Daily update · Aug 15–16, 2026
Linux kernel: OpenRISC security fix, Apple M3 I2C, Tegra194 timer updates
A security fix for OpenRISC signal handling plus device-tree corrections for Apple M3 and Tegra194.
In brief
This batch includes a security fix for OpenRISC signal handling, where a crafted signal frame could let an unprivileged task disable memory protection and read/write arbitrary physical memory. There are also device-tree corrections for Apple M3 (T8122) I2C controllers and Nvidia Tegra194's EL2 virtual timer interrupt, plus a NULL check in OP-TEE's FF-A memory lending path. These are targeted fixes rather than new features.
Bug fixes
OpenRISC signal return no longer restores privileged SR bits
restore_sigcontext() previously copied the entire supervision register from a signal frame and only cleared the mode bit. A crafted frame could therefore clear privileged bits such as the data-MMU enable bit, giving an unprivileged task access to arbitrary physical memory. The fix restricts which SR bits can be restored on sigreturn.
Why it matters: Fixes a potential local privilege escalation on OpenRISC systems.
Apple M3 (T8122) I2C device-tree correction
Corrects the MMIO ranges and IRQs for T8122 I2C controllers, which had wrong values in the initial device tree.
Why it matters: I2C-dependent hardware such as audio codecs can function correctly on affected Apple Silicon machines.
Tegra194 EL2 virtual timer interrupt added
Adds the per-CPU interrupt for the EL2 virtual timer on Tegra194, so the ARM arch timer driver no longer warns when running at EL2 with VHE.
Why it matters: Removes the 'Firmware Bug' warning on Tegra194 platforms and lets the timer driver use the intended interrupt.
OP-TEE FF-A memory lending NULL check
optee_ffa_lend_protmem() now validates the allocated pointer, closing a possible NULL dereference under memory pressure.
Why it matters: Avoids a kernel crash in the OP-TEE FF-A path when allocation fails.
Source commits4 entries +
optee: ffa: Add NULL check in optee_ffa_lend_protmem
Mostafa Saleh · Jun 17, 2026 · 1 files
arm64: dts: apple: t8122: Fix I2C resources
Michael Reeves · Jun 29, 2026 · 1 files
arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
Jon Hunter · Jul 28, 2026 · 1 files
openrisc: signal: do not restore privileged SR bits on sigreturn
Ali Ahmet Memis · Aug 7, 2026 · 2 files