Daily update · Aug 8–9, 2026
Linux mainline update: xHCI regression fix, rtl8723bs wireless fixes, RMI4 hardening, and more
Notable fixes across USB, wireless, input, framebuffer, futex, s390 crypto, and Rust builds.
In brief
This update restores xHCI USB host functionality on 32-bit ARM systems, hardens several drivers against out-of-bounds and memory-disclosure bugs reachable from unprivileged or attacker-controlled input, and fixes hangs and stalls in futex, framebuffer, and serial drivers. New hardware quirks improve out-of-box support for specific gamepads and laptops.
Security & hardening
rtl8723bs WiFi driver: multiple out-of-bounds reads reachable before association
Several IE parsers in the staging rtl8723bs driver read fixed-offset fields without length checks, and the WEP shared-key auth handler copies up to 255 bytes of challenge text into a 128-byte buffer. These paths are reachable from a malicious AP before association.
Why it matters: Protects rtl8723bs SDIO adapter users from kernel memory corruption or disclosure triggered by crafted wireless frames.
Synaptics RMI4 touchpad diagnostics heap overflow fixes
A series of fixes corrects TX/RX electrode count handling, report-size validation, stale-buffer propagation, and mid-stream input changes in the F54 diagnostics V4L2 interface.
Why it matters: Protects users of RMI4 touchpads exposing diagnostics via V4L2 from heap corruption via malformed sensor data or runtime format changes.
6058f0fea10fdc76c3c8e8ad49c5adc2b7d6fbfd76746adc8786d74bf50e
evdev: stack memory leak and Spectre-v1 mitigation
evdev previously passed partially uninitialized input_event instances to userspace, leaking stack bytes on padded architectures such as SPARC64. Separately, EVIOCGMASK/EVIOCSMASK event type indices are now clamped with array_index_mask_nospec() to prevent speculative out-of-bounds loads.
Why it matters: Prevents kernel memory disclosure to unprivileged evdev clients and hardens against speculative side-channel attacks.
s390 zcrypt CPRB hardening
CCA and EP11 CPRB processing paths now validate minimum sizes, guard against integer/arithmetic overflow, replace struct overlays with proper ASN.1 parsing, zero-pad trailing bytes, and round allocations to 4-byte boundaries.
Why it matters: Protects s390 crypto card users from userspace-triggered buffer overflows and kernel memory leakage to firmware.
5004889551df35ac6754ba6d17ac0bc866fc0864a163783beb3632544724
powerpc/pseries buffer overflow and underflow fixes
papr-phy-attest validates cmd.length to prevent overflow and fixes a memory leak; pseries PCI SR-IOV fixes an AND/OR logic bug in VF count checks; lparcfg_write guards against a kbuf[-1] underflow on zero-length writes.
Why it matters: Avoids memory corruption and SR-IOV misconfiguration when using attestation, PCI virtual functions, or partition config writes.
USB gadget NCM NDP offset bypass and Thunderbolt DROM bounds fixes
A signed ndp_index in the USB NCM gadget could overflow negative via a large attacker offset, bypassing unsigned checks and causing an out-of-bounds read. Separately, a malformed Thunderbolt device could set dual_link_port_nr beyond sw->ports[], storing and dereferencing an out-of-bounds pointer.
Why it matters: Protects USB NCM gadget systems from malicious host frames and hosts from crafted Thunderbolt devices triggering OOB kernel access.
vt KDSKBMETA ioctl now requires permission
The KDSKBMETA ioctl lacked the permission check enforced by every other keyboard setter in vt_k_ioctl().
Why it matters: Non-controlling-console users can no longer alter keyboard meta mode.
Hardware support & quirks
Xbox-compatible gamepads needing 255-byte config descriptors now enumerate
Some third-party and spoofed Xbox-compatible gamepads disconnect during standard enumeration because they expect a 255-byte GET_DESCRIPTOR(CONFIGURATION) request. A new USB quirk and ShanWan-specific entry force that size.
Why it matters: Owners of affected ShanWan and similar gamepads regain XInput mode with rumble instead of falling back to limited HID.
Xiaomi Book Pro 14 and HONOR MagicBook Pro 14 internal keyboards fixed
Both laptops ship with keyboards that stop responding after the standard ATKBD deactivate command; a quirk skips that command so the keyboard and Caps Lock LED work without boot parameters.
Why it matters: Owners get a working keyboard out of the box instead of needing i8042.dumbkbd.
Bug fixes
xHCI broken on 32-bit ARM due to CRCR bit mask truncation
The switch to the BIT() macro cleared the upper 32 bits of the 64-bit CRCR command register, making xHCI unusable on systems such as Raspberry Pi 4B compiled for arm32. BIT_ULL restores the correct 64-bit mask.
Why it matters: Users of 32-bit ARM boards, notably Raspberry Pi 4B, regain working USB host functionality.
futex indefinite hang during private hash resize
A task performing a custom private futex hash resize could block in uninterruptible sleep indefinitely, triggering the hung-task detector and kernel panic. The pivot logic now correctly waits for the reference count to reach zero.
Why it matters: Threads using per-task private futex hashes no longer risk system-wide hangs when resizing the hash table.
fbdev sysfs and console OOB, stale-pointer, and use-after-free fixes
Fixes bound mode sysfs output to the page buffer, clear fb_info->mode before deleting videomodes, serialize mode sysfs access, break out of fb_io_read on partial copy_to_user, and bounds-check glyph indices after font resize.
Why it matters: Framebuffer console and sysfs users avoid memory corruption, stale pointer dereferences, and out-of-bounds I/O during font resize, console rotation, and mode reads.
d15d51fb26e895e647d2a530061db6b7a91081cc73be40c6ef7656e85f1ae033cbf3975a
NXP LPC32xx UART interrupt storm livelock
The LPC3220 UART can latch an RX timeout interrupt with an empty FIFO that serial8250_rx_chars never clears, causing a level-triggered interrupt storm that livelocks single-core ARM926 CPUs. The driver now explicitly clears the stuck condition.
Why it matters: Devices using the LPC32xx front-panel serial port no longer hang when the port is repeatedly opened.
SC16IS7xx serial TX stall with both UART channels active
THRI interrupt enable was requested asynchronously after filling the TX FIFO; if the FIFO drained past the trigger level before THRI was enabled, no new interrupt fired and characters remained queued indefinitely. THRI is now enabled before filling.
Why it matters: Multi-channel SC16IS7xx SPI UART users no longer experience indefinite transmit stalls.
x86 MCE polling timer crash on systems with CMCI storm inheritance
CMCI discovery could trigger mce_timer_kick before the MCE polling timer was initialized, hitting a debugobjects assert and warning during boot. The timer is now set up before CMCI discovery runs.
Why it matters: Affected machines boot cleanly without MCE timer debug warnings.
Qualcomm fastrpc memory leaks, races, and refcount leaks
Multiple fixes address an empty Audio PD memory pool leak, list races during interrupted invokes and unmaps, a channel context refcount leak on session alloc failure, and an undestroyed ctx_idr leak on free.
Why it matters: Qualcomm fastrpc users get stable Audio PD memory allocation and fewer resource leaks on error and interrupt paths.
ab99eaafb0c46102ceb4eab8b85a0e91d7d6310f786839962fae94ee14f7
Build & developer fixes
Rust io helpers and doctests gated on CONFIG_HAS_IOMEM
The Rust ioremap/iounmap helpers and doctests now gate on CONFIG_HAS_IOMEM, fixing build failures on architectures like s390 allnoconfig where these functions are not provided.
Why it matters: Rust kernel support builds cleanly on architectures without CONFIG_HAS_IOMEM, improving cross-architecture build coverage.
Source commits78 entries +
thunderbolt: stream: Unmap buffers with mapped size
Xu Rao · Jun 11, 2026 · 1 files
driver core: add missing kernel-doc for union members
Randy Dunlap · Jun 23, 2026 · 1 files
thunderbolt: Fix bandwidth group reservation indexing
Xu Rao · Jun 24, 2026 · 1 files
thunderbolt: Bound the DROM dual link port number before indexing sw->ports
Bryam Vargas · Jun 25, 2026 · 1 files
Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
Dmitry Torokhov · Jun 26, 2026 · 1 files
Input: synaptics-rmi4 - zero report size on F54 work error
Dmitry Torokhov · Jun 26, 2026 · 1 files
Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
Bryam Vargas · Jun 26, 2026 · 1 files
Input: synaptics-rmi4 - block s_input when F54 queue is busy
Dmitry Torokhov · Jun 26, 2026 · 1 files
Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
Dmitry Torokhov · Jun 26, 2026 · 1 files
fbdev: bound mode sysfs output to the sysfs buffer
Melbin K Mathew · Jul 1, 2026 · 1 files
fbdev: clear fb_info->mode before deleting a videomode
Melbin K Mathew · Jul 1, 2026 · 1 files
fbdev: serialize mode sysfs access with lock_fb_info()
Melbin K Mathew · Jul 1, 2026 · 1 files
thunderbolt: icm: Preserve USB4 proxy data-valid bit
Xu Rao · Jul 13, 2026 · 1 files
counter: microchip-tcb-capture: Fix DT channel validation
Babanpreet Singh · Jul 14, 2026 · 1 files
Input: cs40l50-vibra - validate custom data from user space
HyeongJun An · Jul 18, 2026 · 1 files
staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
Muhammad Bilal · Jul 19, 2026 · 1 files
staging: rtl8723bs: fix OOB read in WMM_param_handler()
Muhammad Bilal · Jul 19, 2026 · 1 files
mei: pull kvfree out of spinlock
Alexander Usyskin · Jul 19, 2026 · 1 files
Input: byd - synchronize timer deletion before freeing private data
Linmao Li · Jul 20, 2026 · 1 files
staging: rtl8723bs: fix missing shared-key auth challenge length check
Panagiotis Petrakopoulos · Jul 20, 2026 · 1 files
usb: cdnsp: fix incorrect endian conversions for APB timeout register
Pawel Laszczak · Jul 20, 2026 · 1 files
usb: gadget: f_ncm: Use unsigned int for ndp_index
Sonali Pradhan · Jul 20, 2026 · 1 files
fbdev: core: Fix pointer desynchronization in fb_io_read()
Mingyu Wang · Jul 21, 2026 · 1 files
serial: sc16is7xx: enable THRI before filling TX FIFO
Luca Fresi · Jul 21, 2026 · 1 files
usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg
Jiangshan Yi · Jul 22, 2026 · 1 files
Input: xpad - add support for ZENAIM LEVERLESS
Kyohei Kadota · Jul 23, 2026 · 1 files
Input: edt-ft5x06 - ignore contacts with an out-of-range slot id
Alexandre Hamamdjian · Jul 23, 2026 · 1 files
misc: fastrpc: Fix initial memory allocation for Audio PD memory pool
Ekansh Gupta · Jul 24, 2026 · 1 files
misc: fastrpc: Remove buffer from list prior to unmap operation
Ekansh Gupta · Jul 24, 2026 · 1 files
misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
Junrui Luo · Jul 24, 2026 · 1 files
misc: fastrpc: fix channel ctx ref leak when session alloc fails
Anandu Krishnan E · Jul 24, 2026 · 1 files
misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
Eddie Lin · Jul 24, 2026 · 1 files
nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI
Aelin Reidel · Jul 24, 2026 · 1 files
nvmem: layouts: Add fixed-layout driver
Mathieu Dubois-Briand · Jul 24, 2026 · 7 files
Input: psxpad-spi - set driver data before use
Linmao Li · Jul 25, 2026 · 1 files
Input: iforce - validate input packet lengths
Pengpeng Hou · Jul 25, 2026 · 2 files
serial: 8250_dma: Clear stale RX state on shutdown
Cunhao Lu · Jul 27, 2026 · 1 files
rust_binder: do not query current thread for all ioctls
Alice Ryhl · Jul 27, 2026 · 1 files
staging: rtl8723bs: validate monitor transmit frame lengths
Mariano Baragiola · Jul 27, 2026 · 1 files
thunderbolt: Initialize ->domain_released completion before it is being used
Mika Westerberg · Jul 28, 2026 · 1 files
usb: core: Add quirk for 255-bytes initial config read
Nikhil Solanke · Jul 28, 2026 · 4 files
usb: hub: Split announce_device() to log device identity before enumeration
Nikhil Solanke · Jul 28, 2026 · 1 files
fbdev: Fix out-of-bounds access when rotating console after font resize
Zizhi Wo · Jul 29, 2026 · 1 files
serial: qcom-geni: fix TX DMA buffer flush
Jan Sebastian Götte · Jul 29, 2026 · 1 files
Input: evdev - fix information leak in evdev_pass_values()
Dmitry Torokhov · Jul 29, 2026 · 1 files
serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
Ryan Wilbur · Jul 30, 2026 · 1 files
fixp-arith: convert comments to kernel-doc format
Randy Dunlap · Jul 31, 2026 · 1 files
vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
Joshua Rogers · Jul 31, 2026 · 1 files
vt: add permission check for KDSKBMETA ioctl
Joshua Rogers · Jul 31, 2026 · 1 files
serial: amba-pl011: fix indefinite RS485 post-send delay
Fan Wu · Jul 31, 2026 · 1 files
serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ
Fan Wu · Jul 31, 2026 · 1 files
serial: amba-pl011: synchronize DMA teardown
Fan Wu · Jul 31, 2026 · 1 files
usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
Aleksandr Nogikh · Jul 31, 2026 · 1 files
usb: quirks: Add ShanWan gamepad to quirk list
Ishaan Dandekar · Aug 2, 2026 · 1 files
docs: threat-model: clarify "security bug" vs "vulnerability"
Willy Tarreau · Aug 2, 2026 · 1 files
docs: threat-model: move fake devices out of "non production use"
Willy Tarreau · Aug 2, 2026 · 1 files
docs: security-bugs: clarify what counts as a valid version
Willy Tarreau · Aug 2, 2026 · 1 files
docs: coding-assistant: explain important steps when looking for bugs
Willy Tarreau · Aug 2, 2026 · 1 files
docs: security-bugs: clarify some mandatory steps for AI reports
Willy Tarreau · Aug 2, 2026 · 1 files
Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
Zhefu Zhang · Aug 2, 2026 · 1 files
Input: atkbd - skip deactivate for HONOR ZQC-P
Donglin Lyu · Aug 2, 2026 · 1 files
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
Richard Davies · Aug 3, 2026 · 1 files
s390/zcrypt: Fix CPRB memory allocation in zcrypt misc code
Harald Freudenberger · Aug 3, 2026 · 2 files
s390/zcrypt: Improve CCA CPRB length and overflow checks
Harald Freudenberger · Aug 3, 2026 · 1 files
s390/zcrypt: Improve EP11 CPRB length and overflow checks
Harald Freudenberger · Aug 3, 2026 · 1 files
s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing
Harald Freudenberger · Aug 3, 2026 · 1 files
s390/zcrypt: Pad trailing CCA or EP11 message with zeros
Harald Freudenberger · Aug 3, 2026 · 1 files
x86/mce: Set up the polling timer before CMCI discovery
Breno Leitao · Aug 3, 2026 · 1 files
Input: evdev - sanitize event type index when fetching event masks
Dmitry Torokhov · Aug 4, 2026 · 1 files
Input: hynitron_cstxxx - validate touch count and finger IDs
Jianing Li · Aug 4, 2026 · 1 files
usb: xhci: use BIT_ULL for CRCR bits to fix incorrect 64bit mask
Lachlan Hodges · Aug 4, 2026 · 1 files
futex: Fix race in futex_pivot_pending() during private hash resize
Yao Kai · Aug 4, 2026 · 1 files
rust: io: gate ioremap/iounmap on CONFIG_HAS_IOMEM
Danilo Krummrich · Aug 5, 2026 · 3 files
rust: io: gate ioremap doctests on CONFIG_HAS_IOMEM
Danilo Krummrich · Aug 5, 2026 · 2 files
powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak
George Wilson · Aug 7, 2026 · 1 files
powerpc/pseries: pci - logic bug
George Wilson · Aug 7, 2026 · 1 files
powerpc/pseries: lparcfg - fix kbuf[] underflow
George Wilson · Aug 7, 2026 · 1 files
fbdev: bitblit: bound-check glyph index in bit_cursor()
Rik van Riel · Aug 8, 2026 · 1 files