Your message dated Sun, 06 Sep 2026 21:32:12 +0000
with message-id <[email protected]>
and subject line Bug#1142912: fixed in linux 6.12.105-1
has caused the Debian Bug report #1142912,
regarding linux-image-6.12.96+deb13-amd64: CONFIG_MISC_ALCOR_PCI not set, no
driver for Alcor Micro AU6625 card reader
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1142912: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1142912
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: linux
Version: 6.12.96-1
X-Debbugs-Cc: [email protected]
User: [email protected]
Usertags: amd64
Message-ID:
<178518194208.3775.15079597262063583335.reportbug@portatilelorenzo.local>
Date: Mon, 27 Jul 2026 21:52:22 +0200
Severity: normal
Dear maintainer,
The bus of my laptop's Alcor Micro AU6625 is detected by the kernel
but there
isn't a driver for using it.
CONFIG_MISC_ALCOR_PCI is left unset in the kernel config used to build
this
package, although both source and header of the driver are present in
Debian's
kernel source tree and header tree.
The driver is just excluded from the compiled binary kernel.
$ uname -a
Linux portatilelorenzo 6.12.96+deb13-amd64 #1 SMP PREEMPT_DYNAMIC
Debian
6.12.96-1 (2026-07-20) x86_64 GNU/Linux
$ lspci -nn | grep -i alcor
04:00.0 Unassigned class [ff00]: Alcor Micro AU6625 PCI-E Flash card
reader
controller [1aea:6625]
$ cat /boot/config-$(uname -r) | grep -i alcor
# CONFIG_MISC_ALCOR_PCI is not set
$ find /usr/src/linux-headers-6.12.96+deb13-common -iname
"alcor_pci.h"
/usr/src/linux-headers-6.12.96+deb13-common/include/linux/alcor_pci.h
$ tar -tJf /usr/src/linux-source-6.12.tar.xz | grep -i alcor
linux-source-6.12/drivers/misc/cardreader/alcor_pci.c
linux-source-6.12/drivers/mmc/host/alcor.c
linux-source-6.12/include/linux/alcor_pci.h
Is this exclusion intentional? If it isn't, would it be possible in
future
builds to enable CONFIG_MISC_ALCOR_PCI and CONFIG_MMC_ALCOR needed for
supporting this adapter?
Thanks!
-- System Information:
Debian Release: 13.6
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500,
'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 6.12.96+deb13-amd64 (SMP w/12 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE,
TAINT_UNSIGNED_MODULE
Locale: LANG=it_IT.UTF-8, LC_CTYPE=it_IT.UTF-8 (charmap=UTF-8),
LANGUAGE not
set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
--- End Message ---
--- Begin Message ---
Source: linux
Source-Version: 6.12.105-1
Done: Salvatore Bonaccorso <[email protected]>
We believe that the bug you reported is fixed in the latest version of
linux, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <[email protected]> (supplier of updated linux package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 24 Aug 2026 22:05:50 +0200
Source: linux
Architecture: source
Version: 6.12.105-1
Distribution: trixie-security
Urgency: high
Maintainer: Debian Kernel Team <[email protected]>
Changed-By: Salvatore Bonaccorso <[email protected]>
Closes: 1142912 1143545
Changes:
linux (6.12.105-1) trixie-security; urgency=high
.
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.102
- [amd64] x86/bugs: Make Safe-RET robust against interrupt injection
(CVE-2026-68480)
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.103
- netfilter: nf_conntrack_expect: restore helper propagation via
expectation
- netfilter: br_netfilter: Reallocate headroom if necessary in
neigh_hh_bridge()
- net: mpls: initialize rtm_tos in mpls_getroute()
- HID: logitech-dj: Standardise hid_report_enum variable nomenclature
- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB
write
- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report
- bpf: Reset register bounds before narrowing retval range in
check_mem_access()
- netconsole: avoid OOB reads, msg is not nul-terminated (CVE-2026-43197)
- [amd64] thunderbolt: Prevent XDomain delayed work use-after-free on
disconnect
- [arm64] pinctrl: qcom: Unconditionally mark gpio as wakeup enable
- [arm64] pinctrl: qcom: sc8280xp: Add missing wakeup entries for
GPIO143/151
- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
- [amd64] dmaengine: idxd: fix fdev setup failure cleanup in
idxd_cdev_open()
- gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe()
- ata: sata_mv: accept 1 or 2 resources in platform probe
- ata: libahci_platform: support non-consecutive port numbers
- ahci: Introduce ahci_ignore_port() helper
- ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup
- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup
- of: reserved_mem: Add code to dynamically allocate reserved_mem array
- of: reserved_mem: prevent OOB when too many dynamic regions are defined
- btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag
- btrfs: zoned: fix deadlock between metadata writeback and transaction
commit
- [arm64] phy-zynqmp: Postpone getting clock rate until actually needed
- [arm64] phy: zynqmp: fix clock error handling in xpsgtr_phy_init()
- [arm64] phy: zynqmp: fix runtime PM leak on probe allocation failure
- netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in
sip_help_tcp()
- [arm64] drm/mediatek: Check CRTC state before freeing
- Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep
annotation
- KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return
type
- keys: fix out-of-bounds read in keyring_get_key_chunk()
- keys: make keyring key-chunk byte order agree with keyring_diff_objects()
- assoc_array: trim the final shortcut word using the current chunk end
- netfilter: nf_tables: make nft_object rhltable per table
- netfilter: xt_hashlimit: validate hashtable supports
XT_HASHLIMIT_RATE_MATCH
- ipvs: fix the checksum validations
- ipvs: fix places with wrong packet offsets
- ipvs: do not mangle ICMP replies for non-first fragments
- netfilter: nft_payload: fix mask build for partial field offload
- rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled
(CVE-2026-68322)
- rds: tcp: hold the RCU lock across ipv6_chk_addr() in
rds_tcp_laddr_check()
- [amd64,arm64] pinctrl-amd: Don't clear S4 wake bits at probe
- scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
- scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection
buffer
- scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
- smb: client: fix buffer leaks in SMB1 read and write
- spi: spi-cadence: supports transmission with bits_per_word of 16 and 32
- spi: spi-cadence: Move TX FIFO full busy-wait into FIFO
- hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
- hwmon: (ina2xx) Add support for has_alerts configuration flag
- hwmon: (ina2xx) Add support for INA260
- hwmon: (ina226) Add support for SY24655
- hwmon: (ina2xx) Make it easier to add more devices
- hwmon: (ina2xx) Add support for INA234
- hwmon: (ina2xx) Shift INA234 shunt and current registers
- hwmon: (ina2xx) Fix various overflow issues
- hwmon: (ltc4282) Fix reading the minimum alarm voltage
- hwmon: (sht3x) Fix unaligned accesses
- hwmon: (lm90) Only report alarms if driver is ready
- hwmon: (nzxt-smart2) DMA-align output buffer
- net: do not send ICMP/NDISC Redirects when peer allocation fails
- hwmon: (nct6775-core) Prevent access to unsupported weight registers
- net: bridge: mrp: fix Option TLV length in MRP_Test frames
- forcedeth: fix UAF of txrx_stats in nv_remove
- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
- hwmon: (adt7470) Fix cache updated before hardware write on I2C error
- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()
- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks
- hwmon: (adt7470) Use cached PWM frequency value
- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
- hwmon: (adt7470) Fix PWM auto temp state array and bounds check
- rtase: fix double free of multi-frag skb on DMA map failure
- [powerpc*] boot: Fix simpleboot CPU node lookup check
- [powerpc*] boot: Fix treeboot-currituck CPU node lookup check
- [powerpc*] boot: Fix treeboot-akebono CPU node lookup check
- net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
- wifi: mac80211: validate individual TWT params before driver setup
- net: ethernet: mtk_eth_soc: support named IRQs
- net: ethernet: mtk_eth_soc: add consts for irq index
- net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in
poll_controller
- hwmon: (pmbus) Fix return value from pmbus_update_byte_data()
- [amd64,arm64] idpf: adjust TxQ ring count minimum
- [amd64,arm64] idpf: Fix mailbox IRQ name leak on request failure
- Bluetooth: ISO: clear iso_data always when detaching conn from hcon
- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos
- Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis()
- Bluetooth: ISO: fix leaking sk after socket release
- Bluetooth: ISO: avoid deadlocks in iso_sock_timeout
- Bluetooth: btintel: Validate length before parsing diagnostics TLV
- Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists
- Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
- Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync
- net: phylink: put link_gpio if phylink_create fails
- scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
- scsi: ufs: core: Cancel RTC work in active-active suspend
- scsi: zfcp: Fix memory leak during adapter release by destroying
gid_pn_req
- scsi: target: Clear cmd_cnt when initial counter enrollment fails
- net: sxgbe: free TX rings on RX allocation failure
- net: sxgbe: check descriptor ring allocation failures
- can: isotp: check register_netdevice_notifier() error in module init
- tracing/mmiotrace: Reset dropped_count in mmio_reset_data()
- tracing: Remove TRACE_EVENT_FL_FILTERED logic
- tracing/mmiotrace: Remove reference to unused per CPU data pointer
- tracing/mmiotrace: Add NULL check for mmio_trace_array in logging
functions
- [riscv64] mm: Fix out-of-bounds page-table walk during memory hot-remove
- [arm64] net: dsa: mt7530: check bus->read() errors in the MDIO regmap
backend
- [arm64] net: dsa: mt7530: error out on failed reads in MT7531 PHY polling
- net: libwx: fix FDIR ATR queue mismatch for software VLAN packets
- [arm64] octeontx2-pf: Set correct sequence for carrier off and tx queue
stop
- sched/deadline: Use revised wakeup rule only for running dl_server
- qede: sync udp_tunnel ports outside qede_lock in the recovery path
- ksmbd: return success for deferred final close
- ksmbd: fix use-after-free in __close_file_table_ids()
- pinctrl: devicetree: don't free uninitialized dev_name on error path
- erofs: cap LZMA stream pool size
- pinctrl: bm1880: add missing select GENERIC_PINCONF
- fortify: Disable -Wstringop-overread in tests
- mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
- fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes
- mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
- mm/hugetlb: fix list corruption in allocate_file_region_entries()
- mm/vmstat: fold stranded per-cpu node stats when a node comes online
- tracing/probes: Reject $arg0 in meta argument expansion
- [amd64] KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while
L2 is active
- [s390x] KVM: s390: pci: Reject adapter interrupt forwarding if already
enabled
- [s390x] KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
- [s390x] KVM: s390: pci: Validate AIBV and AISB before pinning guest pages
- sctp: validate Adaptation Indication parameter length
- audit: fix potential integer overflow in audit_log_n_string()
- audit: fix potential use-after-free in audit_del_rule()
- Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()
- Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()
- Bluetooth: mgmt: fix pending command UAF in EIR updates
- Bluetooth: mgmt: fix UAF in pair command cancellation
- Bluetooth: hci_sync: Fix advertising data UAFs
- Bluetooth: HIDP: reject frames without a transaction header
- Bluetooth: HIDP: validate numbered report payloads
- bpf: lwt: Fix dst reference leak on reroute failure
- ALSA: 6fire: Fix UAF at error handling during probe
- ALSA: lx6464es: fix period byte count for 16-bit streams
- ALSA: pcm: wake linked drain waiters on unlink
- ALSA: seq: Fix division by zero in initialize_timer()
- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes
- ALSA: ump: fix double free of out_cvts on rawmidi error
- ASoC: tas2562: fix DVC coefficient write order
- ASoC: tas2562: fix broken entries in the volume lookup table
- ata: libata-eh: Increase STANDBY IMMEDIATE timeout
- ata: libata-sata: fix ata_scsi_lpm_supported() iteration
- ALSA: usb-audio: fix use-after-free in ump_to_endpoint()
- ALSA: usb-audio: fix stack info leak in RME Digiface status
- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
- ALSA: usb-audio: Clamp frame size in implicit-feedback mode
- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
- e1000: fix memory leak in e1000_probe()
- igbvf: Fix leak in TX DMA error cleanup
- ipvs: do not propagate one-packet flag to synced conns
- net/smc: fix socket use-after-free during link group termination
- netfilter: ipset: do not update comments from kernel-side hash adds
- tipc: avoid use-after-free in poll trace queue dumps
- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames
- binfmt_misc: reject a flag character as the field delimiter
- binfmt_misc: don't let an 'F' entry pin its own instance
- mm/page_reporting: use system_freezable_wq to fix UAF during suspend
- mm: memcg: initialize *locked in memcg1_oom_prepare() stub
- net: bridge: stop fast-leave after deleting a port group
- net: ipv6: clear suppressed fib6 rule result
- [powerpc*] ps3: Fix map failure path in dma_ioc0_map_pages()
- veth: convert frag_list skbs before running XDP
- vxlan: re-fetch eth header after route_shortcircuit()
- vxlan: unclone skb head before modifying eth header in
route_shortcircuit()
- vxlan: use neigh_ha_snapshot() in route_shortcircuit()
- vxlan: use pskb_network_may_pull() in route_shortcircuit()
- ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()
- tracing: Check return value of __register_event() in
trace_module_add_events()
- tracing/filters: Fix false positive match in regex_match_full()
- spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure
- scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
- sctp: reject stale cookies with mismatched verification tags
- sctp: prevent peer transport count overflow
- hwmon: (npcm750-pwm-fan): stop fan timer on device detach
- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client
- i2c: amd-mp2: Unregister callback on adapter add failure
- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure
- cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
- cpufreq: schedutil: Publish util hooks only after all sg_cpu are
initialized
- power: supply: bq25890: fix the -10 C NTC lookup entry
- power: supply: max17040: handle missing status supplier
- [s390x] pci: Fix s390_pci_mmio_write syscall error return without MIO
- [s390x] qeth: Check CAP_NET_ADMIN for private ioctls
- [s390x] dasd: Fix potential NULL pointer dereference
- [s390x] dasd: Fix undersized format-check buffer
- [s390x] zcrypt: Fix wrong domain value verification with EP11 CPRBs
- [s390x] zcrypt: Validate length for CCA AES cipher key requests
- [s390x] zcrypt: Validate length for CCA ECC private key requests
- [arm64] phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
- [arm64] phy: zynqmp: use read-modify-write for SERDES scrambler bypass
- [arm64] phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
- net: openvswitch: fix potential UAF on meter attach failure
- net: openvswitch: fix skb leak on flow key update failure during
recirculation
- net: openvswitch: fix skb leak on flow key update failure during ct
- ice: wait for reset completion in ice_resume()
- ice: fix memory leak in ice_lbtest_prepare_rings()
- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock
deadlock
- i2c: iproc: reset bus after timeout if START_BUSY is stuck
- i2c: imx: Fix slave registration race and error handling
- i2c: imx: Cancel hrtimer before clearing slave pointer
- can: c_can: c_can_chip_config(): keep controller in init mode until
bittiming is configured
- can: ems_usb: validate CPC message lengths
- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB
resubmit failure
- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb
allocation failure
- can: j1939: transport: j1939_session_fresh_new(): initialize receive
buffer
- can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking
- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in
kvaser_usb_hydra_get_busparams()
- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received
command extents
- can: softing: fw_parse(): validate firmware record spans
- can: peak_usb: add bounds check for USB channel index
- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on
URB
submit error
- can: peak_usb: validate uCAN receive record lengths
- can: ctucanfd: add missing MODULE_DEVICE_TABLE()
- can: ctucanfd: use self-test mode for PRESUME_ACK
- can: ctucanfd: unmap BAR0 using base address
- can: ctucanfd: handle bus error interrupts
- can: ctucanfd: mark error-active controller status valid
- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs
- [arm*] drm/vc4: Supply the overflow slot size in BPOS, not the whole bin
BO size
- [arm*] drm/vc4: Zero the tile state data array before each BIN job
- [arm64] drm/panthor: reject firmware sections with oversized data
- [arm64] drm/panthor: validate firmware interface structure sizes
- [arm64] drm/mediatek: ovl_adaptor: balance component registrations
- drm/amdgpu: restore UMD profile pstate after runtime resume
- drm/amdgpu: cap GTT size to physical RAM on APUs
- drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
- drm/amd/display: use proper context for logging
- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
- drm/amdkfd: fix QID bit leak in pqm_create_queue()
- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
- drm/amdkfd: Handle invalid event type in CRIU event restore
- drm/amdkfd: hold event_mutex while checkpointing CRIU events
- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
- drm/vmwgfx: reject DX_BIND_QUERY without a DX context
- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
- drm/vmwgfx: bound DMA command body size against suffix pointer
- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
- drm/vmwgfx: use check_add_overflow for shader size+offset bound
- drm/vmwgfx: validate external BO copy bounds for both stride paths
- spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX
- HID: logitech-dj: Fix maxfield check in DJ short report validation
- ata: libahci_platform: Do not set mask_port_map when not needed
- ata: ahci: Make ahci_ignore_port() handle empty mask_port_map
- of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array()
fails
- Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release
- drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting
- drm/xe: Introduce xe_gt_dbg_printer()
- drm/xe: Apply whitelist to engine save-restore
- drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists
(CVE-2026-68267)
- drm/xe/rtp: Maintain OA whitelists separately
- drm/xe/rtp: Keep track of non-OA nonpriv slots
- drm/xe/rtp: Generalize whitelist_apply_to_hwe
- drm/xe/rtp: Save OA nonpriv registers to register save/restore lists
- drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs
- drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt
- drm/xe/oa: (De-)whitelist OA registers on OA stream open/release
- drm/xe/rtp: Ensure locking/ref counting for OA whitelists
- mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
- fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes
- mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
- lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled()
- mm/slab: prevent unbounded recursion in free path with new kmalloc type
- gpio: pch: use raw_spinlock_t for the register lock
- usb: gadget: f_tcm: synchronize delayed set_alt with teardown
(CVE-2026-68367)
- usb: typec: ucsi: split connector lock classes
- usb: typec: ucsi: Fix race condition and ordering in port unregistration
- media: i2c: imx219: Rename VTS to FRM_LENGTH
- media: imx219: Fix maximum frame length in lines
- media: chips-media: wave5: Support CBP profile
- media: uapi: rkisp: Correct name version enum
- wifi: brcmfmac: drain bus_reset work on device removal (CVE-2026-64586)
- wifi: ath6kl: fix use-after-free in aggr_reset_state() (CVE-2026-68198)
- wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress
(CYW)
- wifi: brcmfmac: set F2 blocksize to 256 for BCM43752
- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change
- mptcp: pm: avoid code duplication to lookup endp
- mptcp: add mptcp_userspace_pm_lookup_addr helper
- mptcp: pm: use addr entry for get_local_id
- mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)
- drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions
- drm/amdgpu: Fix context pstate override handling (CVE-2026-68273)
- drm/sched: Store the drm client_id in drm_sched_fence
- drm/amdgpu: give each kernel job a unique id
- drm/amdgpu/gfx: fix cleaner shader IB buffer overflow (CVE-2026-68276)
- drm/fb-helper: Allocate and release fb_info in single place
- drm/tegra: fbdev: Remove offset into framebuffer memory
- drm/exec: Remove the index parameter from
drm_exec_for_each_locked_obj[_reverse]
- drm/xe: Wait on external BO kernel fences in exec IOCTL
- [arm64] drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable()
- [arm64] drm/i915/vrr: require valid min/max vfreq for VRR
(CVE-2026-68254)
- drm/xe: Rename ___xe_bo_create_locked()
- drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266)
- [arm64] drm/i915/hdcp: Move to using intel_display in intel_hdcp
- [arm64] drm/i915/hdcp: require monotonically increasing seq_num_v
- [arm64] drm/i915/hdcp: Skip inactive MST connectors when building stream
list
- [arm64] drm/i915/hdcp: check streams[] bounds before overflow
(CVE-2026-68253)
- drm/xe: Stub out new pagefault layer
- drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)
- rxrpc: Generate rtt_min
- rxrpc: Adjust the rxrpc_rtt_rx tracepoint
- rxrpc: Fix the calculation and use of RTO
- rxrpc: Manage RTT per-call rather than per-peer
- rxrpc: Fix irq-disabled in local_bh_enable() (CVE-2025-38525)
- can: use skb hash instead of private variable in headroom
- can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
- usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
- drm/fb-helper: Fix a locking bug in an error path
- [arm64,armhf] drm/tegra: fbdev: Do not assign to struct
drm_fb_helper.info
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.104
- mount: honour SB_NOUSER in the new mount API
- drm/amd/display: Add AV mute wait frames to dce110_set_avmute
- drm/amd/display: Check for tg ops in dce110_set_avmute
- [s390x] zcrypt: Fix missing mem scrub at clear key import in
cca_clr2cipherkey()
- NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
- [arm64] dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer
- drm/bridge: ps8640: propagate AUX transfer register errors
- [arm64] net: hns3: fix speed configuration residue after driver reload
- Revert "net: thunderbolt: Enable end-to-end flow control also in
transmit"
- bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
- enic: fix tx_hang_reset use-after-free on device removal
- net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock
- pds_core: keep the health thread stopped during reset
- pds_core: cancel pending PCI reset work on AER recovery
- netfilter: ipset: switch ext_size to atomic64_t
- ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
- ipvs: return the csum validation for forward hook
- watchdog: bd96801_wdt: Fix timeout for enabled WDG
- btrfs: fix memory leak in btrfs_do_encoded_write()
- bpf: Preserve pointer state for commuted arithmetic
- net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in
smc_llc_event_handler()
- net/sched: cls_route: fix fastmap use-after-free on filter
- [arm64] net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
- devlink: fix net namespace reference leak in reload
- net/mlx5: fw_tracer, return NULL on create error
- counter: microchip-tcb-capture: Fix DT channel validation
- bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch
- bpf: tcp: Make sure iter->batch always contains a full bucket snapshot
- bpf: tcp: Get rid of st_bucket_done
- bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items
- bpf: tcp: Avoid socket skips and repeats during iteration
- bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
- vhost/vdpa: reject overflowing PA map page counts on 32-bit
- vdpa/mlx5: Fix buffer length in create_direct_keys()
- tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss()
- xsk: require at least 16 bytes of TX metadata
- udp: fix potential use-after-free in tunnel segmentation
- net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
- net/openvswitch: check Ethernet header length in key_extract()
- net/sched: cls_api: Always acquire rtnl_lock when destroying locked
classifiers
- hwmon: (nzxt-smart2) Check return value of init_device() in probe
- hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations
- bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss()
- bnxt_en: Determine and store default RX ring in vnic structure
- bnxt_en: Refresh VNIC default ring on queue restart if needed
- bnxt_en: Fix PTP PPS setting bug
- sctp: fix addip_serial increment on ASCONF_ACK allocation failure
- tcp: fix TFO max_qlen accounting across reuseport migration
- net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
- net: prestera: validate firmware header length
- net: remove WARN_ON_ONCE() from sk_mc_loop()
- net/smc: fix TOCTOU race between smc_listen_out() and listener close
- [amd64] net: thunderbolt: Tear down DMA paths before stopping the rings
- ata: pata_sl82c105: fix bridge revision use-after-free
- net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
- sctp: clear control chunk transport if it is being removed
- tls: don't abort the connection on signal-interrupted sends
- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string
termination
- hwmon: (ads7828) Fix external VREF regulator handling
- hwmon: (ltc4282) Avoid overflow in maximum power calculation
- hwmon: (ltc4282) Clamp negative current limits
- hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt
- mm/vmscan: wake up flushers conditionally to avoid cgroup OOM
(Closes: #1143545)
- net: fec: do not release NULL pages when RX buffer allocation fails
- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
- mtd: spinand: fix direct mapping creation sizes
- mtd: spinand: try a regular dirmap if creating a dirmap for continuous
reading fails
- mtd: spinand: repeat reading in regular mode if continuous reading fails
- swapfile: call cond_resched() before locking si->lock
- Input: evdev - sanitize event type index when fetching event masks
- ALSA: usb-audio: fix OOB write on Type II inbound URBs
- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
- [amd64] thunderbolt: icm: Preserve USB4 proxy data-valid bit
- usb: cdnsp: fix incorrect endian conversions for APB timeout register
- usb: gadget: f_ncm: Use unsigned int for ndp_index
- net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
- net: usb: ipheth: fix carrier_work UAF on disconnect
- vt: add permission check for KDSKBMETA ioctl
- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
- Input: evdev - fix information leak in evdev_pass_values()
- ima: fix out-of-bounds read in xattr_verify()
- ipvs: stop estimator after disabled calc phase
- ipvs: add totalconns for dest
- ipvs: properly update the overload flag on dest edit
- ipvs: clear IPv4 options after rebasing tunnel ICMP errors
- packet: use consistent hard_header_len in non-ring send paths
- packet: use consistent hard_header_len in TX_RING send path
- net/packet: reset the MAC header on the packet-socket transmit path
- packet: synchronize pressure clearing with ring reconfiguration
- net: fix skb length accounting after generic XDP frag adjustment
- net: openvswitch: reallocate update replies for mismatched IDs
- net/sched: reject overly deep qdisc hierarchies
- net: octeontx2-pf: Fix UB in shift operation
- net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
- mac802154: fix netdev use-after-free in beacon worker
- netfilter: ebt_nflog: pin the NFLOG backend
- net: bridge: mrp: fix uninitialised bytes on the wire
- [s390x] KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
(CVE-2026-74514)
- [s390x] KVM: s390: pci: Fix missing error codes and memory unaccounting
- [s390x] KVM: s390: pci: Fix resource leak on IRQ registration failure
- [s390x] KVM: s390: pci: Fix aisb calculation
- block: Reorder the request allocation code in blk_mq_submit_bio()
- blk-mq: pop cached request if it is usable (CVE-2026-64017)
- blk-mq: reinsert cached request to the list
- dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk
- [amd64] crypto: ccp - Add new SEV/SNP platform shutdown API
- [amd64] KVM: SVM: Add support to initialize SEV/SNP functionality in KVM
- [amd64] crypto: ccp - Fix checks for SNP_VLEK_LOAD input buffer length
- [amd64] crypto: ccp - Abort doing SEV INIT if SNP INIT fails
- futex: Prevent robust futex exit race some more
- kunit/fortify: Replace "volatile" with OPTIMIZER_HIDE_VAR()
- kunit/fortify: Add back "volatile" for sizeof() constants
- pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
- ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
- ipv4: fix use-after-free in fib_nhc_update_mtu()
- mei: pull kvfree out of spinlock
- nvmem: layouts: Add fixed-layout driver
- serial: qcom-geni: fix TX DMA buffer flush
- serial: 8250_dma: Clear stale RX state on shutdown
- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
- staging: rtl8723bs: fix OOB read in WMM_param_handler()
- staging: rtl8723bs: fix missing shared-key auth challenge length check
- staging: rtl8723bs: validate monitor transmit frame lengths
- misc: fastrpc: fix channel ctx ref leak when session alloc fails
- misc: fastrpc: Remove buffer from list prior to unmap operation
- misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
- ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
- ALSA: usx2y: bound the hwdep mmap fault offset
- tracing: Fix race between update_event_fields and, event_define_fields
- fbdev: bitblit: bound-check glyph index in bit_cursor()
- ring-buffer: Prevent subbuf order change when resizing is disabled
- mm/huge_memory: fix huge_zero_pfn race
- net: smc: fix splice entry lifetime imbalance in smc_rx_splice
- ipv6: prevent in6_dev_get() from resurrecting inet6_dev
- netfilter: bridge: release template ct on non-IP path
- netfilter: nf_conntrack: defer invalid log until after unlock
- net: atlantic: free stranded TX buffers on ring deinit
- net: atlantic: free RX pages of consumed but not refilled buffers
- net/sched: act_ct: fix sk_buff leak when the header checks reject a
packet
- net/sched: act_gact, act_police: range check the fallback control action
- ovl: don't warn when the mount is completed from another user namespace
- binfmt_misc: don't warn when the mount is completed from another user
namespace
- Revert "drm/amdgpu: fix aperture mapping leak"
- xdp: reject clones that overrun skb_shared_info tailroom
- vxlan: do not arm the ageing timer on a device that is down
- vsock/virtio: read virtqueues under worker locks
- vsock/virtio: avoid refilling the RX queue after teardown
- veth: fix skb length accounting after XDP frag adjustment
- vhost: reset the vring metadata cache on vring reconfiguration
- tls: don't leave a full plaintext sk_msg ring unpushed
- tipc: read le->link under the node lock in tipc_node_link_down()
- smb: client: Fix use-after-free in cifs_try_adding_channels()
- [amd64] KVM: x86/mmu: WARN and clear role.invalid when creating a child
shadow page
- eventfs: Fix use-after-free in eventfs_remove_rec()
- Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
- ptp: ocp: Fix board ID over-read
- ipv6: fix Route Information option length validation
- ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
- fscrypt: use the mount idmap for the owner check in
fscrypt_ioctl_set_policy()
- sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
- ima: Instantiate file_truncate and path_truncate hooks
- fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
- fsverity: Fix silent truncation in bpf_get_fsverity_digest()
- bpf, sockmap: Fix sk_redir use-after-free in send verdict
- scsi: scsi_debug: Negate wrapped memcmp() result
- sctp: keep chunk->transport in step with the list it is queued on
- sctp: fix use-after-free of cached ASCONF chunk
- sctp: clear new_transport when removing a peer
- [amd64] thunderbolt: Bound the DROM dual link port number before indexing
sw->ports
- [amd64] thunderbolt: Fix bandwidth group reservation indexing
- bpf: tcp: fix double sock release on batch realloc
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.105
- block: stop the timeout timer when releasing a never added disk
- bpf: Fix linked reg delta tracking when src_reg == dst_reg
(CVE-2026-53092)
- bpf: Clear delta when clearing reg id for non-{add,sub} ops
- f2fs: fix UAF issue in f2fs_merge_page_bio() (CVE-2025-40054)
- mtd: ubi: skip programming unused bits in ubi headers
- ubi: fastmap: fix ubi->fm memory leak
- mm/damon/ops-common: putback folios on invalid migrate nid
(CVE-2026-74644)
- mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD}
- igc: fix netdev not re-attached after resume if interface is down
- ipvs: separate destination availability state
- net: mana: Fix EQ leak in mana_remove on NULL port
- [amd64] crypto: ccp: Add external API interface for PSP module
initialization
- [amd64] KVM: SVM: Ensure PSP module is initialized if KVM module is
built-in
- selinux: require every boolean value to be defined
- selinux: reject a class permission count below its inherited common
- selinux: do not cancel a policy conversion that never started
- selinux: reject an unclaimed class value in security_get_classes()
- mptcp: avoid combining some incoming suboptions
- mptcp: options: reset DSS fields in case of unexpected size
- mptcp: fastopen: only mark MPTFO subflows with SYN data
- [s390x] qeth: validate user buffer length in SNMP and ARP query ioctls
- [amd64] ASoC: SOF: sof-audio: Fix error path in
sof_widget_setup_unlocked()
- fbdev: core: Fix pointer desynchronization in fb_io_read()
- drm/panthor: skip zero-sized firmware sections
- drm/amdgpu: reject oversized IBs with per-ring packet limits
- drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12
- drm/amdgpu: fix aperture iounmap skipped on device removal
- [amd64] ASoC: SOF: topology: Use acpi mach from the machine driver
- Input: xpad - add support for ZENAIM LEVERLESS
- Input: cs40l50-vibra - validate custom data from user space
- [powerpc*] pseries: pci - logic bug
- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
- Input: focaltech - fix array out-of-bounds in
focaltech_process_rel_packet
- Input: psxpad-spi - set driver data before use
- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
- Input: iforce - validate input packet lengths
- [powerpc*] pseries: lparcfg - fix kbuf[] underflow
- Input: synaptics-rmi4 - zero report size on F54 work error
- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
- Input: synaptics-rmi4 - block s_input when F54 queue is busy
- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
- Input: hynitron_cstxxx - validate touch count and finger IDs
- [arm64] crypto: qce - fix error path in devm_qce_register_algs
- gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on
unbind
- [arm64] pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state
0
- libceph: fix multiple unsafe decodes in decode_locker()
- ftrace: Protect direct_functions in ftrace_find_rec_direct
- ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
- Input: sur40 - fix input device registration ordering
- Input: sur40 - fix V4L error path cleanup
- libceph: Avoid using invalid osd indices from primary_temp
- ceph: fix MDS random selection readiness predicate
- libceph: tolerate addrvecs with multiple entries of the same type
- [armhf] mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on
32-bit
- mmc: sdhci: unmap the bounce buffer before device release
- mmc: sdhci: make tuning_err a signed int
- drm/connector/hdmi: Fix out of bounds memory read
- drm/xe: Order ring writes before ring tail updates
- drm/radeon: fix autosuspend cleanup during teardown
- [s390x] vfio_ccw: Free all memory if cp_init() fails
- [s390x] vfio_ccw: Limit the number of channel program segments
- [s390x] vfio_ccw: Cancel existing workqueues
- [s390x] vfio_ccw: Ensure index for read/write regions are within range
- [s390x] vfio_ccw: Ensure first IDAW remains constant
- [s390x] vfio_ccw: Fix out of bounds check on CCW array
- [s390x] vfio_ccw: Move cp cleanup out of not operational
- [s390x] vfio_ccw: Selectively expand io_mutex
- [s390x] vfio_ccw: Calculate idal length based on idaw type
- [s390x] vfio_ccw: Implement a crw lock
- drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix
- drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE
- drm/amdgpu: Reject UVD message with invalid number of h265 refs
- drm/amdgpu: fix nbif 6.3.1 l1 low power not functional
- drm/amdgpu: check ASPM on the dGPU host link
- drm/amdgpu: validate GEM_CREATE domain combinations
- drm/amdgpu: Reject UVD message with dimensions above 4096
- drm/amdgpu: Implement insert_end for VCE 3
- drm/amdgpu: Fix UVD min buffer sizes
- drm/amdgpu: Fix UVD dpb min size calculation for H264
- drm/amdgpu: Fix UVD decode image min size calculation
- drm/amdgpu: disallow multiple FENCE chunks in one submit
- xfs: clear zapped attr fork state when bmap repair finds no attr fork
- xfs: zero i_nlink before repair puts inode on unlinked list
- xfs: only check mergeability of bnobt records
- xfs: don't double-lock when deleting a self-referential directory
- xfs: set the prev pointer when reinserting an inode on the unlinked list
- xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers
- xfs: nlink scrub must take IOLOCK before determining ILOCK state
- xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev
- xfs: fix ilock leak on error in xfs_dq_get_next_id
- xfs: don't zap the attr fork on repair when there are queued pptr updates
- xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair
- xfs: fix allocated inodes that show up in the unlinked list
- xfs: fix another iunlink infinite loop bug in online fsck
- xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers
- xfs: avoid UAF on sc->tempip in xrep_tempfile_create
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN
- xfs: don't swallow dquot recovery verification errors
- xfs: check xfarray iteration errors when committing unlinked inode lists
- xfs: check v5 superblock features early
- ceph: Remove ceph_writepage()
- ceph: Use a folio in ceph_page_mkwrite()
- ceph: Convert ceph_find_incompatible() to take a folio
- ceph: Convert writepage_nounlock() to write_folio_nounlock()
- ceph: fix writeback_count leak in write_folio_nounlock()
- ceph: avoid fs reclaim while using current->journal_info
- ceph: fix hanging __ceph_get_caps() with stale mds_wanted
- libceph: Amend checking to fix `make W=1` build breakage
- libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
(CVE-2026-68159)
- mm/khugepaged: guard is_zero_pfn() calls with pte_present()
- userfaultfd: prevent registration of special VMAs (CVE-2026-68166)
- libceph: fix two unsafe bare decodes in decode_lockers() (CVE-2026-68082)
- net/sched: serialize qdisc_rtab_list against concurrent get/put
(CVE-2026-68138)
- super: remove pointless s_root checks
- super: skip dying superblocks early
- super: use a common iterator (Part 1)
- super: use common iterator (Part 2)
- fs/super: fix emergency thaw double-unlock of s_umount
- super: fix emergency thaw deadlock on frozen block devices
(CVE-2026-68132)
- smb: move smb_version_values to common/smbglob.h
- smb: move get_rfc1002_len() to common/smbglob.h
- smb/server: rename include guard in smb_common.h
- ksmbd: rename smb2_get_msg to smb_get_msg
- smb/server: fix minimum SMB1 PDU size
- smb/server: fix minimum SMB2 PDU size
- ksmbd: validate minimum PDU size for transform requests (CVE-2026-68431)
- eventpoll: pin files while checking reverse paths
- tcp: Pass flags to __tcp_send_ack
- tcp: fast path functions later
- tcp: reorganize tcp_sock_write_txrx group for variables later
- tcp: challenge ACK for non-exact RST in SYN-RECEIVED (CVE-2026-68118)
- iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
- btrfs: add debug build only WARN
- btrfs: add space_info argument to btrfs_chunk_alloc()
- btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg()
- btrfs: zoned: fix missing chunk metadata reservation
- [amd64] KVM: x86: Cancel delayed I/O APIC EOI handling before destroying
vCPUs (CVE-2026-74517)
- [arm64] ASoC: tas2562: Validate values for volume writes
- ata: libata-scsi: terminate deferred commands on time out
- igc: remove napi_synchronize() in igc_down()
- ksmbd: conn lock to serialize smb2 negotiate
- ksmbd: reject repeated SMB2 NEGOTIATE requests (CVE-2026-74494)
- net: pktgen: fix code style (WARNING: Block comments)
- net: pktgen: fix proc entry use-after-free (CVE-2026-74479)
- binfmt_misc: don't leak the user namespace when the mount fails
(CVE-2026-74483)
- fsnotify, lsm: Decouple fsnotify from lsm
- fsnotify: opt-in for permission events at file open time
- fs: don't block write during exec on pre-content watched files
- binfmt_misc: restore write access when removing an entry (CVE-2026-74487)
- vrf: Make pcpu_dstats update functions available to other modules.
- vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS.
- vxlan: use pskb_network_may_pull() for transmit path header pulls
(CVE-2026-74474)
- ice: fix VF interrupts cleanup
- include/linux/fs.h: add inode_lock_killable()
- smb: client: fix race with fallocate(2) and AIO+DIO
- cifs: add fscache_resize_cookie() to cifs_setsize()
- can: rcar_canfd: change the initializing flow for clocks and resets
- drm/amd/pm: Use same metric table for APU
- drm/amd/pm: Use macro to initialize metrics table
- drm/amd/pm: fix torn gpu metrics reads
- drm/amdgpu: remove unused function parameter
- drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
- drm/amd/pm: adjust the visibility of pp_table sysfs node
- drm/amd/pm: fix pptable use-after-free (CVE-2026-74450)
- net: tap: set skb->dev before parsing virtio net header in
tap_get_user_xdp() (CVE-2026-74684)
- drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
- ring-buffer: Simplify functions with __free(kfree) to free allocations
- ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
(CVE-2026-74602)
- mm/pagewalk: split walk_page_range_novma() into kernel/user parts
- mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
(CVE-2026-74672)
- mm/ptdump: always stabilise against page table freeing using init_mm
(CVE-2026-74599)
- KVM: SVM: Serialize accesses to the owner and mirror list with separate
lock (CVE-2026-74607)
- ring-buffer: Simplify ring_buffer_read_page() with guard()
- ring-buffer: Make ring_buffer_{un}map() simpler with guard(mutex)
- ring-buffer: Prevent resizing of persistent ring buffer
- [amd64] x86/mce: Remove __mcheck_cpu_init_early()
- [amd64] x86/mce: Set CR4.MCE last during init
- [amd64] x86/mce: Set up the polling timer before CMCI discovery
- [amd64] ASoC: SOF: ipc4-topology: Refresh copier IPC payload before
widget
setup
- net/x25: fix use-after-free of the socket by its timers (CVE-2026-74628)
- [arm64] tegra: Add EL2 virtual timer interrupt for Tegra194
- crypto: ccm - Set rfc4309 maxauthsize from child
- netfilter: ipset: fix refcount race between list:set GC and swap
- netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort
path
- netfilter: flowtable: publish GC-visible tuple last
- netfilter: ipset: fix list type element drift bug
- netfilter: ipset: let destroy callbacks adjust ext mem size
- ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
- macvlan: inherit needed_headroom and needed_tailroom from lowerdev
- veth: fix queue index used to wake the peer txq in veth_poll
- tcp: fix icsk_ack.ato bitfield overflow
- net: packet: fix wrong transport_header when sending VLAN-tagged frame
- net/tls: Fail tls_sw_splice_read() after a failed async decrypt
- af_packet: Don't send zero-byte data in tpacket_snd().
- net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
- net/sched: cls_u32: skip hash tables in u32_bind_class()
- net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
- net/sched: cls_bpf: reject dev-bound programs bound to a different device
- drm/xe/oa: Fix sync entry leak on OA config emit failure
- erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
- perf: Unify perf_event_free_task() / perf_event_exit_task_context()
- perf/core: Fix group leader use-after-free after sibling detach
(CVE-2026-74637)
- fs: unlock the superblock during iterate_supers_type
- binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
- net: harmonize tstats and dstats
- ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS
- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu()
- ring-buffer: Use current_context for safe per-CPU buffer swap
(CVE-2026-74601)
- ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r
- net: ethernet: mtk_eth_soc: only use legacy mode on missing IRQ name
- net: ethernet: mtk_eth_soc: improve support for named interrupts
.
[ Salvatore Bonaccorso ]
* drivers/mmc/host: Enable MMC_ALCOR as module (Closes: #1142912)
* drivers/misc/cardreader: Enable MISC_ALCOR_PCI as module (Closes: #1142912)
Checksums-Sha1:
e9e97c0e2288513ea333a38f682f31bdb99af14e 290418 linux_6.12.105-1.dsc
123ea3e7ec3048cc27fed670873283db74251227 151395944 linux_6.12.105.orig.tar.xz
c22359a2a8e400e2f7d9657401b8a871630f924b 1885248 linux_6.12.105-1.debian.tar.xz
eb9624e81a72d370e4207667a23afb0c33ca02bf 6900 linux_6.12.105-1_source.buildinfo
Checksums-Sha256:
546d33ef1a1ec53c3ac12a78853347c77aa161b00649f338dc535c09a59f3567 290418
linux_6.12.105-1.dsc
5d2c47d01ff7a688e650daf2f1c0c21269b58d54c2b151bcf3a58549f5559e82 151395944
linux_6.12.105.orig.tar.xz
95090297cea3ae7d3b4cce5e94cb0adc7912a5c9659a6d1fbb6898f80692b7ee 1885248
linux_6.12.105-1.debian.tar.xz
1a3d207794f3b91580403e5f668ea8dfc28ebc492a071d19919dba7e20517620 6900
linux_6.12.105-1_source.buildinfo
Files:
b5e2abf680088e19637f259462db20f5 290418 kernel optional linux_6.12.105-1.dsc
ea4b311a2ae7444f632f55dbbf7f7e02 151395944 kernel optional
linux_6.12.105.orig.tar.xz
5b699291296da677ded21150a5502f4f 1885248 kernel optional
linux_6.12.105-1.debian.tar.xz
0bae83f77c6ed88e3282863ed69a0be9 6900 kernel optional
linux_6.12.105-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmqMpdFfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EWBQQAKAkeItc/Rdc/PiYOo45hE6Rn9szfUZA
gzN2XIm/wGBVxmXvOfy8N5+l/syVbko20+NrhGZ7bpV4f2paoJTvskMPIYIvPQD+
ktzUsbFx/I+03cKZqIkThlPieCO0IVFJstK7Pd8o0xP23IZN7b1AzVIom8ksVZi2
/MYtcCM5hn8Wez5kd4ROlenWThbFRvFUSt9NNCKHEsq0LhaSNNYuqGm6EomNZrhA
+RZ1IeO8P+v0X8itZyD4qkCz/MulHr8Dgb1aqonzJuHjslIdrGR/Zra1Ph/VzaZq
J9848LsN+v6STf3Y/QO21lqEgeM59xsWEOIMUahtjaSa25Oe4AyKHNhbbDPxXdET
Rv2aKs/jEry8BejU8nvjKW4DQCBk5bpiAHnUj8GvCoxEwmKYIEEWNcxKqaMTYrUF
9CIlmF0+aKZwT2CqFYYXWCq6j9Wrb8g7RAo8ZLzGQT8W2iDxNIBilpPuUdPEHLe8
lOUEYRRfgAb/dwsEJlV7iXDUUURWIE9jE5aMSGLQRU6ovZyJzH/epMJTGiTTJf7S
bdVxYpqXj0eflL5aThky0YB9niBmWK4bqkqcaLn8/+bVzvGm1bp+9UFkV3rl6iIy
j9HAxG0oK1MpXwKKWcqPh0+A5rb+pbYIVzpBEFESFN1HDGqnEFEj841TH0WpElUS
Oq05/5dDmoM/
=mHKc
-----END PGP SIGNATURE-----
pgpuNC_57_iu9.pgp
Description: PGP signature
--- End Message ---
