Daily update · Sep 3–4, 2026

Linux mainline updates: NTFS corruption fixes, TCP use-after-free, Bluetooth L2CAP OOB writes, and more

A wave of NTFS data-corruption and security fixes headlines today's updates, alongside critical network protocol hardening, device-mapper integrity repairs, and memory-management fixes.

Bug fixes Security and hardening

#bluetooth-l2cap #dm-integrity #ntfs #sctp #secretmem #tcp-use-after-free

151 meaningful commitsDaily snapshot

In brief

Today's mainline updates address a cluster of NTFS driver bugs causing silent disk corruption, information leaks, and performance bottlenecks. Network security fixes close a TCP use-after-free exploitable for privilege escalation, a remote SCTP denial-of-service, Bluetooth L2CAP out-of-bounds writes, vsock source spoofing, and UDP side-channel leaks. Device-mapper gains integrity-target overflow and crash fixes, while memory management sees secretmem RLIMIT_MEMLOCK bypass and tmpfs THP dirty-bit fixes. New hardware support arrives for the Compal EXM-G1x LTE modem.

NTFS corruption and security fixes

Silent disk corruption on 4K-sector volumes

The NTFS driver computed bi_sector in volume-sector-size units instead of 512-byte units, causing silent disk corruption on writes to volumes with 4K sector sizes.

Why it matters: Anyone using NTFS on 4K-native storage could experience silent data corruption on writes.

6faa235a649e

FITRIM could discard allocated clusters

ntfs_trim_fs() derived discard length by aligning the original extent length down rather than aligning the absolute end, extending the discard range past free extents into allocated clusters.

Why it matters: Running fstrim on an NTFS volume could silently discard data from allocated clusters.

03c6ecc4b4b1

Information leak via fallocate and mmap read race

The fallocate path did not hold invalidate_lock for standard allocation modes, allowing concurrent mmap page faults to read uninitialized disk data from newly allocated clusters before they were zeroed.

Why it matters: A local user could read stale disk contents through a racing mmap read during fallocate.

67aded1da114

Volume incorrectly marked clean after errors

ntfs_sync_fs() unconditionally cleared the dirty bit even when volume errors had been recorded, so a sync() on an errored volume marked it clean and prevented recovery on next mount.

Why it matters: NTFS volumes that experienced errors could be marked clean, skipping needed recovery and leaving corruption unrepaired.

0e4c83990541

Truncate races with mmap writes causing SIGBUS and corruption

ntfs_setattr_size() and ntfs_filemap_page_mkwrite() did not hold invalidate_lock, allowing concurrent truncate or fallocate to race with page faults and produce spurious SIGBUS or corrupt data.

Why it matters: Programs using memory-mapped NTFS files could experience unexpected SIGBUS or data corruption during concurrent file resizing.

9cc5761b8f28 0fecc393f206

fallocate returns success when interrupted by signal

ntfs_attr_fallocate() checked for pending signals but returned 0 instead of -EINTR when interrupted, so callers believed the allocation succeeded even though it was incomplete.

Why it matters: Applications using fallocate on NTFS files could silently receive incomplete allocations when interrupted by signals.

4dc8f4ee2d46

WOF system-compressed file reads serialized globally

WOF decompression held a module-global mutex across the entire chunk loop including disk I/O, serializing all readers system-wide on disk waits rather than just on decompressor scratch space.

Why it matters: Reading system-compressed files on NTFS could see dramatically reduced throughput when multiple processes accessed them concurrently.

41a52ba4a5fe

Network security and hardening

TCP use-after-free in getsockopt for congestion control info

do_tcp_getsockopt() read icsk_ca_ops without RCU protection; with BPF struct_ops congestion control, the pointer could be freed concurrently via setsockopt, causing a slab use-after-free.

Why it matters: A local attacker could trigger a use-after-free in the TCP stack, potentially leading to privilege escalation.

5271b79b7ad6 385e474086c2

SCTP remote denial of service via crafted ASCONF-ACK

A mismatch between padded and unpadded parameter iteration in ASCONF-ACK processing could cause an infinite loop in softirq context when an attacker sends a crafted odd-length parameter.

Why it matters: A remote peer can trigger a kernel soft lockup on any SCTP-enabled kernel, causing denial of service without application credentials.

2cb0b0b1ed69 6cfc1b90cb86

Bluetooth L2CAP out-of-bounds write fixes

Multiple commits fix out-of-bounds writes in the Bluetooth L2CAP ECRED connection path caused by incorrect channel counting and mode selection, which could corrupt kernel memory.

Why it matters: Bluetooth users could be affected by kernel memory corruption from crafted L2CAP connection requests.

4ef05db5b08b 56c2b5831d39

vsock connected socket source validation

The virtio and VMCI vsock transports did not validate that incoming packets for connected sockets came from the stored peer address, allowing unrelated sources to establish or reset connections.

Why it matters: vsock users are protected against spoofed packets that could hijack or reset connections.

dee44f41f206 ad9a7da3fa39

UDP exception cache side-channel mitigations

ICMP error handling for UDP sockets created FIB nexthop exceptions only after matching a socket, allowing off-path attackers to probe the exception cache and discover ephemeral ports via side-channel.

Why it matters: Connected UDP socket users gain improved protection against off-path attackers discovering ephemeral port numbers.

4c3499f79f8c ac76cab50e89

SELinux BPF token permission TOCTOU fix

The SELinux BPF token access control checks looked up creator SID via the token file descriptor multiple times, allowing a TOCTOU race if the user changes the fd between lookups.

Why it matters: Users of SELinux with BPF token access control are protected against a time-of-check-to-time-of-use race that could bypass permission checks.

77d499e61d36

Bluetooth Intel TLV parsing bounds checks

Several fixes validate TLV value lengths and firmware ID boundaries in the btintel driver to prevent out-of-bounds reads from malformed controller responses.

Why it matters: Users with Intel Bluetooth controllers are protected against kernel memory exposure from malformed device responses.

a086c0892969 ac8aa9e0ec93 3a74624b5dea

s390/pci: uninitialized kernel data leaked in SCLP error reports

report_error_write() did not validate that the user-provided buffer was large enough to contain the report length claimed by the report header, allowing up to ~4K of uninitialized kernel data to leak into the SCLP report.

Why it matters: A privileged entity processing SCLP reports could observe uninitialized kernel memory contents.

8ac60ae2a307

zcrypt CRT key structure leaks kernel memory

The zcrypt CCA CRT key token had uninitialized padding bytes between key components that were sent to the crypto card, potentially leaking kernel memory contents.

Why it matters: s390 zcrypt users are protected against kernel memory leakage to crypto hardware.

98d23edcd414

Device-mapper and block integrity

dm-integrity buffer overflow and infinite loop on discard

A buffer overflow occurs when discard tag size is smaller than digest size, and an infinite loop occurs when tag size exceeds the on-stack buffer, both triggered during discard operations.

Why it matters: Users of dm-integrity with discard support are protected against kernel memory corruption and hangs.

59e6f919d77d 18d80c77b4c7

dm-crypt silent I/O failure race condition

crypt_dec_pending reads io->error before dropping its reference, so a concurrent error update between the read and the decrement can cause a failed read or write to be reported as successful.

Why it matters: dm-crypt users could silently lose data integrity on I/O failures without proper error reporting.

148845aa1921

dm-integrity requires stable writes for internal hash modes

Without stable writes, a buffered writer can modify writeback folios after dm-integrity computes integrity tags but before the lower device consumes the data, causing permanent checksum failures after a crash.

Why it matters: dm-integrity users with internal hash modes gain protection against data corruption and permanent checksum mismatches after crashes.

b2fd92f016e9

dm-integrity NULL pointer crash in read-only recovery mode

If a dm-integrity device has the dirty bitmap flag set and is activated in read-only mode, dm_integrity_resume attempted to read the journal containing the bitmap, causing a NULL pointer dereference.

Why it matters: Users activating dm-integrity devices with a dirty bitmap in read-only mode will no longer experience a kernel crash.

7d4d4f3b668d

Memory management

secretmem bypass of RLIMIT_MEMLOCK and OOM accounting

secretmem folios were treated as mlock'd but remained unevictable until inode eviction, allowing users to bypass RLIMIT_MEMLOCK by mapping and unmapping. The memory was also not counted in RSS, hiding it from the OOM killer.

Why it matters: A process could consume all available memory through secretmem without being constrained by mlock limits or being targeted by the OOM killer.

97d34aa65c29

Transparent huge pages: dirty bit propagation for tmpfs

zap_huge_pmd_folio() propagated the young bit but not the dirty bit for file-backed mappings, which for tmpfs could result in dirty data not being written back since tmpfs lacks page_mkwrite.

Why it matters: Shared writable mappings of tmpfs files using huge pages could silently lose dirty state, risking data not being written back to swap or disk.

fe6cf984939d

memcg v1 soft limit knob made inert

The cgroup v1 memory.soft_limit_in_bytes knob has been deprecated since v6.12 and is now decoupled from its implementation: writes are silently ignored and reads always report the maximum value. This also fixes a syzbot-triggered issue with soft limit reclaim running from kswapd.

Why it matters: Users of cgroup v1 who rely on the soft limit for memory pressure management will find it no longer has any effect; this is the first step toward full removal.

a3417097fb10

Networking bug fixes and performance

IPv4 multipath divide-by-zero crash during route rebalancing

A concurrent change to ignore_routes_with_linkdown could make the first pass of fib_rebalance() compute zero total weight while the second pass sees an eligible nexthop, causing a division by zero.

Why it matters: Systems using IPv4 multipath routing could experience a kernel crash during link state changes.

5046d2880fec

IPv6 Segment Routing Header network header restoration

ipv6_srh_rcv() incorrectly assumed the SRH immediately follows the fixed IPv6 header; when another extension header precedes it, the network offset became negative, breaking flow dissection, BPF, and forwarding.

Why it matters: IPv6 Segment Routing users with Hop-by-Hop or other extension headers get correct routing, forwarding, and BPF flow dissection.

975b5b067f52

IPv6 multicast RCU list corruption fixes

Multiple commits fix RCU-protected IPv6 multicast list updates that used direct pointer assignments or in-place mutations instead of proper copy-on-write or rcu_assign_pointer, causing torn reads and list diversion for concurrent readers.

Why it matters: IPv6 multicast users gain protection against corrupted source filter lists and incorrect group membership checks during concurrent updates.

93b49239840b c073d1b070f1 0c8f56c583c3

IGMP multicast source list converted to RCU for performance

The IGMP source filter list used a spinlock in the multicast receive fast path, causing lock contention; converting to RCU eliminates the spinlock acquisition in packet receive and route lookup paths.

Why it matters: Systems with heavy IPv4 multicast traffic experience reduced lock contention and improved throughput.

2987ee196c88

GRO prevents nesting of hardware-GRO SKBs inside fraglist GRO packets

Fraglist GRO combined with hardware GRO could construct a GSO packet that could not be correctly segmented back during TCP tethering or forwarding. The fix flushes an already-built fraglist GRO packet when a hardware GRO packet arrives.

Why it matters: Users doing TCP tethering or forwarding on systems with hardware GRO support may avoid corrupted segmented packets.

66817a979426

Bonding ALB out-of-bounds memory access via uninitialized transport header

alb_determine_nd() used icmp6_hdr(skb) which dereferences an uninitialized transport_header for packets from raw sockets or forwarded paths. The fix fetches the ICMPv6 header directly after the IPv6 header following pskb_network_may_pull().

Why it matters: Systems using bonding in ALB mode with IPv6 traffic could experience kernel memory corruption or crashes.

70f3995830d3

TIPC NULL dereference on full publication list

When user-space binds more than 65535 service addresses, protocol service types are no longer inserted into the TIPC name table, causing a NULL pointer dereference in the idle task.

Why it matters: TIPC users who bind large numbers of services are protected against kernel crashes and broken topology notifications.

b3b76e9f4f24

page_pool fragment offset alignment for odd-sized requests

page_pool_alloc_frag_netmem() did not round fragment sizes on DMA-coherent architectures like x86, leaving frag_offset misaligned for all subsequent fragments carved from the same shared page.

Why it matters: Network performance on x86 and other DMA-coherent architectures improves as shared page pool fragments stay properly cache-aligned.

dc0df5a0c62c

Revert sleepable static key reset to avoid deadlock

The reverted change replaced a work queue with a direct static_key_disable() call in DO_ONCE_SLEEPABLE(), but callers such as __inet_hash_connect() may hold the socket lock, causing deadlock. The revert restores the work queue approach.

Why it matters: This prevents a potential deadlock when network connections trigger one-time initialization while holding socket locks.

0ba6912f7e97

Hardware support and driver fixes

QMI WWAN driver adds Compal EXM-G1x LTE modem support

Adds the QMI WWAN interface for the Compal EXM-G1x, a Qualcomm SDX12-based LTE modem, using the DTR quirk on interface 8.

Why it matters: Owners of devices with this embedded LTE modem can now use it for cellular connectivity under Linux.

08710f033e3e

amd-xgbe: driver accepted packets with bad checksums

The amd-xgbe driver set the MAC_RCR.DCRCC bit which disabled hardware FCS validation, causing packets with bad frame check sequences to be accepted unconditionally.

Why it matters: Systems with AMD 10GbE network hardware could receive corrupted packets silently.

ac8d6b28d48c

QRTR sends HELLO on endpoint registration to unblock slave-role devices

Previously the HELLO handshake was owned solely by the name server, which could cause a deadlock when both host and remote waited for the other to send first. The handshake is now moved to the core layer.

Why it matters: External peripherals such as WLAN chipsets attached over MHI that operate in a slave role will now reliably establish QRTR communication.

544d85de4dc2

Bluetooth hci_core device registration race

hci_register_dev() queued power_on work before initializing the MSFT extension, allowing hci_power_on() to run msft_do_close() on an uninitialized mutex, causing use-after-free on concurrent teardown.

Why it matters: Bluetooth users are protected against crashes during device registration races on Intel controllers using MSFT extensions.

57938bbdb9bf

Bridge multicast teardown use-after-free fix

During port teardown, br_multicast_del_port() and __br_multicast_disable_port_ctx() could have their hlist walk terminated early if br_multicast_find_del_pg() deleted the iterator's saved next node, leaving dangling port group entries.

Why it matters: Systems using bridge multicast snooping could avoid kernel memory corruption when removing bridge ports with active multicast groups.

5a3f7a683aee

af_packet tpacket negative length BUG() trigger

tpacket_parse_header() cast the user-provided u32 tp_len to int, so values above INT_MAX could produce negative return values interpreted as error codes, triggering BUG() in sock_sendmsg_nosec().

Why it matters: Users of AF_PACKET TPACKET interfaces are protected against kernel BUG() triggers from malformed packet ring headers.

73e594c19b4f

Source commits151 entries +

8ee1ef0f2f8c

mm/hugetlb: fix missing migratable flag on same-node hugetlb migration

Wupeng Ma · Jul 7, 2026 · 1 files

8ac60ae2a307

s390/pci: Fix leak of uninitialized kernel data in SCLP report

Niklas Schnelle · Aug 6, 2026 · 1 files

f3c63b8cabbb

s390/ap: Drop unused member from ap_device_id

Uwe Kleine-König (The Capable Hub) · Aug 6, 2026 · 1 files

7ac81e2d2240

dm-ebs: fix incorrect device offset check in ebs_ctr()

Genjian Zhang · Aug 7, 2026 · 1 files

7b8a8ae4dd17

mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio

Sourav Panda · Aug 11, 2026 · 1 files

439077c39d8f

s390/diag324: Preserve -EBUSY return code

Sumanth Korikkar · Aug 11, 2026 · 1 files

a3417097fb10

memcg: make the v1 soft limit knob inert

Shakeel Butt · Aug 11, 2026 · 2 files

7f918871112e

s390/ipl: Fix NULL deref in kdump without re-IPL parm block

Vasily Gorbik · Aug 13, 2026 · 1 files

37f61b71cbc0

s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block

Vasily Gorbik · Aug 13, 2026 · 1 files

ca1f4a5ecab0

s390/time: Use jiffies instead of jiffies_64

Heiko Carstens · Aug 13, 2026 · 1 files

267bede12d3b

mm/hugetlb: keep max_huge_pages when dissolving surplus folios

Longlong Xia · Aug 14, 2026 · 1 files

b00c10948fa4

s390/cpacf: Unpoison instruction results

Ilya Leoshkevich · Aug 14, 2026 · 1 files

77d499e61d36

selinux: fix BPF token permission checks

Paul Moore · Aug 14, 2026 · 1 files

eedc8474d469

mm/hugetlb_cgroup: call page_counter_set_max() outside VM_BUG_ON()

Narek Jilavyan · Aug 17, 2026 · 1 files

dc41e961a269

mm/migrate_device: avoid out-of-bounds writes for compound folios

Hui Su · Aug 17, 2026 · 1 files

2fd4e7693674

mm: fix incorrect vm_flags usage when checking allowable orders for tmpfs

Baolin Wang · Aug 18, 2026 · 2 files

2ccb8878c149

dm cache: fix demotion stats in passthrough mode

Ming-Hung Tsai · Aug 18, 2026 · 1 files

f025ca73decd

userfaultfd: reset err to be 0 when move_pages_ptes succeeded

Bryan Lim · Aug 19, 2026 · 1 files

f3110e969ad2

s390/pai: Handle multiple PMU stop callback invocations

Thomas Richter · Aug 19, 2026 · 1 files

fe6cf984939d

mm/huge_memory: transfer the pmd dirty bit to the folio on zap

Usama Arif · Aug 19, 2026 · 1 files

a0c798ed4103

s390/boot: Fix physical memory search range

Vasily Gorbik · Aug 19, 2026 · 1 files

d76181dfabda

s390/boot: Avoid IPL parameter append past command line

Vasily Gorbik · Aug 19, 2026 · 1 files

12373ea918a0

s390/boot: Bound command line facility ranges

Vasily Gorbik · Aug 19, 2026 · 2 files

6e0803a17055

MAINTAINERS: add Lance Yang as a hung task detector co-maintainer

Lance Yang · Aug 20, 2026 · 1 files

a91a5c25a2c3

s390/zcrypt: Validate length in reply before using it

Holger Dengler · Aug 20, 2026 · 1 files

59e6f919d77d

dm-integrity: fix buffer overflow with keyed discard

Ben Cressey · Aug 20, 2026 · 1 files

18d80c77b4c7