Daily update · Aug 22–23, 2026
Networking fixes: SMC memory safety, TCP MSS clamp, and driver corrections
A batch of bug fixes lands across net, net/sched, and Ethernet drivers, addressing use-after-free, divide-by-zero, and DMA mismatches.
In brief
This daily update covers a wide range of networking fixes, including memory-safety issues in SMC and XDP, a TCP MSS clamp, and several driver corrections. The changes address potential crashes, data corruption, and incorrect accounting.
Bug fixes
bnxt_en: fix hwmon callback and TPH gating
The hwmon event handler was called with the platform device instead of the hwmon device, and TPH was enabled on NICs without queue-management support, causing boot-time error floods.
Why it matters: Prevents undefined behavior in hwmon notifications and noisy 'RX queue restart failed' messages on older Broadcom NICs.
net/smc: fix LLC queue entry use-after-free and rkey bounds
A queue entry was freed before its data was read, and v2 LLC messages could read past the entry or trust oversized rkey counts, leading to KASAN reports and incorrect rtoken deletion.
Why it matters: Fixes memory corruption and out-of-bounds access in SMC-Rv2 link setup.
ntb_netdev: correct RX drop and packet accounting
The driver double-counted drops already handled by netif_rx() and failed to count packets dropped on refill failure.
Why it matters: Network statistics now reflect actual packet and drop counts.
sparx5: fix debugfs naming and atomic-context MAC table access
Debugfs used unregistered netdev names causing warning floods; MAC table access slept while holding a spinlock.
Why it matters: Cleans boot warnings and prevents 'sleep in atomic context' errors.
txgbe/libwx: fix interrupt unmasking and PTP flag race
txgbe unmasked the wrong interrupt bit in non-MSI-X mode; libwx used a racy read-copy-update on a flags bitmap.
Why it matters: Fixes missed interrupts and lost flag updates in Wangxun drivers.
net/sched: fix FQ pacing underflow and CAKE autorate throttle
FQ's pacing delay could underflow when offload enabled, halving the delay; CAKE's autorate guard never updated its timestamp, allowing excessive reconfiguration.
Why it matters: Improves pacing accuracy and reduces unnecessary shaper reconfiguration under bursty traffic.
tcp: clamp route advmss to TCP_MIN_MSS
Route-derived MSS values could drop below 1, causing a divide-by-zero in window calculation.
Why it matters: Prevents a potential crash when routes advertise very small MSS.
xdp: fix zero-copy frame layout for cpumap redirect
The copied frame could overlap skb_shared_info or exceed the page, causing KASAN slab-out-of-bounds.
Why it matters: Fixes memory corruption when redirecting AF_XDP zero-copy packets through cpumap.
gtp: serialize PDP context updates
Concurrent deletion via netlink and device unregister could free the same context twice.
Why it matters: Fixes a race that could lead to a general protection fault.
qede: fix NULL pointer in TPA fragment processing
A dropped assignment left buffer.data NULL, causing a 'ghost' BD to be recycled and later dereferenced.
Why it matters: Fixes NULL pointer dereference under memory pressure.
page_pool: stop passing device GFP flags to XArray
Device-specific GFP flags like GFP_DMA32 were passed to XArray allocations, triggering slab warnings.
Why it matters: Removes spurious warnings and incorrect allocation flags.
hibmcge: fix page_pool DMA direction mismatch
The driver synced with DMA_TO_DEVICE while the pool used DMA_FROM_DEVICE, violating the DMA API contract.
Why it matters: Prevents swiotlb bounce-buffer issues and DMA API debug warnings.
ipip: fix skb leak in collect_md mode
When metadata_dst allocation failed, the skb was not freed.
Why it matters: Fixes a packet leak in IPIP tunnels using collect_md.
ptp: netc: fix PEROUT period truncation and divide-by-zero
A period bound check allowed values above U32_MAX, which were truncated and could cause a divide-by-zero.
Why it matters: Fixes potential crash in PTP PEROUT configuration.
net/sched: account classifier allocations to memcg
Filter allocations used plain GFP_KERNEL, allowing unprivileged users to pin kernel memory outside memcg charging.
Why it matters: Closes a memory-accounting gap for tc classifier filters.
Source commits23 entries +
i2c: rust: mark I2cAdapter methods as inline
Nicolás Antinori · May 21, 2026 · 1 files
net: microchip: vcap: use port number instead of netdev name for debugfs
Daniel Machon · Aug 17, 2026 · 3 files
net: sparx5: fix sleep in atomic context in MAC table access
Daniel Machon · Aug 17, 2026 · 1 files
net: txgbe: fix MISC interrupt unmasking in non-MSI-X mode and device shutdown
Jiawen Wu · Aug 18, 2026 · 1 files
qede: Fix NULL pointer dereference in TPA fragment processing
Vaibhav Nagare · Aug 18, 2026 · 2 files
net: libwx: fix concurrent bitmap overwrite in PTP setup
Jiawen Wu · Aug 18, 2026 · 1 files
gtp: serialize PDP context updates
Qing Ming · Aug 18, 2026 · 1 files
xdp: fix zero-copy frame layout
Weiming Shi · Aug 18, 2026 · 1 files
net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()
Yehyeong Lee · Aug 19, 2026 · 1 files
net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages
Yehyeong Lee · Aug 19, 2026 · 1 files
net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry
Yehyeong Lee · Aug 19, 2026 · 2 files
ipip: fix skb leak in collect_md mode when metadata_dst allocation fails
Anton Danilov · Aug 19, 2026 · 1 files
net/sched: account classifier filter allocations to memcg
Jamal Hadi Salim · Aug 19, 2026 · 10 files
tcp: clamp route advmss to TCP_MIN_MSS
Yong Wang · Aug 19, 2026 · 5 files
net: ntb_netdev: Avoid double-accounting netif_rx() drops
Koichiro Den · Aug 19, 2026 · 1 files
net: ntb_netdev: Count packets dropped on RX refill failure
Koichiro Den · Aug 19, 2026 · 1 files
net_sched: sch_fq: fix pacing delay underflow with pacing offload
Eric Dumazet · Aug 20, 2026 · 1 files
net: hibmcge: fix page_pool DMA direction mismatch
Jian Shen · Aug 20, 2026 · 1 files
net/sched: sch_cake: fix autorate reconfiguration throttling
Giuseppe Piscitelli · Aug 20, 2026 · 1 files
net: page_pool: Remove zone/policy GFP flags when allocating XArray entries
Rong Zhang · Aug 20, 2026 · 1 files
bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check
Thomas Walsh · Aug 20, 2026 · 1 files
ptp: netc: fix period truncation and potential divide-by-zero in PEROUT
Wei Fang · Aug 21, 2026 · 1 files
bnxt_en: Fix call to hardware monitoring event handler
Guenter Roeck · Aug 21, 2026 · 1 files