Daily update · Aug 26–27, 2026
Mainline fixes: SRv6 stale metadata, AppArmor warning, IRQ refcount leak
Three bug fixes land in mainline, including a security-relevant IPv6 segment routing fix.
In brief
This batch contains three bug fixes: an AppArmor error-path warning, an SRv6 decapsulation issue that can leave stale IPv6 control-block data, and a device-tree IRQ refcount leak. The SRv6 fix is the most notable because it is reachable from an unprivileged user and network namespace.
Bug fixes
AppArmor: initialize policy list heads before failure cleanup
If AppArmor profile creation fails before policy_init() completes, the policy list heads are not initialized. profile_free() then runs its sanity checks on uninitialized lists and triggers a kernel warning.
Why it matters: Prevents a spurious kernel WARN during AppArmor profile creation failure; no user-visible behavior change is expected.
seg6: reset IP6CB after IPv6 decapsulation
When SRv6 (IPv6 Segment Routing) decapsulation pulls the outer IPv6 headers, the IPv6 control block still contains offsets and flags from the outer packet. The inner packet can then be processed with stale nhoff and extension-header data, and an unprivileged user in a namespace can trigger this via End.DT6 with crafted outer extension headers.
Why it matters: Fixes a potential out-of-bounds read in the IPv6 input path after SRv6 decapsulation.
of/irq: fix device node refcount leak in of_irq_get_affinity()
of_irq_parse_one() takes a reference on the interrupt controller node, but of_irq_get_affinity() never drops it after parsing. The leak is hit through platform_get_irq_affinity(), used by arm_pmu, arm_spe_pmu, and coresight-trbe.
Why it matters: Prevents a gradual reference-count leak on interrupt controller nodes for ARM PMU, SPE, and TRBE users.
Source commits4 entries +
power: sequencing: rename pwrseq_power_on/off() to pwrseq_enable/disable()
Bartosz Golaszewski · Jul 31, 2026 · 8 files
seg6: reset IP6CB after IPv6 decapsulation
Zhiling Zou · Aug 22, 2026 · 1 files
apparmor: policy_int make sure list heads are initialized before fail path
John Johansen · Aug 24, 2026 · 1 files
of/irq: Fix device node refcount leak in of_irq_get_affinity()
Fuad Tabba · Aug 26, 2026 · 1 files