drm/amdkfd: Add TLB flush after MES queue eviction/suspension
(CVE-2026-89811)
- drm/amdgpu: force complete the MES ring fences on reset (CVE-2026-89812)
- drm/amdgpu: force complete the KIQ ring fences on reset (CVE-2026-89813)
- f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()
(CVE-2026-89833)
- [arm64] KVM: arm64: vgic-v3: take an LPI reference in
vgic_v3_save_pending_tables (CVE-2026-89913)
- [s390x] KVM: s390: Fix memory corruption by not reinjecting CK machine
checks (CVE-2026-89920)
- mm/huge_memory: transfer the pmd dirty bit to the folio on zap
(CVE-2026-89987)
- netfilter: nf_tables: prefer nft_trans_elem_alloc helper
- netfilter: nf_tables: add nft_trans_commit_list_add_elem helper
- netfilter: nf_tables: prepare for multiple elements in nft_trans_elem
structure
- netfilter: nf_tables: skip double clone set expressions on element insert
(CVE-2026-90061)
- net_sched: sch_fq: add three drop_reason
- net/sched: add qstats_cpu_drop_inc() helper
- net/sched: act_ife: Only operate on Ethernet frames (CVE-2026-90083)
- octeontx2-vf: fix workqueue and netdev race in probe/remove
(CVE-2026-90084)
- xsk: honor XDP_TX_METADATA in zero-copy path (CVE-2026-90086)
- Bluetooth: do not leak an hci_conn when a second LE connect is rejected
(CVE-2026-90087)
- net: add getsockopt_iter callback to proto_ops
- Bluetooth: L2CAP: convert to getsockopt_iter
- Bluetooth: L2CAP: access chan->conn safely in get/setsockopt
(CVE-2026-90093)
- Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root
partition (CVE-2026-90097)
- net/sched: account classifier filter allocations to memcg (CVE-2026-90099)
- NFSv4.1: zero referring call lists before decoding (CVE-2026-90104)
- vxlan: fix reading neigh ha (CVE-2026-90105)
- net: bridge: arp/nd proxy: fix reading neigh ha (CVE-2026-90106)
- ip6mr: do not clone dst in ip6mr_cache_report() (CVE-2026-90111)
- ALSA: mtpav: shut down output timer before card teardown (CVE-2026-90116)
- virtio_net: Fix resize of the RX ring (CVE-2026-90142)
- dpll: fix NULL deref in dpll_device_ops() during teardown race
(CVE-2026-90144)
- bpf, xdp: move offload check into dev_xdp_install()
- NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers
(CVE-2026-90149)
- ksmbd: scope session state changes to bound connections (CVE-2026-90154)
- ksmbd: detach blocked lock requests before freeing (CVE-2026-90155)
- ksmbd: safely discard unregistered deferred locks (CVE-2026-90156)
- erofs: fix interlaced ztailpacking pclusters (CVE-2026-90161)
- ksmbd: defer publishing granted locks to prevent UAF/double-free race
(CVE-2026-90162)
- ksmbd: serialize oplock close with pending break ownership
(CVE-2026-90167)
- ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() (CVE-2026-90174)
- bpf: Check pointer type for all atomic RMW paths (CVE-2026-90177)
- apparmor: fix deadlock in complain-mode change_hat (CVE-2026-90179)
- blk-cgroup: delay freeing policy data after rcu grace period
- blk-iocost: clear delay state when freeing policy data (CVE-2026-90182)
- blk-iolatency: clear delay state when freeing policy data (CVE-2026-90183)
- ocfs2: validate DIO orphan slot during inode read (CVE-2026-90204)
- ocfs2: validate orphan slot during inode read (CVE-2026-90205)
- nvmet: fix max_qid race between configfs and controller allocation
(CVE-2026-90206)
- clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type
(CVE-2026-90208)
- bpf: Compare iterator types during state pruning (CVE-2026-90217)
- apparmor: fix unconfined user namespace restriction forced stack
(CVE-2026-90231)
- amt: Don't support cross-netns setup. (CVE-2026-90232)
- NFS: Return a delegation the client fails to record (CVE-2026-90234)
- [amd64] iommu/vt-d: Flush context cache with correct SID when tearing down
aliases (CVE-2026-90240)
- bpf: Fix mmap_lock leak in irq_work path (CVE-2026-90247)
- Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero (CVE-2026-74533)
- Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
(CVE-2026-90256)
- btrfs: qgroup: fix a wrong length calculation in
qgroup_free_reserved_data() (CVE-2026-90259)
- btrfs: zoned: don't clobber the extent buffer when zeroing it out
(CVE-2026-90260)
- btrfs: check if root is readonly when setting posix acl (CVE-2026-90263)
- btrfs: always wait for ordered extents to avoid OE races (CVE-2026-90264)
- btrfs: defrag: fix deadlock between defrag and delalloc space reservation
(CVE-2026-90265)
- scsi: sd: Move the sd_config_discard() function definition
- scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails
(CVE-2026-90267)
- coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf
enable (CVE-2026-90273)
- drm/amd/display: disable replay when crc source is enabled
- drm/amd/display: Resize MST HDCP per-connector arrays to 32
(CVE-2026-90289)
- bpf: Factor callchain_store function from __bpf_get_stack
- bpf: Factor callchain_finalize function from __bpf_get_stack
- bpf: Remove trace_in argument from __bpf_get_stack
- bpf: Clear buf on error in __bpf_get_task_stack (CVE-2026-90300)
- ocfs2/heartbeat: fix slot mapping rollback leaks on error paths
- ocfs2: o2hb: quiesce negotiate handlers and timeout work (CVE-2026-90301)
- thermal: hwmon: Remove hwmon class device along with its parent
(CVE-2026-90311)
- ocfs2: validate inline xattrs during inode block validation
(CVE-2026-90321)
- ublk: check import_ubuf() return value (CVE-2026-90324)
- blk-cgroup: fix race between policy activation and blkg destruction
(CVE-2026-90326)
- HID: steam: Reject short reads (CVE-2026-90328)
- HID: logitech-hidpp: Fix FF device cleanup on init failure
(CVE-2026-90330)
- tty: skip cdev_del() when no cdev is registered (CVE-2026-90335)
- serial: core: clear freed pointers on uart_register_driver() failure
(CVE-2026-90336)
- serial: core: do fallible allocations before the console can be registered
(CVE-2026-90337)
- wifi: cfg80211: stop PMSR before P2P and NAN teardown (CVE-2026-90343)
- wifi: brcmfmac: fix P2P action frame handling without device vif
(CVE-2026-90345)
- wifi: nl80211: check link is beaconing for color change
- wifi: nl80211: clean up color-change beacon data on errors
(CVE-2026-90346)
- [arm64] ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry
(CVE-2026-90347)
- wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed
(CVE-2026-90351)
- bpf: Reject >8 byte return values on return-reading trampoline paths
(CVE-2026-90359)
- drm/msm: don't tear down KMS twice when KMS init fails (CVE-2026-90363)
- wifi: mt76: cancel reset and rc work on device unregister (CVE-2026-90365)
- wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
(CVE-2026-90367)
- wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()
(CVE-2026-90408)
- [amd64] drm/i915: rename range_overflows_end() to range_end_overflows()
- [amd64] drm/i915: document range_overflows() and range_end_overflows()
macros
- overflow: add range_overflows() and range_end_overflows()
- drm/panthor: Add vm_bind region with kbo range overlap check
(CVE-2026-90409)
- RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()
(CVE-2026-90417)
- PCI: Make pci_match_one_device() match on ID instead of device
- PCI: Fix dyn_id add TOCTOU
- PCI: Fix UAF when probe runs concurrent to dyn ID removal (CVE-2026-90421)
- clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path
(CVE-2026-90422)
- iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path
(CVE-2026-90424)
- iommu/tegra241-cmdqv: Don't fall back to a freed smmu after
devm_krealloc() (CVE-2026-90427)
- scsi: ufs: core: Convert string descriptor format macros to enum
- scsi: ufs: core: Validate string descriptors (CVE-2026-92480)
- pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip
(CVE-2026-92482)
- bpf: Fix WARNING in bpf_tracing_link_release (CVE-2026-92485)
- ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() (CVE-2026-92503)
- bpf: Zero queue and stack outputs on lock failure (CVE-2026-92520)
- drm/sched: Use struct for drm_sched_init() params
- drm/msm: Only fini scheduler after successful init (CVE-2026-93058)
- firmware: arm_scmi: Fix SCMI device destroy lifetimes (CVE-2026-93081)
- fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() (CVE-2026-93100)
- RDMA/rvt: Return NULL after port allocation failure (CVE-2026-93104)
- esp: do not unref managed frag pages in esp_ssg_unref() (CVE-2026-93105)
- platform/x86: asus-wmi: fix resource leaks on probe failure
(CVE-2026-93116)
- usb: gadget: uac: validate rate list length before storing
(CVE-2026-93122)
- bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max
(CVE-2026-93125)
- [amd64] platform/x86: dell-wmi-base: Fix handling of ultra performance key
(CVE-2026-93129)
- bpf: Reject writes through untrusted BTF pointers (CVE-2026-93144)
- time/namespace: Validate nanosecond field in proc_timens_set_offset()
(CVE-2026-93146)
- bpf: Reject MEM_ALLOC BTF accesses past object bounds (CVE-2026-93148)
- dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout
(CVE-2026-93168)
- drm/amd/display: Fix dangling pointer in CRTC reset function
(CVE-2026-93175)
- drm/amd/display: Fix dangling pointer in plane reset function
(CVE-2026-93176)
- mm/page_owner: use memcg_data snapshot to avoid TOCTOU in
print_page_owner_memcg() (CVE-2026-93216)
- nfsd: convert nfsd_net boolean flags to unsigned long flags word
(CVE-2026-93221)
- mm/hugetlb: refactor code around vmemmap_walk
- mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier
(CVE-2026-93230)
- ACPI: bus: Introduce acpi_bus_get_primary_device() (CVE-2026-93251)
- powerpc/xive: add error return value to xive_smp_probe()
- powerpc/xive: propagate IPI init errors to prevent use-after-free
(CVE-2026-93260)
- remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3
(CVE-2026-93272)
- ksmbd: remove redundant DACL check in smb_check_perm_dacl
- ksmbd: fix maximum allowed access checks (CVE-2026-93282)
- drm/amdkfd: fix SMI event cross-process information leak (CVE-2026-97422)
- drm/amdgpu: Update SRIOV Exchange Headers for RAS Telemetry Support
- drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq
(CVE-2026-97424)
- wifi: iwlwifi: simplify nested if checks
- wifi: iwlwifi: mvm: fix P2P-Device binding handling (CVE-2026-97432)
- RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind()
(CVE-2026-97477)
- virt: acrn: Remove unused list 'acrn_irqfd_clients'
- virt: acrn: Fix irqfd use-after-free during eventfd shutdown
(CVE-2026-97478)
- PM: sleep: core: Synchronize runtime PM status of parents and children
- PM: sleep: core: Restrict power.set_active propagation
- PM: Rearrange documentation related to __pm_runtime_disable()
- PM: Block enabling of runtime PM during system suspend
- PM: runtime: Introduce pm_runtime_blocked()
- PM: sleep: Use DPM_FLAG_SMART_SUSPEND conditionally
- PM: sleep: Fix bit masking operation
- driver core: Add device_link_test() for testing device link flags
- driver core: Avoid warning when removing a device while its supplier is
unbinding (CVE-2026-97479)
- serial: 8250: invert serial8250_register_8250_port() CIR condition
- tty: serial: 8250: protect against NULL uart->port.dev in register
(CVE-2026-97480)
- drm/amdgpu: Remove unused amdgpu_i2c functions
- drm/amdgpu/atombios: drop empty function
- drm/amdgpu: rework i2c init and fini
- drm/amdgpu: Bound GPIO I2C table entry count from VBIOS (CVE-2026-97493)
- gpiolib: make value setters have return values
- gpiolib: wrap gpio_chip::set()
- gpiolib: rework the wrapper around gpio_chip::set_multiple()
- gpiolib: introduce gpio_chip setters that return values
- pinctrl: mediatek: paris: don't double-check the GPIO number
- pinctrl: mediatek: paris: use new GPIO line value setter callbacks
- pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction
(CVE-2026-97501)
- genirq/proc: Switch to lock guards
- genirq: Consistently use '%u' format specifier for unsigned int variables
- genirq/proc: Size interrupt directory names for 10-digit interrupt numbers
(CVE-2026-97503)
- media: chips-media: wave5: Release m2m_ctx after Instance Removed from
List (CVE-2026-97513)
- i3c: master: svc: Fix npcm845 FIFO empty issue
- i3c: master: svc: Fix npcm845 invalid slvstart event
- i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845
(CVE-2026-97515)
- hwmon: (asus_rog_ryujin) Rely on subsystem locking
- hwmon: (asus_rog_ryujin) Add per-device configuration
- hwmon: (asus_rog_ryujin) Validate HID report lengths (CVE-2026-97538)
- smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
(CVE-2026-97554)
- smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid
(CVE-2026-97561)
- drm/amdgpu: skip the VMID 0 flush for VRAM (CVE-2026-97928)
- [amd64] perf/x86/intel: Prevent drain_pebs() reentry (CVE-2026-97960)
- net/mlx5e: Move representor vnic reporter to eswitch devlink port
(CVE-2026-97962)
- Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()
(CVE-2026-97975)
- vhost: invalidate vring access on IOTLB transitions (CVE-2026-97988)
- vduse: validate virtqueue alignment (CVE-2026-97989)
- virtio_ring: fix stale descriptor flags after a failed packed add
(CVE-2026-97997)
- [amd64] iommu/amd: Do not reallocate GA log buffers on resume
(CVE-2026-98003)
- bpf: mark a NULL call argument precise (CVE-2026-98019)
- tracing: Fix subbuf resize races with trace_pipe_raw readers
(CVE-2026-98032)
- bpf: Preserve inner map identity in callback frames (CVE-2026-98033)
- bpf: Mark NULL kptr stores precise (CVE-2026-98034)
- bpf: Keep refcount_acquire nullable for borrowed RCU kptrs
(CVE-2026-98038)
- bpf: Don't infer non-NULL from a pointer with an unbounded offset
(CVE-2026-98043)
- bpf: Reject legacy packet loads from callbacks (CVE-2026-98044)
- bpf: Check ancestor frames for rbtree callbacks (CVE-2026-98047)
- bpf: don't rewrite bpf_fastcall patterns entered by a jump
(CVE-2026-98048)
- bpf: zero extend the result of an arena 32-bit cmpxchg (CVE-2026-98049)
- [amd64] ASoC: Intel: avs: Refactor and fix init_config access
(CVE-2026-98053)
- bpf: Mark syscall helpers as sleepable (CVE-2026-98058)
- bpf: Mark signal tracepoint siginfo arguments as scalar (CVE-2026-98062)
- erofs: disable LZ4 rolling decompression for now (CVE-2026-98067)
- net: rename netns_local to netns_immutable
- net: plumb extack in __dev_change_net_namespace()
- net: Remove conflicting altnames for dying netns in
__dev_change_net_namespace(). (CVE-2026-98073)
- btrfs: zstd: fix lost wakeup when waiting for a workspace (CVE-2026-98079)
- bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks
(CVE-2026-98084)
- bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
(CVE-2026-98085)
- ipv6: mcast: use rcu_assign_pointer() for __rcu list updates
(CVE-2026-98099)
- smb/client: invalidate fscache for fallocate range operations
(CVE-2026-98124)
- net: stmmac: fix dma mapping leak in stmmac_tso_xmit() (CVE-2026-98131)
- bpf: check_cond_jmp_op(): properly infer if register is null
(CVE-2026-98134)
- printk: Don't WARN on kthread_run failure. (CVE-2026-98147)
- drm/gud: validate GUD_ROTATION_0 is present in supported rotations
(CVE-2026-98148)
- drm/virtio: Use drm_gem_plane_helper_prepare_fb()
- drm/virtio: Add a helper to map and note the dma addrs and lengths
- drm/virtio: use the DMA API for resource backing on Xen (CVE-2026-98156)
- functionfs: fix the open/removal races (CVE-2025-71074)
- ACPI: platform: Use acpi_bus_get_primary_device() (CVE-2026-100072)
- [amd64] KVM: nSVM: Triple fault if restore host CR3 fails on nested
#VMEXIT (CVE-2026-46032)
- greybus: raw: fix use-after-free if write is called after disconnect
(CVE-2026-53024)
- firmware: arm_ffa: Add support for IMPDEF value in the memory access
descriptor
- firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset
calculation (CVE-2026-68400)
- pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI
(CVE-2026-72009)
- cxl/region: Resolve region deletion races (CVE-2026-74272)
- bpf: Remove migrate_{disable|enable} in bpf_obj_free_fields()
- bpf: Clear rb node linkage when freeing bpf_rb_root (CVE-2026-74344)
- ocfs2: validate external xattr entries when reading metadata
(CVE-2026-90320)
- dm-integrity: replace forgeable discard filler with a keyed sector marker
(CVE-2026-90333)
- [amd64] perf/x86/intel/uncore: Fix uncore_box ref/unref ordering
(CVE-2026-93181)
- i3c: master: Fix recursive locking during device registration
(CVE-2026-93202)
- xfs: remove unused trace event xfs_dqreclaim_dirty
- ublk: fix dead loop when canceling io command
- riscv: uaccess: Only restore the CSR_STATUS SUM bit
- [s390x] kvm: Initialize uninitialized flags variable
- [s390x] KVM: s390: wrapper for KVM_BUG
- [s390x] KVM: s390: move pv gmap functions into kvm
- [s390x] KVM: s390: use __kvm_faultin_pfn()
- [s390x] KVM: s390: move gmap_shadow_pgt_lookup() into kvm
- [s390x] KVM: s390: pv: fix race when making a page secure
- [s390x] KVM: s390: Fix FOLL_*/FAULT_FLAG_* confusion
- [s390x] kvm: Mask extra bits from program interrupt code
- scsi: ufs: qcom : Fix NULL pointer dereference in ufs_qcom_setup_clocks
- accel/ivpu: Fix race condition when mapping dmabuf
- [amd64] KVM: SEV: Drop FOLL_WRITE for encrypted region registration
- net: Fix wild-memory-access in __register_pernet_operations() when
CONFIG_NET_NS=n.
- mpls: Set rt->rt_nhn just before returning from mpls_nh_build_multi().
- media: verisilicon: Fix kernel panic due to __initconst misuse
- soc/tegra: pmc: Document tegra_pmc.syscore field
- soc/tegra: pmc: Add kerneldoc for wake-up variables
- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring
- ceph: do not skip the first folio of the next object in writeback
- ceph: fix crash after fscrypt_encrypt_pagecache_blocks() error
- ceph: introduce ceph_submit_write() method
- ceph: always call ceph_shift_unused_folios_left()
- spi: microchip-core-qspi: stop checking viability of op->max_freq in
supports_op callback
- sched/psi: Create the psimon kthread outside of cgroup_mutex
- ocfs2: use correct endian in ocfs2_dinode_has_extents
- netfs: release readahead folios on iterator preparation failure
- netfs: Fix folio state after ENOMEM whilst under writeback iteration
- net: do not acquire dev->tx_global_lock in netdev_watchdog_up()
- [s390x] zcrypt: Fix memory leak with CCA cards used as accelerator
- EDAC/igen6: Fix the flood of invalid error reports
- netfilter: ctnetlink: do not expose expectation DEAD flag
- EDAC/igen6: Fix NULL pointer dereference
- Revert "esp: do not unref managed frag pages in esp_ssg_unref()"
- mm/hugetlb_vmemmap: fix incorrect vmemmap restore in rollback
- PM: sleep: Unblock runtime PM when device prepare fails
- soundwire: intel_auxdevice: Fix system suspend/resume handling
- gpiolib: Allow to use setters with return value for output-only gpios
- gpiolib: initialize return value in gpiochip_set_multiple()
- i3c: master: svc: Fix missed IBI after false SLVSTART on NPCM845
- i3c: master: svc: Fix npcm845 FIFO_EMPTY quirk
- i3c: master: svc: Fix i3c_master_get_free_addr return check
- tracing: Fix ring_buffer_read_page_size() kernel-doc
- tracing: Fix comment in tracing_buffers_splice_read()
- dm-integrity: fix buffer overflow with keyed discard
- bpf, sockmap: Account for receive queue in FIONREAD without a verdict
program
- wifi: atk9k: Revert "wifi: ath9k: reject short WMI command responses"
(Closes: #1151097)
- [s390x] uv: Don't return 0 from make_hva_secure() if the operation was not
successful
- drm/panfrost: Fix scheduler workqueue bug
- ksmbd: fix heap out-of-bounds write in krb5_authenticate()
- [amd64] KVM: x86: Use active memslots for the per-vCPU MMIO cache
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.115
- rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup
- rose: disconnect orphaned STATE_2 sockets when device is gone
- rose: release netdev ref and destroy orphaned incoming sockets
- rose: clear neighbour pointer in rose_kill_by_device()
- rose: don't free fd-owned sockets when reaping in the heartbeat
- rose: keep the route needed for routing loop detection
- rose: guard rose_transmit_link() against a NULL neighbour
- rose: use timer_shutdown_sync() for t0timer teardown
- rose: don't warn on stray CALL_ACCEPTED/CLEAR_CONFIRMATION in state 3
- rose: hold a reference on incoming sockets queued for accept()
- ax25: bound REJ-driven fast retransmits with the existing N2 counter
- rose: purge rose_neigh->queue on final teardown
- mptcp: move the OoO check back into __mptcp_try_fallback()
- fat: stop reading directory entries past the end-of-directory marker
- [arm64,armhf] soc/tegra: fuse: Add missing newline to APBMISC error
message
- power: supply: Fix maintenance charge table kernel-doc
- power: supply: ds2780: Fix ds2780_get_capacity() returning raw value
- Drivers: hv: Avoid infinite retry loop in init_vp_index()
- [amd64] x86/hyperv: Avoid using per-cpu output page in
hv_apicid_to_vp_index()
- Drivers: hv: Don't reset VMBus connection state on error/exit paths
(CVE-2026-99216)
- pinctrl: qcom: ipq5018: add missing pwm3 function on gpio13
- tools/power turbostat: Fix fd_perf leak on reset
- tools/power turbostat: Fix add_counter issue if > 24 counters.
- power: supply: generic-adc-battery: Fix temperature IIO channel conversion
- pinctrl: qcom: ipq5018: replace gcc_plltest with pwm2 on gpio12
- drm/vc4: hdmi: Move packet RAM enable to PM runtime (CVE-2026-99214)
- vsock: treat TCP_CLOSING as once-established (CVE-2026-99213)
- net/rds: don't let the rdma_cm destroy an id RDS still owns on route
failure (CVE-2026-99212)
- [amd64] ASoC: Intel: avs: Reset the stream unless it is already prepared
- [armhf] ASoC: stm32: spdifrx: fix synchronization state check
- regcache: Add ->populate() callback to separate from ->init()
- regcache: Do not overwrite error code when finalizing cache after error
- regmap: Drop map lock during cache init and exit
- netlink: reset skb headers before unicast and multicast filtering
(CVE-2026-99211)
- [arm64,armhf] spi: tegra114: assert CS GPIO for every transfer in a
message
- scsi: st: Save the visited block for the partition the drive is in
- scsi: target: iscsi: Fix race in discovery auth updates (CVE-2026-99206)
- ocfs2/dlm: Protect the recovery list during debugfs reads (CVE-2026-99204)
- pipe: preserve existing fasync readers on writer setup failure
(CVE-2026-99203)
- tracing: probes: error if BTF is required but unavailable
- scsi: libsas: Fix SMP IO deadlock during HA resume (CVE-2026-99202)
- netlink: avoid hashing the network namespace pointer (CVE-2026-99201)
- net: bcmgenet: unshare the skb before writing the control block
(CVE-2026-99192)
- net/ipv6: Introduce payload_len helpers
- calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()
(CVE-2026-99191)
- gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths
(CVE-2026-99190)
- gpio: mxc: use lock guards for the generic GPIO chip lock
- gpio: mxc: fix both_edges bit operations
- gpio: mxc: use BIT() macro
- gpio: mxc: fix wakeup_pads bit operations
- perf: Fix perf_pmu_migrate_context() leaving events behind
(CVE-2026-99187)
- printk: Postpone kthread startup
- PCI: Don't treat ~0 as ready in pci_dev_wait() with RRS SV
(Closes: #1112238)
- afs: free the super info after a grace period
- autofs: ignore notification errors from a replaced pipe (CVE-2026-99181)
- unicode: free the map after a grace period (CVE-2026-99180)
- [amd64] x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI
context (CVE-2026-99178)
- [amd64] KVM: nVMX: Reset MMU back to the root MMU if loading L2 state
fails for !VM-Entry (CVE-2026-99176)
- fsnotify: prevent mark additions during connector teardown
(CVE-2026-99175)
- pid_namespace: make zap_pid_ns_processes() freezable
- eventfs: Free the eventfs_inode after an rcu grace period too
(CVE-2026-99173)
- namei: test for a negative dentry the way traverse_mounts() does
- net/sched: fix use-after-free in __tcf_action_put() (CVE-2026-99167)
- net: rds: fix uninitialized trans dereference in CM event handler
(CVE-2026-99166)
- pinctrl: amd: Clear S4 wake bits when firmware has _AEI
- sctp: revalidate output stream after association connect wait
(CVE-2026-99165)
- tools: gpio: fix building from the top level with O=
- tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace
fields (CVE-2026-99163)
- i2c: qcom-cci: Fix HALT_ACK reset request being dropped
- perf: Update cgroup time when rotating multiplexed events
- ring-buffer: Do not show buffer_meta for CPUs without a buffer
(CVE-2026-99160)
- ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()
(CVE-2026-99159)
- ring-buffer: Fix false warning in ring_buffer_map_get_reader()
(CVE-2026-99158)
- scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies
(CVE-2026-99157)
- scsi: xen/scsifront: Check for a NULL shadow entry on a backend response
(CVE-2026-99155)
- scsi: libiscsi: Reject a negative task index from parse_pdu_itt
(CVE-2026-99154)
- scsi: libiscsi: Validate the ITT reflected in a Reject PDU
(CVE-2026-99153)
- scsi: libiscsi: Validate the task named by a management response
(CVE-2026-99152)
- drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang
- drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr
(CVE-2026-99150)
- drm/exec: don't immediately add prelocked obj to array of locked objs
(CVE-2026-99147)
- tracing: Fix the shift out of bounds in the log2 histogram modifier
- tracing: Take trace_types_lock when dropping the buffer_meta reference
- tracing: Check operator stack capacity before pushing (CVE-2026-99142)
- tracing: Do not initialize tracefs work if tracing is disabled
- tracing: Fix hist trigger timestamps for buffered events (CVE-2026-99140)
- wifi: p54: validate firmware record lengths (CVE-2026-99100)
- tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)
(CVE-2026-99139)
- tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO) (CVE-2026-99138)
- cgroup: fix spurious SIGKILL of CLONE_INTO_CGROUP children
- dm cache: fix demotion stats in passthrough mode
- dm cache: fix issue with background work locking
- dm-crypt: fix a tiny race condition in crypt_dec_pending (CVE-2026-99136)
- dm-ebs: fix incorrect device offset check in ebs_ctr()
- dm-integrity: fix infinite loop on discard with large tag size
(CVE-2026-99135)
- dm-integrity: require stable writes for internal hash modes
- mac802154: fix data race and NULL deref on local->assoc_dev
(CVE-2026-99134)
- net/iucv: fix the recvmsg window update (CVE-2026-99133)
- xfs: fix capability check in xfs (CVE-2026-99131)
- workqueue: Use raise_softirq() to trigger softirq in irq_work handler
- tipc: protect node reset trace dump with node lock
- sctp: validate chunk length in the inqueue parser (CVE-2026-99128)
- page_pool: keep frag_offset aligned for odd-sized requests
(CVE-2026-99127)
- [s390x] ctcm: Prevent XID null dereference (CVE-2026-99126)
- [s390x] pci: Fix leak of uninitialized kernel data in SCLP report
(CVE-2026-99124)
- ipv4: avoid divide by zero in fib_rebalance (CVE-2026-99121)
- drm/amdgpu: Fix VCE 3 ring align_mask
- mm, madvise: fix potential workingset node list_lru leaks
(Closes: #1151281)
- mm/huge_memory: initialise workingset state before folio split
- [s390x] Revert "s390/mm: Add missing secure storage access fixups for
donated memory"
- netfilter: nft_byteorder: remove multi-register support
- mm/huge_memory: bypass THP tuneables for huge pfnmap mappings
- [amd64] KVM: x86/mmu: Preserve nested TDP shadow page tables if they are
used as roots
- net: bridge: mcast: don't truncate the port group walk on teardown
(CVE-2026-99117)
- ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION (CVE-2026-99115)
- ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION
(CVE-2026-99114)
- ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in
(CVE-2026-99113)
- net/sched: cls_flower: validate mask pointer after nla_next()
(CVE-2026-99112)
- smb: client: fix heap overflow in cifs_do_set_acl() (CVE-2026-99110)
- smb: client: fix multiuser mount with krb5
- scsi: st: Fix use-after-free race between st_remove() and st_open()
(CVE-2026-99156)
- perf: Track the perf mlock gift separately
- eventfs: fix SRCU read lock leak in eventfs_iterate()
- net: call getsockopt_iter if available
- kernel/watch_queue: Use pipe_buf() to retrieve the pipe buffer
- watch_queue: Fix note pool publication race in watch_queue_set_size()
(CVE-2026-99179)
- ntfs3: free the sbi after a grace period (CVE-2026-99171)
- ext4: free the sbi after a grace period (CVE-2026-99174)
- [amd64] ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated
ALH capture (CVE-2026-99182)
- drm/xe: Bump LRU for external objects on exec and rebind
- tracing: Keep the predicate limit separate from program capacity
(CVE-2026-99143)
- io_uring/cancel: don't spin on local work the task can't run
(CVE-2026-99130)
- virtio: set skb owner of virtio_transport_reset_no_sock() reply
- vsock/virtio: validate packet source for connected sockets
(CVE-2026-99123)
- ipv4: udp: Create exceptions before socket matching (CVE-2026-99077)
- workqueue: release pwq pools by pool type
- workqueue: Fix unbound pool lifetime for pending pwqs (CVE-2026-99103)
- i2c: viai2c-wmt: Replace dev_err() with dev_err_probe() in probe function
- i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe() (CVE-2026-99161)
- futex: Fix mm reuse handling for FUT_OFF_MMSHARED (CVE-2026-99169)
- [amd64] drm/i915/dmc: Harden DMC firmware payload parsing (CVE-2026-99118)
- tracing: Fix ignored return value of resize_buffer_duplicate_size()
- drm/amdgpu: free the userptr ranges when a CS fails after parser_bos
(CVE-2026-99106)
- sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on
its CPU's local DSQ (CVE-2026-99105)
- cifs: add revalidation on FSCTL failure in smb2_duplicate_extents()
- xfs: don't hold buffer locks across sync transaction commit in
xfs_sync_sb_buf (CVE-2026-99132)
- rose: clear stale N(R)/N(S) before (re)transmitting a data frame
- netrom: linearize and validate lengths in nr_rx_frame()
- netrom: require full NET/ROM headers in nr_route_frame()
- net: netrom: validate source address in nr_find_socket()
- netrom: bound fragment reassembly in nr_queue_rx_frame()
- ax25: fix OOB read after address header strip in ax25_rcv()
- ax25: check frame length in ax25_decode() and ax25_rx_iframe()
- net: ax25: fix integer overflow in ax25_rx_fragment()
- netrom: use a single lock for the node and neighbour lists
- netrom: look up and update routes in one critical section
- netrom: fix reference count leak in nr_rt_device_down
- netrom: clear nr_neigh->ax25 under the routing lock in nr_link_failed()
- netrom: fix nr_node leak when nr_del_node() removes the last route
- rose: clear through routes when a neighbour is removed from the tables
- rose: restart the link of a neighbour created over a live AX.25 connection
- ax25: serialise the transmission of I frames on a connection
- rose: process received frames and send with the socket locked
- ax25: don't create two connections for the same link in ax25_send_frame()
- ax25: read the connection's ax25_dev only once when walking ax25_list
- ax25: wait for ax25_send_frame() before detaching the connections of a
device
- ax25: don't accept frames on a device that is going down
- ax25: send a private copy of each I frame
- rose: clear the circuits of a neighbour that restarts the link
- ax25: send unacknowledged I frames again when a link is re-established
- rose: bring up the link of the preferred route passed over by a connect
request
- ax25: don't free an incoming SABM skb left on the listener's queue
- mm/pagewalk: fix stale walk->action escaping walk_pmd_range()
- block: avoid potential deadlock on zone revalidation failure
- Revert "srcu: Use irq_work to start GP in tiny SRCU"
- net_sched: codel: fix stale state for empty flows in fq_codel
- Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn
- tracing: Reject incomplete event filter expressions
- tracing: Save the event file instead of the compatible histogram
- tracing: Unregister field variable histograms when the command fails
- tracing: Fix 64-bit and signed histogram fields on 32-bit kernels
- tracing/histograms: Verify event_call identity when updating synth_event
refcount
- io-wq: order the exit bit against worker creation task work
- io_uring/waitid: own the request before clearing ->head
- io_uring/cmd: don't leave list poison in ->hash_node
- io_uring/wait: don't spin on a stuck overflow list
- io_uring/io-wq: don't lose the signal that ends work
- io_uring/io-wq: don't hide a link from cancellations
- io_uring: don't flood a cancelling task with task_work
- io_uring/io-wq: don't strand work when a worker exits
- io_uring/io-wq: don't exit with a creation pending
- io_uring/io-wq: let cancel find picked up hashed work
- io_uring/poll: don't lose a cancel as io-wq arms poll
- io_uring: don't lose a cancel as io-wq parks a request
- io_uring/cancel: don't forget that the work was running
- io_uring/cancel: recognize "no timeout" on 32-bit
- io_uring/cancel: let CANCEL_ALL find parked requests
- io_uring: wake ring pollers for local task_work
- io_uring/wait: look at all CQ waiters on wake up
- io_uring/poll: drop stale double poll entry on rearm
- io_uring/timeout: don't skip over reached sequences
- io_uring/timeout: keep repeat count on multishot update
- io_uring/wait: no early -ETIME if min_wait finds work
- io_uring/napi: make stale entries time out after 60s
- io_uring/napi: don't busy poll past an expired timeout
- io_uring/kbuf: handle index wrap in last buffer check
- io_uring/sqpoll: let the thread sleep on disabled rings
- io_uring: don't pass restart error codes to userspace
- io_uring/net: don't retry recv on uncommitted buffers
- io_uring/timeout: no ABS update of multishot timeouts
- io_uring/timeout: don't end a linked timeout with 1
- io_uring: look up the file before queueing to io-wq
- io_uring/poll: avoid retry wakeup loss when dropping ownership
- io_uring/timeout: don't put a sequence target behind the last flush
- io_uring/timeout: don't flush with the sequence behind the last flush
- io_uring/timeout: don't lose a cancel as io-wq arms a timeout
- io_uring/poll: don't loop on HUP with multiple references
- io_uring/net: keep recv buffer select length within MAX_RW_COUNT
- io_uring/wait: wake real-time waiters from hard interrupt context
- io_uring/waitid: prevent cancel reference wrap
- keys: Avoid the owner account dereference in named keyring lookup
- keys: Check the authorization payload in process keyring searches
- keys: Protect the type name while describing a key
- keys: make keyring indexes independent of kernel addresses
- keys: Protect the read method check against type removal
- KEYS: Fix key_reject_and_link() race with keyring restriction
- KEYS: trusted: Fix blob allocation size in tpm2_key_decode()
- keys/trusted_keys: return immediately after TPM unseal failure
- asymmetric_keys: reject trust keys without IDs
- ftrace: Initialize modname and offset in print_rec()
- coredump: hold RCU while releasing parked threads
- signal: don't retarget shared signals in a dying thread group
- signal: only SIGKILL and the freezers interrupt a coredumping task
- ptrace: refuse to change the signal mask of a user worker
- fork: release the files of a failed fork after sched_cancel_fork()
- signal: allow taks to temporarily block TIF_NOTIFY_SIGNAL
- pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
.
[ Salvatore Bonaccorso ]
* net: skbuff: propagate shared-frag marker in skb_zerocopy()
Checksums-Sha1:
5f96a19a2b4aabc8ed20412655ee33d06b277eec 10935 linux-signed-amd64_6.12.115+1.dsc
9ed0b4784cd8ac98468acf9cc2e723b07e33cf82 1096424 linux-signed-amd64_6.12.115+1.tar.xz
Checksums-Sha256:
f45ebc7c7a0886716ccbd5748ef91848a2c62b2fb6d5adb0a7ab3c530c09cb87 10935 linux-signed-amd64_6.12.115+1.dsc
9170afb38b423824f96d884255da0d3a4e480147ec0cfcc45c7ea0ba5a95b3b1 1096424 linux-signed-amd64_6.12.115+1.tar.xz
Files:
ac248c920ca6f7387225024593d75361 10935 kernel optional linux-signed-amd64_6.12.115+1.dsc
b024ee773f460b3fca568e5fb35955a9 1096424 kernel optional linux-signed-amd64_6.12.115+1.tar.xz
-----BEGIN PGP SIGNATURE-----
iHUEARYKAB0WIQSInBJdRTWyTRy0ztFCTVFtUgONCgUCauZEUAAKCRBCTVFtUgON
ClddAP93aCjutCC7RnMqic1lCiGkf0lRzL66162MGDnVk3SiCwEAmRJsXa7+RV1+
CdWgsBrBG+CUbFJTkazywUwfoTtucgI=
=21uS
-----END PGP SIGNATURE-----
