Your message dated Tue, 10 Nov 2026 19:55:43 +0000
with message-id <[email protected]>
and subject line Bug#1151281: fixed in linux 6.12.115-1
has caused the Debian Bug report #1151281,
regarding linux-image-6.12.113+deb13-amd64: kswapd NULL pointer dereference in
list_lru_add() (workingset_update_node), system freeze
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1151281: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151281
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: src:linux
Version: 6.12.113-1
Severity: important
Tags: upstream
Control: found -1 6.12.111-1
Dear Maintainer,
Since the upgrade to 6.12.113-1, one of our KVM guests froze twice under
page-cache reclaim. A second guest running 6.12.111-1 froze with similar
symptoms during the same kind of workload, but that oops could not be
captured; 6.12.111-1 is marked found because it contains the same upstream
change (see below), not because of a captured trace.
kswapd oopses with a NULL pointer dereference in list_lru_add() and dies
while holding the mapping's xa_lock, so every subsequent reader of that
file spins forever in __pv_queued_spin_lock_slowpath/kvm_wait and the
guest becomes unresponsive.
Oops (captured from guest memory, kernel otherwise untainted):
BUG: kernel NULL pointer dereference, address: 0000000000000008
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 1 UID: 0 PID: 67 Comm: kswapd0 Not tainted 6.12.113+deb13-amd64 #1
Debian 6.12.113-1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
RIP: 0010:list_lru_add+0x83/0x110
Call Trace:
list_lru_add_obj+0x7c/0xa0
workingset_update_node+0x8a/0xb0
xas_store+0x24e/0x670
__filemap_remove_folio+0x116/0x1e0
__remove_mapping+0xdf/0x220
shrink_folio_list+0xb62/0xd00
evict_folios+0x24f/0x650
try_to_shrink_lruvec+0x21b/0x2b0
shrink_one+0x102/0x1f0
shrink_node+0xa08/0xc40
balance_pgdat+0x520/0x9a0
kswapd+0x1f1/0x380
kthread+0xcf/0x100
ret_from_fork+0x31/0x50
ret_from_fork_asm+0x1a/0x30
note: kswapd0[67] exited with irqs disabled
note: kswapd0[67] exited with preempt_count 3
Workload: XFS root/data filesystem, many short-lived SSH sessions (each in
its own systemd session scope / memcg) doing file deployments. No global
memory pressure (about 60% of RAM available, swap unused). The freeze
happened twice within 30 hours on 6.12.113-1. We never saw it on this guest with
6.12.107-1.
Probable cause: stable 6.12.109 picked up
ad812805fea7 "xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()"
(upstream 789763523fb4)
which makes xa_nodes allocated during folio split memcg-charged. The upstream
dependency that installs the shadow_nodes list_lru on the xa_state during
split,
aca1f2d5de17 "mm/huge_memory: initialise workingset state before folio split"
does not appear to be in 6.12.y (checked ChangeLog-6.12.109 to 6.12.113).
Without it, a memcg-charged xa_node can reach workingset_update_node() for a
memcg whose shadow_nodes list_lru was never allocated, hence the NULL+0x8
dereference (list_add_tail on l->list.prev).
The same crash and analysis were reported on Amazon Linux 6.12.110:
https://github.com/awslabs/amazon-eks-ami/issues/2845
Amazon shipped a fixed kernel (6.12.111-136.204) on 2026-10-12.
Note: the security tracker marks CVE-2026-80729 (the aca1f2d5de17 fix) as
"vulnerable code not present" for trixie. That is true for xas_try_split(),
but the 6.12.109 backport reintroduces the same defect via xas_split_alloc(),
so trixie is effectively affected.
Since an unprivileged process filling page cache in its own memcg seems
able to trigger it, this is also a local DoS on shared hosts.
Workaround confirmed in place: booting with cgroup.memory=nokmem.
Suggested fix: backport aca1f2d5de17 to 6.12.y (and 6.18.y, where the
stable backport also failed to apply), or revert ad812805fea7 in the
Debian package until stable catches up.
We are reporting the regression to [email protected] /
[email protected] as well and will link the thread here.
-- Package-specific info:
** Version:
Linux version 6.12.113+deb13-amd64 ([email protected])
(x86_64-linux-gnu-gcc-14 (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for
Debian) 2.44) #1 SMP PREEMPT_DYNAMIC Debian 6.12.113-1 (2026-10-15)
** Command line:
BOOT_IMAGE=/boot/vmlinuz-6.12.113+deb13-amd64 root=/dev/mapper/vg_root-rootfs
ro cgroup.memory=nokmem console=tty0 console=ttyS0,115200 quiet
** Not tainted
** Model information
sys_vendor: QEMU
product_name: Standard PC (i440FX + PIIX, 1996)
product_version: pc-i440fx-9.2
chassis_vendor: QEMU
chassis_version: pc-i440fx-9.2
bios_vendor: SeaBIOS
bios_version: rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org
** Configuration for modprobe:
blacklist arkfb
blacklist aty128fb
blacklist atyfb
blacklist radeonfb
blacklist cirrusfb
blacklist cyber2000fb
blacklist kyrofb
blacklist matroxfb_base
blacklist mb862xxfb
blacklist neofb
blacklist pm2fb
blacklist pm3fb
blacklist s3fb
blacklist savagefb
blacklist sisfb
blacklist tdfxfb
blacklist tridentfb
blacklist vt8623fb
options snd_pcsp index=-2
options cx88_alsa index=-2
options snd_atiixp_modem index=-2
options snd_intel8x0m index=-2
options snd_via82xx_modem index=-2
options bonding max_bonds=0
options dummy numdummies=0
options ifb numifbs=0
options cgroup memory=nokmem
** Loaded modules:
binfmt_misc
intel_rapl_msr
intel_rapl_common
kvm_amd
ccp
kvm
irqbypass
crct10dif_pclmul
ghash_clmulni_intel
sha512_ssse3
sha256_ssse3
sha1_ssse3
aesni_intel
gf128mul
crypto_simd
bochs
cryptd
drm_vram_helper
vga16fb
drm_ttm_helper
pcspkr
vgastate
ttm
drm_kms_helper
virtio_balloon
button
joydev
evdev
sg
drm
efi_pstore
configfs
nfnetlink
vsock_loopback
vmw_vsock_virtio_transport_common
vmw_vsock_vmci_transport
vsock
vmw_vmci
qemu_fw_cfg
ip_tables
x_tables
autofs4
xfs
libcrc32c
crc32c_generic
hid_generic
usbhid
hid
dm_mod
sr_mod
cdrom
uhci_hcd
ata_generic
ehci_pci
sd_mod
virtio_net
ehci_hcd
ata_piix
libata
usbcore
net_failover
virtio_scsi
psmouse
failover
scsi_mod
serio_raw
crc32_pclmul
i2c_piix4
crc32c_intel
i2c_smbus
scsi_common
usb_common
floppy
** PCI devices:
00:00.0 Host bridge [0600]: Intel Corporation 440FX - 82441FX PMC [Natoma]
[8086:1237] (rev 02)
Subsystem: Red Hat, Inc. Qemu virtual machine [1af4:1100]
Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr-
Stepping- SERR+ FastB2B- DisINTx-
Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort-
<MAbort- >SERR- <PERR- INTx-
00:01.0 ISA bridge [0601]: Intel Corporation 82371SB PIIX3 ISA [Natoma/Triton
II] [8086:7000]
Subsystem: Red Hat, Inc. Qemu virtual machine [1af4:1100]
Physical Slot: 1
Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr-
Stepping- SERR+ FastB2B- DisINTx-
Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort-
<TAbort- <MAbort- >SERR- <PERR- INTx-
00:01.1 IDE interface [0101]: Intel Corporation 82371SB PIIX3 IDE
[Natoma/Triton II] [8086:7010] (prog-if 80 [ISA Compatibility mode-only
controller, supports bus mastering])
Subsystem: Red Hat, Inc. Qemu virtual machine [1af4:1100]
Physical Slot: 1
Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr-
Stepping- SERR+ FastB2B- DisINTx-
Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort-
<TAbort- <MAbort- >SERR- <PERR- INTx-
Latency: 0
Region 0: I/O ports at 01f0 [size=8]
Region 1: I/O ports at 03f4
Region 2: I/O ports at 0170 [size=8]
Region 3: I/O ports at 0374
Region 4: I/O ports at f0c0 [size=16]
Kernel driver in use: ata_piix
Kernel modules: ata_piix, ata_generic
00:01.2 USB controller [0c03]: Intel Corporation 82371SB PIIX3 USB
[Natoma/Triton II] [8086:7020] (rev 01) (prog-if 00 [UHCI])
Subsystem: Red Hat, Inc. QEMU Virtual Machine [1af4:1100]
Physical Slot: 1
Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr-
Stepping- SERR+ FastB2B- DisINTx-
Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort-
<MAbort- >SERR- <PERR- INTx-
Latency: 0
Interrupt: pin D routed to IRQ 11
Region 4: I/O ports at f080 [size=32]
Kernel driver in use: uhci_hcd
Kernel modules: uhci_hcd
00:01.3 Bridge [0680]: Intel Corporation 82371AB/EB/MB PIIX4 ACPI [8086:7113]
(rev 03)
Subsystem: Red Hat, Inc. Qemu virtual machine [1af4:1100]
Physical Slot: 1
Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr-
Stepping- SERR+ FastB2B- DisINTx-
Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort-
<TAbort- <MAbort- >SERR- <PERR- INTx-
Interrupt: pin A routed to IRQ 9
Kernel driver in use: piix4_smbus
Kernel modules: i2c_piix4
00:02.0 VGA compatible controller [0300]: Device [1234:1111] (rev 02) (prog-if
00 [VGA controller])
Subsystem: Red Hat, Inc. Device [1af4:1100]
Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr-
Stepping- SERR- FastB2B- DisINTx-
Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort-
<MAbort- >SERR- <PERR- INTx-
Latency: 0
Region 0: Memory at fd000000 (32-bit, prefetchable) [size=16M]
Region 2: Memory at fea50000 (32-bit, non-prefetchable) [size=4K]
Expansion ROM at 000c0000 [disabled] [size=128K]
Kernel driver in use: bochs-drm
Kernel modules: bochs
00:03.0 Unclassified device [00ff]: Red Hat, Inc. Virtio memory balloon
[1af4:1002]
Subsystem: Red Hat, Inc. Device [1af4:0005]
Physical Slot: 3
Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr-
Stepping- SERR+ FastB2B- DisINTx-
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort-
<MAbort- >SERR- <PERR- INTx-
Latency: 0
Interrupt: pin A routed to IRQ 10
Region 0: I/O ports at f000 [size=64]
Region 4: Memory at 382000000000 (64-bit, prefetchable) [size=16K]
Capabilities: <access denied>
Kernel driver in use: virtio-pci
00:05.0 PCI bridge [0604]: Red Hat, Inc. QEMU PCI-PCI bridge [1b36:0001]
(prog-if 00 [Normal decode])
Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr-
Stepping- SERR+ FastB2B- DisINTx-
Status: Cap+ 66MHz+ UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort-
<MAbort- >SERR- <PERR- INTx-
Latency: 0
Interrupt: pin A routed to IRQ 11
Region 0: Memory at 380000000000 (64-bit, non-prefetchable) [size=256]
Bus: primary=00, secondary=01, subordinate=01, sec-latency=0
I/O behind bridge: e000-efff [size=4K] [16-bit]
Memory behind bridge: fe800000-fe9fffff [size=2M] [32-bit]
Prefetchable memory behind bridge: 381800000000-381fffffffff [size=32G]
[32-bit]
Secondary status: 66MHz+ FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort-
<MAbort- <SERR- <PERR-
BridgeCtl: Parity- SERR+ NoISA- VGA- VGA16- MAbort- >Reset- FastB2B-
PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-
Capabilities: <access denied>
00:08.0 Communication controller [0780]: Red Hat, Inc. Virtio console
[1af4:1003]
Subsystem: Red Hat, Inc. Device [1af4:0003]
Physical Slot: 8
Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr-
Stepping- SERR+ FastB2B- DisINTx+
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort-
<MAbort- >SERR- <PERR- INTx-
Latency: 0
Interrupt: pin A routed to IRQ 11
Region 0: I/O ports at f040 [size=64]
Region 1: Memory at fea51000 (32-bit, non-prefetchable) [size=4K]
Region 4: Memory at 382000004000 (64-bit, prefetchable) [size=16K]
Capabilities: <access denied>
Kernel driver in use: virtio-pci
00:12.0 Ethernet controller [0200]: Red Hat, Inc. Virtio network device
[1af4:1000]
Subsystem: Red Hat, Inc. Device [1af4:0001]
Physical Slot: 18
Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr-
Stepping- SERR+ FastB2B- DisINTx+
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort-
<MAbort- >SERR- <PERR- INTx-
Latency: 0
Interrupt: pin A routed to IRQ 10
Region 0: I/O ports at f0a0 [size=32]
Region 1: Memory at fea52000 (32-bit, non-prefetchable) [size=4K]
Region 4: Memory at 382000008000 (64-bit, prefetchable) [size=16K]
Expansion ROM at fea00000 [disabled] [size=256K]
Capabilities: <access denied>
Kernel driver in use: virtio-pci
00:1e.0 PCI bridge [0604]: Red Hat, Inc. QEMU PCI-PCI bridge [1b36:0001]
(prog-if 00 [Normal decode])
Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr-
Stepping- SERR+ FastB2B- DisINTx-
Status: Cap+ 66MHz+ UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort-
<MAbort- >SERR- <PERR- INTx-
Interrupt: pin A routed to IRQ 10
Region 0: Memory at 380000001000 (64-bit, non-prefetchable) [size=256]
Bus: primary=00, secondary=02, subordinate=02, sec-latency=0
I/O behind bridge: d000-dfff [size=4K] [16-bit]
Memory behind bridge: fe600000-fe7fffff [size=2M] [32-bit]
Prefetchable memory behind bridge: 381000000000-3817ffffffff [size=32G]
[32-bit]
Secondary status: 66MHz+ FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort-
<MAbort- <SERR- <PERR-
BridgeCtl: Parity- SERR+ NoISA- VGA- VGA16- MAbort- >Reset- FastB2B-
PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-
Capabilities: <access denied>
00:1f.0 PCI bridge [0604]: Red Hat, Inc. QEMU PCI-PCI bridge [1b36:0001]
(prog-if 00 [Normal decode])
Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr-
Stepping- SERR+ FastB2B- DisINTx-
Status: Cap+ 66MHz+ UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort-
<MAbort- >SERR- <PERR- INTx-
Interrupt: pin A routed to IRQ 11
Region 0: Memory at 380000002000 (64-bit, non-prefetchable) [size=256]
Bus: primary=00, secondary=03, subordinate=03, sec-latency=0
I/O behind bridge: c000-cfff [size=4K] [16-bit]
Memory behind bridge: fe400000-fe5fffff [size=2M] [32-bit]
Prefetchable memory behind bridge: 380800000000-380fffffffff [size=32G]
[32-bit]
Secondary status: 66MHz+ FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort-
<MAbort- <SERR- <PERR-
BridgeCtl: Parity- SERR+ NoISA- VGA- VGA16- MAbort- >Reset- FastB2B-
PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-
Capabilities: <access denied>
01:01.0 SCSI storage controller [0100]: Red Hat, Inc. Virtio SCSI [1af4:1004]
(prog-if 00 [Vendor specific])
Subsystem: Red Hat, Inc. Device [1af4:0008]
Physical Slot: 1-2
Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr-
Stepping- SERR+ FastB2B- DisINTx+
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort-
<MAbort- >SERR- <PERR- INTx-
Latency: 0
Interrupt: pin A routed to IRQ 10
Region 0: I/O ports at e000 [size=64]
Region 1: Memory at fe800000 (32-bit, non-prefetchable) [size=4K]
Region 4: Memory at 381800000000 (64-bit, prefetchable) [size=16K]
Capabilities: <access denied>
Kernel driver in use: virtio-pci
** USB devices:
not available
-- System Information:
Debian Release: 13.7
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.12.113+deb13-amd64 (SMP w/4 CPU threads; PREEMPT)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages linux-image-6.12.113+deb13-amd64 depends on:
ii initramfs-tools [linux-initramfs-tool] 0.148.4
ii kmod 34.2-2
ii linux-base 4.12.1
Versions of packages linux-image-6.12.113+deb13-amd64 recommends:
ii apparmor 4.1.0-1
Versions of packages linux-image-6.12.113+deb13-amd64 suggests:
pn debian-kernel-handbook <none>
ii firmware-linux-free 20241210-2
ii grub-pc 2.12-9+deb13u2
pn linux-doc-6.12 <none>
Versions of packages linux-image-6.12.113+deb13-amd64 is related to:
pn firmware-amd-graphics <none>
pn firmware-atheros <none>
pn firmware-bnx2 <none>
pn firmware-bnx2x <none>
pn firmware-brcm80211 <none>
pn firmware-cavium <none>
pn firmware-cirrus <none>
pn firmware-intel-graphics <none>
pn firmware-intel-misc <none>
pn firmware-intel-sound <none>
pn firmware-ipw2x00 <none>
pn firmware-ivtv <none>
pn firmware-iwlwifi <none>
pn firmware-libertas <none>
pn firmware-marvell-prestera <none>
pn firmware-mediatek <none>
pn firmware-misc-nonfree <none>
pn firmware-myricom <none>
pn firmware-netronome <none>
pn firmware-netxen <none>
pn firmware-nvidia-graphics <none>
pn firmware-qcom-soc <none>
pn firmware-qlogic <none>
pn firmware-realtek <none>
pn firmware-samsung <none>
pn firmware-siano <none>
pn firmware-ti-connectivity <none>
pn xen-hypervisor <none>
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: linux
Source-Version: 6.12.115-1
Done: Salvatore Bonaccorso <[email protected]>
We believe that the bug you reported is fixed in the latest version of
linux, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <[email protected]> (supplier of updated linux package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 31 Oct 2026 15:51:21 +0100
Source: linux
Architecture: source
Version: 6.12.115-1
Distribution: trixie-security
Urgency: high
Maintainer: Debian Kernel Team <[email protected]>
Changed-By: Salvatore Bonaccorso <[email protected]>
Closes: 1112238 1151097 1151281
Changes:
linux (6.12.115-1) trixie-security; urgency=high
.
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.114
- spi: mpc52xx: clean up interrupt handling
- usb: gadget: f_hid: Add missing error code
- [amd64] iommu/amd: Disable AMD IOMMU if CMPXCHG16B feature is not
supported
- [amd64] iommu/amd: Fix ivrs_base memleak in early_amd_iommu_init()
- ice: fix use-after-free in dynamic port cleanup
- xfs: stop exchanging reflink flags when exchanging mappings
- xfs: fix exchange-range-to-eof file size exchange
- ip6_gre: remove obsolete ERSPAN PMTU update
- xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock
- xfs: catch stale AGF/AGF metadata
- xfs: avoid dquot buffer pin deadlock
- xfs: rearrange code in xfs_buf_item.c
- xfs: factor out stale buffer item completion
- xfs: fix unmount hang with unflushable inodes stuck in the AIL
- drm/amd: Create a device link between APU display and XHCI devices
- ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands
- mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP
- mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge
- wifi: mt76: connac: tolerate inactive BSS deactivation
- net: team: Remove unused team_mode_op, port_enabled
- net: team: Rename port_disabled team mode op to port_tx_disabled
- net: team: fix NULL pointer dereference in team_xmit during mode change
(CVE-2026-64190)
- net: team: stop reusing skb after queue override
- sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF
scheduler
- Bluetooth: hci_sync: Fix command skb lifetime during scan setup
- Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex
- drm/vmwgfx: Stop using dev_private to store driver data.
- drm/vmwgfx: validate pitch coming from userspace
- namespace: don't inherit MNT_UMOUNT in clone_mnt()
- namespace: check the mounts before reading their parents in pivot_root()
- dm-integrity: use internal variable for digestsize
- dm-integrity: rename internal_hash
- dm-integrity: fix buffer overflow in inline mode with large tag size
- net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop
- [riscv64] patch: Avoid early phys_to_page()
- [riscv64] patch: fix handling of bpf-jit execmem addresses
- scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ
- scsi: ch: Do not keep references to data transfer element devices
- scsi: ufs: core: Move an assignment in ufshcd_mcq_process_cqe()
- scsi: ufs: core: Add debug log for MCQ command timeout
- scsi: ufs: core: Add a comment block above
ufshcd_mcq_compl_all_cqes_lock()
- scsi: ufs: core: Avoid unsafe MMIO reads in
ufshcd_mcq_compl_all_cqes_lock()
- drm/vc4: Use video aperture helpers
- drm/vc4: Fix firmware reference leak in vc4_drm_bind()
- namespace: unhash a dentry before detaching the mounts on it
- namespace: check the target before walking it in do_mount_setattr()
- fcntl: refuse F_SET_RW_HINT on an immutable inode
- namespace: handle mount locking for automounts correctly
- smb: client: improve compound padding in encryption
- smb: client: get rid of bounds check in SMB2_ioctl_init()
- smb: client: fix compound alignment with encryption
- [amd64] drm/i915/display: pass display to intel_crtc_for_pipe()
- [amd64] drm/i915/vga: Convert VGA code to intel_display
- [amd64] drm/i915/display: convert I915_STATE_WARN() to struct
intel_display
- [amd64] drm/i915/gmbus: convert to struct intel_display
- [amd64] drm/i915/crt: convert to struct intel_display
- [amd64] drm/i915: Grab intel_display from the encoder to avoid potential
oopsies (CVE-2024-58074)
- ax25: Remove broken autobind (CVE-2025-22109)
- f2fs: quota: fix to avoid warning in dquot_writeback_dquots()
(CVE-2025-23132)
- [riscv64] KVM: Teardown riscv specific bits after kvm_exit
(CVE-2025-23135)
- wifi: ath12k: fix struct hal_rx_phyrx_rssi_legacy_info
- wifi: ath12k: fix incorrect TID updation in DP monitor status path
- wifi: ath12k: Avoid explicit type cast in monitor status parse handler
- wifi: ath12k: Avoid memory leak while enabling statistics
(CVE-2025-37743)
- perf/dwc_pcie: Qualify RAS DES VSEC Capability by Vendor, Revision
- perf/dwc_pcie: fix duplicate pci_dev devices (CVE-2025-37746)
- ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd
(CVE-2025-37906)
- kasan: avoid sleepable page allocation from atomic context
(CVE-2025-38029)
- clk: sunxi-ng: h616: Reparent CPU clock during frequency changes
- clk: sunxi-ng: h616: Reparent GPU clock during frequency changes
(CVE-2025-38041)
- net: ethernet: ti: am65-cpsw: streamline RX queue creation and cleanup
- dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from
k3_udma_glue_reset_rx_chn (CVE-2025-38042)
- virtio: break and reset virtio devices on device_shutdown()
(CVE-2025-38064)
- coresight: holding cscfg_csdev_lock while removing cscfg from csdev
(CVE-2025-38132)
- PCI/pwrctl: Use of_platform_device_create() to create pwrctl devices
- PCI/pwrctl: Create pwrctl device only if at least one power supply is
present
- PCI/pwrctrl: Cancel outstanding rescan work when unregistering
(CVE-2025-38137)
- drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() (CVE-2025-38187)
- wifi: ath12k: convert struct ath12k_sta::update_wk to use struct
wiphy_work
- wifi: ath12k: ath12k_mac_op_sta_state(): clean up update_wk cancellation
- wifi: ath12k: prepare vif data structure for MLO handling
- wifi: ath12k: Fix memory leak due to multiple rx_stats allocation
(CVE-2025-38199)
- mm: fix uprobe pte be overwritten when expanding vma (CVE-2025-38207)
- [riscv64] Enable cbo.zero only when all harts support Zicboz
- [riscv64] Add support for per-thread envcfg CSR values
- [riscv64] save the SR_SUM status over switches (CVE-2025-38261)
- wifi: rtw89: pci: configure manual DAC mode via PCI config API only
(CVE-2025-38284)
- [s390x] entry: Remove __GMAP_ASCE and use _PIF_GUEST_FAULT again
- [s390x] kvm: Remove kvm_arch_fault_in_page()
- [s390x] mm/fault: Handle guest-related program interrupts in KVM
- [s390x] mm: Simplify get_fault_type()
- [s390x] mm: Get rid of fault type switch statements
- [s390x] mm: Fix in_atomic() handling in do_secure_storage_access()
(CVE-2025-38359)
- [amd64] platform/x86/amd/pmf: Switch to platform_get_resource() and
devm_ioremap_resource()
- [amd64] platform/x86/amd: pmf: Use device managed allocations
(CVE-2025-38421)
- drm/rockchip: vop2: Consistently use dev_err_probe()
- drm/rockchip: vop2: Register the primary plane and overlay plane
separately
- drm/rockchip: vop2: fail cleanly if missing a primary plane for a
video-port (CVE-2025-38597)
- wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()
(CVE-2025-38605)
- rv: Remove trailing whitespace from tracepoint string
- rv: Use strings in da monitors tracepoints (CVE-2025-38636)
- wifi: iwlwifi: return ERR_PTR from opmode start()
- wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() (CVE-2025-38656)
- net/sched: Fix backlog accounting in qdisc_dequeue_internal
(CVE-2025-39677)
- mm/mremap: fix WARN with uffd that has remap events disabled
(CVE-2025-39775)
- [amd64] crypto: x86/aegis128 - eliminate some indirect calls
- [amd64] crypto: x86/aegis128 - optimize length block preparation using
SSE4.1
- [amd64] crypto: x86/aegis128 - improve assembly function prototypes
- [amd64] crypto: x86/aegis - Fix sleeping when disallowed on PREEMPT_RT
- [amd64] crypto: x86/aegis - Add missing error checks (CVE-2025-39789)
- net/mlx5: HWS, denote how refcounts are protected
- net/mlx5: HWS, simplify allocations as we support only FDB
- net/mlx5: HWS, handle returned error value in pool alloc
- net/mlx5: HWS, update flow - remove the use of dual RTCs
- net/mlx5: HWS, Remove unused element array
- net/mlx5: HWS, Make pool single resource
- net/mlx5: HWS, Refactor pool implementation
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path
(CVE-2025-39830)
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error
flow
(CVE-2025-39834)
- ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog
(CVE-2025-39859)
- wifi: mt76: mt7915: fix list corruption after hardware restart
(CVE-2025-39862)
- mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()
(CVE-2025-39910)
- smb: client: let recv_done verify data_offset, data_length and
remaining_data_length (CVE-2025-39933)
- [s390x] iommu/s390: handle IOAT registration based on domain
- [s390x] iommu/s390: set appropriate IOTA region type
- [s390x] iommu/s390: Make attach succeed when the device was surprise
removed (CVE-2025-39958)
- [riscv64] KVM: Write hgatp register with valid mode bits (CVE-2025-40065)
- drm/xe: Don't allow evicting of BOs in same VM in array of VM binds
(CVE-2025-40086)
- remoteproc: Switch back to struct platform_driver::remove()
- remoteproc: qcom: pas: Make remoteproc name human friendly
- remoteproc: qcom_q6v5_pas: Simplify with dev_err_probe()
- remoteproc: qcom: pas: Conclude the rename from adsp
- remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E (CVE-2025-40113)
- scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
(CVE-2025-40130)
- crypto: hisilicon/hpre - enable all clusters clock gating
- crypto: hisilicon/qm - request reserved interrupt for virtual function
(CVE-2025-40136)
- [amd64] ASoC: Intel: avs: Use topology information for endpoint numbers
- [amd64] ASoC: Intel: avs: Do not share the name pointer between
components
(CVE-2025-40338)
- sysfs: check visibility before changing group attribute ownership
(CVE-2025-40355)
- amd/amdkfd: enhance kfd process check in switch partition
(CVE-2025-68174)
- drm/xe/guc: Add devm release action to safely tear down CT
(CVE-2025-68193)
- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage
- net/mlx5: HWS, fix bad parameter in CQ creation
- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET
- net/mlx5: Store the global doorbell in mlx5_priv
- net/mlx5e: Prepare for using different CQ doorbells
- mlx5: Fix default values in create CQ (CVE-2025-68209)
- scsi: ufs: qcom : Refactor phy_power_on/off calls
- scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)
(CVE-2025-68236)
- clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL
(CVE-2025-68318)
- netconsole: Acquire su_mutex before navigating configs hierarchy
(CVE-2025-68319)
- net: vxlan: prevent NULL deref in vxlan_xmit_one (CVE-2025-68353)
- btrfs: fix double free of qgroup record after failure to add delayed ref
head (CVE-2025-68359)
- wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks
(CVE-2025-68360)
- md: init bioset in mddev_init (CVE-2025-68368)
- coresight-tmc: change tmc_drvdata spinlock's type to raw_spinlock_t
- coresight: ETR: Fix ETR buffer use-after-free issue (CVE-2025-68376)
- wifi: ath12k: Fix MSDU buffer types handling in RX error path
(CVE-2025-68729)
- accel/ivpu: Allow to import single buffer into multiple contexts
- accel/ivpu: Rework bind/unbind of imported buffers
- accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context()
(CVE-2025-68730)
- drm/panthor: Prevent potential UAF in group creation (CVE-2025-68735)
- scsi: qla2xxx: Clear cmds after chip reset (CVE-2025-68745)
- staging: most: remove broken i2c driver (CVE-2025-68755)
- wifi: mac80211: fix typo in HE MCS check
- wifi: mac80211: log link information in ieee80211_determine_chan_mode
- wifi: mac80211: don't WARN for connections on invalid channels
(CVE-2025-71227)
- accel/qaic: Add config structs for supported cards
- net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels
(CVE-2025-71285)
- PCI: endpoint: Add missing NULL check for alloc_workqueue()
(CVE-2025-71313)
- bpf: Mark bpf_refcount field as unique (CVE-2026-100074)
- staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error
paths (CVE-2026-100076)
- drm/msm: Recover HW before retire hung submit (CVE-2026-100077)
- block: zero non-PI portion of auto integrity buffer (CVE-2026-23007)
- idpf: fix error handling in the init_task on load (CVE-2026-23017)
- stddef: Introduce TRAILING_OVERLAP() helper macro
- virtio_net: Fix misalignment bug in struct virtnet_info (CVE-2026-23143)
- ALSA: usb-audio: Prevent excessive number of frames (CVE-2026-23208)
- riscv: trace: fix snapshot deadlock with sbi ecall (CVE-2026-23217)
- io_uring/rw: free potentially allocated iovec on cache put failure
(CVE-2026-23259)
- cxl/mbox: validate payload size before accessing contents in
cxl_payload_from_user_allowed() (CVE-2026-23327)
- sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting
(CVE-2026-23371)
- ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz
(CVE-2026-23377)
- netfilter: nf_tables: clone set on flush only (CVE-2026-23385)
- serial: rename local uart_port_lock() -> uart_port_ref_lock()
- serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN
(CVE-2026-23472)
- RDMA/efa: Fix use of completion ctx after free (CVE-2026-31493)
- bpf: Fix exception exit lock checking for subprogs (CVE-2026-31526)
- drm/mediatek: dsi: Store driver data before invoking
mipi_dsi_host_register (CVE-2026-31562)
- [s390x] mm: Add missing secure storage access fixups for donated memory
(CVE-2026-31568)
- dm: limit swapping tables for devices with zone write plugs
(CVE-2025-38140)
- drm/tilcdc: Fix removal actions in case of failed probe (CVE-2025-71141)
- net: Factorise setup_net() and cleanup_net().
- net: Add ops_undo_single for module load/unload.
- net: Add ->exit_rtnl() hook to struct pernet_operations.
- wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in
pre_exit (CVE-2026-31579)
- [amd64] KVM: SEV: Use long-term pin when registering encrypted memory
regions
- [amd64] KVM: SEV: Protect *all* of sev_mem_enc_register_region() with
kvm->lock (CVE-2026-31592)
- rxrpc: proc: size address buffers for %pISpc output (CVE-2026-31630)
- Bluetooth: hci_event: move wake reason storage into validated event
handlers (CVE-2026-31771)
- bpf: Factor out atomic_ptr_type_ok()
- bpf: Factor out check_atomic_rmw()
- bpf: Factor out check_load_mem() and check_store_reg()
- bpf: Fix incorrect pruning due to atomic fetch precision tracking
(CVE-2026-43009)
- Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
(CVE-2026-43022)
- bnxt_en: Update firmware interface spec to 1.10.3.85
- bnxt_en: set backing store type from query type (CVE-2026-43034)
- mpls: Hold dev refcnt for mpls_nh.
- mpls: Unify return paths in mpls_dev_notify().
- mpls: Add mpls_dev_rcu().
- mpls: Pass net to mpls_dev_get().
- mpls: Add mpls_route_input().
- mpls: Convert mpls_dump_routes() to RCU.
- mpls: Protect net->mpls.platform_label with a per-netns mutex.
- mpls: add seqcount to protect the platform_label{,s} pair
(CVE-2026-43042)
- HID: core: Add reserved item tag for main items
- HID: rate-limit hid_warn to prevent log flooding
- HID: core: Mitigate potential OOB by removing bogus memset()
(CVE-2026-43048)
- xfs: remove bp->b_error check in xfs_attr3_root_inactive
- xfs: factor out xfs_attr3_node_entry_remove
- xfs: close crash window in attr dabtree inactivation (CVE-2026-43053)
- net: ioam6: fix OOB and missing lock (CVE-2026-43083)
- ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()
(CVE-2026-43101)
- types: move struct rcuwait into types.h
- irqwork: Move data struct to a types header
- srcu: Use irq_work to start GP in tiny SRCU (CVE-2026-43115)
- btrfs: tree-log: don't use token set/get accessors in fill_inode_item()
- btrfs: fix zero size inode with non-zero size after log replay
(CVE-2026-43118)
- fs/ntfs3: Accumulated refactoring changes
- ntfs3: fix circular locking dependency in run_unpack_ex (CVE-2026-43127)
- wifi: iwlwifi: fix 22000 series SMEM parsing (CVE-2026-43172)
- ksmbd: fix signededness bug in smb_direct_prepare_negotiation()
(CVE-2026-43185)
- drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on
DCN35 (CVE-2026-43191)
- ASoC: qcom: q6asm: handle the responses after closing
- ASoC: qcom: q6asm: drop DSP responses for closed data streams
(CVE-2026-43204)
- wifi: rtw89: pci: validate sequence number of TX release report
(CVE-2026-43213)
- team: avoid NETDEV_CHANGEMTU event when unregistering slave
(CVE-2026-43234)
- media: chips-media: wave5: Fix Null reference while testing fluster
(CVE-2026-43263)
- ring-buffer: Fix possible dereference of uninitialized pointer
(CVE-2026-43272)
- drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some
panels (CVE-2026-43294)
- drm/amdgpu: Skip vcn poison irq release on VF (CVE-2026-43298)
- btrfs: do not ASSERT() when the fs flips RO inside
btrfs_repair_io_failure() (CVE-2026-43299)
- btrfs: remove 'reserved' argument from btrfs_pin_extent()
- btrfs: don't BUG() on unexpected delayed ref type in
run_one_delayed_ref()
(CVE-2026-43308)
- md raid: fix hang when stopping arrays with metadata through dm-raid
(CVE-2026-43309)
- media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure
- media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC
(CVE-2026-43310)
- KVM: Export hardware virtualization enabling/disabling functions
- syscore: Pass context data to callbacks
- soc/tegra: pmc: Fix unsafe generic_handle_irq() call (CVE-2026-43311)
- wifi: iwlwifi: mvm: don't send a 6E related command when not supported
(CVE-2026-43325)
- drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw()
(CVE-2026-43337)
- ice: ptp: don't WARN when controlling PF is unavailable (CVE-2026-43346)
- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue
(CVE-2026-43352)
- i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (CVE-2026-43353)
- scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)
- [amd64] ASoC: amd: acp-mach-common: Add missing error check for clock
acquisition (CVE-2026-43443)
- rxrpc: kdoc: Update function descriptions and add link from rxrpc.rst
- rxrpc, afs: Fix missing error pointer check after
rxrpc_kernel_lookup_peer() (CVE-2026-43463)
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ
(CVE-2026-43464)
- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ
(CVE-2026-43465)
- nouveau/gsp: drop WARN_ON in ACPI probes (CVE-2026-43485)
- bpf: Fix tcx/netkit detach permissions when prog fd isn't given
(CVE-2026-45932)
- btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation
(CVE-2026-45934)
- net: stmmac: fix oops when split header is enabled (CVE-2026-45940)
- drm/exynos: vidi: use priv->vidi_dev for ctx lookup in
vidi_connection_ioctl() (CVE-2026-45956)
- gfs2: fix memory leaks in gfs2_fill_super error path (CVE-2026-45961)
- [amd64] KVM: SVM: Add missing save/restore handling of LBR MSRs
(CVE-2026-46014)
- ipmi:ssif: Clean up kthread on errors (CVE-2026-46044)
- [amd64] KVM: x86: Rename "governed features" helpers to use
"guest_cpu_cap"
- [amd64] KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2
VMRUN (CVE-2026-46059)
- ceph: Remove call to PagePrivate2()
- ceph: extend ceph_writeback_ctl for ceph_writepages_start() refactoring
- ceph: introduce ceph_process_folio_batch() method
- ceph: Remove uses of page from ceph_process_folio_batch()
- ceph: fix num_ops off-by-one when crypto allocation fails
(CVE-2026-46066)
- [amd64] KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (CVE-2026-46071)
- dm-verity-fec: fix reading parity bytes split across blocks (take 3)
(CVE-2026-46130)
- spi: microchip-core-qspi: Support per spi-mem operation frequency
switches
- spi: microchip-core-qspi: set min_speed_hz during probe
- spi: microchip-core-qspi: remove unused param from
mchp_coreqspi_write_op()
- spi: microchip-core-qspi: control built-in cs manually (CVE-2026-46148)
- [riscv64] kvm: fix vector context allocation leak (CVE-2026-46171)
- f2fs: fix fsck inconsistency caused by FGGC of node block
(CVE-2026-46175)
- refcount: provide ops for cases when object's memory can be reused
- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)
- spi: ch341: switch to use devm_spi_alloc_host()
- spi: ch341: fix devres lifetime (CVE-2026-46228)
- drm/amd/display: Fix dc_link NULL handling in HPD init (CVE-2026-46245)
- NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages
(CVE-2026-46256)
- coresight: tmc-etr: Fix race condition between sysfs and perf mode
(CVE-2026-46272)
- selinux: allow multiple opens of /sys/fs/selinux/policy (CVE-2026-46302)
- netfilter: nf_tables: use list_del_rcu for netlink hooks (CVE-2026-46324)
- RDMA/rxe: Move some code to rxe_loc.h in preparation for ODP
- RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE
(CVE-2026-46325)
- Revert "net/smc: Introduce TCP ULP support" (CVE-2026-46330)
- tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (CVE-2026-52937)
- libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()
(CVE-2026-52956)
- net: airoha: fix BQL imbalance in TX path (CVE-2026-52983)
- sched/psi: fix race between file release and pressure write
(CVE-2026-52991)
- netfilter: nat: use kfree_rcu to release ops (CVE-2026-53000)
- ice: fix double-free of tx_buf skb (CVE-2026-53009)
- f2fs: fix data loss caused by incorrect use of nat_entry flag
(CVE-2026-53017)
- f2fs: avoid reading already updated pages during GC (CVE-2026-53018)
- greybus: raw: fix use-after-free on cdev close (CVE-2026-53025)
- net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)
- wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync
(CVE-2026-53103)
- wifi: mt76: Fix memory leak destroying device (CVE-2026-53104)
- [powerpc*] 64s: Fix unmap race with PMD migration entries
(CVE-2026-53108)
- [powerpc*] pgtable-frag: Fix bad page state in pte_frag_destroy
(CVE-2026-53109)
- vdpa: use generic driver_override infrastructure (CVE-2026-53118)
- staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length
subtraction (CVE-2026-53178)
- sctp: validate embedded INIT chunk and address list lengths in cookie
(CVE-2026-53224)
- wifi: fix leak if split 6 GHz scanning fails (CVE-2026-53258)
- [arm64] KVM: arm64: Take the SRCU lock for page table walks in fault
injection and AT emulation (CVE-2026-53277)
- [amd64] iommu/vt-d: Avoid NULL pointer dereference or refcount corruption
(CVE-2026-53281)
- btrfs: only release the dirty pages io tree after successful writes
(CVE-2026-53284)
- drm/amd/display: Wrap DCN32 phantom-plane allocation in
DC_RUN_WITH_PREEMPTION_ENABLED (CVE-2026-53285)
- net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind
(CVE-2026-53292)
- net: mana: Guard mana_remove against double invocation (CVE-2026-53297)
- io_uring/napi: protect concurrent io_napi_entry timeout accesses
- io_uring/napi: improve __io_napi_add
- io_uring/napi: Use lock guards
- io_uring/napi: clean up __io_napi_do_busy_loop
- io_uring/napi: cap busy_poll_to 10 msec (CVE-2026-53321)
- drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()
(CVE-2026-53330)
- f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage
(CVE-2026-53368)
- drm/msm: always recover the gpu (CVE-2026-53377)
- fbdev: omap2: fix inconsistent lock returns in omapfb_mmap
- fbdev: omap2: fix use-after-free in omapfb_mmap (CVE-2026-53401)
- f2fs: read COW data with the original inode during atomic write
(CVE-2026-63811)
- gcov: use atomic counter updates to fix concurrent access crashes
(CVE-2026-63825)
- wifi: mt76: add wcid publish check in mt76_sta_add (CVE-2026-63832)
- drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring (CVE-2026-63853)
- net: airoha: Do not read uninitialized fragment address in
airoha_dev_xmit() (CVE-2026-63857)
- net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()
(CVE-2026-63859)
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)
- net/handshake: hand off the pinned file reference to accept_doit
(CVE-2026-63979)
- ethtool: module: call ethnl_ops_complete() on module flash errors
(CVE-2026-63998)
- ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
(CVE-2026-63999)
- netfilter: nf_tables: fix dst corruption in same register operation
(CVE-2026-64006)
- tcp: Remove sk->sk_prot->orphan_count.
- tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
(CVE-2026-64024)
- cgroup/rstat: validate cpu before css_rstat_cpu() access (CVE-2026-64036)
- hwmon: (lm90) Stop work before releasing hwmon device (CVE-2026-64038)
- netfs: Fix leak of request in netfs_write_begin() error handling
(CVE-2026-64060)
- netfs: Fix missing locking around retry adding new subreqs
(CVE-2026-64068)
- netfilter: bridge: eb_tables: close module init race (CVE-2026-64076)
- netfilter: ebtables: move to two-stage removal scheme (CVE-2026-64077)
- netfilter: x_tables: allow initial table replace without emitting audit
log message
- netfilter: x_tables: allocate hook ops while under mutex (CVE-2026-64079)
- wifi: mac80211: fix missing RX bitrate update for mesh forwarding path
- wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
(CVE-2026-64117)
- erofs: fix metabuf leak in inode xattr initialization (CVE-2026-64146)
- drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (CVE-2026-64154)
- netfs: Fix zeropoint update where i_size > remote_i_size (CVE-2026-64159)
- hwmon: (lm90) Add lock protection to lm90_alert (CVE-2026-64213)
- KVM: guest_memfd: Treat memslot binding offset+size as unsigned values
(CVE-2026-64283)
- smb/client: fix chown/chgrp with SMB3 POSIX Extensions (CVE-2026-64388)
- ksmbd: validate NTLMv2 response before updating session key
(CVE-2026-64389)
- ksmbd: prevent path traversal bypass by restricting caseless retry
(CVE-2026-64400)
- [amd64] KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting
APIC state
- [amd64] KVM: x86: Move kvm_set_apic_base() implementation to lapic.c
(from
x86.c)
- [amd64] KVM: x86: Rename APIC base setters to better capture their
relationship
- [amd64] KVM: x86: Move update_cr8_intercept() to lapic.c
- [amd64] KVM: x86: Unconditionally recompute CR8 intercept on PPR update
(CVE-2026-64513)
- [amd64] KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to
invalid guest state (CVE-2026-68081)
- drm/amdgpu: Fix kernel panic during driver load failure (CVE-2026-68105)
- media: stm32: dcmipp: use v4l2_subdev_is_streaming
- media: stm32: dcmipp: replace s_stream with enable/disable_streams
- media: stm32-dcmipp: Return queued buffers on start_streaming() failure
(CVE-2026-68211)
- drm/vc4: Shut down BO cache timer before teardown (CVE-2026-68233)
- drm/amdgpu: Use dbg level for VBIOS check messages
- drm/amdgpu: Add wrapper for freeing vbios memory
- drm/amdgpu: Release VFCT ACPI table reference (CVE-2026-68238)
- [amd64] drm/i915/mst: limit DP MST ESI service loop (CVE-2026-68241)
- [amd64] drm/i915/gt: Fix NULL deref on sched_engine alloc failure
(CVE-2026-68242)
- drm/amdkfd: Check bounds on CRIU restore queue type and mqd size
(CVE-2026-68258)
- idpf: fix max_vport related crash on allocation error during init
(CVE-2026-68291)
- LoongArch: BPF: Zero-extend signed ALU32 div/mod results (CVE-2026-68295)
- cifs: prevent readdir from changing file size due to stale directory
metadata
- cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain
paths (CVE-2026-68312)
- tipc: serialize udp bearer replicast list updates (CVE-2026-68323)
- fwctl/bnxt_en: Refactor aux bus functions to be more generic
- bnxt_en: Handle partially initialized auxiliary devices (CVE-2026-68375)
- drm/xe/guc: Keep scheduler timeline name alive (CVE-2026-68383)
- Bluetooth: hci_sync: extend conn_hash lookup critical sections
(CVE-2026-68393)
- bpf: Disable migration when destroying sock storage
- bpf: Disable migration when cloning sock storage
- rcu: add rcu_read_lock_dont_migrate()
- bpf: Use rcu_read_lock_dont_migrate in bpf_sk_storage.c
- bpf: Fix UAF in sock clone early bailouts (CVE-2026-68399)
- firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()
(CVE-2026-68401)
- wifi: cfg80211: use wiphy work for socket owner autodisconnect
(CVE-2026-68404)
- wifi: mac80211: refactor populating mesh related fields in sinfo
- wifi: cfg80211: add link_station_info structure to support MLO statistics
- wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)
- wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()
(CVE-2026-68412)
- RDMA/irdma: Prevent user-triggered null deref on QP create
(CVE-2026-68418)
- sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()
(CVE-2026-68421)
- xfrm: fix stale skb->prev after async crypto steals a GSO segment
(CVE-2026-68426)
- drm/amd/display: use kvzalloc to allocate struct dc (CVE-2026-68436)
- net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains
(CVE-2026-68441)
- drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size
(CVE-2026-68447)
- ovl: check access to copy_file_range source with src mounter creds
(CVE-2026-68448)
- [s390x] zcrypt: Fix buffer over-read in cca_cipher2protkey
(CVE-2026-68453)
- wifi: mac80211: validate extension-frame layout before RX
(CVE-2026-68470)
- wifi: ieee80211: validate MLE common info length (CVE-2026-68471)
- ata: libata-core: Disable LPM on Silicon Motion MD619{H,G}XCLDE3TC
- ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD (CVE-2026-72031)
- mmc: vub300: Use devm_mmc_alloc_host() helper
- mmc: vub300: fix use-after-free on disconnect
- mmc: vub300: rename probe error labels
- mmc: vub300: fix use-after-free on probe failure (CVE-2026-72073)
- dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)
- ocfs2: correct l_next_free_rec in online check
- ocfs2: add suballoc slot check in ocfs2_validate_inode_block()
- ocfs2: add extra consistency checks for chain allocator dinodes
- ocfs2: validate i_refcount_loc when refcount flag is set
- ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec
(CVE-2026-72162)
- [arm64] KVM: arm64: vgic: Handle race between interrupt affinity change
and LPI disabling (CVE-2026-72288)
- ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and
igmp_stop_timer() (CVE-2026-72321)
- net/liquidio: drop cached VF pci_dev LUT (CVE-2026-72329)
- Bluetooth: 6lowpan: avoid untracked enable work (CVE-2026-72337)
- net/mlx5e: Fix publication race for priv->channel_stats[]
(CVE-2026-72341)
- netfs: Clean up some whitespace in trace header
- netfs: Use a folio_queue allocation and free functions
- netfs: Add a tracepoint to log the lifespan of folio_queue structs
- netfs: Abstract out a rolling folio buffer implementation
- netfs: Drop the was_async arg from netfs_read_subreq_terminated()
- netfs: Fix netfs_create_write_req() to handle async cache object creation
(CVE-2026-72366)
- iomap: guard io_size EOF trim against concurrent truncate underflow
(CVE-2026-72367)
- afs: Fix reinitialisation of the inode, in particular ->lock_work
(CVE-2026-72375)
- xen/pvcalls: bound backend response req_id before indexing rsp[]
(CVE-2026-72380)
- sctp: fix addr_wq_timer race in sctp_free_addr_wq() (CVE-2026-72383)
- drm/panthor: Always use the IRQ-safe variant when acquiring the fence
lock
(CVE-2026-72388)
- hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()
(CVE-2026-72397)
- sctp: add INIT verification after cookie unpacking (CVE-2026-72398)
- tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()
(CVE-2026-72404)
- bpf: Guard conntrack opts error writes (CVE-2026-72423)
- md/raid10: fix writes_pending leak on write request failures
(CVE-2026-72439)
- md/raid1: fix writes_pending and barrier reference leaks on write
failures
(CVE-2026-72440)
- soundwire: fix bug in sdw_add_element_group_count found by syzkaller
(CVE-2026-72488)
- net: serialize netif_running() check in enqueue_to_backlog()
(CVE-2026-72493)
- RDMA/irdma: Replace waitqueue and flag with completion (CVE-2026-72494)
- RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
(CVE-2026-72495)
- RDMA/bnxt_re: Add a max slot check for SQ (CVE-2026-72497)
- RDMA/bnxt_re: Free CQ toggle page after firmware teardown
(CVE-2026-72499)
- RDMA/bnxt_re: Fix budget handling of notification queue
- RDMA/bnxt_re: Remove unusable nq variable
- RDMA/bnxt_re: Free SRQ toggle page after firmware teardown
(CVE-2026-72500)
- RDMA/bnxt_re: Initialize dpi variable to zero (CVE-2026-72501)
- sockmap: Fix use-after-free in udp_bpf_recvmsg() (CVE-2026-74257)
- ALSA: seq: Clean up fifo locking with guard
- ALSA: seq: avoid stale FIFO cells during resize (CVE-2026-74261)
- net: watchdog: fix refcount tracking races (CVE-2026-74264)
- bnxt: fix head underflow on XDP head-grow (CVE-2026-74269)
- cxl/region: Block region delete during region creation (CVE-2026-74273)
- ixgbe: do not configure xps for XDP queues (CVE-2026-74317)
- bpf: Reject sleepable BPF_LSM_CGROUP programs at load time
(CVE-2026-74338)
- ocfs2: validate fast symlink target during inode read (CVE-2026-74350)
- wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()
(CVE-2026-74368)
- md: replace wait loop with wait_event() in md_handle_request()
- md/raid1,raid10: fix deadlock in read error recovery path
(CVE-2026-74375)
- md/raid1,raid10: fix bio accounting for split md cloned bios
(CVE-2026-74373)
- md/raid1,raid10: fix error-path detection with md_cloned_bio()
(CVE-2026-74374)
- nvmet-tcp: check return value of nvmet_tcp_set_queue_sock
(CVE-2026-74385)
- ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data
(CVE-2026-74388)
- OPP: Fix race between OPP addition and lookup (CVE-2026-74405)
- wifi: ath11k: cancel SSR work items during PCI shutdown (CVE-2026-74407)
- drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero
viewport (CVE-2026-74449)
- [s390x] ap: Move response_type struct into ap_msg struct
- [s390x] ap/zcrypt: Rework AP message buffer allocation
- [s390x] ap: Introduce ap message buffer pool
- [s390x] ap/zcrypt: New xflag parameter
- [s390x] zcrypt: Move inline function rng_type6cprb_msgx from header to
code
- [s390x] zcrypt: Rework domain processing within zcrypt device driver
- [s390x] zcrypt: Close speculative mem read possibility (CVE-2026-74466)
- afs: Fix UAF when sending a message (CVE-2026-74506)
- dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister
(CVE-2026-74513)
- [amd64] iommu/iommufd: Fix IOPF group ownership UAF (CVE-2026-74520)
- octeontx2-af: Block VFs from clobbering special CGX PKIND state
(CVE-2026-74527)
- Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback
(CVE-2026-74529)
- Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
(CVE-2026-74530)
- Bluetooth: ISO: hold sk properly in iso_conn_ready (CVE-2026-74537)
- Bluetooth: ISO: lock sk in iso_connect_ind (CVE-2026-74538)
- netfs: Fix folio_queue ENOMEM in writeback by adding a mempool
(CVE-2026-74542)
- net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
(CVE-2026-74544)
- xsk: drain continuation descs after overflow in xsk_build_skb()
(CVE-2026-74559)
- xsk: provide sufficient space in pool->tx_descs
- xsk: reclaim invalid Tx descriptors in ZC batch path (CVE-2026-74558)
- btrfs: skip global block reserve accounting for rescue mounts
(CVE-2026-74571)
- mm/page_table_check: skip special zero mappings (CVE-2026-74600)
- eventfs: Use children field for rcu head and add memory barriers
(CVE-2026-74605)
- tls: rx: restore msg_iter before TLS 1.3 optimistic retry
(CVE-2026-74611)
- watchdog: at91sam9_wdt: prevent timer rearm during teardown
(CVE-2026-74687)
- [s390x] ism: Fix UAF of sba and ieq during ism_dev_exit()
(CVE-2026-74690)
- netfilter: nf_flow_table: drop existing skb dst before
skb_dst_set_noref()
(CVE-2026-74695)
- bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
(CVE-2026-74697)
- hwmon: (pmbus) Fix type confusion in notification logic (CVE-2026-74711)
- vhost_iotlb: bound map allocation in add_range (CVE-2026-74713)
- bpf: Fix netns reference imbalance in conntrack kfuncs (CVE-2026-74715)
- btrfs: lzo: reject inline extents without valid headers (CVE-2026-74723)
- xfs: handle NULL b_addr in xfs_buf_free (CVE-2026-74728)
- soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
(CVE-2026-74729)
- gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
(CVE-2026-74733)
- firewire: ohci: fix NULL pointer dereference in ar_context_release
(CVE-2026-74734)
- ipvs: revalidate ihl to prevent out-of-bounds access (CVE-2026-74747)
- sctp: validate cookie AUTH state before use (CVE-2026-74752)
- scsi: core: pair EH runtime PM get and put (CVE-2026-74754)
- ASoC: SOF: Relocate and rework functionality for PCM stream freeing
- ASoC: SOF: pcm: Move period/buffer configuration print after platform
open
- ASoC: SOF: pcm: Add snd_sof_pcm specific wrappers for dev_dbg() and
dev_err()
- ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout
(CVE-2026-80581)
- tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg (CVE-2026-80607)
- net: ibm: emac: use devm_platform_ioremap_resource
- net: ibm: emac: use platform_get_irq
- net: emac: Fix NULL pointer dereference in emac_probe (CVE-2026-80614)
- ieee802154: Avoid calling WARN_ON() on -ENOMEM in
cfg802154_switch_netns()
(CVE-2026-80616)
- coresight: ete: Always save state on power down (CVE-2026-80623)
- ALSA: seq: oss: Serialize readq reset state with q->lock (CVE-2026-80628)
- btrfs: lzo: reject compressed segment that overflows the compressed input
(CVE-2026-80631)
- netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag
(CVE-2026-80634)
- EDAC/igen6: Initialize edac_op_state according to the configuration data
- EDAC/igen6: Add polling support
- EDAC/igen6: Skip absent memory controllers
- EDAC/igen6: Fix call trace due to missing release() (CVE-2026-80643)
- scsi: hisi_sas: Add slave_destroy interface for v3 hw (CVE-2026-80653)
- soc: xilinx: Fix race condition in event registration (CVE-2026-80655)
- cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size (CVE-2026-80662)
- netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
(CVE-2026-80668)
- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
(CVE-2026-80692)
- idpf: bound interrupt-vector register fill to the allocated array
(CVE-2026-80693)
- dmaengine: idxd: fix double free of wq, engine, and group structs
(CVE-2026-80698)
- drm/amd/display: check if dml21_add_phantom_plane() is successful
(CVE-2026-80705)
- btrfs: initialize inode mapping flags for cached inodes (CVE-2026-80734)
- bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
(CVE-2026-80738)
- drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length
- drm/amdkfd: Add bounds check for CRAT subtype length (CVE-2026-80747)
- Bluetooth: ISO: zero the sockaddr before returning it in getname
(CVE-2026-80761)
- fbdev: Wrap user-invoked calls to fb_set_var() in helper (CVE-2026-80786)
- tipc: avoid busy looping in tipc_exit_net() (CVE-2026-80866)
- NTB: core: Add .get_dma_dev() callback to ntb_dev_ops
- NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers
- ntb: Store original DMA address for future release (CVE-2026-80884)
- tap: Keep hdr_len in tap_get_user()
- net: tap: fix wrong transport_header when sending VLAN-tagged frame
(CVE-2026-80905)
- io_uring: defer eventfd signaling when queued from a wakeup handler
(CVE-2026-80920)
- wifi: iwlwifi: dvm: pair transport op-mode enter/leave
- wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()
(CVE-2026-80948)
- svcrdma: Reject Read lists that exceed the page budget (CVE-2026-89528)
- svcrdma: Add Write chunk WRs to the RPC's Send WR chain
- svcrdma: wake sq waiters when the transport closes
- svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails
(CVE-2026-89534)
- SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2
(CVE-2026-89537)
- ext2: Fix lost inode updates for IS_SYNC inodes (CVE-2026-89601)
- smb: client: reject a tree connect response whose byte count is too small
(CVE-2026-89631)
- cifs: call pagecache_isize_extended() in cifs_setsize() when extending
(CVE-2026-89642)
- ceph: cap delegated inode count in ceph_parse_deleg_inos()
(CVE-2026-89648)
- ceph: fix UAF in check_new_map() on session freed during unlock
(CVE-2026-89654)
- nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net
(CVE-2026-89682)
- nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths
(CVE-2026-89705)
- lockd, nfsd: RCU-protect nlmsvc_ops dispatch (CVE-2026-89709)
- mm/mglru: reset page lru tier bits when activating
- mm/mglru: use the common routine for dirty/writeback reactivation
- mm/mglru: fix and remove redundant unevictable folio handling
(CVE-2026-89757)
- ksmbd: fix tree connection use-after-free in smb2_tree_connect()
(CVE-2026-89788)
- drm/amdkfd: Fix partial migrate issue
- drm/amdkfd: return migration pages from copy function
- Revert "drm/amdkfd: return migration pages from copy function"
- drm/amdkfd: Fix the case that vm range is hole at
svm_migrate_copy_to_vram
(CVE-2026-89808)
- drm/amdkfd: return migration pages from copy function - again
- drm/amdkfd: Fix error path at svm_migrate_copy_to_ram (CVE-2026-89810)
- drm/amdkfd: Add TLB flush after MES queue eviction/suspension
(CVE-2026-89811)
- drm/amdgpu: force complete the MES ring fences on reset (CVE-2026-89812)
- drm/amdgpu: force complete the KIQ ring fences on reset (CVE-2026-89813)
- f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()
(CVE-2026-89833)
- [arm64] KVM: arm64: vgic-v3: take an LPI reference in
vgic_v3_save_pending_tables (CVE-2026-89913)
- [s390x] KVM: s390: Fix memory corruption by not reinjecting CK machine
checks (CVE-2026-89920)
- mm/huge_memory: transfer the pmd dirty bit to the folio on zap
(CVE-2026-89987)
- netfilter: nf_tables: prefer nft_trans_elem_alloc helper
- netfilter: nf_tables: add nft_trans_commit_list_add_elem helper
- netfilter: nf_tables: prepare for multiple elements in nft_trans_elem
structure
- netfilter: nf_tables: skip double clone set expressions on element insert
(CVE-2026-90061)
- net_sched: sch_fq: add three drop_reason
- net/sched: add qstats_cpu_drop_inc() helper
- net/sched: act_ife: Only operate on Ethernet frames (CVE-2026-90083)
- octeontx2-vf: fix workqueue and netdev race in probe/remove
(CVE-2026-90084)
- xsk: honor XDP_TX_METADATA in zero-copy path (CVE-2026-90086)
- Bluetooth: do not leak an hci_conn when a second LE connect is rejected
(CVE-2026-90087)
- net: add getsockopt_iter callback to proto_ops
- Bluetooth: L2CAP: convert to getsockopt_iter
- Bluetooth: L2CAP: access chan->conn safely in get/setsockopt
(CVE-2026-90093)
- Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root
partition (CVE-2026-90097)
- net/sched: account classifier filter allocations to memcg
(CVE-2026-90099)
- NFSv4.1: zero referring call lists before decoding (CVE-2026-90104)
- vxlan: fix reading neigh ha (CVE-2026-90105)
- net: bridge: arp/nd proxy: fix reading neigh ha (CVE-2026-90106)
- ip6mr: do not clone dst in ip6mr_cache_report() (CVE-2026-90111)
- ALSA: mtpav: shut down output timer before card teardown (CVE-2026-90116)
- virtio_net: Fix resize of the RX ring (CVE-2026-90142)
- dpll: fix NULL deref in dpll_device_ops() during teardown race
(CVE-2026-90144)
- bpf, xdp: move offload check into dev_xdp_install()
- NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers
(CVE-2026-90149)
- ksmbd: scope session state changes to bound connections (CVE-2026-90154)
- ksmbd: detach blocked lock requests before freeing (CVE-2026-90155)
- ksmbd: safely discard unregistered deferred locks (CVE-2026-90156)
- erofs: fix interlaced ztailpacking pclusters (CVE-2026-90161)
- ksmbd: defer publishing granted locks to prevent UAF/double-free race
(CVE-2026-90162)
- ksmbd: serialize oplock close with pending break ownership
(CVE-2026-90167)
- ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() (CVE-2026-90174)
- bpf: Check pointer type for all atomic RMW paths (CVE-2026-90177)
- apparmor: fix deadlock in complain-mode change_hat (CVE-2026-90179)
- blk-cgroup: delay freeing policy data after rcu grace period
- blk-iocost: clear delay state when freeing policy data (CVE-2026-90182)
- blk-iolatency: clear delay state when freeing policy data
(CVE-2026-90183)
- ocfs2: validate DIO orphan slot during inode read (CVE-2026-90204)
- ocfs2: validate orphan slot during inode read (CVE-2026-90205)
- nvmet: fix max_qid race between configfs and controller allocation
(CVE-2026-90206)
- clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type
(CVE-2026-90208)
- bpf: Compare iterator types during state pruning (CVE-2026-90217)
- apparmor: fix unconfined user namespace restriction forced stack
(CVE-2026-90231)
- amt: Don't support cross-netns setup. (CVE-2026-90232)
- NFS: Return a delegation the client fails to record (CVE-2026-90234)
- [amd64] iommu/vt-d: Flush context cache with correct SID when tearing
down
aliases (CVE-2026-90240)
- bpf: Fix mmap_lock leak in irq_work path (CVE-2026-90247)
- Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero
(CVE-2026-74533)
- Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
(CVE-2026-90256)
- btrfs: qgroup: fix a wrong length calculation in
qgroup_free_reserved_data() (CVE-2026-90259)
- btrfs: zoned: don't clobber the extent buffer when zeroing it out
(CVE-2026-90260)
- btrfs: check if root is readonly when setting posix acl (CVE-2026-90263)
- btrfs: always wait for ordered extents to avoid OE races (CVE-2026-90264)
- btrfs: defrag: fix deadlock between defrag and delalloc space reservation
(CVE-2026-90265)
- scsi: sd: Move the sd_config_discard() function definition
- scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails
(CVE-2026-90267)
- coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf
enable (CVE-2026-90273)
- drm/amd/display: disable replay when crc source is enabled
- drm/amd/display: Resize MST HDCP per-connector arrays to 32
(CVE-2026-90289)
- bpf: Factor callchain_store function from __bpf_get_stack
- bpf: Factor callchain_finalize function from __bpf_get_stack
- bpf: Remove trace_in argument from __bpf_get_stack
- bpf: Clear buf on error in __bpf_get_task_stack (CVE-2026-90300)
- ocfs2/heartbeat: fix slot mapping rollback leaks on error paths
- ocfs2: o2hb: quiesce negotiate handlers and timeout work (CVE-2026-90301)
- thermal: hwmon: Remove hwmon class device along with its parent
(CVE-2026-90311)
- ocfs2: validate inline xattrs during inode block validation
(CVE-2026-90321)
- ublk: check import_ubuf() return value (CVE-2026-90324)
- blk-cgroup: fix race between policy activation and blkg destruction
(CVE-2026-90326)
- HID: steam: Reject short reads (CVE-2026-90328)
- HID: logitech-hidpp: Fix FF device cleanup on init failure
(CVE-2026-90330)
- tty: skip cdev_del() when no cdev is registered (CVE-2026-90335)
- serial: core: clear freed pointers on uart_register_driver() failure
(CVE-2026-90336)
- serial: core: do fallible allocations before the console can be
registered
(CVE-2026-90337)
- wifi: cfg80211: stop PMSR before P2P and NAN teardown (CVE-2026-90343)
- wifi: brcmfmac: fix P2P action frame handling without device vif
(CVE-2026-90345)
- wifi: nl80211: check link is beaconing for color change
- wifi: nl80211: clean up color-change beacon data on errors
(CVE-2026-90346)
- [arm64] ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry
(CVE-2026-90347)
- wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach
failed
(CVE-2026-90351)
- bpf: Reject >8 byte return values on return-reading trampoline paths
(CVE-2026-90359)
- drm/msm: don't tear down KMS twice when KMS init fails (CVE-2026-90363)
- wifi: mt76: cancel reset and rc work on device unregister
(CVE-2026-90365)
- wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
(CVE-2026-90367)
- wifi: ath12k: fix overreads in
ath12k_wmi_process_csa_switch_count_event()
(CVE-2026-90408)
- [amd64] drm/i915: rename range_overflows_end() to range_end_overflows()
- [amd64] drm/i915: document range_overflows() and range_end_overflows()
macros
- overflow: add range_overflows() and range_end_overflows()
- drm/panthor: Add vm_bind region with kbo range overlap check
(CVE-2026-90409)
- RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()
(CVE-2026-90417)
- PCI: Make pci_match_one_device() match on ID instead of device
- PCI: Fix dyn_id add TOCTOU
- PCI: Fix UAF when probe runs concurrent to dyn ID removal
(CVE-2026-90421)
- clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path
(CVE-2026-90422)
- iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path
(CVE-2026-90424)
- iommu/tegra241-cmdqv: Don't fall back to a freed smmu after
devm_krealloc() (CVE-2026-90427)
- scsi: ufs: core: Convert string descriptor format macros to enum
- scsi: ufs: core: Validate string descriptors (CVE-2026-92480)
- pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip
(CVE-2026-92482)
- bpf: Fix WARNING in bpf_tracing_link_release (CVE-2026-92485)
- ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() (CVE-2026-92503)
- bpf: Zero queue and stack outputs on lock failure (CVE-2026-92520)
- drm/sched: Use struct for drm_sched_init() params
- drm/msm: Only fini scheduler after successful init (CVE-2026-93058)
- firmware: arm_scmi: Fix SCMI device destroy lifetimes (CVE-2026-93081)
- fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() (CVE-2026-93100)
- RDMA/rvt: Return NULL after port allocation failure (CVE-2026-93104)
- esp: do not unref managed frag pages in esp_ssg_unref() (CVE-2026-93105)
- platform/x86: asus-wmi: fix resource leaks on probe failure
(CVE-2026-93116)
- usb: gadget: uac: validate rate list length before storing
(CVE-2026-93122)
- bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max
(CVE-2026-93125)
- [amd64] platform/x86: dell-wmi-base: Fix handling of ultra performance
key
(CVE-2026-93129)
- bpf: Reject writes through untrusted BTF pointers (CVE-2026-93144)
- time/namespace: Validate nanosecond field in proc_timens_set_offset()
(CVE-2026-93146)
- bpf: Reject MEM_ALLOC BTF accesses past object bounds (CVE-2026-93148)
- dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout
(CVE-2026-93168)
- drm/amd/display: Fix dangling pointer in CRTC reset function
(CVE-2026-93175)
- drm/amd/display: Fix dangling pointer in plane reset function
(CVE-2026-93176)
- mm/page_owner: use memcg_data snapshot to avoid TOCTOU in
print_page_owner_memcg() (CVE-2026-93216)
- nfsd: convert nfsd_net boolean flags to unsigned long flags word
(CVE-2026-93221)
- mm/hugetlb: refactor code around vmemmap_walk
- mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier
(CVE-2026-93230)
- ACPI: bus: Introduce acpi_bus_get_primary_device() (CVE-2026-93251)
- powerpc/xive: add error return value to xive_smp_probe()
- powerpc/xive: propagate IPI init errors to prevent use-after-free
(CVE-2026-93260)
- remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3
(CVE-2026-93272)
- ksmbd: remove redundant DACL check in smb_check_perm_dacl
- ksmbd: fix maximum allowed access checks (CVE-2026-93282)
- drm/amdkfd: fix SMI event cross-process information leak (CVE-2026-97422)
- drm/amdgpu: Update SRIOV Exchange Headers for RAS Telemetry Support
- drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq
(CVE-2026-97424)
- wifi: iwlwifi: simplify nested if checks
- wifi: iwlwifi: mvm: fix P2P-Device binding handling (CVE-2026-97432)
- RDMA/counter: Fix num_counters leak on bind_qp failure in
alloc_and_bind()
(CVE-2026-97477)
- virt: acrn: Remove unused list 'acrn_irqfd_clients'
- virt: acrn: Fix irqfd use-after-free during eventfd shutdown
(CVE-2026-97478)
- PM: sleep: core: Synchronize runtime PM status of parents and children
- PM: sleep: core: Restrict power.set_active propagation
- PM: Rearrange documentation related to __pm_runtime_disable()
- PM: Block enabling of runtime PM during system suspend
- PM: runtime: Introduce pm_runtime_blocked()
- PM: sleep: Use DPM_FLAG_SMART_SUSPEND conditionally
- PM: sleep: Fix bit masking operation
- driver core: Add device_link_test() for testing device link flags
- driver core: Avoid warning when removing a device while its supplier is
unbinding (CVE-2026-97479)
- serial: 8250: invert serial8250_register_8250_port() CIR condition
- tty: serial: 8250: protect against NULL uart->port.dev in register
(CVE-2026-97480)
- drm/amdgpu: Remove unused amdgpu_i2c functions
- drm/amdgpu/atombios: drop empty function
- drm/amdgpu: rework i2c init and fini
- drm/amdgpu: Bound GPIO I2C table entry count from VBIOS (CVE-2026-97493)
- gpiolib: make value setters have return values
- gpiolib: wrap gpio_chip::set()
- gpiolib: rework the wrapper around gpio_chip::set_multiple()
- gpiolib: introduce gpio_chip setters that return values
- pinctrl: mediatek: paris: don't double-check the GPIO number
- pinctrl: mediatek: paris: use new GPIO line value setter callbacks
- pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction
(CVE-2026-97501)
- genirq/proc: Switch to lock guards
- genirq: Consistently use '%u' format specifier for unsigned int variables
- genirq/proc: Size interrupt directory names for 10-digit interrupt
numbers
(CVE-2026-97503)
- media: chips-media: wave5: Release m2m_ctx after Instance Removed from
List (CVE-2026-97513)
- i3c: master: svc: Fix npcm845 FIFO empty issue
- i3c: master: svc: Fix npcm845 invalid slvstart event
- i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845
(CVE-2026-97515)
- hwmon: (asus_rog_ryujin) Rely on subsystem locking
- hwmon: (asus_rog_ryujin) Add per-device configuration
- hwmon: (asus_rog_ryujin) Validate HID report lengths (CVE-2026-97538)
- smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
(CVE-2026-97554)
- smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid
(CVE-2026-97561)
- drm/amdgpu: skip the VMID 0 flush for VRAM (CVE-2026-97928)
- [amd64] perf/x86/intel: Prevent drain_pebs() reentry (CVE-2026-97960)
- net/mlx5e: Move representor vnic reporter to eswitch devlink port
(CVE-2026-97962)
- Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()
(CVE-2026-97975)
- vhost: invalidate vring access on IOTLB transitions (CVE-2026-97988)
- vduse: validate virtqueue alignment (CVE-2026-97989)
- virtio_ring: fix stale descriptor flags after a failed packed add
(CVE-2026-97997)
- [amd64] iommu/amd: Do not reallocate GA log buffers on resume
(CVE-2026-98003)
- bpf: mark a NULL call argument precise (CVE-2026-98019)
- tracing: Fix subbuf resize races with trace_pipe_raw readers
(CVE-2026-98032)
- bpf: Preserve inner map identity in callback frames (CVE-2026-98033)
- bpf: Mark NULL kptr stores precise (CVE-2026-98034)
- bpf: Keep refcount_acquire nullable for borrowed RCU kptrs
(CVE-2026-98038)
- bpf: Don't infer non-NULL from a pointer with an unbounded offset
(CVE-2026-98043)
- bpf: Reject legacy packet loads from callbacks (CVE-2026-98044)
- bpf: Check ancestor frames for rbtree callbacks (CVE-2026-98047)
- bpf: don't rewrite bpf_fastcall patterns entered by a jump
(CVE-2026-98048)
- bpf: zero extend the result of an arena 32-bit cmpxchg (CVE-2026-98049)
- [amd64] ASoC: Intel: avs: Refactor and fix init_config access
(CVE-2026-98053)
- bpf: Mark syscall helpers as sleepable (CVE-2026-98058)
- bpf: Mark signal tracepoint siginfo arguments as scalar (CVE-2026-98062)
- erofs: disable LZ4 rolling decompression for now (CVE-2026-98067)
- net: rename netns_local to netns_immutable
- net: plumb extack in __dev_change_net_namespace()
- net: Remove conflicting altnames for dying netns in
__dev_change_net_namespace(). (CVE-2026-98073)
- btrfs: zstd: fix lost wakeup when waiting for a workspace
(CVE-2026-98079)
- bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks
(CVE-2026-98084)
- bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
(CVE-2026-98085)
- ipv6: mcast: use rcu_assign_pointer() for __rcu list updates
(CVE-2026-98099)
- smb/client: invalidate fscache for fallocate range operations
(CVE-2026-98124)
- net: stmmac: fix dma mapping leak in stmmac_tso_xmit() (CVE-2026-98131)
- bpf: check_cond_jmp_op(): properly infer if register is null
(CVE-2026-98134)
- printk: Don't WARN on kthread_run failure. (CVE-2026-98147)
- drm/gud: validate GUD_ROTATION_0 is present in supported rotations
(CVE-2026-98148)
- drm/virtio: Use drm_gem_plane_helper_prepare_fb()
- drm/virtio: Add a helper to map and note the dma addrs and lengths
- drm/virtio: use the DMA API for resource backing on Xen (CVE-2026-98156)
- functionfs: fix the open/removal races (CVE-2025-71074)
- ACPI: platform: Use acpi_bus_get_primary_device() (CVE-2026-100072)
- [amd64] KVM: nSVM: Triple fault if restore host CR3 fails on nested
#VMEXIT (CVE-2026-46032)
- greybus: raw: fix use-after-free if write is called after disconnect
(CVE-2026-53024)
- firmware: arm_ffa: Add support for IMPDEF value in the memory access
descriptor
- firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset
calculation (CVE-2026-68400)
- pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI
(CVE-2026-72009)
- cxl/region: Resolve region deletion races (CVE-2026-74272)
- bpf: Remove migrate_{disable|enable} in bpf_obj_free_fields()
- bpf: Clear rb node linkage when freeing bpf_rb_root (CVE-2026-74344)
- ocfs2: validate external xattr entries when reading metadata
(CVE-2026-90320)
- dm-integrity: replace forgeable discard filler with a keyed sector marker
(CVE-2026-90333)
- [amd64] perf/x86/intel/uncore: Fix uncore_box ref/unref ordering
(CVE-2026-93181)
- i3c: master: Fix recursive locking during device registration
(CVE-2026-93202)
- xfs: remove unused trace event xfs_dqreclaim_dirty
- ublk: fix dead loop when canceling io command
- riscv: uaccess: Only restore the CSR_STATUS SUM bit
- [s390x] kvm: Initialize uninitialized flags variable
- [s390x] KVM: s390: wrapper for KVM_BUG
- [s390x] KVM: s390: move pv gmap functions into kvm
- [s390x] KVM: s390: use __kvm_faultin_pfn()
- [s390x] KVM: s390: move gmap_shadow_pgt_lookup() into kvm
- [s390x] KVM: s390: pv: fix race when making a page secure
- [s390x] KVM: s390: Fix FOLL_*/FAULT_FLAG_* confusion
- [s390x] kvm: Mask extra bits from program interrupt code
- scsi: ufs: qcom : Fix NULL pointer dereference in ufs_qcom_setup_clocks
- accel/ivpu: Fix race condition when mapping dmabuf
- [amd64] KVM: SEV: Drop FOLL_WRITE for encrypted region registration
- net: Fix wild-memory-access in __register_pernet_operations() when
CONFIG_NET_NS=n.
- mpls: Set rt->rt_nhn just before returning from mpls_nh_build_multi().
- media: verisilicon: Fix kernel panic due to __initconst misuse
- soc/tegra: pmc: Document tegra_pmc.syscore field
- soc/tegra: pmc: Add kerneldoc for wake-up variables
- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring
- ceph: do not skip the first folio of the next object in writeback
- ceph: fix crash after fscrypt_encrypt_pagecache_blocks() error
- ceph: introduce ceph_submit_write() method
- ceph: always call ceph_shift_unused_folios_left()
- spi: microchip-core-qspi: stop checking viability of op->max_freq in
supports_op callback
- sched/psi: Create the psimon kthread outside of cgroup_mutex
- ocfs2: use correct endian in ocfs2_dinode_has_extents
- netfs: release readahead folios on iterator preparation failure
- netfs: Fix folio state after ENOMEM whilst under writeback iteration
- net: do not acquire dev->tx_global_lock in netdev_watchdog_up()
- [s390x] zcrypt: Fix memory leak with CCA cards used as accelerator
- EDAC/igen6: Fix the flood of invalid error reports
- netfilter: ctnetlink: do not expose expectation DEAD flag
- EDAC/igen6: Fix NULL pointer dereference
- Revert "esp: do not unref managed frag pages in esp_ssg_unref()"
- mm/hugetlb_vmemmap: fix incorrect vmemmap restore in rollback
- PM: sleep: Unblock runtime PM when device prepare fails
- soundwire: intel_auxdevice: Fix system suspend/resume handling
- gpiolib: Allow to use setters with return value for output-only gpios
- gpiolib: initialize return value in gpiochip_set_multiple()
- i3c: master: svc: Fix missed IBI after false SLVSTART on NPCM845
- i3c: master: svc: Fix npcm845 FIFO_EMPTY quirk
- i3c: master: svc: Fix i3c_master_get_free_addr return check
- tracing: Fix ring_buffer_read_page_size() kernel-doc
- tracing: Fix comment in tracing_buffers_splice_read()
- dm-integrity: fix buffer overflow with keyed discard
- bpf, sockmap: Account for receive queue in FIONREAD without a verdict
program
- wifi: atk9k: Revert "wifi: ath9k: reject short WMI command responses"
(Closes: #1151097)
- [s390x] uv: Don't return 0 from make_hva_secure() if the operation was
not
successful
- drm/panfrost: Fix scheduler workqueue bug
- ksmbd: fix heap out-of-bounds write in krb5_authenticate()
- [amd64] KVM: x86: Use active memslots for the per-vCPU MMIO cache
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.115
- rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup
- rose: disconnect orphaned STATE_2 sockets when device is gone
- rose: release netdev ref and destroy orphaned incoming sockets
- rose: clear neighbour pointer in rose_kill_by_device()
- rose: don't free fd-owned sockets when reaping in the heartbeat
- rose: keep the route needed for routing loop detection
- rose: guard rose_transmit_link() against a NULL neighbour
- rose: use timer_shutdown_sync() for t0timer teardown
- rose: don't warn on stray CALL_ACCEPTED/CLEAR_CONFIRMATION in state 3
- rose: hold a reference on incoming sockets queued for accept()
- ax25: bound REJ-driven fast retransmits with the existing N2 counter
- rose: purge rose_neigh->queue on final teardown
- mptcp: move the OoO check back into __mptcp_try_fallback()
- fat: stop reading directory entries past the end-of-directory marker
- [arm64,armhf] soc/tegra: fuse: Add missing newline to APBMISC error
message
- power: supply: Fix maintenance charge table kernel-doc
- power: supply: ds2780: Fix ds2780_get_capacity() returning raw value
- Drivers: hv: Avoid infinite retry loop in init_vp_index()
- [amd64] x86/hyperv: Avoid using per-cpu output page in
hv_apicid_to_vp_index()
- Drivers: hv: Don't reset VMBus connection state on error/exit paths
(CVE-2026-99216)
- pinctrl: qcom: ipq5018: add missing pwm3 function on gpio13
- tools/power turbostat: Fix fd_perf leak on reset
- tools/power turbostat: Fix add_counter issue if > 24 counters.
- power: supply: generic-adc-battery: Fix temperature IIO channel
conversion
- pinctrl: qcom: ipq5018: replace gcc_plltest with pwm2 on gpio12
- drm/vc4: hdmi: Move packet RAM enable to PM runtime (CVE-2026-99214)
- vsock: treat TCP_CLOSING as once-established (CVE-2026-99213)
- net/rds: don't let the rdma_cm destroy an id RDS still owns on route
failure (CVE-2026-99212)
- [amd64] ASoC: Intel: avs: Reset the stream unless it is already prepared
- [armhf] ASoC: stm32: spdifrx: fix synchronization state check
- regcache: Add ->populate() callback to separate from ->init()
- regcache: Do not overwrite error code when finalizing cache after error
- regmap: Drop map lock during cache init and exit
- netlink: reset skb headers before unicast and multicast filtering
(CVE-2026-99211)
- [arm64,armhf] spi: tegra114: assert CS GPIO for every transfer in a
message
- scsi: st: Save the visited block for the partition the drive is in
- scsi: target: iscsi: Fix race in discovery auth updates (CVE-2026-99206)
- ocfs2/dlm: Protect the recovery list during debugfs reads
(CVE-2026-99204)
- pipe: preserve existing fasync readers on writer setup failure
(CVE-2026-99203)
- tracing: probes: error if BTF is required but unavailable
- scsi: libsas: Fix SMP IO deadlock during HA resume (CVE-2026-99202)
- netlink: avoid hashing the network namespace pointer (CVE-2026-99201)
- net: bcmgenet: unshare the skb before writing the control block
(CVE-2026-99192)
- net/ipv6: Introduce payload_len helpers
- calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()
(CVE-2026-99191)
- gpiolib: fix memory leak in gpiod_set_array_value_complex() on error
paths
(CVE-2026-99190)
- gpio: mxc: use lock guards for the generic GPIO chip lock
- gpio: mxc: fix both_edges bit operations
- gpio: mxc: use BIT() macro
- gpio: mxc: fix wakeup_pads bit operations
- perf: Fix perf_pmu_migrate_context() leaving events behind
(CVE-2026-99187)
- printk: Postpone kthread startup
- PCI: Don't treat ~0 as ready in pci_dev_wait() with RRS SV
(Closes: #1112238)
- afs: free the super info after a grace period
- autofs: ignore notification errors from a replaced pipe (CVE-2026-99181)
- unicode: free the map after a grace period (CVE-2026-99180)
- [amd64] x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI
context (CVE-2026-99178)
- [amd64] KVM: nVMX: Reset MMU back to the root MMU if loading L2 state
fails for !VM-Entry (CVE-2026-99176)
- fsnotify: prevent mark additions during connector teardown
(CVE-2026-99175)
- pid_namespace: make zap_pid_ns_processes() freezable
- eventfs: Free the eventfs_inode after an rcu grace period too
(CVE-2026-99173)
- namei: test for a negative dentry the way traverse_mounts() does
- net/sched: fix use-after-free in __tcf_action_put() (CVE-2026-99167)
- net: rds: fix uninitialized trans dereference in CM event handler
(CVE-2026-99166)
- pinctrl: amd: Clear S4 wake bits when firmware has _AEI
- sctp: revalidate output stream after association connect wait
(CVE-2026-99165)
- tools: gpio: fix building from the top level with O=
- tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace
fields (CVE-2026-99163)
- i2c: qcom-cci: Fix HALT_ACK reset request being dropped
- perf: Update cgroup time when rotating multiplexed events
- ring-buffer: Do not show buffer_meta for CPUs without a buffer
(CVE-2026-99160)
- ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()
(CVE-2026-99159)
- ring-buffer: Fix false warning in ring_buffer_map_get_reader()
(CVE-2026-99158)
- scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies
(CVE-2026-99157)
- scsi: xen/scsifront: Check for a NULL shadow entry on a backend response
(CVE-2026-99155)
- scsi: libiscsi: Reject a negative task index from parse_pdu_itt
(CVE-2026-99154)
- scsi: libiscsi: Validate the ITT reflected in a Reject PDU
(CVE-2026-99153)
- scsi: libiscsi: Validate the task named by a management response
(CVE-2026-99152)
- drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang
- drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr
(CVE-2026-99150)
- drm/exec: don't immediately add prelocked obj to array of locked objs
(CVE-2026-99147)
- tracing: Fix the shift out of bounds in the log2 histogram modifier
- tracing: Take trace_types_lock when dropping the buffer_meta reference
- tracing: Check operator stack capacity before pushing (CVE-2026-99142)
- tracing: Do not initialize tracefs work if tracing is disabled
- tracing: Fix hist trigger timestamps for buffered events (CVE-2026-99140)
- wifi: p54: validate firmware record lengths (CVE-2026-99100)
- tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)
(CVE-2026-99139)
- tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)
(CVE-2026-99138)
- cgroup: fix spurious SIGKILL of CLONE_INTO_CGROUP children
- dm cache: fix demotion stats in passthrough mode
- dm cache: fix issue with background work locking
- dm-crypt: fix a tiny race condition in crypt_dec_pending (CVE-2026-99136)
- dm-ebs: fix incorrect device offset check in ebs_ctr()
- dm-integrity: fix infinite loop on discard with large tag size
(CVE-2026-99135)
- dm-integrity: require stable writes for internal hash modes
- mac802154: fix data race and NULL deref on local->assoc_dev
(CVE-2026-99134)
- net/iucv: fix the recvmsg window update (CVE-2026-99133)
- xfs: fix capability check in xfs (CVE-2026-99131)
- workqueue: Use raise_softirq() to trigger softirq in irq_work handler
- tipc: protect node reset trace dump with node lock
- sctp: validate chunk length in the inqueue parser (CVE-2026-99128)
- page_pool: keep frag_offset aligned for odd-sized requests
(CVE-2026-99127)
- [s390x] ctcm: Prevent XID null dereference (CVE-2026-99126)
- [s390x] pci: Fix leak of uninitialized kernel data in SCLP report
(CVE-2026-99124)
- ipv4: avoid divide by zero in fib_rebalance (CVE-2026-99121)
- drm/amdgpu: Fix VCE 3 ring align_mask
- mm, madvise: fix potential workingset node list_lru leaks
(Closes: #1151281)
- mm/huge_memory: initialise workingset state before folio split
- [s390x] Revert "s390/mm: Add missing secure storage access fixups for
donated memory"
- netfilter: nft_byteorder: remove multi-register support
- mm/huge_memory: bypass THP tuneables for huge pfnmap mappings
- [amd64] KVM: x86/mmu: Preserve nested TDP shadow page tables if they are
used as roots
- net: bridge: mcast: don't truncate the port group walk on teardown
(CVE-2026-99117)
- ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION (CVE-2026-99115)
- ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION
(CVE-2026-99114)
- ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in
(CVE-2026-99113)
- net/sched: cls_flower: validate mask pointer after nla_next()
(CVE-2026-99112)
- smb: client: fix heap overflow in cifs_do_set_acl() (CVE-2026-99110)
- smb: client: fix multiuser mount with krb5
- scsi: st: Fix use-after-free race between st_remove() and st_open()
(CVE-2026-99156)
- perf: Track the perf mlock gift separately
- eventfs: fix SRCU read lock leak in eventfs_iterate()
- net: call getsockopt_iter if available
- kernel/watch_queue: Use pipe_buf() to retrieve the pipe buffer
- watch_queue: Fix note pool publication race in watch_queue_set_size()
(CVE-2026-99179)
- ntfs3: free the sbi after a grace period (CVE-2026-99171)
- ext4: free the sbi after a grace period (CVE-2026-99174)
- [amd64] ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated
ALH capture (CVE-2026-99182)
- drm/xe: Bump LRU for external objects on exec and rebind
- tracing: Keep the predicate limit separate from program capacity
(CVE-2026-99143)
- io_uring/cancel: don't spin on local work the task can't run
(CVE-2026-99130)
- virtio: set skb owner of virtio_transport_reset_no_sock() reply
- vsock/virtio: validate packet source for connected sockets
(CVE-2026-99123)
- ipv4: udp: Create exceptions before socket matching (CVE-2026-99077)
- workqueue: release pwq pools by pool type
- workqueue: Fix unbound pool lifetime for pending pwqs (CVE-2026-99103)
- i2c: viai2c-wmt: Replace dev_err() with dev_err_probe() in probe function
- i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe() (CVE-2026-99161)
- futex: Fix mm reuse handling for FUT_OFF_MMSHARED (CVE-2026-99169)
- [amd64] drm/i915/dmc: Harden DMC firmware payload parsing
(CVE-2026-99118)
- tracing: Fix ignored return value of resize_buffer_duplicate_size()
- drm/amdgpu: free the userptr ranges when a CS fails after parser_bos
(CVE-2026-99106)
- sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on
its CPU's local DSQ (CVE-2026-99105)
- cifs: add revalidation on FSCTL failure in smb2_duplicate_extents()
- xfs: don't hold buffer locks across sync transaction commit in
xfs_sync_sb_buf (CVE-2026-99132)
- rose: clear stale N(R)/N(S) before (re)transmitting a data frame
- netrom: linearize and validate lengths in nr_rx_frame()
- netrom: require full NET/ROM headers in nr_route_frame()
- net: netrom: validate source address in nr_find_socket()
- netrom: bound fragment reassembly in nr_queue_rx_frame()
- ax25: fix OOB read after address header strip in ax25_rcv()
- ax25: check frame length in ax25_decode() and ax25_rx_iframe()
- net: ax25: fix integer overflow in ax25_rx_fragment()
- netrom: use a single lock for the node and neighbour lists
- netrom: look up and update routes in one critical section
- netrom: fix reference count leak in nr_rt_device_down
- netrom: clear nr_neigh->ax25 under the routing lock in nr_link_failed()
- netrom: fix nr_node leak when nr_del_node() removes the last route
- rose: clear through routes when a neighbour is removed from the tables
- rose: restart the link of a neighbour created over a live AX.25
connection
- ax25: serialise the transmission of I frames on a connection
- rose: process received frames and send with the socket locked
- ax25: don't create two connections for the same link in ax25_send_frame()
- ax25: read the connection's ax25_dev only once when walking ax25_list
- ax25: wait for ax25_send_frame() before detaching the connections of a
device
- ax25: don't accept frames on a device that is going down
- ax25: send a private copy of each I frame
- rose: clear the circuits of a neighbour that restarts the link
- ax25: send unacknowledged I frames again when a link is re-established
- rose: bring up the link of the preferred route passed over by a connect
request
- ax25: don't free an incoming SABM skb left on the listener's queue
- mm/pagewalk: fix stale walk->action escaping walk_pmd_range()
- block: avoid potential deadlock on zone revalidation failure
- Revert "srcu: Use irq_work to start GP in tiny SRCU"
- net_sched: codel: fix stale state for empty flows in fq_codel
- Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn
- tracing: Reject incomplete event filter expressions
- tracing: Save the event file instead of the compatible histogram
- tracing: Unregister field variable histograms when the command fails
- tracing: Fix 64-bit and signed histogram fields on 32-bit kernels
- tracing/histograms: Verify event_call identity when updating synth_event
refcount
- io-wq: order the exit bit against worker creation task work
- io_uring/waitid: own the request before clearing ->head
- io_uring/cmd: don't leave list poison in ->hash_node
- io_uring/wait: don't spin on a stuck overflow list
- io_uring/io-wq: don't lose the signal that ends work
- io_uring/io-wq: don't hide a link from cancellations
- io_uring: don't flood a cancelling task with task_work
- io_uring/io-wq: don't strand work when a worker exits
- io_uring/io-wq: don't exit with a creation pending
- io_uring/io-wq: let cancel find picked up hashed work
- io_uring/poll: don't lose a cancel as io-wq arms poll
- io_uring: don't lose a cancel as io-wq parks a request
- io_uring/cancel: don't forget that the work was running
- io_uring/cancel: recognize "no timeout" on 32-bit
- io_uring/cancel: let CANCEL_ALL find parked requests
- io_uring: wake ring pollers for local task_work
- io_uring/wait: look at all CQ waiters on wake up
- io_uring/poll: drop stale double poll entry on rearm
- io_uring/timeout: don't skip over reached sequences
- io_uring/timeout: keep repeat count on multishot update
- io_uring/wait: no early -ETIME if min_wait finds work
- io_uring/napi: make stale entries time out after 60s
- io_uring/napi: don't busy poll past an expired timeout
- io_uring/kbuf: handle index wrap in last buffer check
- io_uring/sqpoll: let the thread sleep on disabled rings
- io_uring: don't pass restart error codes to userspace
- io_uring/net: don't retry recv on uncommitted buffers
- io_uring/timeout: no ABS update of multishot timeouts
- io_uring/timeout: don't end a linked timeout with 1
- io_uring: look up the file before queueing to io-wq
- io_uring/poll: avoid retry wakeup loss when dropping ownership
- io_uring/timeout: don't put a sequence target behind the last flush
- io_uring/timeout: don't flush with the sequence behind the last flush
- io_uring/timeout: don't lose a cancel as io-wq arms a timeout
- io_uring/poll: don't loop on HUP with multiple references
- io_uring/net: keep recv buffer select length within MAX_RW_COUNT
- io_uring/wait: wake real-time waiters from hard interrupt context
- io_uring/waitid: prevent cancel reference wrap
- keys: Avoid the owner account dereference in named keyring lookup
- keys: Check the authorization payload in process keyring searches
- keys: Protect the type name while describing a key
- keys: make keyring indexes independent of kernel addresses
- keys: Protect the read method check against type removal
- KEYS: Fix key_reject_and_link() race with keyring restriction
- KEYS: trusted: Fix blob allocation size in tpm2_key_decode()
- keys/trusted_keys: return immediately after TPM unseal failure
- asymmetric_keys: reject trust keys without IDs
- ftrace: Initialize modname and offset in print_rec()
- coredump: hold RCU while releasing parked threads
- signal: don't retarget shared signals in a dying thread group
- signal: only SIGKILL and the freezers interrupt a coredumping task
- ptrace: refuse to change the signal mask of a user worker
- fork: release the files of a failed fork after sched_cancel_fork()
- signal: allow taks to temporarily block TIF_NOTIFY_SIGNAL
- pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
.
[ Salvatore Bonaccorso ]
* net: skbuff: propagate shared-frag marker in skb_zerocopy()
Checksums-Sha1:
d0d8e5faa99b328f43d45a7d1c857b3687c3425b 290418 linux_6.12.115-1.dsc
02528e4e7d8126b880cec2c89e86447785289eaa 151676884 linux_6.12.115.orig.tar.xz
4bc10f6ef66d535fe4e80d9fa70d5bac722871ee 1975748 linux_6.12.115-1.debian.tar.xz
9506317fe7a88dc389cb5603b235861c5ff3c788 6025 linux_6.12.115-1_source.buildinfo
Checksums-Sha256:
88cb3f116bba951bfc3786419d7eb720ff63dfe5978234ebe5db19f0b72fefb6 290418
linux_6.12.115-1.dsc
eaccd6c987f438de08039859df5507600a31245bb041ca62f2ef3fd30bd2172d 151676884
linux_6.12.115.orig.tar.xz
da0983b129749db052011c073cca26eaa71c6344a5e3e610d0611743e7fbf1cb 1975748
linux_6.12.115-1.debian.tar.xz
2c931abfb8d21629b836990d51355820f8b6d81e202582e6bfa7c979642b95c2 6025
linux_6.12.115-1_source.buildinfo
Files:
d46ae1ec2e35bbcc9785a669a5c9e965 290418 kernel optional linux_6.12.115-1.dsc
7d3010cfdb5536a721a6454314852c6b 151676884 kernel optional
linux_6.12.115.orig.tar.xz
f1e32176c3ccb5f43e0da05779cd7e59 1975748 kernel optional
linux_6.12.115-1.debian.tar.xz
1b33191cb509647e251ed6004d7eb469 6025 kernel optional
linux_6.12.115-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrmAOdfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89E8o0P/2iU8lF+/31Zz03v8XLtuTscX5bcH5PZ
IVxOBGOd7LV3wqxERjF6x7gwhZcBCnYI/34UnaDLQaEv8IZiqLdteMIsxzv+BGKL
TJq6JRVacrJc3mMQEY/K8I0/lwxLEmbaCgh6A2Cx1SkjeRB92R7InH8sNsBmChbg
rBr9xNDgbCqf+GuFFj5aVt8FPubcUtkewlZA/wAvuZWE9u+irb96TussPz1gJXnX
MDNX+5uBJvUDRWsSUu8O0eqUgk1gsZbYnWz4kk0iksDkes0OsM2mf/6xeelUehe8
GBG1ab77tvaMf1g2WsYiy4snt4ywbd6i1ebQ9Xu2BjuoRpmWs/T2x0TktcxS/F1g
9R6c2FYdxiQS3YmmTSdig1IDDG2HSsGYzJMIAmA6LpzR8tYkj5Vl3by55fA8KxeV
thWN/xz0+AFSz6GWqGftgfHr/PGcsUFsk1PXFgLyI1R79D+ze9FoRWd9mkIqYlJQ
o+9sBR7fqFumD3YMmFbAOeTppyepx5efb2kurORhlGqvsoqiRORHVDwb6VXIeVVE
ufEYHrvmFseMevnkp9NdxSh8W9hxPd0qyWjc+H+s2ejxWi/Wt1ACuFZS4s1cHc/o
ZRWI9LvopcONd8FYA8bxEn9Ol7sicvJSrIFkCWgsEJ+Z6LOS9ePrJAF6xYqGM3Rc
/1FPFZcDwcWv
=4qvr
-----END PGP SIGNATURE-----
pgp449DSa_qbC.pgp
Description: PGP signature
--- End Message ---
