Thank you for your contribution to Debian.
Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 29 Aug 2026 06:19:09 +0200 Source: linux Architecture: source Version: 6.12.107-1 Distribution: trixie-security Urgency: high Maintainer: Debian Kernel Team <[email protected]> Changed-By: Salvatore Bonaccorso <[email protected]> Changes: linux (6.12.107-1) trixie-security; urgency=high . * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.106 - PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems - Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept - ALSA: scarlett2: Use a private URB for the notification endpoint - rndis_host: add overflow check in rndis_rx_fixup() - gpio: ml-ioh: use raw_spinlock_t for the register lock (CVE-2026-80562) - gve: fix zero-length skb frag with header-split - hwmon: (ltc4286) Fix symbol namespace of MODULE_IMPORT_NS() - netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (CVE-2026-64216) - inet: frags: add inet_frag_putn() helper - ipv4: frags: remove ipq_put() - inet: frags: change inet_frag_kill() to defer refcount updates - inet: frags: save a pair of atomic operations in reassembly - inet: frags: publish queues before arming timer (CVE-2026-74662) - serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (CVE-2026-74653) - NTB: ntb_netdev: Preserve RX queue depth on allocation failure (CVE-2026-74626) - serial: amba-pl011: synchronize DMA teardown - serial: sc16is7xx: rename EFR mutex with generic name - serial: sc16is7xx: use guards for simple mutex locks - serial: sc16is7xx: enable THRI before filling TX FIFO - xfs: namespace the maximum length/refcount symbols - xfs: don't use a xfs_log_iovec for ri_buf in log recovery - xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536) - xfs: hoist per-bucket unlinked list check to helper - xfs: don't livelock in scrub on a circular unlinked list - ALSA: dummy: Check card index validity at probe - ocfs2: fix missing metadata reservation for large xattrs - null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows - kcov: fix data corruption and race conditions on PREEMPT_RT - ext4: stop retrying saturated xattr cache entries - ext4: clear error before retrying inode xattr space fallback - ext4: propagate errors from fast commit range replay - xfs: validate attr entry pointer before field access - libceph: fix OOB read in decode_watchers() via missing bounds check (CVE-2026-80557) - nfc: digital: clamp SENSF_RES length to the destination buffer - nfc: fdp: bound the device-reported read length and fix an skb leak - nfc: microread: validate target discovery payload lengths - nfc: llcp: bound the connect_sn TLV walk to the skb - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers - nfc: llcp: reject PDUs shorter than the LLCP header - nfc: pn533: purge fragmented skbs during cleanup - nfc: st21nfca: validate ATR_REQ length against the received frame - nfc: nci: fix out-of-bounds write in nci_target_auto_activated() - nfc: nci: fix uninit-value in the RF discover/activated NTF handlers - nfc: nci: free destination parameters when closing a connection - ndisc: ndisc_send_redirect() cleanup - Input: byd - synchronize timer deletion before freeing private data (CVE-2026-80572) - ipv4: reject undersized MTUs in ip_do_fragment() - ipv6: fix use-after-free in ip6_finish_output2() - nvmet-auth: zero the AUTH_RECEIVE response buffer - nvmet-fc: fix invalid free in LS IOD error path - nvmet-tcp: bound SGL data length before allocating command buffers - nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations - mptcp: pm: fix data race in add_addr timer callback - [arm64] ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses (CVE-2026-80583) - drm/xe: Fix DPT allocation paths. - HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C - HID: magicmouse: re-enable multitouch after reset-resume - HID: magicmouse: do not keep a stale msc->input if no input is claimed - HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID - HID: core: fix OOB read of field->usage in hid_set_field() - net/ionic: avoid OOB TX partner lookup for hwstamp RXQ - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (CVE-2026-64581) - ipv4: start using dst_dev_rcu() (CVE-2025-40074) - mptcp: pm: fix memory leak from alloc-during-teardown race - Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard - Input: atkbd - skip deactivate for HONOR ZQC-P - HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() - HID: nintendo: register input device after capabilities are set - HID: nintendo: stop device IO before hid_hw_stop on probe failure - HID: core: fix number/pointer type confusion on long items - HID: sensor: custom: Fix use-after-free in enable_sensor - HID: hyperv: validate initial device info bounds - Bluetooth: hci_event: fix LE list UAF on reset - Bluetooth: hci_event: validate LE Set CIG Parameters response - Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync - Bluetooth: hci_aml: validate firmware segment lengths - net: gro: properly validate BIG TCP aggregation criteria https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.107 - inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590) Checksums-Sha1: 2a6386c57553606693484fdc2ccaf6ac3ebf8e11 290418 linux_6.12.107-1.dsc b3363e415e6a3fb869b4d43a2e35eba07f0902f6 151398592 linux_6.12.107.orig.tar.xz e13a94c08bb6e0c40fffb3e971e12344988cff45 1886412 linux_6.12.107-1.debian.tar.xz d76e860c91446afa6cd469c1067cc86b424f9737 6895 linux_6.12.107-1_source.buildinfo Checksums-Sha256: 00f5874a383295a3237321cf59a0f172495084f16cb3dac24ee5aae6649d809a 290418 linux_6.12.107-1.dsc efc76d3c78a5d65f42724118c437d11db1c9f6309a5f024ee9a8b1978fdc6919 151398592 linux_6.12.107.orig.tar.xz d8c003ecac7c54f59c69dc61258f93d937dce90e70f53bb5a34dd58db13028ed 1886412 linux_6.12.107-1.debian.tar.xz 44fec61de0e851cfefc890640c31d4b3f0c0d14997b8a35b11e8c4643ce29e05 6895 linux_6.12.107-1_source.buildinfo Files: 59ebc75ef747abfe0bcbc201be05308f 290418 kernel optional linux_6.12.107-1.dsc 514e0f270adc2a24e805ed00d8206884 151398592 kernel optional linux_6.12.107.orig.tar.xz fe61e4579a2549c092707cf90dc13a2e 1886412 kernel optional linux_6.12.107-1.debian.tar.xz 764958e9041a6e65ce5c1ac08b2c345d 6895 kernel optional linux_6.12.107-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmqSXm5fFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk ZWJpYW4ub3JnAAoJEAVMuPMTQ89E1TAP/jHdoPkCaGcvGLGJg9OvsZme+FLz1c71 Fm8vXb3E4iBd36NITMaEGdyEpgUXTGnFz9X1lhHK4T8BuVum0kSYgxdG1+mZVAyh VjZfaruixUlUU5BQF+aCcUsoh3Dv+S+w+JGKAlMcXVyh8DmmOoB+UV5u6p9Nuaf2 aobeYD6iPyflxsdxM5Q5TbD/Cx/EDqi2uX/D3ltaQJMqWmoCrl1NSvvAOHRCiSci lau2je6A0fII4uvpASgcE0MLgdazKyQN6pB0wF/cnqwqVwfrkD2IkJm9LfYr+ncA 4fRkM78lHJY6F2K/ve+ih9ux4FGH3NzfwuQqMRRMeTMxBvEaOglnvJXYus748+fY M4eaFMwfZnM6Ma4CumcgLJLupm26KZjS5T4jEd8s/WDnr6eoa4DnKxHFuVEEqYkx Vo4Ej7cHwtDboy1bqy8P/9MI92AZhJmC8RuYkyW3xnqajtIfyK6rwN9t94FlMviY 0ItIp6F9tmtpjTPNPB7jCX16tq6Y+0r9ffuPDxONAKh5A+jxvmIa1ftn+cM1aeJO +0YvS7NM34aW8PCO8yIW4dVRV0O/cIabUMV6McH6P+t8F1o/aTpBuUkd3LZD4a+a E+wiGl2JJwjbNEdc8mGK3nhuy5JaoDY224q6Oc3+3yAZZnu1QoFZWRQo1C1YVdx0 Dw1aVqAlLR9F =IU9Z -----END PGP SIGNATURE-----
pgpW7zDPD36Fe.pgp
Description: PGP signature
