Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package kernel-source-longterm for openSUSE:Factory checked in at 2026-07-08 17:32:42 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/kernel-source-longterm (Old) and /work/SRC/openSUSE:Factory/.kernel-source-longterm.new.1982 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "kernel-source-longterm" Wed Jul 8 17:32:42 2026 rev:133 rq:1364181 version:6.18.38 Changes: -------- --- /work/SRC/openSUSE:Factory/kernel-source-longterm/kernel-longterm.changes 2026-06-29 17:29:34.844432392 +0200 +++ /work/SRC/openSUSE:Factory/.kernel-source-longterm.new.1982/kernel-longterm.changes 2026-07-08 17:34:04.232300722 +0200 @@ -1,0 +2,207 @@ +Mon Jul 6 09:30:11 CEST 2026 - [email protected] + +- Revert "apparmor: fix use-after-free in rawdata dedup loop (bko#221513)." + This reverts commit 56e7bc4e4e6e6d21b0fe6181ce275ead50467d84. +- commit 0a98124 + +------------------------------------------------------------------- +Sat Jul 4 23:22:17 CEST 2026 - [email protected] + +- Linux 6.18.38 (bsc#1258210). +- apparmor: advertise the tcp fast open fix is applied + (bsc#1258210). +- net/tcp-ao: fix use-after-free of key in del_async path + (bsc#1258210). +- serial: 8250_dw: unregister 8250 port if clk_notifier_register() + fails (bsc#1258210). +- ksmbd: fix out-of-bounds read in smb_check_perm_dacl() + (bsc#1258210). +- NFS: Prevent resource leak in nfs_alloc_server() (bsc#1258210). +- NFSv4: clear exception state on successful mkdir retry + (bsc#1258210). +- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr + (bsc#1258210). +- NFSv4/flexfiles: reject zero filehandle version count + (bsc#1258210). +- nfsd: reset write verifier on deferred writeback errors + (bsc#1258210). +- nfsd: avoid leaking pre-allocated openowner on unconfirmed + retry race (bsc#1258210). +- nfsd: check get_user() return when reading princhashlen + (bsc#1258210). +- nfsd: fix inverted cp_ttl check in async copy reaper + (bsc#1258210). +- nfsd: fix posix_acl leak on SETACL decode failure (bsc#1258210). +- NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1258210). +- i2c: core: fix adapter registration race (bsc#1258210). +- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode + (bsc#1258210). +- fbdev: modedb: fix a possible UAF in fb_find_mode() + (bsc#1258210). +- fbdev: Fix fb_new_modelist to prevent null-ptr-deref in + fb_videomode_to_var (bsc#1258210). +- riscv: kfence: Call mark_new_valid_map() for kfence_unprotect() + (bsc#1258210). +- riscv: mm: Extract helper mark_new_valid_map() (bsc#1258210). +- power: reset: linkstation-poweroff: fix use-after-free in the + linkstation_poweroff_init() (bsc#1258210). +- KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path + (bsc#1258210). +- KVM: x86: hyper-v: Bound the bank index when querying sparse + banks (bsc#1258210). +- MIPS: smp: report dying CPU to RCU in stop_this_cpu() + (bsc#1258210). +- 9p: avoid putting oldfid in p9_client_walk() error path + (bsc#1258210). +- ocfs2: reject oversized group bitmap descriptors (bsc#1258210). +- rpmsg: char: Fix use-after-free on probe error path + (bsc#1258210). +- fpga: region: fix use-after-free in child_regions_with_firmware() + (bsc#1258210). +- irqchip/imgpdc: Fix resource leak, add missing chained handler + cleanup on remove (bsc#1258210). +- pNFS: Fix use-after-free in pnfs_update_layout() (bsc#1258210). +- LoongArch: Report dying CPU to RCU in stop_this_cpu() + (bsc#1258210). +- tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done + (bsc#1258210). +- blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1258210). +- hdlc_ppp: sync per-proto timers before freeing hdlc state + (bsc#1258210). +- pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() + (bsc#1258210). +- gfs2: fix use-after-free in gfs2_qd_dealloc (bsc#1258210). +- crypto: nx - fix nx_crypto_ctx_exit argument (bsc#1258210). +- KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch + with get_unaligned() (bsc#1258210). +- KVM: x86/mmu: Ensure hugepage is in by slot before checking + max mapping level (bsc#1258210). +- exfat: fix potential use-after-free in exfat_find_dir_entry() + (bsc#1258210). +- MIPS: DEC: Prevent initial console buffer from landing in XKPHYS + (bsc#1258210). +- bpf: use kvfree() for replaced sysctl write buffer (bsc#1258210). +- block: Avoid mounting the bdev pseudo-filesystem in userspace + (bsc#1258210). +- f2fs: keep atomic write retry from zeroing original data + (bsc#1258210). +- f2fs: fix incorrect FI_NO_EXTENT handling in + __destroy_extent_node() (bsc#1258210). +- f2fs: validate ACL entry sizes in f2fs_acl_from_disk() + (bsc#1258210). +- f2fs: fix to round down start offset of fallocate for pin file + (bsc#1258210). +- f2fs: validate compress cache inode only when enabled + (bsc#1258210). +- f2fs: validate orphan inode entry count (bsc#1258210). +- f2fs: pass correct iostat type for single node writes + (bsc#1258210). +- wifi: iwlwifi: mld: validate sta_mask before ffs() in BA + session handlers (bsc#1258210). +- wifi: iwlwifi: mld: fix race condition in PTP removal + (bsc#1258210). +- wifi: iwlwifi: mvm: fix race condition in PTP removal + (bsc#1258210). +- wifi: rtw88: usb: fix memory leaks on USB write failures + (bsc#1258210). +- wifi: rtw88: increase TX report timeout to fix race condition + (bsc#1258210). +- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor + (bsc#1258210). +- wifi: ath11k: fix warning when unbinding (bsc#1258210). +- wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer + (bsc#1258210). +- wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S + (bsc#1258210). +- userfaultfd: ensure mremap_userfaultfd_fail() releases + mmap_changing (bsc#1258210). +- keys: Pin request_key_auth payload in instantiate paths + (bsc#1258210). +- KEYS: fix overflow in keyctl_pkey_params_get_2() (bsc#1258210). +- gcov: use atomic counter updates to fix concurrent access + crashes (bsc#1258210). +- err.h: use __always_inline on all error pointer helpers + (bsc#1258210). +- KVM: arm64: Omit tag sync on stage-2 mappings of the zero page + (bsc#1258210). +- block: invalidate cached plug timestamp after task switch + (bsc#1258210). +- kernel/fork: clear PF_BLOCK_TS in copy_process() (bsc#1258210). +- fbdev: fix use-after-free in store_modes() (bsc#1258210). +- NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and + CONFIG share BAR (bsc#1258210). +- apparmor: fix use-after-free in rawdata dedup loop (bsc#1258210). +- apparmor: mediate the implicit connect of TCP fast open sendmsg + (bsc#1258210). +- net: ip_gre: require CAP_NET_ADMIN in the device netns for + changelink (bsc#1258210). +- net: skmsg: preserve sg.copy across SG transforms (bsc#1258210). +- mac802154: llsec: add skb_cow_data() before in-place crypto + (bsc#1258210). +- af_unix: Set gc_in_progress to true in unix_gc() (bsc#1258210). +- wifi: mt76: add wcid publish check in mt76_sta_add (bsc#1258210). +- ntfs3: reject direct userspace writes to reserved $LX* xattrs + (bsc#1258210). +- ipv4: account for fraggap on the paged allocation path + (bsc#1258210). +- ipv6: account for fraggap on the paged allocation path + (bsc#1258210). +- batman-adv: tvlv: avoid race of cifsnotfound handler state + (bsc#1258210). +- batman-adv: tvlv: enforce 2-byte alignment (bsc#1258210). +- batman-adv: dat: prevent false sharing between VLANs + (bsc#1258210). +- batman-adv: tt: track roam count per VID (bsc#1258210). +- batman-adv: tt: don't merge change entries with different VIDs + (bsc#1258210). +- batman-adv: tp_meter: handle overlapping packets (bsc#1258210). +- batman-adv: tp_meter: prevent parallel modifications of last_recv + (bsc#1258210). +- batman-adv: tp_meter: annotate last_recv_time access with + READ/WRITE_ONCE (bsc#1258210). +- batman-adv: tp_meter: restrict number of unacked list entries + (bsc#1258210). +- batman-adv: v: prevent OGM aggregation on disabled hardif + (bsc#1258210). +- batman-adv: frag: avoid underflow of TTL (bsc#1258210). +- batman-adv: frag: ensure fragment is writable before modifying + TTL (bsc#1258210). +- batman-adv: fix (m|b)cast csum after decrementing TTL + (bsc#1258210). +- batman-adv: ensure bcast is writable before modifying TTL + (bsc#1258210). +- batman-adv: gw: don't deselect gateway with active hardif + (bsc#1258210). +- batman-adv: tp_meter: initialize last_recv_time during init + (bsc#1258210). +- batman-adv: prevent ELP transmission interval underflow + (bsc#1258210). +- batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE + (bsc#1258210). +- batman-adv: tp_meter: add only finished tp_vars to lists + (bsc#1258210). +- batman-adv: tp_meter: handle seqno wrap-around for fast recovery + detection (bsc#1258210). +- batman-adv: tp_meter: fix fast recovery precondition + (bsc#1258210). +- batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd + (bsc#1258210). +- batman-adv: tp_meter: avoid window underflow (bsc#1258210). +- batman-adv: tp_meter: initialize dec_cwnd explicitly + (bsc#1258210). +- batman-adv: tp_meter: initialize dup_acks explicitly + (bsc#1258210). +- batman-adv: tp_meter: keep unacked list in ascending ordered + (bsc#1258210). +- lockd: fix TEST handling when not all permissions are available + (bsc#1258210). +- Revert "PCI: qcom: Advertise Hotplug Slot Capability with no + Command Completion support" (bsc#1258210). +- selinux: fix overlayfs mmap() and mprotect() access checks + (bsc#1258210). +- lsm: add backing_file LSM hooks (bsc#1258210). +- KVM: x86: Fix shadow paging use-after-free due to unexpected + role (bsc#1258210). +- commit ddc10c7 + +------------------------------------------------------------------- kernel-source-longterm.changes: same change kernel-syms-longterm.changes: same change ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ kernel-longterm.spec ++++++ --- /var/tmp/diff_new_pack.eJyPoY/_old 2026-07-08 17:34:07.476414342 +0200 +++ /var/tmp/diff_new_pack.eJyPoY/_new 2026-07-08 17:34:07.480414483 +0200 @@ -18,8 +18,8 @@ %define srcversion 6.18 -%define patchversion 6.18.37 -%define git_commit 2afdd3fd759f01ede4f9c9874d4f3b8fee369a98 +%define patchversion 6.18.38 +%define git_commit 0a981243ad63e6f94001965c01627d27ed9be52c %define variant -longterm%{nil} %define compress_modules zstd %define compress_vmlinux xz @@ -40,9 +40,9 @@ %(chmod +x %_sourcedir/{guards,apply-patches,check-for-config-changes,group-source-files.pl,split-modules,modversions,kabi.pl,arch-symbols,check-module-license,splitflist,mergedep,moddep,modflist,kernel-subpackage-build}) Name: kernel-longterm -Version: 6.18.37 +Version: 6.18.38 %if 0%{?is_kotd} -Release: <RELEASE>.g2afdd3f +Release: <RELEASE>.g0a98124 %else Release: 0 %endif ++++++ kernel-source-longterm.spec ++++++ --- /var/tmp/diff_new_pack.eJyPoY/_old 2026-07-08 17:34:07.524416023 +0200 +++ /var/tmp/diff_new_pack.eJyPoY/_new 2026-07-08 17:34:07.528416163 +0200 @@ -17,8 +17,8 @@ %define srcversion 6.18 -%define patchversion 6.18.37 -%define git_commit 2afdd3fd759f01ede4f9c9874d4f3b8fee369a98 +%define patchversion 6.18.38 +%define git_commit 0a981243ad63e6f94001965c01627d27ed9be52c %define variant -longterm%{nil} %define gcc_package gcc %define gcc_compiler gcc @@ -28,9 +28,9 @@ %(chmod +x %_sourcedir/{guards,apply-patches,check-for-config-changes,group-source-files.pl,split-modules,modversions,kabi.pl,arch-symbols,check-module-license,splitflist,mergedep,moddep,modflist,kernel-subpackage-build}) Name: kernel-source-longterm -Version: 6.18.37 +Version: 6.18.38 %if 0%{?is_kotd} -Release: <RELEASE>.g2afdd3f +Release: <RELEASE>.g0a98124 %else Release: 0 %endif ++++++ kernel-syms-longterm.spec ++++++ --- /var/tmp/diff_new_pack.eJyPoY/_old 2026-07-08 17:34:07.580417985 +0200 +++ /var/tmp/diff_new_pack.eJyPoY/_new 2026-07-08 17:34:07.580417985 +0200 @@ -16,15 +16,15 @@ # -%define git_commit 2afdd3fd759f01ede4f9c9874d4f3b8fee369a98 +%define git_commit 0a981243ad63e6f94001965c01627d27ed9be52c %define variant -longterm%{nil} %include %_sourcedir/kernel-spec-macros Name: kernel-syms-longterm -Version: 6.18.37 +Version: 6.18.38 %if 0%{?is_kotd} -Release: <RELEASE>.g2afdd3f +Release: <RELEASE>.g0a98124 %else Release: 0 %endif ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.eJyPoY/_old 2026-07-08 17:34:07.744423729 +0200 +++ /var/tmp/diff_new_pack.eJyPoY/_new 2026-07-08 17:34:07.756424149 +0200 @@ -1,6 +1,6 @@ -mtime: 1782626679 -commit: 13eb0ce63d0b4d25730bfaa68b8793eea9dce536dd56c812387082a5223de5e0 +mtime: 1783404335 +commit: 4f1b91752724cf44d324000535e0e77fb0a0c661d1a57bdff3328b3d5b5b99b5 url: https://src.opensuse.org/kernelbugs/kernel-source-longterm -revision: 13eb0ce63d0b4d25730bfaa68b8793eea9dce536dd56c812387082a5223de5e0 +revision: 4f1b91752724cf44d324000535e0e77fb0a0c661d1a57bdff3328b3d5b5b99b5 trackingbranch: Kernel/slowroll ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-07-07 08:05:35.000000000 +0200 @@ -0,0 +1 @@ +.osc ++++++ patches.kernel.org.tar.bz2 ++++++ /work/SRC/openSUSE:Factory/kernel-source-longterm/patches.kernel.org.tar.bz2 /work/SRC/openSUSE:Factory/.kernel-source-longterm.new.1982/patches.kernel.org.tar.bz2 differ: char 11, line 1 ++++++ patches.suse.tar.bz2 ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/patches.suse/apparmor-fix-use-after-free-in-rawdata-dedup-loop.patch new/patches.suse/apparmor-fix-use-after-free-in-rawdata-dedup-loop.patch --- old/patches.suse/apparmor-fix-use-after-free-in-rawdata-dedup-loop.patch 2026-06-17 03:39:38.000000000 +0200 +++ new/patches.suse/apparmor-fix-use-after-free-in-rawdata-dedup-loop.patch 1970-01-01 01:00:00.000000000 +0100 @@ -1,114 +0,0 @@ -From 6f060496d03e4dc560a40f73770bd08335cb7a27 Mon Sep 17 00:00:00 2001 -From: Ruslan Valiyev <[email protected]> -Date: Tue, 26 May 2026 00:04:46 +0200 -Subject: [PATCH] apparmor: fix use-after-free in rawdata dedup loop -References: bko#221513 -Patch-mainline: Queued in subsystem maintainer repository -Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor.git -Git-commit: 6f060496d03e4dc560a40f73770bd08335cb7a27 - -aa_replace_profiles() walks ns->rawdata_list to dedup the incoming -policy blob against entries already attached to existing profiles. -Per the kernel-doc on struct aa_loaddata, list membership does not -hold a reference: profiles hold pcount, and when the last pcount -drops, do_ploaddata_rmfs() is queued on a workqueue that takes -ns->lock and removes the entry. Between dropping the last pcount -and the workqueue running, an entry remains on the list with -pcount == 0. - -aa_get_profile_loaddata() is an unconditional kref_get() on -pcount, so when the dedup loop hits such an entry, refcount -hardening reports - - refcount_t: addition on 0; use-after-free. - -inside aa_replace_profiles(), and the poisoned counter then -trips "saturated" and "underflow" warnings on the subsequent -uses of the same loaddata. - -Before commit a0b7091c4de4 ("apparmor: fix race on rawdata -dereference") the dedup path used a get_unless_zero-style helper -on a single counter, so the existing "if (tmp)" guard was -meaningful. The split-refcount refactor introduced -aa_get_profile_loaddata(), which has plain kref_get() semantics, -and the guard quietly became a no-op. - -Introduce aa_get_profile_loaddata_not0(), matching the existing -_not0 convention used by aa_get_profile_not0(), and use it for -the rawdata_list dedup lookup so dying entries are skipped. - -Reproduced on x86_64 with v7.1-rc5 in QEMU+KVM running Ubuntu -24.04 + stress-ng 0.17.06: - - stress-ng --apparmor 1 --klog-check --timeout 60s - -Without this patch the three refcount_t warnings fire within a -few seconds. With it the same 60 s run is clean. Coverage is a -smoke-test only; a longer soak with CONFIG_KASAN, CONFIG_KCSAN -and CONFIG_PROVE_LOCKING would be welcome from anyone with the -cycles. - -Fixes: a0b7091c4de4 ("apparmor: fix race on rawdata dereference") -Reported-by: Colin Ian King <[email protected]> -Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221513 -Cc: [email protected] -Signed-off-by: Ruslan Valiyev <[email protected]> -Signed-off-by: John Johansen <[email protected]> -Acked-by: David Disseldorp <[email protected]> ---- - security/apparmor/include/policy_unpack.h | 19 +++++++++++++++++++ - security/apparmor/policy.c | 8 ++++++-- - 2 files changed, 25 insertions(+), 2 deletions(-) - -diff --git a/security/apparmor/include/policy_unpack.h b/security/apparmor/include/policy_unpack.h -index e5a95dc4da1f7..b9de0fdf9ee52 100644 ---- a/security/apparmor/include/policy_unpack.h -+++ b/security/apparmor/include/policy_unpack.h -@@ -163,6 +163,25 @@ aa_get_profile_loaddata(struct aa_loaddata *data) - return data; - } - -+/** -+ * aa_get_profile_loaddata_not0 - get a profile reference count if not zero -+ * @data: reference to get a count on -+ * -+ * Like aa_get_profile_loaddata(), but safe to call on an entry that may -+ * be on a list (e.g. ns->rawdata_list) where the last pcount has already -+ * dropped and the deferred cleanup has not yet run. -+ * -+ * Returns: pointer to reference, or %NULL if @data is NULL or its -+ * profile refcount has already reached zero. -+ */ -+static inline struct aa_loaddata * -+aa_get_profile_loaddata_not0(struct aa_loaddata *data) -+{ -+ if (data && kref_get_unless_zero(&data->pcount)) -+ return data; -+ return NULL; -+} -+ - void __aa_loaddata_update(struct aa_loaddata *data, long revision); - bool aa_rawdata_eq(struct aa_loaddata *l, struct aa_loaddata *r); - void aa_loaddata_kref(struct kref *kref); -diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c -index 847b0ff450c51..b59e827747dad 100644 ---- a/security/apparmor/policy.c -+++ b/security/apparmor/policy.c -@@ -1230,8 +1230,12 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label, - if (aa_rawdata_eq(rawdata_ent, udata)) { - struct aa_loaddata *tmp; - -- tmp = aa_get_profile_loaddata(rawdata_ent); -- /* check we didn't fail the race */ -+ /* -+ * Entries remain on rawdata_list with -+ * pcount == 0 until do_ploaddata_rmfs() -+ * runs; only take a live profile ref. -+ */ -+ tmp = aa_get_profile_loaddata_not0(rawdata_ent); - if (tmp) { - aa_put_profile_loaddata(udata); - udata = tmp; --- -2.51.0 - ++++++ series.conf ++++++ --- /var/tmp/diff_new_pack.eJyPoY/_old 2026-07-08 17:34:08.520450908 +0200 +++ /var/tmp/diff_new_pack.eJyPoY/_new 2026-07-08 17:34:08.532451328 +0200 @@ -8407,6 +8407,117 @@ patches.kernel.org/6.18.37-052-virtiofs-fix-UAF-on-submount-umount.patch patches.kernel.org/6.18.37-053-mm-do-not-copy-page-tables-unnecessarily-for-.patch patches.kernel.org/6.18.37-054-Linux-6.18.37.patch + patches.kernel.org/6.18.38-001-KVM-x86-Fix-shadow-paging-use-after-free-due-.patch + patches.kernel.org/6.18.38-002-lsm-add-backing_file-LSM-hooks.patch + patches.kernel.org/6.18.38-003-selinux-fix-overlayfs-mmap-and-mprotect-acces.patch + patches.kernel.org/6.18.38-004-Revert-PCI-qcom-Advertise-Hotplug-Slot-Capabi.patch + patches.kernel.org/6.18.38-005-lockd-fix-TEST-handling-when-not-all-permissi.patch + patches.kernel.org/6.18.38-006-batman-adv-tp_meter-keep-unacked-list-in-asce.patch + patches.kernel.org/6.18.38-007-batman-adv-tp_meter-initialize-dup_acks-expli.patch + patches.kernel.org/6.18.38-008-batman-adv-tp_meter-initialize-dec_cwnd-expli.patch + patches.kernel.org/6.18.38-009-batman-adv-tp_meter-avoid-window-underflow.patch + patches.kernel.org/6.18.38-010-batman-adv-tp_meter-avoid-divide-by-zero-for-.patch + patches.kernel.org/6.18.38-011-batman-adv-tp_meter-fix-fast-recovery-precond.patch + patches.kernel.org/6.18.38-012-batman-adv-tp_meter-handle-seqno-wrap-around-.patch + patches.kernel.org/6.18.38-013-batman-adv-tp_meter-add-only-finished-tp_vars.patch + patches.kernel.org/6.18.38-014-batman-adv-bla-annotate-lasttime-access-with-.patch + patches.kernel.org/6.18.38-015-batman-adv-prevent-ELP-transmission-interval-.patch + patches.kernel.org/6.18.38-016-batman-adv-tp_meter-initialize-last_recv_time.patch + patches.kernel.org/6.18.38-017-batman-adv-gw-don-t-deselect-gateway-with-act.patch + patches.kernel.org/6.18.38-018-batman-adv-ensure-bcast-is-writable-before-mo.patch + patches.kernel.org/6.18.38-019-batman-adv-fix-m-b-cast-csum-after-decrementi.patch + patches.kernel.org/6.18.38-020-batman-adv-frag-ensure-fragment-is-writable-b.patch + patches.kernel.org/6.18.38-021-batman-adv-frag-avoid-underflow-of-TTL.patch + patches.kernel.org/6.18.38-022-batman-adv-v-prevent-OGM-aggregation-on-disab.patch + patches.kernel.org/6.18.38-023-batman-adv-tp_meter-restrict-number-of-unacke.patch + patches.kernel.org/6.18.38-024-batman-adv-tp_meter-annotate-last_recv_time-a.patch + patches.kernel.org/6.18.38-025-batman-adv-tp_meter-prevent-parallel-modifica.patch + patches.kernel.org/6.18.38-026-batman-adv-tp_meter-handle-overlapping-packet.patch + patches.kernel.org/6.18.38-027-batman-adv-tt-don-t-merge-change-entries-with.patch + patches.kernel.org/6.18.38-028-batman-adv-tt-track-roam-count-per-VID.patch + patches.kernel.org/6.18.38-029-batman-adv-dat-prevent-false-sharing-between-.patch + patches.kernel.org/6.18.38-030-batman-adv-tvlv-enforce-2-byte-alignment.patch + patches.kernel.org/6.18.38-031-batman-adv-tvlv-avoid-race-of-cifsnotfound-ha.patch + patches.kernel.org/6.18.38-032-ipv6-account-for-fraggap-on-the-paged-allocat.patch + patches.kernel.org/6.18.38-033-ipv4-account-for-fraggap-on-the-paged-allocat.patch + patches.kernel.org/6.18.38-034-ntfs3-reject-direct-userspace-writes-to-reser.patch + patches.kernel.org/6.18.38-035-wifi-mt76-add-wcid-publish-check-in-mt76_sta_.patch + patches.kernel.org/6.18.38-036-af_unix-Set-gc_in_progress-to-true-in-unix_gc.patch + patches.kernel.org/6.18.38-037-mac802154-llsec-add-skb_cow_data-before-in-pl.patch + patches.kernel.org/6.18.38-038-net-skmsg-preserve-sg.copy-across-SG-transfor.patch + patches.kernel.org/6.18.38-039-net-ip_gre-require-CAP_NET_ADMIN-in-the-devic.patch + patches.kernel.org/6.18.38-040-apparmor-mediate-the-implicit-connect-of-TCP-.patch + patches.kernel.org/6.18.38-041-apparmor-fix-use-after-free-in-rawdata-dedup-.patch + patches.kernel.org/6.18.38-042-NTB-epf-Avoid-pci_iounmap-with-offset-when-PE.patch + patches.kernel.org/6.18.38-043-fbdev-fix-use-after-free-in-store_modes.patch + patches.kernel.org/6.18.38-044-kernel-fork-clear-PF_BLOCK_TS-in-copy_process.patch + patches.kernel.org/6.18.38-045-block-invalidate-cached-plug-timestamp-after-.patch + patches.kernel.org/6.18.38-046-KVM-arm64-Omit-tag-sync-on-stage-2-mappings-o.patch + patches.kernel.org/6.18.38-047-err.h-use-__always_inline-on-all-error-pointe.patch + patches.kernel.org/6.18.38-048-gcov-use-atomic-counter-updates-to-fix-concur.patch + patches.kernel.org/6.18.38-049-KEYS-fix-overflow-in-keyctl_pkey_params_get_2.patch + patches.kernel.org/6.18.38-050-keys-Pin-request_key_auth-payload-in-instanti.patch + patches.kernel.org/6.18.38-051-userfaultfd-ensure-mremap_userfaultfd_fail-re.patch + patches.kernel.org/6.18.38-052-wifi-mt76-mt76x2u-Add-support-for-ELECOM-WDC-.patch + patches.kernel.org/6.18.38-053-wifi-mt76-mt7925-don-t-disable-AP-BSS-when-re.patch + patches.kernel.org/6.18.38-054-wifi-ath11k-fix-warning-when-unbinding.patch + patches.kernel.org/6.18.38-055-wifi-rtlwifi-rtl8821ae-Fix-C2H-bit-location-i.patch + patches.kernel.org/6.18.38-056-wifi-rtw88-increase-TX-report-timeout-to-fix-.patch + patches.kernel.org/6.18.38-057-wifi-rtw88-usb-fix-memory-leaks-on-USB-write-.patch + patches.kernel.org/6.18.38-058-wifi-iwlwifi-mvm-fix-race-condition-in-PTP-re.patch + patches.kernel.org/6.18.38-059-wifi-iwlwifi-mld-fix-race-condition-in-PTP-re.patch + patches.kernel.org/6.18.38-060-wifi-iwlwifi-mld-validate-sta_mask-before-ffs.patch + patches.kernel.org/6.18.38-061-f2fs-pass-correct-iostat-type-for-single-node.patch + patches.kernel.org/6.18.38-062-f2fs-validate-orphan-inode-entry-count.patch + patches.kernel.org/6.18.38-063-f2fs-validate-compress-cache-inode-only-when-.patch + patches.kernel.org/6.18.38-064-f2fs-fix-to-round-down-start-offset-of-falloc.patch + patches.kernel.org/6.18.38-065-f2fs-validate-ACL-entry-sizes-in-f2fs_acl_fro.patch + patches.kernel.org/6.18.38-066-f2fs-fix-incorrect-FI_NO_EXTENT-handling-in-_.patch + patches.kernel.org/6.18.38-067-f2fs-keep-atomic-write-retry-from-zeroing-ori.patch + patches.kernel.org/6.18.38-068-block-Avoid-mounting-the-bdev-pseudo-filesyst.patch + patches.kernel.org/6.18.38-069-bpf-use-kvfree-for-replaced-sysctl-write-buff.patch + patches.kernel.org/6.18.38-070-MIPS-DEC-Prevent-initial-console-buffer-from-.patch + patches.kernel.org/6.18.38-071-exfat-fix-potential-use-after-free-in-exfat_f.patch + patches.kernel.org/6.18.38-072-KVM-x86-mmu-Ensure-hugepage-is-in-by-slot-bef.patch + patches.kernel.org/6.18.38-073-KVM-Replace-guest-triggerable-BUG_ON-in-ioeve.patch + patches.kernel.org/6.18.38-074-crypto-nx-fix-nx_crypto_ctx_exit-argument.patch + patches.kernel.org/6.18.38-075-gfs2-fix-use-after-free-in-gfs2_qd_dealloc.patch + patches.kernel.org/6.18.38-076-pwrseq-core-fix-use-after-free-in-pwrseq_debu.patch + patches.kernel.org/6.18.38-077-hdlc_ppp-sync-per-proto-timers-before-freeing.patch + patches.kernel.org/6.18.38-078-blk-cgroup-fix-UAF-in-__blkcg_rstat_flush.patch + patches.kernel.org/6.18.38-079-tipc-fix-slab-use-after-free-Read-in-tipc_aea.patch + patches.kernel.org/6.18.38-080-LoongArch-Report-dying-CPU-to-RCU-in-stop_thi.patch + patches.kernel.org/6.18.38-081-pNFS-Fix-use-after-free-in-pnfs_update_layout.patch + patches.kernel.org/6.18.38-082-irqchip-imgpdc-Fix-resource-leak-add-missing-.patch + patches.kernel.org/6.18.38-083-fpga-region-fix-use-after-free-in-child_regio.patch + patches.kernel.org/6.18.38-084-rpmsg-char-Fix-use-after-free-on-probe-error-.patch + patches.kernel.org/6.18.38-085-ocfs2-reject-oversized-group-bitmap-descripto.patch + patches.kernel.org/6.18.38-086-9p-avoid-putting-oldfid-in-p9_client_walk-err.patch + patches.kernel.org/6.18.38-087-MIPS-smp-report-dying-CPU-to-RCU-in-stop_this.patch + patches.kernel.org/6.18.38-088-KVM-x86-hyper-v-Bound-the-bank-index-when-que.patch + patches.kernel.org/6.18.38-089-KVM-SVM-Fix-page-overflow-in-sev_dbg_crypt-fo.patch + patches.kernel.org/6.18.38-090-power-reset-linkstation-poweroff-fix-use-afte.patch + patches.kernel.org/6.18.38-091-riscv-mm-Extract-helper-mark_new_valid_map.patch + patches.kernel.org/6.18.38-092-riscv-kfence-Call-mark_new_valid_map-for-kfen.patch + patches.kernel.org/6.18.38-093-fbdev-Fix-fb_new_modelist-to-prevent-null-ptr.patch + patches.kernel.org/6.18.38-094-fbdev-modedb-fix-a-possible-UAF-in-fb_find_mo.patch + patches.kernel.org/6.18.38-095-fbdev-modedb-Fix-misaligned-fields-in-the-192.patch + patches.kernel.org/6.18.38-096-i2c-core-fix-adapter-registration-race.patch + patches.kernel.org/6.18.38-097-NFSD-Fix-SECINFO_NO_NAME-decode-error-cleanup.patch + patches.kernel.org/6.18.38-098-nfsd-fix-posix_acl-leak-on-SETACL-decode-fail.patch + patches.kernel.org/6.18.38-099-nfsd-fix-inverted-cp_ttl-check-in-async-copy-.patch + patches.kernel.org/6.18.38-100-nfsd-check-get_user-return-when-reading-princ.patch + patches.kernel.org/6.18.38-101-nfsd-avoid-leaking-pre-allocated-openowner-on.patch + patches.kernel.org/6.18.38-102-nfsd-reset-write-verifier-on-deferred-writeba.patch + patches.kernel.org/6.18.38-103-NFSv4-flexfiles-reject-zero-filehandle-versio.patch + patches.kernel.org/6.18.38-104-NFSv4-pNFS-reject-zero-length-r_addr-in-nfs4_.patch + patches.kernel.org/6.18.38-105-NFSv4-clear-exception-state-on-successful-mkd.patch + patches.kernel.org/6.18.38-106-NFS-Prevent-resource-leak-in-nfs_alloc_server.patch + patches.kernel.org/6.18.38-107-ksmbd-fix-out-of-bounds-read-in-smb_check_per.patch + patches.kernel.org/6.18.38-108-serial-8250_dw-unregister-8250-port-if-clk_no.patch + patches.kernel.org/6.18.38-109-net-tcp-ao-fix-use-after-free-of-key-in-del_a.patch + patches.kernel.org/6.18.38-110-apparmor-advertise-the-tcp-fast-open-fix-is-a.patch + patches.kernel.org/6.18.38-111-Linux-6.18.38.patch ######################################################## # Build fixes that apply to the vanilla kernel too. @@ -8441,7 +8552,6 @@ # jj/linux-apparmor apparmor-next patches.suse/apparmor-don-t-audit-files-pointing-to-aa_null.dentr.patch patches.suse/apparmor-fix-uninitialised-pointer-passed-to-audit_l.patch - patches.suse/apparmor-fix-use-after-free-in-rawdata-dedup-loop.patch ######################################################## # end of sorted patches ######################################################## ++++++ source-timestamp ++++++ --- /var/tmp/diff_new_pack.eJyPoY/_old 2026-07-08 17:34:08.560452309 +0200 +++ /var/tmp/diff_new_pack.eJyPoY/_new 2026-07-08 17:34:08.564452449 +0200 @@ -1,4 +1,4 @@ -2026-06-27 12:46:53 +0000 -GIT Revision: 2afdd3fd759f01ede4f9c9874d4f3b8fee369a98 +2026-07-06 07:30:11 +0000 +GIT Revision: 0a981243ad63e6f94001965c01627d27ed9be52c GIT Branch: slowroll
