Daily update · Aug 6–7, 2026
Linux mainline: XFS and SELinux hardening, btrfs fixes, networking and hardware updates
A daily roundup of notable kernel patches, including memory-safety fixes, filesystem reliability improvements, and hardware driver updates.
In brief
Today's mainline patches close several memory-corruption and use-after-free paths in XFS, SELinux, BPF, and network packet handling. Filesystem updates improve btrfs and XFS reliability, while driver fixes cover KVM, Ethernet, and laptop audio.
Security & hardening
XFS log-recovery heap overflow fixed
XFS now bounds-checks the dirty-region bitmap of buffer log items before replaying them at mount time, preventing a crafted filesystem image from driving memcpy() past the buffer allocation.
Why it matters: Mounting untrusted XFS images can no longer corrupt kernel heap memory, closing a potential local privilege-escalation or denial-of-service vector.
x86 Safe-RET mitigation can't be bypassed by interrupts
On AMD systems affected by SRSO, an interrupt arriving during the Safe-RET sequence could neutralize the mitigation. Interrupt entry now emulates a successful Safe-RET state and avoids executing a RET afterward.
Why it matters: AMD systems remain protected against SRSO/Spectre-v2 side-channel attacks even when interrupts arrive during the mitigation sequence.
SELinux rejects malformed policy images instead of corrupting memory
Multiple policy-loading paths now validate permission counts, inherited commons, sparse tables, and conversion state before use, and a failed load no longer dereferences an unconverted old policy.
Why it matters: Crafted or malformed SELinux policies can no longer cause out-of-bounds heap writes, NULL-pointer crashes, or a stuck policy reload.
d14b5d0e97fc9a82dcd98b6ee5c0235a3c4eb98a8ac5077522b05fec62c0a93d37a09b86
IPv6 Router Advertisement route option validation fixed
Two off-by-one checks allowed a short Route Information option to pass validation and then copy up to 8 bytes beyond the option. The length checks now match RFC 4191.
Why it matters: IPv6 hosts are protected from malformed Router Advertisements triggering an out-of-bounds read.
IPVS NAT ICMP handling hardened against concurrent header changes
The IPv4 IHL is now read once and the validated transport-header length is used, preventing an out-of-bounds write if a local attacker changes packet headers while IPVS processes them.
Why it matters: Prevents memory corruption on systems using IPVS load balancing.
BPF sockmap send-verdict use-after-free fixed
A cached socket reference could be consumed by one sendmsg while another thread still used a raw pointer to the same socket. The race is now closed.
Why it matters: Prevents kernel crashes or memory corruption in BPF sockmap redirection paths.
Packet socket transmit path hardened against out-of-bounds access
Protocol-bound PACKET_QDISC_BYPASS frames now get a valid skb->mac_header, and packet send paths snapshot dev->hard_header_len so concurrent device reconfiguration can't make headroom too small. The CAP_SYS_RAWIO zero-padding path was also removed.
Why it matters: Closes multiple out-of-bounds read/write paths in AF_PACKET transmit, including a ~64 KiB read past the skb head.
ksmbd SMB compression receive validation tightened
ksmbd now rejects unnegotiated Pattern_V1 payloads, validates compression flags before allocating decompression buffers, and applies the pre-authentication PDU limit when decompressing requests.
Why it matters: Protects ksmbd SMB shares from unauthenticated clients causing oversized allocations or invalid compression modes.
Filesystems
btrfs fixes race between mmap and direct I/O reads
A folio could stay clean after btrfs wrote it back during direct I/O reads, skipping the needed copy-on-write fixup. The code now calls dirty_folio() when appropriate.
Why it matters: Prevents a rare data-integrity issue for btrfs users mixing mmap and direct I/O on the same file.
btrfs disables large folios on highmem 32-bit systems
Large folio support is disabled for btrfs on highmem systems because zstd compression could trigger page faults and crash on 32-bit i686 kernels.
Why it matters: Prevents crashes for 32-bit btrfs users, especially those using zstd compression.
btrfs unmount race with CoW fixup workers fixed
close_ctree() now explicitly flushes fixup workers before freeing the cleaner kthread and fs roots.
Why it matters: Avoids possible crashes during unmount after writeback-induced CoW fixups.
XFS exchange-range no longer clears reflink flag incorrectly
Skipped mappings during an exchange-range operation could clear the reflink flag from an inode that still owns shared written extents.
Why it matters: Prevents potential data corruption on XFS filesystems using reflink or exchange-range operations.
XFS log recovery rejects corrupt dquot records
An error path that discarded dquot verification failures has been fixed, so corrupt quota records can no longer be treated as valid and written back.
Why it matters: Prevents quota corruption from being persisted after XFS log recovery.
XFS online repair hardened against corrupt metadata
Several xfs_scrub repair issues are fixed, including livelock on circular unlinked lists, double-locking on self-referential directories, a use-after-free in tempfile creation, and overly strict parent-pointer checks.
Why it matters: Makes XFS online repair safer and less likely to hang or crash while fixing corrupted filesystems.
Networking
Bonding ALB monitor race fixed
bond_alb_monitor() could act on stale promiscuity state after the active slave changed; it now re-checks state under RTNL.
Why it matters: Prevents bonding crashes and network interfaces being stuck in promiscuous mode during failover or slave removal.
UDP tunnel segmentation use-after-free fixed
__skb_udp_tunnel_segment() now fetches the UDP header after the pull that can reallocate skb->head, so the saved pointer cannot go stale.
Why it matters: Avoids a potential use-after-free in VXLAN/GENEVE UDP tunnel segmentation.
AF_XDP TX metadata handling hardened
AF_XDP now requires at least 16 bytes of TX metadata, validates launch-time metadata size and flags, and snapshots flags to stop user-space races.
Why it matters: Protects high-performance AF_XDP applications from malformed or concurrently changed TX metadata.
kTLS send path no longer oopses on full plaintext records
When a TLS socket's plaintext record ring became full but wasn't pushed, a subsequent splice could wrap the ring and cause a NULL pointer dereference in scatterwalk code.
Why it matters: Fixes a local crash path in kTLS over loopback TCP sockets.
TLS 1.3 receive retry no longer corrupts data
Optimistic zero-copy decryption now restores msg_iter before falling back to a retry, so retried records are written at the correct position in the user buffer.
Why it matters: kTLS 1.3 receivers no longer see corrupted data from retried records.
Thunderbolt networking regression on ASMedia hosts reverted
End-to-end flow control on the Thunderbolt transmit ring caused a hang on ASMedia ASM4242 USB4 host routers because they never deliver the required credits.
Why it matters: Restores Thunderbolt networking on affected USB4 hardware.
Hardware & drivers
AMD KVM TLB flush fix prevents Windows guest corruption
With nested page tables enabled, SVM's guest-virtual-address TLB flush was insufficient for Hyper-V TLB flush requests; the fix forces a full ASID flush on AMD.
Why it matters: Fixes rare Windows BSODs and memory corruption in AMD-hosted KVM VMs with Hyper-V enlightenments.
mlx5e BQL reset crash fixed
mlx5e_queue_start() could reset BQL counters for channels with in-flight TX WQEs, causing a kernel BUG in dql_completed(). It now only resets when no bytes are in flight.
Why it matters: Prevents kernel panics during channel reconfiguration on Mellanox/BlueField Ethernet controllers.
Broadcom NIC receive-data corruption prevented
On older Broadcom chips, EOP padding on AGG rings could overwrite the next segment's data when Relaxed Ordering is enabled. TPA now disables EOP.
Why it matters: Prevents silent receive-data corruption on affected Broadcom adapters, especially on ARM systems.
Intel igc NICs usable again after resume when interface was down
igc's resume path only re-attached the netdev when the interface was running; now it re-attaches unconditionally.
Why it matters: Users with Intel I225/I226 2.5GbE NICs no longer need to reload the driver after suspend/resume when Wake-on-LAN is disabled.
stmmac MTU change hang fixed on PHYs that stop RX clock
__stmmac_open() now resumes the PHY before performing the DMA software reset; some PHYs stop their receive clock while powered down, making the reset time out.
Why it matters: Boards using stmmac Ethernet (such as RK3566 with RTL8211F) can change MTU without hanging the interface.
Laptop audio quirks add working microphones
DMI quirks enable the ACP6x sound card on HP Victus 16-e1xxx, Xiaomi RedmiBook 16, and MSI Raider A18 HX laptops.
Why it matters: Owners of these 2025 AMD laptops get a working internal microphone on Linux.
Thermal hwmon sysfs compatibility restored
Reverts two changes that registered a separate hwmon device for each thermal zone and altered sysfs layout, breaking user-space thermal monitoring tools.
Why it matters: Existing thermal monitoring scripts and tools keep working with the familiar hwmon device names and paths.
Performance
SELinux SysV IPC performance regression fixed
Expensive MLS level-category validation is now done once at policy load time instead of on every access check.
Why it matters: Reverses an 89-94% throughput regression in msgsnd/msgrcv for SELinux users.
TCP receive threshold no longer shrinks when window scaling changes
The receive-MSS measurement path now updates the window clamp without trimming rcv_ssthresh, avoiding repeated cuts from oscillating scaling ratios.
Why it matters: Network connections with varying segment sizes should see more stable receive performance.
XFS read-ahead sized using realtime device limits
XFS now configures I/O and read-ahead sizes using the realtime device's limits instead of only the main device's.
Why it matters: Improves read performance by up to 5% on XFS setups using separate metadata and realtime devices.
Source commits252 entries +
x86/bugs: Make Safe-RET robust against interrupt injection
Borislav Petkov (AMD) · Jun 3, 2026 · 4 files
xfs: propagate errors from xfs_rtginode_load
Guanghui Yang · Jul 12, 2026 · 1 files
KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
Sean Christopherson · Jul 13, 2026 · 1 files
xfs: fix off-by-one in rtrefcount btree root level validation
Xiang Mei · Jul 14, 2026 · 1 files
xfs: bounds-check buffer log item's dirty bitmap
Ibrahim Hashimov · Jul 15, 2026 · 1 files
btrfs: lzo: reject inline extents without valid headers
David Lee · Jul 15, 2026 · 1 files
xfs: clear zapped attr fork state when bmap repair finds no attr fork
Qiang Ma · Jul 16, 2026 · 1 files
xfs: handle NULL b_addr in xfs_buf_free
Yun Zhou · Jul 19, 2026 · 1 files
bpf, sockmap: Fix sk_redir use-after-free in send verdict
Chengfeng Ye · Jul 19, 2026 · 1 files
btrfs: disable large folios for systems with highmem
Qu Wenruo · Jul 20, 2026 · 1 files
xfs: update BDI {io,ra}_pages values based on the RT device limits
Christoph Hellwig · Jul 20, 2026 · 2 files
xfs: check cowextsize in xrep_inode_cowextsize
Darrick J. Wong · Jul 21, 2026 · 1 files
xfs: fix transaction block reservation in xrep_rtbitmap
Darrick J. Wong · Jul 21, 2026 · 1 files
xfs: rtsummary scrub should treat rtbitmap corruption errors as an xref error
Darrick J. Wong · Jul 21, 2026 · 1 files
xfs: zero i_nlink before repair puts inode on unlinked list
Darrick J. Wong · Jul 21, 2026 · 1 files
xfs: mark nonzero sb_gquotino as corrupt on metadir filesystems
Darrick J. Wong · Jul 21, 2026 · 1 files
ovpn: limit keepalive values to one day
Marco Baffo · Jul 22, 2026 · 2 files
xfs: fix inverted clearance of inode junk flags
Andrey Albershteyn · Jul 22, 2026 · 1 files
mm/page_table_check: skip special zero mappings
Zhiling Zou · Jul 22, 2026 · 1 files
KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled
Paolo Bonzini · Jul 23, 2026 · 7 files
mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
Lorenzo Stoakes (ARM) · Jul 23, 2026 · 3 files
mm/ptdump: always stabilise against page table freeing using init_mm
Lorenzo Stoakes (ARM) · Jul 23, 2026 · 2 files
arm64: remove redundant concurrent ptdump UAF mitigation
Lorenzo Stoakes (ARM) · Jul 23, 2026 · 4 files
ovpn: fix incorrect use of rcu_access_pointer()
Qingfang Deng · Jul 24, 2026 · 1 files
net: hns3: fix speed configuration residue after driver reload
Jijie Shao · Jul 24, 2026 · 1 files
net/packet: reset the MAC header on the packet-socket transmit path
Doruk Tan Ozturk · Jul 24, 2026 · 1 files
tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss()
Nathan Gao · Jul 25, 2026 · 1 files
mm/huge_memory: initialise workingset state before folio split
Matt Fleming · Jul 25, 2026 · 1 files
bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
Xiang Mei (Microsoft) · Jul 25, 2026 · 1 files
mm/damon/ops-common: putback folios on invalid migrate nid
liyouhong · Jul 26, 2026 · 1 files
net/x25: fix use-after-free of the socket by its timers
Baul Lee · Jul 26, 2026 · 2 files
xfs: fix ilock leak on error in xfs_dq_get_next_id
Long Li · Jul 27, 2026 · 1 files
xfs: don't swallow dquot recovery verification errors
Long Li · Jul 27, 2026 · 1 files
xfs: only check mergeability of bnobt records
Darrick J. Wong · Jul 27, 2026 · 1 files
xfs: don't double-lock when deleting a self-referential directory
Darrick J. Wong · Jul 27, 2026 · 1 files
xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers
Darrick J. Wong · Jul 27, 2026 · 1 files
xfs: don't zap the attr fork on repair when there are queued pptr updates
Darrick J. Wong · Jul 27, 2026 · 1 files
xfs: nlink scrub must take IOLOCK before determining ILOCK state
Darrick J. Wong · Jul 27, 2026 · 1 files
xfs: avoid UAF on sc->tempip in xrep_tempfile_create
Darrick J. Wong · Jul 27, 2026 · 1 files
xfs: hoist per-bucket unlinked list check to helper
Darrick J. Wong · Jul 27, 2026 · 1 files
xfs: don't livelock in scrub on a circular unlinked list
Darrick J. Wong · Jul 27, 2026 · 2 files
xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair
Darrick J. Wong · Jul 27, 2026 · 1 files
xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev
Darrick J. Wong · Jul 27, 2026 · 1 files
xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers
Darrick J. Wong · Jul 27, 2026 · 1 files
xfs: check xfarray iteration errors when committing unlinked inode lists
Darrick J. Wong · Jul 27, 2026 · 1 files
xfs: fix allocated inodes that show up in the unlinked list
Darrick J. Wong · Jul 27, 2026 · 2 files
xfs: fix another iunlink infinite loop bug in online fsck
Darrick J. Wong · Jul 27, 2026 · 2 files
xfs: set the prev pointer when reinserting an inode on the unlinked list
Darrick J. Wong · Jul 27, 2026 · 1 files
xfs: don't ignore runtime errors in xrep_iunlink_reload_next
Darrick J. Wong · Jul 27, 2026 · 1 files
net: devmem: prevent net-iov / page mixing
Pavel Begunkov · Jul 27, 2026 · 1 files
btrfs: fix memory leak in btrfs_do_encoded_write()
Dmitry Antipov · Jul 27, 2026 · 1 files
Revert "net: thunderbolt: Enable end-to-end flow control also in transmit"
Fan Ye · Jul 27, 2026 · 1 files
xsk: require at least 16 bytes of TX metadata
Stanislav Fomichev · Jul 27, 2026 · 1 files
xsk: pass TX metadata pointer by reference
Stanislav Fomichev · Jul 27, 2026 · 8 files
xsk: clear metadata pointer when no timestamp is requested
Stanislav Fomichev · Jul 27, 2026 · 2 files
xsk: validate launch-time metadata size
Stanislav Fomichev · Jul 27, 2026 · 2 files
xsk: move xsk_tx_metadata_request() to xdp_sock_drv.h
Stanislav Fomichev · Jul 27, 2026 · 2 files
xsk: validate metadata when processing requests
Stanislav Fomichev · Jul 27, 2026 · 6 files
pds_core: keep the health thread stopped during reset
Nikhil P. Rao · Jul 27, 2026 · 2 files
pds_core: cancel pending PCI reset work on AER recovery
Nikhil P. Rao · Jul 27, 2026 · 1 files
inet: frags: publish queues before arming timer
Zhiling Zou · Jul 27, 2026 · 1 files
microblaze: restore the page alignment of swapper_pg_dir
Ramin Moussavi · Jul 27, 2026 · 1 files
btrfs: trigger cow fixup via dirty_folio()
Boris Burkov · Jul 27, 2026 · 8 files
selinux: reject a permission value exceeding the class permission count
Bryam Vargas · Jul 28, 2026 · 1 files
selinux: reject a class permission count below its inherited common
Bryam Vargas · Jul 28, 2026 · 1 files
s390/vfio_ccw: Free all memory if cp_init() fails
Eric Farman · Jul 28, 2026 · 1 files
s390/vfio_ccw: Limit the number of channel program segments
Eric Farman · Jul 28, 2026 · 2 files
s390/vfio_ccw: Fix out of bounds check on CCW array
Eric Farman · Jul 28, 2026 · 1 files
s390/vfio_ccw: Ensure first IDAW remains constant
Eric Farman · Jul 28, 2026 · 2 files
s390/vfio_ccw: Calculate idal length based on idaw type
Eric Farman · Jul 28, 2026 · 1 files
s390/vfio_ccw: Ensure index for read/write regions are within range
Eric Farman · Jul 28, 2026 · 3 files
s390/vfio_ccw: Cancel existing workqueues
Eric Farman · Jul 28, 2026 · 1 files
s390/vfio_ccw: Move cp cleanup out of not operational
Eric Farman · Jul 28, 2026 · 4 files
s390/vfio_ccw: Selectively expand io_mutex
Eric Farman · Jul 28, 2026 · 5 files
s390/vfio_ccw: Implement a crw lock
Eric Farman · Jul 28, 2026 · 4 files
net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock
Shay Drory · Jul 28, 2026 · 2 files
mm/filemap: __filemap_add_folio() restore index before retrying
Hugh Dickins · Jul 28, 2026 · 1 files
enic: fix tx_hang_reset use-after-free on device removal
Satish Kharat · Jul 28, 2026 · 1 files
xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN
Lin Jiapeng · Jul 28, 2026 · 1 files
net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
Jiawen Liu · Jul 28, 2026 · 1 files
ovpn: skip rehash for peers already removed from by_id
Antonio Quartulli · Jul 28, 2026 · 1 files
ovpn: rehash peer in by_transp_addr table on CMD_PEER_SET
Antonio Quartulli · Jul 28, 2026 · 3 files
ovpn: ensure socket is owned by ovpn before deref sk_user_data
Antonio Quartulli · Jul 28, 2026 · 1 files
ovpn: zero-initialize sockaddr before learning a floated endpoint
Antonio Quartulli · Jul 28, 2026 · 1 files
ovpn: hash floated peer by transport identity only
Antonio Quartulli · Jul 28, 2026 · 1 files
ovpn: disable IPv4 redirects on MP interfaces
Antonio Quartulli · Jul 28, 2026 · 1 files
ovpn: ensure TCP vars are initialized first
Antonio Quartulli · Jul 28, 2026 · 1 files
mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD}
SJ Park · Jul 28, 2026 · 3 files
net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
Yi Cong · Jul 29, 2026 · 1 files
net/mlx5: SF, Handle function changed event
Chris Mi · Jul 29, 2026 · 5 files
net/mlx5: fw_tracer, return NULL on create error
Michael Guralnik · Jul 29, 2026 · 1 files
devlink: fix net namespace reference leak in reload
Or Har-Toov · Jul 29, 2026 · 1 files
packet: synchronize pressure clearing with ring reconfiguration
Zihan Xi · Jul 29, 2026 · 1 files
net/sched: cls_route: fix fastmap use-after-free on filter
Jamal Hadi Salim · Jul 29, 2026 · 1 files
MAINTAINERS: update address for Brendan Jackman
Brendan Jackman · Jul 29, 2026 · 2 files
xfs: check v5 superblock features early
Christoph Hellwig · Jul 29, 2026 · 1 files
net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
Mahanta Jambigi · Jul 29, 2026 · 1 files
xfs: add a separate bio_set for spliting GC writes
Christoph Hellwig · Jul 29, 2026 · 1 files
xfs: add a comment to describe xfs_gc_bio.victim_rtg
Christoph Hellwig · Jul 29, 2026 · 1 files
net: bridge: mrp: fix uninitialised bytes on the wire
Baul Lee · Jul 29, 2026 · 1 files
ovpn: add missing rtnl_link_ops->get_size callback
Ralf Lici · Jul 29, 2026 · 1 files
ipvs: stop estimator after disabled calc phase
Zhiling Zou · Jul 29, 2026 · 1 files
bpf: Simplify sanitize_err() signature
Eduard Zingerman · Jul 29, 2026 · 1 files
bpf: Preserve pointer state for commuted arithmetic
Yiyang Chen · Jul 29, 2026 · 1 files
bpf: Propagate untrusted pointer state in commuted arithmetic
Yiyang Chen · Jul 29, 2026 · 1 files
selftests/bpf: Cover commuted pointer state propagation
Yiyang Chen · Jul 29, 2026 · 3 files
sctp: keep chunk->transport in step with the list it is queued on
Baul Lee · Jul 29, 2026 · 1 files
netfilter: ebt_nflog: pin the NFLOG backend
Chengfeng Ye · Jul 29, 2026 · 1 files
net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
Toke Høiland-Jørgensen · Jul 29, 2026 · 1 files
vsock/virtio: read virtqueues under worker locks
Weiming Shi · Jul 29, 2026 · 1 files
vsock/virtio: avoid refilling the RX queue after teardown
Weiming Shi · Jul 29, 2026 · 1 files
bnxt: fix memory leak in bnxt_queue_mem_alloc error cases
Will Chen · Jul 29, 2026 · 1 files
ASoC/soundwire: Intel: reset the PCMSyCM registers in hda_sdw_bpt_close
Bard Liao · Jul 30, 2026 · 3 files
ipv6: fix Route Information option length validation
Yuejie Shi · Jul 30, 2026 · 1 files
ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup
Peter Ujfalusi · Jul 30, 2026 · 1 files
btrfs: disable bs > ps support if no transparent hugepage support
Qu Wenruo · Jul 30, 2026 · 2 files
ASoC: SOF: topology: Use acpi mach from the machine driver
Bard Liao · Jul 30, 2026 · 1 files
ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
Peter Ujfalusi · Jul 30, 2026 · 1 files
udp: fix potential use-after-free in tunnel segmentation
Xuanqiang Luo · Jul 30, 2026 · 1 files
mm/huge_memory: fix huge_zero_pfn race
Lorenzo Stoakes (ARM) · Jul 30, 2026 · 1 files
mm/huge_memory: separate out CONFIG_PERSISTENT_HUGE_ZERO_FOLIO logic
Lorenzo Stoakes (ARM) · Jul 30, 2026 · 1 files
ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
Dawid Wróbel · Jul 30, 2026 · 1 files
ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
Dawid Wróbel · Jul 30, 2026 · 1 files
ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout
Peter Ujfalusi · Jul 30, 2026 · 1 files
ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx
Zhang Heng · Jul 30, 2026 · 1 files
dibs: initialise dibs->lock in dibs_dev_alloc()
Hidayath Khan · Jul 30, 2026 · 2 files
ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
Zihan Xi · Jul 30, 2026 · 1 files
s390/qeth: validate user buffer length in SNMP and ARP query ioctls
Hidayath Khan · Jul 30, 2026 · 2 files
net: smc: fix splice entry lifetime imbalance in smc_rx_splice
Daming Li · Jul 30, 2026 · 1 files
btrfs: flush the fixup workers during close_ctree
Boris Burkov · Jul 30, 2026 · 2 files
ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
Julian Anastasov · Jul 30, 2026 · 3 files
ipvs: return the csum validation for forward hook
Julian Anastasov · Jul 30, 2026 · 2 files
netfilter: ipset: rework cidr bookkeeping
Jozsef Kadlecsik · Jul 30, 2026 · 7 files
netfilter: ipset: switch ext_size to atomic64_t
Jozsef Kadlecsik · Jul 30, 2026 · 5 files
netfilter: ipset: add small wrappers for hash and bucket sizes
Florian Westphal · Jul 30, 2026 · 1 files
netfilter: ipset: add and use mtype_del_cidr_all helper
Florian Westphal · Jul 30, 2026 · 1 files
netfilter: ipset: switch to rcu work
Florian Westphal · Jul 30, 2026 · 2 files
selinux: bpf: check SBLABEL_MNT before isec init
Carlos Llamas · Jul 30, 2026 · 1 files
net/openvswitch: check Ethernet header length in key_extract()
Cen Zhang (Microsoft) · Jul 30, 2026 · 1 files
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
Jose Fernandez (Anthropic) · Jul 30, 2026 · 1 files
btrfs: initialize inode mapping flags for cached inodes
Qu Wenruo · Jul 31, 2026 · 1 files
ALSA: hda/tas2781: fix ACPI reference handling
Xu Rao · Jul 31, 2026 · 1 files
usbnet: cap max_mtu for drivers without bind callback
Laurent Vivier · Jul 31, 2026 · 1 files
Revert "thermal: hwmon: Use extra_groups for adding temperature attributes"
Rafael J. Wysocki · Jul 31, 2026 · 3 files
Revert "thermal: hwmon: Register a hwmon device for each thermal zone"
Rafael J. Wysocki · Jul 31, 2026 · 1 files
ALSA: usb-audio: Add QUIRK_FLAG_MIXER_GET_CUR_BROKEN for Logitech PRO X 2 LIGHTSPEED
Rong Zhang · Jul 31, 2026 · 1 files
net: prestera: validate firmware header length
Pengpeng Hou · Jul 31, 2026 · 1 files
bpf: Fix netns reference imbalance in conntrack kfuncs
Chengfeng Ye · Jul 31, 2026 · 1 files
selinux: do not cancel a policy conversion that never started
Bryam Vargas · Jul 31, 2026 · 1 files
selinux: require a class's permission values to cover its permission count
Bryam Vargas · Jul 31, 2026 · 1 files
selinux: reject an unclaimed class value in security_get_classes()
Bryam Vargas · Jul 31, 2026 · 1 files
selinux: require every boolean value to be defined
Bryam Vargas · Jul 31, 2026 · 1 files
bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss()
Shravya KN · Jul 31, 2026 · 1 files
bnxt_en: Determine and store default RX ring in vnic structure
Shravya KN · Jul 31, 2026 · 2 files
bnxt_en: Refresh VNIC default ring on queue restart if needed
Shravya KN · Jul 31, 2026 · 1 files
bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
Michael Chan · Jul 31, 2026 · 1 files
bnxt_en: Fix PTP PPS setting bug
Keegan Freyhof · Jul 31, 2026 · 1 files
bnge: Fix NULL pointer dereference in aux device release
Alok Tiwari · Jul 31, 2026 · 1 files
smb: compress: reject Pattern_V1 when not negotiated
Anatolii Shumak · Aug 1, 2026 · 3 files
ksmbd: validate compression Flags before kvmalloc
Anatolii Shumak · Aug 1, 2026 · 1 files
smb/client: show compress mount option
ChenXiaoSong · Aug 1, 2026 · 1 files
bnge: use int for bnge_fix_rings_count() return value
Alok Tiwari · Aug 1, 2026 · 1 files
net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers
Jamal Hadi Salim · Aug 1, 2026 · 1 files
net/sched: reject overly deep qdisc hierarchies
Zijie Huang · Aug 1, 2026 · 2 files
selftests/tc-testing: add qdisc hierarchy depth tests
Zijie Huang · Aug 1, 2026 · 1 files
mailmap: map old addresses to Danila Tikhonov
Danila Tikhonov · Aug 1, 2026 · 1 files
ksmbd: apply the pre-authentication PDU limit when decompressing
Sujal Tuladhar · Aug 1, 2026 · 3 files
smb: client: Fix use-after-free in cifs_try_adding_channels()
Shuangpeng Bai · Aug 2, 2026 · 1 files
rqspinlock: Reset tail when preserving queue on deadlock
Kumar Kartikeya Dwivedi · Aug 2, 2026 · 1 files
mac802154: fix netdev use-after-free in beacon worker
Zihan Xi · Aug 2, 2026 · 1 files
net: usb: ipheth: fix carrier_work UAF on disconnect
Doruk Tan Ozturk · Aug 2, 2026 · 1 files
net: atlantic: free stranded TX buffers on ring deinit
Yangyu Chen · Aug 2, 2026 · 3 files
net: atlantic: free RX pages of consumed but not refilled buffers
Yangyu Chen · Aug 2, 2026 · 1 files
net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()
Dongli Zhang · Aug 2, 2026 · 1 files
net: openvswitch: reallocate update replies for mismatched IDs
Zhiling Zou · Aug 3, 2026 · 1 files
net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
Henry Martin · Aug 3, 2026 · 1 files
ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
Zhiling Zou · Aug 3, 2026 · 1 files
tcp: fix TFO max_qlen accounting across reuseport migration
Jiayuan Chen · Aug 3, 2026 · 1 files
net/smc: fix TOCTOU race between smc_listen_out() and listener close
Sidraya Jayagond · Aug 3, 2026 · 1 files
net: stmmac: resume PHY before hardware setup when opening the interface
Stefan Agner · Aug 3, 2026 · 1 files
xdp: reject clones that overrun skb_shared_info tailroom
Zhiling Zou · Aug 3, 2026 · 1 files
ipv6: prevent in6_dev_get() from resurrecting inet6_dev
Kyle Zeng · Aug 3, 2026 · 1 files
KVM: s390: Fix unlikely NULL gmap dereference
Claudio Imbrenda · Aug 3, 2026 · 2 files
KVM: s390: Do not free SCA if it was not allocated
Claudio Imbrenda · Aug 3, 2026 · 1 files
KVM: s390: Fix kvm_s390_vcpu_unsetup_cmma()
Claudio Imbrenda · Aug 3, 2026 · 1 files
KVM: s390: Fix overclearing ESCA in case of error
Claudio Imbrenda · Aug 3, 2026 · 2 files
KVM: s390: ucontrol: Fix sca_clear_ext_call()
Claudio Imbrenda · Aug 3, 2026 · 2 files
KVM: s390: Fix leaking of PGM_ADDRESSING to userspace
Claudio Imbrenda · Aug 3, 2026 · 4 files
KVM: s390: Fix race in __do_essa()
Claudio Imbrenda · Aug 3, 2026 · 2 files
KVM: s390: cmma: Fix dirty tracking when removing memslot
Claudio Imbrenda · Aug 3, 2026 · 2 files
KVM: s390: ucontrol: Add missing locking around gmap_remove_child()
Claudio Imbrenda · Aug 3, 2026 · 1 files
KVM: s390: Free the mmu cache when kvm_arch_vcpu_create() fails
Claudio Imbrenda · Aug 3, 2026 · 1 files
KVM: s390: Return -EINTR if a signal is pending while faulting-in
Claudio Imbrenda · Aug 3, 2026 · 2 files
KVM: s390: Fix ordering when adding to SCA
Claudio Imbrenda · Aug 3, 2026 · 1 files
KVM: s390: Fix cleanup in kvm_s390_pv_create_cpu()
Claudio Imbrenda · Aug 3, 2026 · 1 files
samples/damon/mtier: error out for zero quota goal target values
SJ Park · Aug 3, 2026 · 1 files
mm/damon/lru_sort: error out for >10000 active_mem_bp
SJ Park · Aug 3, 2026 · 1 files
mm/damon/reclaim: skip damon_call() if ctx has not started
SJ Park · Aug 3, 2026 · 1 files
mm/damon/lru_sort: skip damon_call() if ctx has not started
SJ Park · Aug 3, 2026 · 1 files
ASoC: rt5645: Make the Kconfig symbol user selectable
Rudi Heitbaum · Aug 3, 2026 · 1 files
net: thunderbolt: Tear down DMA paths before stopping the rings
Fan XinRan · Aug 3, 2026 · 1 files
mptcp: options: reset DSS fields in case of unexpected size
Matthieu Baerts (NGI0) · Aug 3, 2026 · 1 files
mptcp: avoid combining some incoming suboptions
Matthieu Baerts (NGI0) · Aug 3, 2026 · 2 files
mptcp: remove MPC && MPJ check
Matthieu Baerts (NGI0) · Aug 3, 2026 · 1 files
mptcp: pm: fix data race in add_addr timer callback
Qing Luo · Aug 3, 2026 · 1 files
selftests: mptcp: join: mark tests with data corruption as failed
Gang Yan · Aug 3, 2026 · 1 files
mptcp: pm: fix memory leak from alloc-during-teardown race
Shardul Bankar · Aug 3, 2026 · 3 files
mptcp: fastopen: only mark MPTFO subflows with SYN data
Wyatt Feng · Aug 3, 2026 · 1 files
mptcp: reclaim forward-allocated memory on RX path errors
Paolo Abeni · Aug 3, 2026 · 1 files
fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
Eric Biggers · Aug 3, 2026 · 1 files
fsverity: Fix silent truncation in bpf_get_fsverity_digest()
Eric Biggers · Aug 3, 2026 · 1 files
net/mlx5e: fix BQL reset on SQ re-activation
Bobby Eshleman · Aug 3, 2026 · 1 files
sctp: fix addip_serial increment on ASCONF_ACK allocation failure
Qing Luo · Aug 4, 2026 · 1 files
tls: don't leave a full plaintext sk_msg ring unpushed
chanyoung · Aug 4, 2026 · 1 files
selftests: tls: add a test for splicing onto a full plaintext record
chanyoung · Aug 4, 2026 · 1 files
MAINTAINERS: add SpacemiT K1/K3 I2S entry
Troy Mitchell · Aug 4, 2026 · 1 files
netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
Eric Dumazet · Aug 4, 2026 · 1 files
net: phy: mediatek: fix TX blink masks using the RX bits
Ahmed Naseef · Aug 4, 2026 · 1 files
net: octeontx2-pf: Fix UB in shift operation
Sergey V. Frolov · Aug 4, 2026 · 1 files
ALSA: FCP: fix OOB write in fcp_meter_ctl_get()
Baul Lee · Aug 4, 2026 · 1 files
ALSA: us144mkii: re-anchor capture URBs on resubmission
Baul Lee · Aug 4, 2026 · 1 files
tls: rx: restore msg_iter before TLS 1.3 optimistic retry
Jérémy Jean · Aug 4, 2026 · 2 files
MAINTAINERS: add myself as a maintainer for Hisilicon Network Subsystem
Jijie Shao · Aug 4, 2026 · 1 files
selinux: check level category sets once at load time
Stephen Smalley · Aug 4, 2026 · 2 files
bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
Luxiao Xu · Aug 4, 2026 · 1 files
net: remove WARN_ON_ONCE() from sk_mc_loop()
Eric Dumazet · Aug 4, 2026 · 1 files
smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive()
Frank Sorenson · Aug 4, 2026 · 1 files
selftests/ftrace: refactor eprobes test to fix argument checks
Martin Kaiser · Aug 4, 2026 · 1 files
Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
Rafael J. Wysocki · Aug 4, 2026 · 1 files
net: qrtr: ns: Raise lookup limit to 128
Łukasz Patron · Aug 4, 2026 · 1 files
ptp: ocp: Fix board ID over-read
Ahmad Byagowi · Aug 4, 2026 · 1 files
igc: fix netdev not re-attached after resume if interface is down
Philipp David · Aug 4, 2026 · 1 files
ALSA: usb-audio: fix OOB write on Type II inbound URBs
Baul Lee · Aug 5, 2026 · 1 files
ALSA: usx2y: bound the hwdep mmap fault offset
Baul Lee · Aug 5, 2026 · 2 files
tls: don't abort the connection on signal-interrupted sends
Maximilian Immanuel Brandtner · Aug 5, 2026 · 1 files
ASoC: cs35l41: sort the register default table
Peter Ujfalusi · Aug 5, 2026 · 1 files
ASoC: cs35l45: sort the register default table
Peter Ujfalusi · Aug 5, 2026 · 1 files
ASoC: cs4265: sort the register default table
Peter Ujfalusi · Aug 5, 2026 · 1 files
ASoC: amd: yc: Add DMI quirk for Xiaomi RedmiBook 16 2025
Zhang Heng · Aug 5, 2026 · 1 files
ASoC: amd: yc: Add DMI quirk for MSI Raider A18 HX A7VHG
Zhang Heng · Aug 5, 2026 · 1 files
bnge: Fix resource leak in bnge_init_nic() error path
Bhargava Marreddy · Aug 5, 2026 · 1 files
net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
Qihang Tang · Aug 5, 2026 · 1 files
packet: use consistent hard_header_len in non-ring send paths
Qihang Tang · Aug 5, 2026 · 2 files
packet: use consistent hard_header_len in TX_RING send path
Qihang Tang · Aug 5, 2026 · 1 files
s390/ism: Fix UAF of sba and ieq during ism_dev_exit()
Alexandra Winter · Aug 5, 2026 · 1 files
net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
Eric Dumazet · Aug 5, 2026 · 1 files
sctp: clear control chunk transport if it is being removed
Xin Long · Aug 5, 2026 · 1 files
MAINTAINERS: dpll: zl3073x: replace Prathosh Satish with Min Li
Ivan Vecera · Aug 5, 2026 · 1 files
net: avoid theoretical races with ref drain
Jakub Kicinski · Aug 6, 2026 · 3 files
net: Defer netdev KOBJ_ADD uevent until the device is published
Dragos Tatulea · Aug 6, 2026 · 3 files
KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
Paolo Bonzini · Aug 6, 2026 · 2 files
ALSA: usb-audio: Fix sticky mixer regressions on M-Audio Fast Track Ultra
Takashi Iwai · Aug 7, 2026 · 1 files