Daily update · Aug 24–25, 2026

Linux mainline: FUSE/CIFS zeroing fixes, Bluetooth hardening, Hyper-V cleanup

Today's pull brings filesystem data-integrity fixes, a batch of Bluetooth and SMB security hardening, Hyper-V modernization, and several driver crash fixes.

Bug fixes Security and hardening

#AF_XDP #Bluetooth #CIFS/SMB #erofs #FUSE #Hyper-V

107 meaningful commitsDaily snapshot

In brief

This update covers fixes for stale data exposure on FUSE and CIFS file extension, new erofs shared-inode capabilities, a large set of Bluetooth stability and security fixes, removal of legacy Hyper-V host support, and multiple networking and driver hardening patches.

Filesystems

Fix stale data exposure when extending FUSE files

Two fixes ensure that extending a file on a FUSE filesystem zeroes the tail of the previous last page and invalidates the correct byte range after O_APPEND direct writes. This prevents reads from returning stale mmap-dirtied data instead of zeros.

Why it matters: Users of FUSE-based filesystems (e.g., sshfs, virtiofs) avoid data corruption and POSIX violations when files are extended.

34b5c4a6e4fb 26d7e1f5c407

Fix FUSE io_uring enablement condition

The condition for accepting IORING_OP_URING_CMD on FUSE connections now requires the FUSE_OVER_IO_URING flag in the FUSE_INIT reply, preventing deadlocks when the server did not enable the feature.

Why it matters: FUSE servers using io_uring benefit from a more robust handshake, avoiding potential hangs.

1f59015e9581

Add SEEK_HOLE/SEEK_DATA, splice, and large folio support to erofs inode_share mode

These changes make erofs inode_share mode correctly report holes via SEEK_HOLE/SEEK_DATA, support splice/sendfile through the shared page cache, and enable large folios for better performance.

Why it matters: Users of erofs with shared inodes (common in some Android/container images) get more accurate file layout queries and faster I/O.

8ebf95897885 e8325399d6e1 c77516e1e6fe

Fix erofs global buffer resize failure handling

When growing global buffers, buffers that already meet the requested size are now skipped, preventing -ENOMEM errors and out-of-bounds pointer array access on retry.

Why it matters: Avoids memory allocation failures and potential crashes during erofs decompression buffer resizing.

a7d097cf0130

Fix stale data exposure when extending CIFS files

cifs_setsize() now calls pagecache_isize_extended() when extending a file, zeroing the tail of the last page.

Why it matters: Prevents dirty bytes from being written back and exposing stale data in the extended region.

c510edb9734a

SMB client hardening

Fix SMB client out-of-bounds read/write in T2 coalescing

coalesce_t2() now validates server-supplied DataOffset fields against buffer bounds before copying data.

Why it matters: Prevents a malicious SMB server from corrupting memory or leaking data via crafted T2 responses.

6343c1da5619

Fix SMB client use-after-free in secondary T2 handling

Malformed secondary T2 responses could leave a dangling buffer pointer, leading to a use-after-free.

Why it matters: Prevents a malicious SMB server from crashing the client or potentially executing code.

730d0bb19507

Validate SMB tree connect response byte count

CIFSTCon() now rejects responses with a byte count too small to parse, avoiding an out-of-bounds read.

Why it matters: Prevents a malicious SMB server from leaking kernel memory via /proc/fs/cifs/DebugData.

65deb1835934

Clear sensitive key material in SMB client

Several SMB client paths now zeroize stack and heap buffers containing keys, hashes, and signatures before freeing them.

Why it matters: Reduces the risk of credential material leaking via memory disclosure bugs.

3d93986f68f4 55a1ad8413f5 1a6bd74a27f1 2f9af06e30b7 111a2b8717ef

Bluetooth

Fix multiple Bluetooth core crashes and hangs

Several fixes address use-after-free and race conditions in L2CAP, RFCOMM, ISO, and mgmt, plus a command timeout in hci_sync. These prevent kernel crashes, memory exhaustion, and Bluetooth initialization failures.

Why it matters: Bluetooth users get a more stable and secure stack, with fewer device enumeration failures and less risk of system crashes.

ca2c4c264986 d4bfa78fd679 66d6ef18548a 44c98fd082ea 759c185d0bbd 560bef609fa5 59eecbe2f2f3 f5afdff569a0

Fix Bluetooth LE connection leak on rejected second connect

The connection complete handler could leak an hci_conn when a second LE connection was rejected while another was still pending.

Why it matters: Prevents resource leaks and potential instability for users with multiple Bluetooth LE connections.

7e1e4047200f

Fix out-of-bounds reads in Bluetooth EIR and MediaTek SDIO

Fixes an OOB read in Bluetooth Extended Inquiry Response parsing and an out-of-bounds DMA read in the MediaTek SDIO Bluetooth driver. Both could expose kernel memory or cause data corruption.

Why it matters: Hardens Bluetooth against malformed remote data and prevents potential information leaks or crashes on affected hardware.

4beb198bc59b fa0ad2d277c7

Hyper-V

Drop support for pre-WS2016/Windows 10 Hyper-V hosts

Linux guest support for Hyper-V versions older than Windows Server 2016/Windows 10 is removed, including legacy VMBus, storvsc, and timer paths. The code is simplified by removing special cases for these ancient hosts.

Why it matters: Users running Linux on very old Hyper-V hosts will need to stay on older kernels; those on modern Hyper-V see cleaner code and fewer legacy quirks.

a9a05e801eff 73da9973b353 6b8345035d9d 54cf8154186f be0cfab740e5

Fix lost interrupts and vector exhaustion on Hyper-V

The Hyper-V PCI MSI irqchip now installs an irq_retrigger callback to avoid dropping interrupts during CPU hot-unplug, and the x86 Hyper-V code reserves three vectors used by the hypervisor to prevent device interrupt mapping failures.

Why it matters: Improves reliability for Linux VMs on Hyper-V, especially with CPU hotplug or nested virtualization.

86bdd16e8f39 769bcbee07a4

Networking

Fix use-after-free in Open vSwitch CT limit teardown

CT limit state was freed without waiting for RCU readers, allowing packet processing to access freed memory during netns teardown.

Why it matters: Fixes a crash that an unprivileged user could trigger from a user/net namespace.

403f96c32c9e

Fix NULL pointer dereference in Qualcomm RMNET deaggregation

Restored skb->dev assignment on deaggregated frames, preventing a NULL deref when a command frame is processed.

Why it matters: Fixes a crash reachable by an unprivileged user creating an rmnet link over a tap device.

a66734a1c5e3

Cap Microsoft MANA NIC MSI-X vectors to device table size

The driver now limits usable MSI-X vectors to the device table size, avoiding a page fault on VMs with many vCPUs.

Why it matters: Prevents a crash when using Azure MANA NICs on large M-series VMs.

2c7493f98014

Align AF_XDP TX metadata layout across 32/64-bit ABIs

Added explicit padding so xsk_tx_metadata has the same layout on all architectures; previously 32-bit systems used a different offset for launch_time.

Why it matters: Fixes silent misprogramming of packet launch times for AF_XDP applications on 32-bit platforms.

bd7d30bd1d38

Fix MediaTek WED v2 TX hang by increasing WDMA reserve buffer

Increased the WDMA RESV_BUFF value from 0x40 to 0x80 to avoid CDM TX FIFO overflow on MT7981/MT7986.

Why it matters: Prevents TX hangs on routers using MediaTek MT7981/MT7986 Wi-Fi.

c0ef04232f9f

Core and driver fixes

Fix truncation of large CMA sizes on kernel command line

The numa_cma and cma_pernuma kernel parameters now correctly handle sizes of 2G and above; previously they were truncated to zero or negative values, silently reserving nothing or rejecting the request.

Why it matters: Users relying on large contiguous memory allocations via kernel parameters get the requested CMA size instead of silent failure.

1476cca098f6

Fix kernel panic when unbinding intel_rapl PMU

The intel_rapl driver now checks whether the PMU is actually registered before unregistering it, avoiding a NULL pointer dereference and kernel panic during driver unbind/removal.

Why it matters: Prevents a crash for users who unbind or remove the Intel RAPL power capping driver.

916b61abba58

Source commits107 entries +

44c98fd082ea

Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop

Hyunwoo Kim · Mar 19, 2026 · 1 files

019716ca2633

smb: client: remove redundant NULL check before kfree()

Mohammad Shahid · Jul 3, 2026 · 1 files

e1fc6e70f36e

Drivers: hv: Use meaningful errnos for hypercall status codes

Hardik Garg · Jul 27, 2026 · 1 files

ba22f575de9d

smb: client: restore the data_offset bound in is_valid_oplock_break()

Bryam Vargas · Jul 28, 2026 · 1 files

769bcbee07a4

x86/hyperv: reserve more vectors

Wei Liu · Jul 30, 2026 · 1 files

bbc2de7fa5b4

docs/ja_JP: translate submitting-patches.rst (tag usage)

Akiyoshi Kurita · Jul 30, 2026 · 1 files

60dbcce1567f

selftests/fuse: test post-EOF page zeroing when a file is extended

Jimmy Zuber · Jul 31, 2026 · 3 files

a9a05e801eff

Drivers: hv: Remove support for WS2012/2012R2 & Win8/8.1 version of Hyper-V

Michael Kelley · Aug 5, 2026 · 5 files

73da9973b353

hv_sock: Remove check for old Hyper-V hosts

Michael Kelley · Aug 5, 2026 · 1 files

6b8345035d9d

hv_netvsc: Remove GPADL teardown special case for old Hyper-V hosts

Michael Kelley · Aug 5, 2026 · 1 files

54cf8154186f

scsi: storvsc: Remove support for storvsc protocol of old Hyper-V hosts

Michael Kelley · Aug 5, 2026 · 1 files

be0cfab740e5

clocksource: hyper-v: Remove support for stimer interrupts in message mode

Michael Kelley · Aug 5, 2026 · 6 files

b96db32fed8d

cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()

Frank Sorenson · Aug 7, 2026 · 1 files

dc6b7c771a96

Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative

Guangshuo Li · Aug 8, 2026 · 1 files

853a92b97ca5

Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative

Guangshuo Li · Aug 8, 2026 · 1 files

c7e9a8cb6918

Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative

Guangshuo Li · Aug 8, 2026 · 1 files

66d6ef18548a

Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan

Pauli Virtanen · Aug 8, 2026 · 2 files

59eecbe2f2f3

Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference

Pavel Shpakovskiy · Aug 8, 2026 · 2 files

48cab1fd5720

cifs: fix clearing stats for fastest execution of each smb2 command

Frank Sorenson · Aug 8, 2026 · 1 files

d4bfa78fd679

Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN

Pauli Virtanen · Aug 8, 2026 · 1 files

ca2c4c264986

Bluetooth: L2CAP: access chan->conn safely in get/setsockopt

Pauli Virtanen · Aug 9, 2026 · 1 files

86bdd16e8f39

PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip

Naman Jain · Aug 10, 2026 · 1 files

ebdc1afb1e26

smb/client: mark missing nlink values as unknown

Ze Tan · Aug 11, 2026 · 2 files

9437f2113b60

smb/client: preserve open info type across compound queries

Ze Tan · Aug 11, 2026 · 2 files

43549eb84266

smb/client: decode reparse metadata using its payload type

Ze Tan · Aug 11, 2026 · 3 files

cb19774faa57

Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request

Ibrahim Abdelkader · Aug 11, 2026 · 1 files

8f1da3536b8f

Drivers: hv: vmbus: add vmbus_establish_gpadl_caller_decrypted()

Kameron Carr · Aug 11, 2026 · 2 files

73fe42af955a

Drivers: hv: vmbus: Add vmbus_alloc_buffer()/vmbus_free_buffer() for CoCo VMs

Kameron Carr · Aug 11, 2026 · 2 files

f85e1cc5ecbb

hv_netvsc: Allocate send/receive buffers using vmbus_alloc_buffer()

Kameron Carr · Aug 11, 2026 · 3 files

6343c1da5619

smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()

Frank Sorenson · Aug 12, 2026 · 1 files

41a9c2b48e25