Your message dated Sat, 07 Nov 2026 10:14:04 +0000
with message-id <[email protected]>
and subject line Bug#1145111: fixed in linux 7.3.3-1
has caused the Debian Bug report #1145111,
regarding linux: kernel NULL pointer dereference when running libqb, rustc or
snapd testsuite
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1145111: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1145111
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: linux
Version: 7.1.9-1
Severity: important
X-Debbugs-Cc: [email protected]
User: [email protected]
Usertags: riscv64
Dear maintainers,
The rv-manda-04 build daemon got a kernel oops this morning when
building the snapd package. It currently runs a 7.1.7+deb13-riscv64
kernel. Here is the backtrace:
[265841.801920] Unable to handle kernel NULL pointer dereference at virtual
address 000000000000004c
[265841.810839] Current systemd.test pgtable: 4K pagesize, 39-bit VAs,
pgdp=0x0000000157206000
[265841.819037] [000000000000004c] pgd=0000000000000000, p4d=0000000000000000,
pud=0000000000000000
[265841.827796] Oops [#1]
[265841.830412] Modules linked in: nls_ascii nls_cp437 vfat fat ftdi_sio
usbserial onie_tlv ofpart spi_nor at24 ledtrig_default_on k1_tsensor leds_gpio
ip6t_REJECT nf_reject_ipv6 ip6table_filter ip6_tables xt_hashlimit ipt_REJECT
nf_reject_ipv4 xt_NFLOG nfnetlink_log xt_multiport xt_tcpudp xt_conntrack
nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter mtdblock mtd_blkdevs
mtd drm sch_fq tcp_bbr nvme_fabrics configfs nfnetlink efivarfs ip_tables
x_tables autofs4 ext4 crc16 mbcache jbd2 crc32c_cryptoapi mmc_spi crc7
of_mmc_spi crc_itu_t mmc_block dm_mod onboard_usb_dev xhci_plat_hcd xhci_hcd
dwc3_generic_plat dwc3 udc_core roles nvme sdhci_of_k1 realtek sdhci_pltfm
usbcore phy_package nvme_core sdhci mmc_core nvme_keyring nvme_auth k1_emac
usb_common mmp_pdma spi_fsl_qspi i2c_k1 phy_k1_usb2
[265841.907949] CPU: 1 UID: 193463271 PID: 1864225 Comm: systemd.test Not
tainted 7.1.7+deb13-riscv64 #1 PREEMPTLAZY Debian 7.1.7-1~bpo13+1
[265841.920327] Hardware name: Unknown Unknown Product/Unknown Product, BIOS
2022.10spacemit-82694-gff90af2940 10/01/2022
[265841.931104] epc : __aa_label_next_not_in_set+0x16/0xd8
[265841.936393] ra : aa_label_is_subset+0x36/0x60
[265841.940846] epc : ffffffff805bdf3e ra : ffffffff805be036 sp :
ffffffc61a6b3780
[265841.948283] gp : ffffffff822bffd0 tp : ffffffd70b013000 t0 :
ffffffff80021f28
[265841.955523] t1 : ffffffd701bfe00c t2 : ffffffff81201660 s0 :
ffffffc61a6b37c0
[265841.962803] s1 : ffffffd70c670ef8 a0 : ffffffc61a6b37c0 a1 :
ffffffd70c670ef8
[265841.970159] a2 : 0000000000000000 a3 : 0000000000000000 a4 :
0000000000000000
[265841.977384] a5 : ffffffd70c670ef8 a6 : 0000000000000000 a7 :
ffffffc61a6b35b0
[265841.984720] s2 : 0000000000000000 s3 : ffffffd70c670ef8 s4 :
ffffffd7fea14960
[265841.992508] s5 : 0000000000000000 s6 : ffffffff81663100 s7 :
0000000000000000
[265842.000004] s8 : ffffffd80384e2c0 s9 : ffffffd70425d480 s10:
ffffffd88aa61700
[265842.007363] s11: 0000000000000009 t3 : ffffffd701bfb00c t4 :
0000000000000001
[265842.014780] t5 : 0000000000000002 t6 : ffffffc61a6b35e4 ssp :
0000000000000000
[265842.022324] status: 0000000200000120 badaddr: 000000000000004c cause:
000000000000000d
[265842.030538] [<ffffffff805bdf3e>] __aa_label_next_not_in_set+0x16/0xd8
[265842.037405] [<ffffffff805be036>] aa_label_is_subset+0x36/0x60
[265842.044021] [<ffffffff805c6110>] aa_unix_file_perm+0x3b0/0x8a8
[265842.050211] [<ffffffff805c3d44>] aa_sock_file_perm+0x74/0x88
[265842.056193] [<ffffffff805bc18c>] aa_file_perm+0x424/0x4c8
[265842.061895] [<ffffffff805b6eac>] apparmor_file_permission+0x54/0x200
[265842.068511] [<ffffffff80558eb4>] security_file_permission+0x5c/0x150
[265842.075262] [<ffffffff8042b9d0>] rw_verify_area+0x48/0x140
[265842.080991] [<ffffffff8042e186>] vfs_write+0x7e/0x4f0
[265842.086084] [<ffffffff8042e7c8>] ksys_write+0xb8/0xe8
[265842.091150] [<ffffffff8042e818>] __riscv_sys_write+0x20/0x30
[265842.096858] [<ffffffff80d0d7c6>] do_trap_ecall_u+0x156/0x520
[265842.102608] [<ffffffff80d202ec>] handle_exception+0x16c/0x178
[265842.108308] Code: ffa6 0013 0000 7139 f822 fc06 f04a 0080 2903 0045 (4678)
5b63
[265842.116173] ---[ end trace 0000000000000000 ]---
[265842.120608] note: systemd.test[1864225] exited with preempt_count 1
[265862.805959] rcu: INFO: rcu_sched self-detected stall on CPU
[265862.811445] rcu: 4-....: (5248 ticks this GP)
idle=ddac/1/0x4000000000000000 softirq=29553384/29553384 fqs=2387
[265862.821649] rcu: (t=5253 jiffies g=30403905 q=244873 ncpus=8)
I have been able to reproduce it on another system running the same
kernel, but not when running a manually build 7.1.4 kernel. I have then
been able to reproduce it on a amd64 system running a 7.1.9+deb14-amd64
kernel. I therefore *suspect* the issue have been introduced by one of
the many apparmor fixes that went in 7.1.5. Here is the corresponding
amd64 backtrace:
[ 3686.682567] BUG: kernel NULL pointer dereference, address: 000000000000004c
[ 3686.684051] #PF: supervisor read access in kernel mode
[ 3686.685078] #PF: error_code(0x0000) - not-present page
[ 3686.685949] PGD 0 P4D 0
[ 3686.685949] Oops: Oops: 0000 [#1] SMP NOPTI
[ 3686.685949] CPU: 3 UID: 428679 PID: 319766 Comm: systemd.test Not tainted
7.1.9+deb14-amd64 #1 PREEMPT(lazy) Debian 7.1.9-1
[ 3686.685949] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
2025.11-5 04/03/2026
[ 3686.685949] RIP: 0010:__aa_label_next_not_in_set+0xb/0xd0
[ 3686.685949] Code: f0 e9 e4 14 79 ff 66 0f 1f 84 00 00 00 00 00 90 90 90 90
90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 0f 1f 44 00 00 41 57 <8b> 42 4c
49 89 f7 41 56 49 89 d6 41 55 49 89 fd 41 54 55 53 8b 6f
[ 3686.685949] RSP: 0018:ffffd06109cf3888 EFLAGS: 00010213
[ 3686.685949] RAX: ffff89b1a103a8f8 RBX: ffff89b1af0421e0 RCX: ffffd06109cf3780
[ 3686.685949] RDX: 0000000000000000 RSI: ffff89b1a103a8f8 RDI: ffffd06109cf3898
[ 3686.685949] RBP: ffffd06109cf3940 R08: ffff89b183a26300 R09: 0000000000000000
[ 3686.685949] R10: 0000000000000000 R11: ffff89b1a103b600 R12: 0000000000000000
[ 3686.685949] R13: ffff89b1a103a8f8 R14: ffff89b1a103a8f8 R15: ffff89b183a26680
[ 3686.685949] FS: 00007f30a3aa5780(0000) GS:ffff89b350cef000(0000)
knlGS:0000000000000000
[ 3686.685949] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3686.685949] CR2: 000000000000004c CR3: 000000000235e000 CR4: 0000000000750ef0
[ 3686.685949] PKRU: 55555554
[ 3686.685949] Call Trace:
[ 3686.685949] <TASK>
[ 3686.685949] aa_label_is_subset+0x3f/0x70
[ 3686.685949] aa_unix_file_perm+0x5e8/0x9d0
[ 3686.685949] aa_file_perm+0x45a/0x550
[ 3686.685949] ? srso_alias_return_thunk+0x5/0xfbef5
[ 3686.685949] ? aa_do_perms+0xc6/0x120
[ 3686.685949] apparmor_file_permission+0x44/0xb0
[ 3686.685949] security_file_permission+0x40/0x100
[ 3686.685949] rw_verify_area+0x56/0x180
[ 3686.685949] vfs_write+0x7c/0x480
[ 3686.685949] ? srso_alias_return_thunk+0x5/0xfbef5
[ 3686.685949] ksys_write+0xbf/0xf0
[ 3686.685949] do_syscall_64+0xe1/0x640
[ 3686.685949] ? srso_alias_return_thunk+0x5/0xfbef5
[ 3686.685949] ? aa_match_to_prot+0xab/0x150
[ 3686.685949] ? srso_alias_return_thunk+0x5/0xfbef5
[ 3686.685949] ? aa_do_perms+0xc6/0x120
[ 3686.685949] ? srso_alias_return_thunk+0x5/0xfbef5
[ 3686.685949] ? aa_unix_label_sk_perm.part.0.isra.0+0x142/0x1f0
[ 3686.685949] ? srso_alias_return_thunk+0x5/0xfbef5
[ 3686.685949] ? __check_object_size+0x48/0x220
[ 3686.685949] ? srso_alias_return_thunk+0x5/0xfbef5
[ 3686.685949] ? srso_alias_return_thunk+0x5/0xfbef5
[ 3686.685949] ? srso_alias_return_thunk+0x5/0xfbef5
[ 3686.685949] ? move_addr_to_user+0xe7/0x110
[ 3686.685949] ? srso_alias_return_thunk+0x5/0xfbef5
[ 3686.685949] ? do_getsockname+0x7b/0xb0
[ 3686.685949] ? srso_alias_return_thunk+0x5/0xfbef5
[ 3686.685949] ? __sys_getsockname+0x7f/0xb0
[ 3686.685949] ? srso_alias_return_thunk+0x5/0xfbef5
[ 3686.685949] ? srso_alias_return_thunk+0x5/0xfbef5
[ 3686.685949] ? do_syscall_64+0x11e/0x640
[ 3686.685949] ? srso_alias_return_thunk+0x5/0xfbef5
[ 3686.685949] ? sock_alloc_file+0x63/0xc0
[ 3686.685949] ? srso_alias_return_thunk+0x5/0xfbef5
[ 3686.685949] ? __sys_socket+0xd0/0x100
[ 3686.685949] ? srso_alias_return_thunk+0x5/0xfbef5
[ 3686.685949] ? srso_alias_return_thunk+0x5/0xfbef5
[ 3686.685949] ? srso_alias_return_thunk+0x5/0xfbef5
[ 3686.685949] ? do_syscall_64+0x98/0x640
[ 3686.685949] ? exc_page_fault+0x82/0x1d0
[ 3686.685949] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 3686.685949] RIP: 0033:0x55ad1c8928ae
[ 3686.685949] Code: ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc
cc cc cc cc cc cc cc cc cc 49 89 f2 48 89 fa 48 89 ce 48 89 df 0f 05 <48> 3d 01
f0 ff ff 76 15 48 f7 d8 48 89 c1 48 c7 c0 ff ff ff ff 48
[ 3686.685949] RSP: 002b:00002b7a7ff63420 EFLAGS: 00000216 ORIG_RAX:
0000000000000001
[ 3686.685949] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 000055ad1c8928ae
[ 3686.685949] RDX: 0000000000000009 RSI: 00002b7a7ff636b8 RDI: 0000000000000008
[ 3686.685949] RBP: 00002b7a7ff63460 R08: 0000000000000000 R09: 0000000000000000
[ 3686.685949] R10: 0000000000000000 R11: 0000000000000216 R12: 00002b7a7ff63590
[ 3686.685949] R13: 00002b7a7fe121a8 R14: 00002b7a7ff04f00 R15: ffffffffffffffff
[ 3686.685949] </TASK>
[ 3686.685949] Modules linked in: overlay nls_ascii nls_cp437 vfat fat bridge
stp llc nfnetlink cfg80211 rfkill intel_rapl_msr intel_rapl_common binfmt_misc
kvm_amd ccp kvm irqbypass aesni_intel gf128mul virtio_balloon pcspkr button
joydev evdev sg vhost_net vhost tun nbd vhost_iotlb drm loop tap msr cpuid
efi_pstore configfs efivarfs qemu_fw_cfg vsock_loopback
vmw_vsock_virtio_transport vmw_vsock_virtio_transport_common vsock virtio_rng
autofs4 ext4 crc16 mbcache jbd2 crc32c_cryptoapi lz4 lz4_compress dm_mod ahci
sd_mod iTCO_wdt libahci intel_pmc_bxt watchdog virtio_net libata virtio_scsi
net_failover psmouse scsi_mod serio_raw failover i2c_i801 scsi_common i2c_smbus
lpc_ich
[ 3686.765532] CR2: 000000000000004c
[ 3686.765532] ---[ end trace 0000000000000000 ]---
Regards
Aurelien
--- End Message ---
--- Begin Message ---
Source: linux
Source-Version: 7.3.3-1
Done: Salvatore Bonaccorso <[email protected]>
We believe that the bug you reported is fixed in the latest version of
linux, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <[email protected]> (supplier of updated linux package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 07 Nov 2026 09:08:08 +0100
Source: linux
Architecture: source
Version: 7.3.3-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Kernel Team <[email protected]>
Changed-By: Salvatore Bonaccorso <[email protected]>
Closes: 1145111 1152841 1152917 1153230
Changes:
linux (7.3.3-1) unstable; urgency=medium
.
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.3.2
- ksmbd: wait for negotiation before receiving another PDU
- smb: smbdirect: don't wait for RDMA_CM_EVENT_DISCONNECTED in
smbdirect_socket_destroy_sync()
- smb: smbdirect: release failed pending sockets of a listener
- smb: smbdirect: don't hand out already failed sockets in
smbdirect_socket_accept()
- ksmbd: reject FSCTL_SET_ZERO_DATA on a directory handle
- wifi: ath12k: move dp_profile_params to dp.h
- wifi: ath12k: convert DP_TX_COMP_RING_SIZE to inline helper
- wifi: ath12k: convert DP_RXDMA_MONITOR_BUF_RING_SIZE to inline helper
- wifi: ath12k: convert DP_RXDMA_MONITOR_DST_RING_SIZE to inline helper
- wifi: ath12k: convert ATH12K_NUM_POOL_TX_DESC to inline helper
- wifi: ath12k: convert ATH12K_RX_DESC_COUNT to inline helper
- wifi: ath12k: convert DP_RX_RELEASE_RING_SIZE to inline helper
- wifi: ath12k: Make RXDMA buffer ring size configurable per memory profile
- wifi: ath12k: Increase RXDMA buffer ring size for default memory profile
- io_uring/waitid: own the request before clearing ->head
- io_uring/cmd: don't leave list poison in ->hash_node
- io_uring/wait: don't spin on a stuck overflow list
- io_uring/io-wq: don't lose the signal that ends work (CVE-2026-99228)
- io_uring/io-wq: don't hide a link from cancellations (CVE-2026-99255)
- io_uring: don't flood a cancelling task with task_work (CVE-2026-99254)
- io_uring: don't lose the DEFER_TASKRUN wake up
- io_uring/cancel: rearm local work wake up before sleep
- io_uring/mpscq: disable preemption while pushing
- io_uring/io-wq: don't go to sleep on pending work
- io_uring/io-wq: don't strand work when a worker exits
- io_uring/io-wq: don't exit with a creation pending
- io_uring/io-wq: let cancel find picked up hashed work
- io_uring/poll: don't lose a cancel as io-wq arms poll
- io_uring: don't lose a cancel as io-wq parks a request
- io_uring/cancel: don't forget that the work was running
- io_uring/cancel: recognize "no timeout" on 32-bit
- io_uring/cancel: let CANCEL_ALL find parked requests
- io_uring: wake ring pollers for local task_work
- io_uring/wait: look at all CQ waiters on wake up
- io_uring/poll: drop stale double poll entry on rearm
- io_uring/futex: allocate private hash before waiting
- io_uring: drop the CQE cache if a refill fails
- io_uring: don't split 128b SQEs at the SQPOLL cap
- io_uring/register: don't wrap 32b CQEs when resizing
- io_uring/register: handle index wrap when resizing
- io_uring/register: keep 128b SQEs intact on resize
- io_uring/fdinfo: fix CQE dump of CQE32 rings
- io_uring/timeout: don't skip over reached sequences
- io_uring/timeout: keep repeat count on multishot update
- io_uring/timeout: use the right clock for ABS updates
- io_uring/wait: no early -ETIME if min_wait finds work
- io_uring/napi: make stale entries time out after 60s
- io_uring/napi: don't busy poll past an expired timeout
- io_uring/zcrx: fix buffer offsets in areas above 4GB
- io_uring/kbuf: handle index wrap in last buffer check
- io_uring/sqpoll: let the thread sleep on disabled rings
- io_uring/openclose: keep the lock in io_pipe_fixed()
- io_uring: don't pass restart error codes to userspace
- io_uring/net: don't retry recv on uncommitted buffers
- io_uring/timeout: no ABS update of multishot timeouts
- io_uring/timeout: don't end a linked timeout with 1
- io_uring: look up the file before queueing to io-wq
- io_uring/timeout: don't put a sequence target behind the last flush
- io_uring/timeout: don't flush with the sequence behind the last flush
- io_uring/timeout: don't lose a cancel as io-wq arms a timeout
- exec: cancel io_uring requests before de_thread()
- fork: move the coredump and exec checks into create_io_thread()
- fork: don't create io threads once PF_POSTCOREDUMP is set
- [arm64] clk: renesas: r9a08g046: Propagate clk rate for ETH TX mux clocks
- ALSA: line6: Clear prev_fbuf on capture buffer release
- Bluetooth: forget a peer's RPA once it advertises its identity address
- wifi: mt76: mt7925: fix reset panic caused by the WM2 rx irq mask
- [armhf] 9524/1: mm: align hugetlb mappings to the huge page size
- blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key()
- ceph: fail readdir when the MDS reply carries no dirfrag
- fuse: don't BUG when the copy buffer is exhausted
- kcov: ignore an out-of-range comparison count in write_comp_data()
- ksmbd: serialize directory emptiness checks with readdir
- libceph: bound mon_command ack decode to front len
- media: cx88: Disable PCI device on MPEG initialization failure
- media: em28xx: reject audio endpoint with zero packet size
- media: go7007: only set audio_enabled if go7007_snd_init() succeeded
- media: usbtv: fix null-pointer dereference on disconnect
- net: ipv4: add zero check for snd_cwnd_clamp
- net: usb: pegasus: do not advance rx_skb->data on dropped frames
- nfsd: fix race between client_info_show() and free_client()
- ocfs2/dlm: drain join handlers before releasing module text
- ocfs2: drain quorum work before removing the cluster
- ocfs2: pin owning modules for open debugfs files
- ocfs2: publish the filecheck owner before adding sysfs attributes
- smb: client: do not pass a NULL buf to is_oplock_break()
- smb: client: fix early procfs exposure race
- [amd64] thunderbolt: Do not RPM complete unrelated subtrees on unplug
- udf: fix return value for non-recorded-allocated extents in
udf_map_block()
- wwan: wwan_hwsim: Pin module for debugfs file operations
- xfs: fix integer overflow problem when setting large free areas
- dt-bindings: interrupt-controller: gicv5: Relax IRS properties
constraints
- irqchip/gic-v5: Fix standalone IRSes OF probe
- serial: core: fix TIOCSSERIAL and TIOCSERCONFIG on uninitialised ports
- net/sched: cls_bpf: accept dev-bound programs on shared blocks
- net/sched: cls_flower: avoid stale mask references after delete
- net/sched: sch_teql: fix slaves_lock IRQ deadlock
- net/sched: sch_teql: fix use-after-free on lower qdisc drop
- net/sched: fix packet reordering on requeue
- net/sched: act_ife: do not consume the inner header on egress
- driver core: take parent lock on deferred probe
- driver core: Limit the messages on a refused uevent
- driver core: fix parent lock use-after-free on USB disconnect
- driver core: take parent lock in async device attach
- Drivers: hv: vmbus: Bounds check the shared ring buffer indices
- backlight: lm3630a: Cancel delayed work before destroying workqueue
- backlight: qcom-wled: Fix NULL pointer dereference in wled_remove()
- backlight: qcom-wled: Fix unbalanced OVP IRQ enable at probe
- backlight: qcom-wled: Fix WLED3 brightness register stride
- ksmbd: accept share config responses from ksmbd-tools before 3.5.3
- ksmbd: avoid restoring only in-memory EOF after allocation change
- ksmbd: defer connection scavenging while session locks are busy
- ksmbd: deny access for an empty DACL instead of granting the request
- ksmbd: drain session procfs readers before dropping table references
- ksmbd: fix extended session security negotiation for raw NTLMSSP
- ksmbd: fix OOB read and cross-share confusion in
ksmbd_validate_name_reconnect()
- ksmbd: fix overflow in dacloffset bounds check in build_sec_desc()
- ksmbd: fix parent dentry lifetime in directory enumeration
- ksmbd: fix session reference leak on compounded SESSION_SETUP
- ksmbd: hold a connection reference for each session channel
- ksmbd: ignore network devices of other namespaces
- ksmbd: limit sessions on each connection
- ksmbd: preserve unreadable named streams on open
- ksmbd: prevent session binding in compound requests
- ksmbd: prevent share root removal through empty paths
- ksmbd: prevent stale data from being written by SMB2 WRITE requests
- ksmbd: reclaim ended sessions on logoff and expiration
- ksmbd: reserve space for the UTF-16 terminator in stream info
- ksmbd: restore Kerberos logins with released ksmbd-tools
- ksmbd: return end of file for reads past a named stream's data
- ksmbd: use u8 for SMB2 oplock level values
- ksmbd: validate AppInstanceId takeover target
- ksmbd: validate security descriptor offsets before pointer arithmetic
- ksmbd: verify transform SessionId matches the decrypted header
- vlan: restore HW VLAN tag insertion with reorder_hdr off
- cgroup: serialize migrations of newly forked processes
- wifi: b43: fix use-after-free in b43_bcma_remove()
- SUNRPC: fix netns use-after-free in write_gssp()
- spmi: Fix potential use-after-free by grabbing of_node reference
- smb: client: fix use-after-free infoleak via the readdir resume name
- smb: client: fix use-after-free in cifs_ses_add_channel()
- sched_ext: Fix use-after-free of a local reenq node left on an inactive
cpu
- RDMA/uverbs: Fix DMABUF use-after-free during ufile cleanup
- RDMA/irdma: avoid use-after-free in icrdma_remove
- rapidio: mport_cdev: fix use-after-free in mport_mm_close()
- pps: generators: fix use-after-free when closing a removed device
- PM: EM: Fix use-after-free of perf domain in netlink doit handlers
- [amd64] platform/x86: asus-wmi: fix use-after-free unregistering kbd_led
led
- [amd64] platform/x86/amd: hfi: Fix a use-after-free when unloading the
driver
- nvmet: fix use-after-free of the old registrant in nvmet_pr_preempt()
- nvmet-fc: fix use-after-free in nvmet_fc_ls_create_connection()
- iommufd: Fix event queue release use-after-free
- landlock: Fix superblock use-after-free in release_inode()
- lockd: Fix use-after-free in nlmsvc_retry_blocked
- media: au0828: fix use-after-free in bulk_timeout timer on disconnect
- media: cx23885: Fix use-after-free in cx23885_finidev due to race
condition
- media: hackrf: fix use-after-free in hackrf_alloc_urbs() error path
- media: imon: fix use-after-free in display_close via dev_dbg
- media: ipu-bridge: Fix use-after-free in IVSC error path
- mm/hugetlb: fix use-after-free in hugetlb_mfill_atomic_pte()
- mm/hugetlb: fix use-after-free of a new anon folio
- apparmor: fix a use-after-free in aa_lookupn_ns()
- ASoC: audio-graph-card2: Fix use-after-free in audio_graph2_link_c2c()
- ata: sata_fsl: Fix use-after-free of host_priv on probe() failure
- [arm64] drm/msm: Fix vm_bo use-after-free in with_vm_locks()
- [s390x] pci: Fix double-free and NULL deref in zpci MSI domain cleanup
- [s390x] pci: Fix MSI directed-mode teardown IRQ bit count
- [s390x] pci: Fix resource leak in zpci MSI setup
- [s390x] pci: Fix use-after-free race in zpci floating interrupt cleanup
- [s390x] pci: Add error cleanup in zpci_directed_irq_init()
- [s390x] cpum_cf: Check session mask before cpu offline
- [s390x] extable: Fix mvcos instruction decoding
- [s390x] kprobes: Prevent kprobes on instructions with exception table
entry
- [s390x] probes: Fix wrong opcode for cgrb fixup
- [s390x] signal: Fix incorrect return address in signal frame
- [s390x] vmcp: Initialize full session info to zero
- [s390x] zcrypt: Fix and improve zcrypt reply message verification checks
- [s390x] zcrypt: Fix out-of-bounds ptr advance in
cca_query_crypto_facility()
- [s390x] zcrypt: Guard domain index uses against speculative bypass
- HID: wacom: Use hdev->product in wacom_setup_touch_input_capabilities
- HID: wacom: Advertise SW_MUTE_DEVICE capability prior to registration
- HID: wacom: Fix Use-After-Free in wacom_intuos_pad
- HID: wacom: Fix Use-After-Free in wacom_bamboo_pad
- HID: wacom: Redesign shared sibling data lifecycle
- HID: wacom: Setup SW_MUTE_DEVICE according to the order of input
registration
- HID: wacom: Write shared touch initial status only once
- klist: avoid accesses after waking klist_remove()
- objtool/rust: add one more `noreturn` Rust function for Rust 1.101.0
- rust: bindings: fix `VM_MAYSHARE` blocklist entry
- rust: bindings: fix VM_MAYSHARE value
- rust: bitmap: restrict bitmap length to at most i32::MAX
- rust: block: fix `Send` bound for `GenDisk`
- rust: block: require `Sync` for `Operations::QueueData`
- rust: bug: pass TAINT_WARN to warn_slowpath_fmt() on UML
- rust: bug: update the SAFETY comment for warn_slowpath_fmt() on UML
- rust: configfs: fix data offset calculation for subsystem callbacks
- rust: cpufreq: reject NULL from cpufreq_cpu_get()
- rust: fwctl: declare cfi_encoding for fwctl_rpc_scope
- rust: module_param: Fix potentially incorrect access of `SetOnce<T>`
- rust: rcpufreq_dt: add module alias
- [amd64] accel/amdxdna: clear the mailbox channel pointer when starting it
fails
- ALSA: control: Fix UAF in snd_ctl_elem_add() on card disconnect
- ALSA: emux: Fix UAF of soundfont zones at note-on
- ALSA: pcmtest: handle multiple wraps in random capture fill
- ASoC: amd: ps: fix snd_acp63_remove() teardown ordering
- Bluetooth: hci_vhci: Pin module for debugfs file operations
- [arm64] drm/panthor: Fix TOCTOU race between GROUP_REGISTERED check and
erase
- fbdev: atmel_lcdfb: Prevent FIFO work after removal
- fbdev: udlfb: don't rebuild the mode list while the framebuffer is in use
- filelock: keep superblock active through delegation wait
- fs/proc/task_mmu: pin mm_users in do_pagemap_scan()
- fsverity: Set S_VERITY only after rollback is no longer possible
- genirq: Defer kfree(irqaction) until irq_thread_dtor() finishes
- genirq: Move interrupt thread exit_work object to irqaction
- HID: hiddev: keep state alive through disconnect unlock
- io_uring/io-wq: save worker type before dropping its reference
- iomap: don't resubmit an ioend after ->writeback_submit() failed
- [arm64] iommu/arm-smmu-v3: Disable the impl before disabling the SMMU on
shutdown
- KVM: guest_memfd: Gracefully handle xarray errors when binding a memslot
- KVM: pfncache: use a dedicated invalidation sequence for cache refresh
- [powerpc*] KVM: PPC: Book3S HV: Add SRCU protection for virtual-mode HPT
hcalls
- media: cx23885: unregister DVB bus when SP2 CI setup fails
- media: gspca: use vb2_video_unregister_device() on disconnect
- media: imx-jpeg: cancel timeout worker when streaming stops
- media: marvell: mcam: stop DMA and cancel s_bh_work before freeing DMA
buffers
- media: microchip-csi2dc: fix async notifier leak on probe error path
- media: microchip-isc: take a reference on the parsed endpoints
- media: redrat3: fix UAF in probe error path leaving rc device registered
- media: s5p-mfc: use timer_shutdown_sync() for the self-rearming watchdog
- mm/rmap: don't discard lazyfree THPs at PMD level
- mm/slab: sample slab_state once in kmem_cache_destroy()
- mm/truncate: look up the end-edge straddler by index
- mm: khugepaged: fix folio is used after folio_put/unlock()
- mm: khugepaged: fix folio is used after pte_unmap_unlock()
- mm: khugepaged: fix swap entry value to folio_pfn()
- mptcp: hold MP_JOIN msk ref when cloning reqsk
- mshv_vtl: detach poll waiter on POLLFREE
- mtd: virt-concat: unlink concat node before freeing it
- mtd: virt-concat: unlink discarded items before freeing
- net: sched: prevent scheduling deactivated qdiscs
- scsi: dc395x: sync the waiting_timer before freeing the host
- serial: core: shut down initialized port on removal
- staging: rtl8723bs: fix protected RX frame validation in decrypt path
- xen-blkfront: unbind irq before tearing down ring and shadow requests
- wifi: ath9k: delete channel-context timers on deinit
- wifi: mt76: mt7996: unlink TWT flow if the MCU rejects the agreement
- virtio_net: atomically disable rx mode work
- vfio/nvgrace-gpu: Use a core-only open_device in fallback mode
- usb: gadget: fix refcount underflow in gadgetfs_bind() error path
- ufs: use u64 for directory size in ufs_last_byte
- spi: spi-pci1xxxx: quiesce DMA engines on transfer timeout
- resource: report a devm_request_resource() conflict under the lock
- phy: core: Fix race-condition between _of_phy_get() and try_module_get()
- power: supply: pf1550: drain IRQ work before unregistering supplies
- power: supply: sbs-battery: disable polling before supply teardown
- pps: generators: don't use the driver's info after unregister
- nvmem: core: Fix OOB read for bit offsets of more than one byte
- nvmet-auth: serialize access to DH-HMAC-CHAP state to fix UAF
- media: rc: Ensure that rc_unregister_device() does not free input device
- media: rc: Ensure registered is cleared in error path
- media: rc: fintek-cir: process a full RX buffer instead of overflowing it
- media: rc: Fix race between bpf(BPG_PROG_ATTACH) and device unregister
- media: rc: Fix race condition during rc_register_device()
- media: rc: mce_kbd: Fix inconsistent locking of keylock
- media: rc: Use after free in ir_raw_event_handle()
- media: rc: After rc_unregister_device() timers can be re-armed
- media: rc: Fix use after free in bpf progs
- media: rc: Fix ABBA deadlock by making locks more fine grained
- ocfs2/heartbeat: unlink live slots when their node is missing
- ocfs2/dlm: hold a lock reference across grant AST enqueue
- ocfs2/dlm: hold the lookup reference across convert AST enqueue
- ocfs2: cancel quota sync work before freeing quota info
- ocfs2: fix chunk number of the first chunk in a local quota file
- ocfs2: pin refcount trees before dropping the lookup lock
- ocfs2: snapshot dentry names in file and setattr traces
- smb: client: fix OOB last_entry pointer from unbounded LastNameOffset
- smb: client: hold server info until cifsd exits
- smb: client: stop processing a read response after a receive error
- ovl: hold a reference on the parent in readdir
- ovl: set OVL_WHITEOUTS before publishing the upper dir
- ovl: take a snapshot of the name for copy up
- ovl: use the pinned upper dir in ovl_fix_origin()
- ovl: always encode the origin fh when index is enabled
- ovl: check that the parents of volatile/dirty are dirs
- ovl: check the casefold flag of directories only
- ovl: do not copy up a dentry that was removed
- ovl: do not copy up an xattr value that was never read
- ovl: fix a torn path in ovl_get_redirect()
- ovl: fix mount setup failing when override_creds drops CAP_SYS_ADMIN
- ovl: fortify ovl_copy_xattr() against underlying layer modifications
- ovl: read the nlink xattr of every indexed non-dir
- ovl: reserve space for the casefolded name terminator
- ovl: set the revalidate flags after d_instantiate()
- ovl: skip copy up of empty security.capability
- xfs: clear the symlink zapped flag if inline symlink is ok
- xfs: mark cow extents bad if there's no rmap mapping for them
- xfs: compute the correct fdblocks/frextents for repair when they're
negative
- xfs: fix ondisk symlink target validation in xrep_dinode_check_dfork
- xfs: fix xfs_rename_space_res for non-pptr filesystems
- xfs: fix missing xfs_qm_adjust_dqlimits call in quotacheck repair
- xfs: fix buffer overruns in xfs_ioc_attr_list
- xfs: online quotacheck must dirty dquot if enforcement adjustments needed
- xfs: avoid cross-rtgroup reaping after a repair
- xfs: actually lock the metafile reservation when adjusting after repair
- xfs: fix unnecessary dapos truncation in xchk_dir_walk
- xfs: fix buffer overflow in corrupt inline attr structure
- xfs: actually report corrupt xattrs as XFAIL during cross-referencing
- xfs: fix inode btree repair when a cluster is larger than a chunk
- xfs: always reset incore attr fork buffer when resetting fork
- xfs: don't pass iget failures up when marking ondisk inodes
- xfs: zero out di_metatype when removing the metadir file iflag
- xfs: flag excessive delalloc rt extents as corruption
- xfs: don't fix the directory tree if live update fails
- xfs: validate rc_domain in xchk_rtrefcount_mergeable
- xfs: don't proceed with xattr repair if the live update fails
- xfs: fix skipped inode mask handling in iscan
- xfs: don't repair fs summary counters with garbage
- xfs: fix lost errno returned from xfarray_foliosort
- xfs: allow softlimit with no hardlimit in quota scrub
- xfs: assign an owner to scrub_stats_fops
- xfs: bail out of directory tree repairs on error
- xfs: fix revalidation of xchk_dquot_iter cached mappings
- xfs: abort dirtree repair if the live update hook dies
- xfs: check fork type against dabtree block magic number
- xfs: mark overfull dabtree node blocks as corrupt
- xfs: jump out of xchk_bmap_check_rmap if fatal signals
- xfs: adjust checks for cross-AG reaping issues
- xfs: actually check XFS_DIFLAG2_METADATA for metadata btree data forks
- xfs: fix xchk_stats_estimate_bufsize to allow for the trailing null
- netfilter: nft_payload: restrict checksum offsets to known values
- rtnetlink: wait for RCU readers in rtnl_link_unregister()
- xfs: reduce new btree slack factor if free space is negative
- xfs: reject absurdly large xattr value lengths in xchk_xattr_actor
- xfs: reject out-of-range attribute value lengths in xfs_attr_copy_value
- xfs: reject remote xattr entries with an out-of-range value length
- xfs: release ip after unlinked list store failure
- xfs: rescan the AGs if incore delalloc counter is negative
- xfs: update quota flags on secondary supers when metadir enabled
- xfs: abort directory tree repair whenever dl->aborted is set
- xfs: always forget cached ACLs if the attr fork swap succeeds
- xfs: always report inode repair setup failures
- xfs: always report scrub errors in tracepoints
- xfs: always zero the whole shortform header when zeroing attr fork
- xfs: bound da-node entry count against the correct geometry
- xfs: bound inode fork length against the fork size during log recovery
- xfs: check for fragments when full-extent sharing matches
- xfs: check for termination during rmap btree walk
- xfs: clarify various parts of the bitmap API
- xfs: clear set[ug]id mode bits when zapping attr fork
- xfs: complain loudly when dirtree checker finds broken links
- xfs: don't allow sm_agno for non-group metadir path checking
- xfs: don't clear COWEXTSIZE on directories on reflink filesystems
- xfs: don't overrun incore inode when cleaning attr forks
- xfs: don't queue rmap update twice when reaping a fork
- xfs: don't rescan ifree and icount when frozen
- xfs: don't scan across metadata/regular directory trees for dirents
- xfs: don't set a metadata directory's parent to sb_rootino
- xfs: don't subtract excess usage twice when computing agf_btreeblks
- xfs: don't try to repair rtsummary if the summary file isn't computed
- xfs: don't try to scrub self-referential dirent in metapath checker
- xfs: fix correction of unwritten extents in quota file data fork
- xfs: fix data fork block count check in xrep_inode_blockcounts
- xfs: init inode number for tracepoint
- xfs: never reset the default quota timer
- xfs: only written file data blocks can be shared
- xfs: opportunistically skip btree block checks
- xfs: propagate errors while checking null siblings
- xfs: range-check bc_levels array access in scrub tracepoints
- xfs: reattach dquots after changing inode ids
- [amd64] x86/bugs: Adapt SRSO mitigation to Zen6
- smb: server: size directory name conversion buffer correctly
- smb: smbdirect: fix buffer length underflow in RDMA transfers
- smb: client: bound POSIX lock data area by response length
- smb: client: don't resurrect an exiting tcon from cached dir workers
- smb: client: fix buffer overflow in SMB2_tcon()
- smb: client: fix fiemap wild read on empty truncated response
- smb: client: fix OOB read of the resume name sent in TRANS2_FIND_NEXT2
- smb: client: fix OOB read in the SMB_FIND_FILE_UNIX name scan
- smb: client: fix slab-out-of-bounds write in id_mode_to_cifs_acl()
- smb: client: reclaim credits for decrypted reads with no matching mid
- smb: client: reject FIND data areas that run past the received response
- smb: client: reject short or out-of-range FIND response parameters
- smb: client: reject short SESSION_SETUP responses
- smb: client: require stable pages for SMB compression
- smb: client: validate NT transaction response layout and offsets
- smb: client: validate SMB1 EA list bounds before parsing
- smb: client: validate the data area in SMB2_read()
- xfs: map pNFS layouts to the end of the extent again
- kernfs: don't lose IN_DELETE_SELF when decoding a file handle
- pNFS: Fix CB_NOTIFY_DEVICEID CHANGE to consume ndc_immediate
- pnfs/blocklayout: Complete a device upcall only on its own reply
- pnfs/blocklayout: Complete a device upcall when the pipe is closed
- NFSv4/pnfs: bound the CB_NOTIFY_DEVICEID array count before allocating
- NFSv4/pnfs: Free the netid when draining a data-server address list
- NFSv4: Fix a regression in the handling of CB_RECALL_ANY
- NFSv4.1/pnfs: suspend pNFS on NFS4ERR_TOOSMALL from LAYOUTGET
- NFSv4/filelayout: Anchor page coalescing on pattern_offset
- NFSv4/flexfiles: fail I/O to the data server once a lock is lost
- NFSv4/flexfiles: Use the full 64-bit offset for read DS selection
- NFSv4/flexfiles: Use the full 64-bit stripe_unit
- NFSv4/flexfiles: Bound page coalescing on the absolute stripe offset
- NFS: Fix stale negative cache on failed nfs_mkdir()
- NFS/localio: detect a short read or write before the iterator has moved
- NFS/localio: fix nfs_local_dio_misaligned tracepoint
- NFS/localio: report the stability a DIO WRITE actually has
- NFSD: cap the number of listeners accepted in listener_set
- nfsd: clear XDR padding in GETXATTR replies
- NFSD: copy SETXATTR data from all XDR buffer segments
- NFSD: Destroy a recalled delegation the client does not hold
- NFSD: Do not send CB_RECALL_ANY to NFSv4.0 clients
- NFSD: Don't complete a cld upcall the daemon has not read
- nfsd: don't modify a session slot when replaying its cached reply
- nfsd: don't offer flexfiles layouts when NFSv3 isn't being served
- NFSD: Fail a pool_threads read whose reply does not fit
- nfsd: fetch direct I/O alignment for files handed to the filecache
- nfsd: Fix id-to-name cache entry leak in idtoname_parse()
- NFSD: Fix out-of-bounds read in the rpc_status dump
- nfsd: hold cl_lock in client_has_openowners()
- nfsd: honour client-provided attributes for NFS4_CREATE_EXCLUSIVE4_1
- NFSD: map fh_verify() status codes for NFS_ACLv3 replies
- NFSD: Map flex file layout IDs through the request's user namespace
- nfsd: preflight SEQUENCE replies before accepting a slot
- nfsd: propagate SETXATTR value decode errors
- NFSD: Reject an oversized principal hash from nfsdcld
- NFSD: Resolve the recall-any mask names in the trace format
- NFSD: Return NFSERR_ISDIR for NFSv2 READ and WRITE on a non-regular file
- NFSD: Set nn->cld_net before registering the cld pipe
- NFSD: validate transport name in listener_set before serv creation
- nfsd: zero NFSv4 COMPOUND tag padding
- SUNRPC: Copy the deferred RPC Call from the head buffer
- SUNRPC: Do not credit control-record octets to the RPC stream
- SUNRPC: fix oversized GSS proxy token copy
- sunrpc: honor the netlink unix_gid NEGATIVE flag
- SUNRPC: keep the first error in svc_register()
- sunrpc: pin gss module across auth_domain RCU free
- SUNRPC: Reject a socket that already has an svc_sock attached
- SUNRPC: Reject a TLS alert record that is not two octets
- SUNRPC: Resume receiving after a TLS control record
- SUNRPC: trace an accepted transport before publishing it
- sunrpc: treat empty auth.unix.gid replies as negative entries
- SUNRPC: Treat every TLS error alert as fatal
- rxrpc: Fix update of call->tx_pending without holding lock
- rxrpc: Fix lack of short-send handling in rxrpc_kernel_send_data()
- afs: Fix afs to abort the rxrpc call on send error
- rxrpc: Fix double IRQ enablement
- rxrpc: Fix return in rxrpc_recvmsg_data() for service calls
- [amd64] x86/cpuid: Mark CPUID function 0x23 as being indexed
- [amd64] x86/mm/pat: Fix effective RW computation in
lookup_address_in_pgd_attr()
- [amd64] ALSA: x86: hdmi: fix chmap array missing terminator entry
- KVM: Only bind memslot to guest_memfd instance for CREATE operations
- [amd64] KVM: SVM: Trigger new ASID allocation in both VMCBs on pCPU
switch
- [amd64] KVM: nSVM: Reject KVM_SET_NESTED_STATE if L1 has EFER.LMA=1 &&
EFER.LME=0
- [amd64] KVM: nSVM: Ignore EFER.LMA if EFER.LME=0 when preparing L2 state
- KVM: Use goto to handle errors during memslot preparation
- [amd64] KVM: VMX: Disallow using to_vmx() in common VT code
- [amd64] KVM: VMX: Formally define KVM's "0xdead" exit reason used for
failed VM-Enter
- [amd64] KVM: VMX: Make handle_bus_lock_vmexit() a shared helper
- [amd64] KVM: VMX: Preserve negative return value in vmx_handle_exit()
with
bus lock detected
- [amd64] KVM: x86/mmu: Bug the VM if KVM attempts to walk more levels than
the MMU has
- [amd64] KVM: x86/mmu: Bug the VM if KVM calcs a CPU role with EFER.LMA=1
&& CR4.PAE=0
- [amd64] KVM: x86/xen: Enforce 4-byte alignment of vcpu_info registration
- [amd64] KVM: x86/xen: Take kvm->srcu in __kvm_xen_has_interrupt()
- [amd64] KVM: x86: Clear hardware HLT state when userspace makes a vCPU
not-halted
- [amd64] KVM: x86: Preserve DR6.BLD (Bus Lock Detect) when delivering #DB
payload
- [amd64] KVM: x86: Request event processing for exception VM-Exits
- [amd64] KVM: x86: Take SRCU in kvm_zap_gfn_range()
- [amd64] KVM: x86: Zero reserved synic flags when delivering message to
avoid stack leak
- [amd64] KVM: TDX: Check if there is valid exit infos based on
vp_enter_ret
- [amd64] KVM: TDX: Enable Notify VM exit
- [amd64] KVM: TDX: Set bits 31:16 to 0 and use UNDEFINED when synthesizing
exit reason
- [amd64] KVM: TDX: Stuff exit_reason with UNDEFINED on wait_for_sept_zap
return
- [amd64] KVM: TDX: Don't assume exit_reason[31:16] is all-0 in
tdx_to_vmx_exit_reason()
- [amd64] KVM: TDX: Enable Bus Lock VM exit
- KVM: guest_memfd: Split bind() into prepare()+commit() phases
- KVM: guest_memfd: take the invalidate lock when unbinding a dying file
- KVM: guest_memfd: Establish memslot<=>guest_memfd bindings *after*
memslot
is ready
- [powerpc*] KVM: PPC: Book3S HV: Add preempt_disable() around virtual-mode
HPTE bit-lock users
- [powerpc*] KVM: PPC: Fix get_d_signext() 12-bit displacement for
paired-single D-form
- HID: usbhid: skip interrupt IN polling for devices with no input reports
- HID: zydacron: validate key report length
- HID: amd_sfh: Remove unsupported motion-state field from accelerometer
report
- HID: amd_sfh: Use report type from request node
- HID: asus: do not send keyboard init reports to touchpads
- HID: core: Fix out-of-bounds left shift by 32 in s32ton()
- HID: cougar: reject short special-key reports
- HID: cp2112: validate response report lengths
- HID: elo: reject short touchscreen reports
- HID: logitech-dj: validate unnumbered keyboard reports
- HID: mcp2200: validate READ_ALL response length
- HID: mcp2221: always initialize and cancel init_work
- HID: mcp2221: validate response report length
- HID: picoLCD: check for fb_deferred_io_init() error
- HID: prodikeys: validate fixed-format MIDI reports
- HID: pxrc: reject short input reports
- HID: quirks: Always poll the Anne Pro 2 with product ID a292
- HID: roccat: isku: reject short button reports
- HID: roccat: koneplus: reject short button reports
- HID: roccat: konepure: reject short button reports
- HID: roccat: kovaplus: reject short button reports
- HID: roccat: pyra: reject short button reports
- HID: roccat: ryos: reject short special reports
- HID: roccat: savu: reject short special reports
- HID: hid-lenovo-go-s: Prevent deadlock if device removed during setup
- HID: hid-lenovo-go-s: Return ret instead of 0 in mcu_property_out()
- HID: hid-lenovo-go-s: Use pm_ptr for reset_resume callback
- HID: hid-lenovo-go-s: Add suspend function and gate access under bool.
- HID: hid-lenovo-go-s: Bound stale reply window before reusing
send_cmd_complete
- HID: hid-lenovo-go-s: Move attribute init to after device query
- HID: hid-lenovo-go-s: Reorganize and rename hid_gos_cfg
- HID: hid-lenovo-go-s: Add kobject_uevent notify during reset-resume
- HID: hid-lenovo-go-s: Move static led_classdev_mc to drvdata struct
- HID: hid-lenovo-go-s: Use devm_kzalloc for drvdata
- [amd64] accel/amdxdna: Add support for AIE2 revision 9
- io_uring/kbuf: advance head when a pickup empties the buffer ring
- io_uring/net: keep recvmsg buffer select length within MAX_RW_COUNT
- io_uring/net: mask socket type with SOCK_TYPE_MASK in
io_socket_bpf_populate()
- io_uring/register: enforce per-task restrictions in
io_uring_register_blind()
- io_uring/net: don't retry a non-blocking connect() that fails with
-EAGAIN
- io_uring: keep the drain active when a deferred drain request is started
- io_uring/io-wq: no new workers once the exit has begun
- io_uring/rsrc: charge buffer arrays and nodes to memcg
- io_uring: charge tctx nodes and personalities
- io_uring: free XArray nodes left by a failed store
- io_uring/bpf-ops: clear bpf_ctx while submitting SQEs
- io_uring: free the task context after a grace period
- io_uring/sqpoll: don't wait for the thread to exit
- io_uring: defer foreign io-wq enqueues to task_work
- io_uring/timeout: count cancelled timeouts in cq_timeouts
- io_uring/net: fix multishot recv length limit accounting
- ksmbd: fix SMB2 CREATE response buffer overflow
- ksmbd: fix out-of-bounds read when padding the final compound response
- ksmbd: use clear_and_wake_up_bit() directly
- ksmbd: track delivery of queued TCP writes
- ksmbd: retry break notifications on another connection
- ksmbd: fix app-instance non-durable supersede session UAF
- ksmbd: fix invalid pointer dereference when get_inode_acl() fails
- ksmbd: use the existing xattr name for a named stream
- ksmbd: fix named stream write and EOF handling
- ksmbd: rebind completed CREATE replays without draining the old channel
- ksmbd: fix use-after-free after a failed durable reconnect
- rust_binder: wake epoll on self-work queued to poll thread
- media: rc: Fix build failure with CONFIG_LIRC disabled
- ksmbd: keep retry timeout clamp bounds constant
- tun: Require CAP_NET_ADMIN to attach to an ownerless device
https://www.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.3.3
- xen-netback: Fix UAF when reading statistics data (CVE-2026-100080)
- xen-netback: defer xenvif_mcast_addr_list_free() (CVE-2026-100081)
- xen-blkback: Avoid UAF when reading I/O statistics (CVE-2026-100082)
.
[ Salvatore Bonaccorso ]
* apparmor: fix NULL ctx->peer derefs in unix socket ctx updates
(Closes: #1145111)
* [amd64] drivers/watchdog: Enable INTEL_OC_WATCHDOG as module
(Closes: #1152841)
* [amd64] drivers/thunderbolt: Enable USB4_STREAM as module (Closes:
#1152917)
.
[ Daniel Drake ]
* [arm64] Enable NXP i.MX93 platforms: add CLK_IMX93, GPIO_VF610 as
builtins, and the i.MX93 peripheral and FRDM-IMX93 board drivers as
modules.
* [arm64] Enable DRM_ACCEL, and DRM_ACCEL_ARM_ETHOSU as module for the Arm
Ethos-U NPU.
.
[ Loïc Minier ]
* [arm64] drivers/media/i2c: Enable VIDEO_OV02C10 as module
.
[ Uwe Kleine-König ]
* Fix awk regexp warnings in reportbug script (Closes: #1153230)
Checksums-Sha1:
f6c31fb6c27d1fcdb570d5b7c84df9e38b16382f 193648 linux_7.3.3-1.dsc
4eb4a59a256a672697ced2b051e74386a52de3e7 165789928 linux_7.3.3.orig.tar.xz
511b5062b555f0033f0c4a272898fb03da1bad84 1472148 linux_7.3.3-1.debian.tar.xz
003cab6fae4726f30d4c1d917cc163d9e69b767b 6039 linux_7.3.3-1_source.buildinfo
Checksums-Sha256:
b133d8bab48e102cfbb0e2cf43524fc00dd5c15804fc52b132936f304b427591 193648
linux_7.3.3-1.dsc
147fbafa6825326baf092b5d6b7343c7906a54ed86fff0254d373fd46fa44698 165789928
linux_7.3.3.orig.tar.xz
80b058f66c49e8075dc8ab14f4a16ba8068e4d9296189b828884e98232fc233f 1472148
linux_7.3.3-1.debian.tar.xz
f0e192c163fac57978431a6b89b8bbb9f56f3d88c966c467e7b8342a92540d82 6039
linux_7.3.3-1_source.buildinfo
Files:
865213918a6d7ae65f035980f8bcc522 193648 kernel optional linux_7.3.3-1.dsc
a4ac80b1b272717e82f6d1e9c3c30f04 165789928 kernel optional
linux_7.3.3.orig.tar.xz
715c0ca8d8e831cc9817e350fc635ead 1472148 kernel optional
linux_7.3.3-1.debian.tar.xz
2935e7883e8b58df53dfeef10ddb2bc9 6039 kernel optional
linux_7.3.3-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmru3XFfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EEuwP/2TeUzm+PClWp1iOYz1zRLbVzXKAun3J
uLvonG5KcRjbDi3QTELJYSSlz8cC7EK7vndwWFYdlDkr97RkoJwuUE6qS7tVO0AM
2bqkyPZNtwRebYxhhWooLL1GnQCzHE6eApHwkwdVSGaduWx9MP4II+JWZ8mKj4Qp
gG3mSJwGkvYwjvHUUvCu1SfLpoTxnB//d9v8xObBbdI7qj4KVsIKdrrZys/YTErH
9tEhwWoOtgAAnwmyJ/644NlsXGQ6huKtxStkrQPel8FNoId3e/Mhdp54YmYqxeW/
GTYRUYpSb3em9zF2xdeZxo0fxcVmTIYGNfNQmTb9bRpvDpTM2gk9DnYz/izJdx8X
q9dHwPm8ErKm7MxRYZfELUJFKislrUBTO4ELJaLP570EtJ88KN9FSTnnjPjU+HcP
GX4bzVzM6vad0PRyhv/RDzHDj3VqzJG6ZAHhtweEj0lXLQT6eihGzAFeLaX5apGE
3sQQ5oUX2vSTbmxS5fdnhSlGC1/VUTABJERGa4rHJc1KfQCFfTtq2SEqkp8QL2iH
M0nbyL7Sdtslo5rFHKam2s5ie8aPt4ZORR6WWqoUXntnhIpTu0Lo1C2HQv4f2Vkm
grWrwmtdgczh+9wF1bXSWRR4IEsrIVvxul/Ycswhh5YD0cCAvYhuWN2BFMB4Bfgv
hVaMiyfSKGoh
=9vlQ
-----END PGP SIGNATURE-----
pgplJNNakQ0SZ.pgp
Description: PGP signature
--- End Message ---
