Daily update · Sep 5–6, 2026
NVMe/TCP security fixes, UFS and btrfs improvements, LoongArch hardening
A batch of mainline kernel fixes targets NVMe/TCP memory corruption, UFS performance, btrfs compression hangs, and LoongArch KVM security.
In brief
Today's mainline kernel updates focus heavily on NVMe/TCP security and reliability, storage improvements for UFS and zoned devices, btrfs fixes, and LoongArch-specific hardening.
NVMe
Reject NVMe/TCP data packets for write commands
The NVMe/TCP driver now validates the data direction of C2HData PDUs and rejects data sent in response to write commands.
Why it matters: Prevents a malicious or buggy NVMe controller from triggering a kernel warning that can panic systems with panic_on_warn.
Fix out-of-bounds write in NVMe-over-TCP target
The NVMe target's TCP receive path did not bound the PDU payload length against the fixed 128-byte buffer, so a second ICReq with a header digest can write 4 bytes past the end. This is reachable by a remote peer.
Why it matters: Prevents a remote attacker from corrupting kernel memory on systems exposing an NVMe/TCP target.
Reject unsolicited data PDUs in NVMe-over-TCP target
The NVMe-over-TCP target accepted H2CData PDUs without checking that the target had solicited data with an R2T, letting a remote host complete a write command early and trigger double completion.
Why it matters: Prevents remote NVMe/TCP peers from causing double completions and memory corruption on the target.
Fix NVMe/TCP TLS deadlock by moving sends to workqueue
The inline send path for NVMe/TCP with TLS can trigger circular locking because the block layer holds srcu while the kTLS software path takes tx_lock; TLS queues now defer sends to the workqueue.
Why it matters: Avoids lockdep warnings and potential deadlock for NVMe/TCP users with TLS enabled.
Fix use-after-free in NVMe target authentication teardown
The NVMe target cancelled delayed authentication expiry work without waiting if it was already running, so SQ teardown could free the queue while the callback still accessed it; a synchronous drain is now used during teardown.
Why it matters: Prevents a rare use-after-free crash in NVMe target setups using in-band authentication.
Print NVMe namespace IDs as unsigned values
NVMe namespace IDs are now printed with %u instead of %d in logs and sysfs, so IDs above 2^31 no longer appear negative.
Why it matters: Makes NVMe namespace identification and scripting less confusing for devices with high or sparse NSIDs.
Fix soft lockup when scanning sparse NVMe namespace IDs
NVMe scanning now removes stale namespaces by range instead of iterating one by one through every NSID in a gap.
Why it matters: Prevents kernel soft lockups on systems with NVMe targets that report widely spaced namespace IDs.
Block and storage
Improve sequential read performance on Qualcomm UFS storage
The Qualcomm UFS driver raises the devfreq down-differential threshold from 5% to 65%, reducing overly aggressive clock downscaling during sequential reads.
Why it matters: Qualcomm-based phones and devices should see more consistent sequential read throughput.
Enable Intel UFS 4.0 Gear5 and MCQ support
Adds link adaptation setup for reliable HS-Gear5 operation and wires up the register blocks needed for Multiple Circular Queues on Intel UFS 4.0 controllers.
Why it matters: Intel UFS 4.0 SSDs can now use higher link speeds and multi-queue I/O, improving performance and reliability.
Stop partition scanning on zoned block devices
Zoned disks now set GENHD_FL_NO_PART, so the kernel no longer scans partition tables on them.
Why it matters: Avoids read operations that can hit offline zones on SMR/ZNS drives and eliminates misleading partition warnings.
Fix direct I/O alignment handling for loop devices
Loop and zloop drivers now fall back to block-device limits when the backing file reports no valid direct I/O alignment, and cap unreasonably large alignment values.
Why it matters: Prevents kernel warnings and potential misbehavior when using loop devices with filesystems that have large block sizes or lack direct I/O support.
Filesystems
Restore security xattr listing on sysfs files
kernfs listxattr now includes security xattrs such as SELinux labels even when no inode attributes are allocated.
Why it matters: Fixes SELinux and other security tooling that needs to enumerate labels on sysfs entries.
Stop chattr from changing btrfs compression algorithm
btrfs now preserves the per-file compression property when unrelated inode flags are changed, instead of resetting it to the mount default.
Why it matters: Users no longer lose their chosen btrfs compression setting when using chattr for other flags.
Fix btrfs zstd compression hang
A lost-wakeup bug in the btrfs zstd workspace pool could leave writers sleeping forever even when a workspace became available.
Why it matters: Prevents rare but severe hangs on btrfs filesystems using zstd compression under memory pressure.
Security hardening
Prevent write upgrade on read-only ublk mmaps
The ublk driver now clears VM_MAYWRITE on read-only command-buffer mappings, so mprotect cannot make them writable.
Why it matters: Closes a security issue where an unprivileged ublk daemon could corrupt kernel-written I/O descriptors.
Fix io_uring SCSI passthrough buffer overruns
The SCSI bsg passthrough path now caps sense-data copies to the user buffer size and closes a time-of-check/time-of-use race on the shared SQE.
Why it matters: Prevents userspace from overflowing kernel command buffers or overrunning response buffers when using io_uring SCSI passthrough.
LoongArch
Validate MSI data in LoongArch KVM to prevent kernel memory corruption
LoongArch KVM passed userspace-supplied MSI data directly into EIOINTC bitmaps without validating it against EIOINTC_IRQS; values >= 256 index past the end of kernel arrays.
Why it matters: Prevents any process with a VM file descriptor from corrupting host kernel memory on LoongArch KVM systems.
Fix LoongArch kretprobe corruption when tasks migrate CPUs
LoongArch's rethook trampoline saved and restored the per-CPU base register around a handler that can preempt; if the task migrated, the stale register poisoned the new CPU's per-CPU data. The trampoline no longer saves/restores it.
Why it matters: Prevents scheduler, timer, and RCU corruption on LoongArch under kretprobe-heavy workloads.
Fix preempt count underflow from userspace breakpoints on LoongArch
LoongArch uses break 11 for kprobes, but userspace can execute the same instruction; the kprobe handler then calls preempt_enable without a matching preempt_disable, underflowing the task's preempt count.
Why it matters: Fixes incorrect in_interrupt() state and socket cgroup attribution; unprivileged userspace can trigger the bug on LoongArch.
Source commits82 entries +
scsi: sg: Report request-table problems when any status is set
Xu Rao · Jul 6, 2026 · 1 files
scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands
Maurizio Lombardi · Jul 17, 2026 · 1 files
scsi: target: iscsi: Reserve a terminator byte for the login payload
Sujal Tuladhar · Aug 1, 2026 · 1 files
btrfs: clean up target device if block group marking fails
Guanghui Yang · Aug 8, 2026 · 1 files
btrfs: send: fix lost error return value in will_overwrite_ref()
Avi Weiss · Aug 10, 2026 · 1 files
btrfs: detach failed sprout device from transaction update list
Guanghui Yang · Aug 10, 2026 · 1 files
btrfs: restore active device pointers after failed sprout
Guanghui Yang · Aug 10, 2026 · 1 files
loop, zloop: fix dma_alignment for large or unreported limits
Keith Busch · Aug 10, 2026 · 2 files
btrfs: tests: do not touch page cache if root/inode allocation failed
Qu Wenruo · Aug 11, 2026 · 1 files
nvme: add opcode filtering for fault injection
Mohamed Khalfella · Aug 11, 2026 · 3 files
scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()
Milan P. Gandhi · Aug 12, 2026 · 1 files
scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()
Milan P. Gandhi · Aug 12, 2026 · 1 files
nvmet-rdma: fix queue leak when connect backlog is exceeded
Xixin Liu · Aug 13, 2026 · 1 files
nvme-fabrics: fix DHCHAP secret leak on parse failure
Xu Rao · Aug 13, 2026 · 1 files
btrfs: preserve the compression property when other inode flags change
Sam Ho · Aug 14, 2026 · 1 files
nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails
Niklas Cassel · Aug 14, 2026 · 1 files
btrfs: scrub: report the failing sector's address, not the stripe base
James C. Owens · Aug 14, 2026 · 1 files
nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
Shivam Kumar · Aug 14, 2026 · 1 files
nvme: add missing SRCU grace period in error path
Tristan Madani · Aug 15, 2026 · 1 files
btrfs: fix transaction use-after-free in raid stripe insertion
Shuangpeng Bai · Aug 17, 2026 · 1 files
btrfs: fix the possible bioc_list memory leak during error
Qu Wenruo · Aug 17, 2026 · 3 files
btrfs: return proper negative error code for update_raid_extent_item()
Qu Wenruo · Aug 17, 2026 · 1 files
scsi: bsg: Cap io_uring sense copy to max_response_len
Yang Xiuwei · Aug 17, 2026 · 1 files
scsi: bsg: Fix TOCTOU in io_uring passthrough command setup
Rahul Chandelkar · Aug 17, 2026 · 1 files
btrfs: send: reject extents for non-regular inodes
ZhengYuan Huang · Aug 17, 2026 · 1 files
nvme: skip the zoned limits update if the zone info query failed
Chao Shi · Aug 17, 2026 · 1 files
nvme: set ns->head in nvme_alloc_ns_head
Kanchan Joshi · Aug 18, 2026 · 1 files
nvme: fix racy access to FDP placement id array
Kanchan Joshi · Aug 18, 2026 · 2 files
btrfs: zoned: propagate do_zone_finish() error in btrfs_zone_finish_endio()
Johannes Thumshirn · Aug 18, 2026 · 1 files
nvme-tcp: check the data direction of a C2HData PDU
Yehyeong Lee · Aug 18, 2026 · 1 files
scsi: ufs: ufs-pci: Add support for Intel UFS 4.0 HS-Gear5
sangram kumar yerra · Aug 18, 2026 · 1 files
scsi: ufs: ufs-pci: Add MCQ support for Intel UFS 4.0 controllers
sangram kumar yerra · Aug 18, 2026 · 1 files
firmware_loader: Change contact for sysfs nodes
Russ Weight · Aug 18, 2026 · 1 files
CREDITS: Add CREDITS entry for Firmware Upload
Russ Weight · Aug 18, 2026 · 1 files
MAINTAINERS: Remove Russ Weight from Firmware Loader
Russ Weight · Aug 18, 2026 · 1 files
btrfs: abort transaction before releasing tree_log_mutex on commit failure
Leo Martins · Aug 19, 2026 · 1 files
nvme-tcp: defer TLS inline send to io_work
Xixin Liu · Aug 19, 2026 · 1 files
nvme-rdma: fix -EIO cleanup order in queue_rq
Xixin Liu · Aug 19, 2026 · 1 files
btrfs: zoned: finish active block group cleanup if call_zone_finish() fails
Johannes Thumshirn · Aug 19, 2026 · 1 files
scsi: fnic: Initialize the NVMe local port info before registering
Linmao Li · Aug 19, 2026 · 1 files
block: save page offset gaps in cloned bio
Keith Busch · Aug 19, 2026 · 1 files
btrfs: do not force reloc root creation during qgroup_account_snapshot()
Qu Wenruo · Aug 20, 2026 · 1 files
drivers: base: test: DRIVER_PE_KUNIT_TEST should not select OF
Geert Uytterhoeven · Aug 20, 2026 · 2 files
btrfs: zstd: fix lost wakeup when waiting for a workspace
FAN YE · Aug 21, 2026 · 1 files
nvme: print namespace IDs as unsigned 32bit value
Mohamed Khalfella · Aug 21, 2026 · 3 files
nvmet: print namespace IDs as unsigned 32bit value
Mohamed Khalfella · Aug 21, 2026 · 3 files
kernfs: preserve security xattrs without allocating iattrs
Hengyu Liang · Aug 22, 2026 · 1 files
nvme: remove stale namespaces by NSID range during scan
Mohamed Khalfella · Aug 23, 2026 · 1 files
nvme-tcp: return -EPROTO for a C2HData on a write
Yehyeong Lee · Aug 23, 2026 · 1 files
scsi: pm8001: Use rollback index when freeing MSI-X vectors
Runyu Xiao · Aug 24, 2026 · 1 files
scsi: ufs: ufs-qcom: Restore HS/LS link startup mode for Qualcomm UFS controller v6.2+
Nitin Rawat · Aug 25, 2026 · 2 files
scsi: ufs: ufs-qcom: Fix sequential read variance
Nitin Rawat · Aug 25, 2026 · 1 files
scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()
Ivy Lopez · Aug 25, 2026 · 1 files
nvmet: reject namespace enable without device path
Seokgyu Choi · Aug 27, 2026 · 1 files
scsi: ibmvfc: Fix kernel-doc name for ibmvfc_scsi_relogin()
Muhammad Falak R Wani · Aug 27, 2026 · 1 files
scsi: ibmvfc: Document protocol parameter of ibmvfc_alloc_target()
Muhammad Falak R Wani · Aug 27, 2026 · 1 files
scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame
Thomas Lamprecht · Aug 27, 2026 · 1 files
nvmet-tcp: reject unsolicited H2CData PDUs
Shivam Kumar · Aug 27, 2026 · 1 files
MAINTAINERS: update Chris Mason's email address
Chris Mason · Aug 27, 2026 · 1 files
ublk: clear VM_MAYWRITE on read-only ublk char device mmap
Kanishka De Silva · Aug 30, 2026 · 1 files
nvmet-auth: Synchronize timeout work during SQ teardown
Kazuki Hanai · Aug 30, 2026 · 3 files
block: flag zoned disks with GENHD_FL_NO_PART
Damien Le Moal · Aug 31, 2026 · 1 files
nvme-tcp.h: drop kernel-doc comments, fix a few descriptions
Randy Dunlap · Aug 31, 2026 · 1 files
scsi: mpi3mr: Fix use-after-free on tgt_dev->starget during target device refresh/update
Laurence Oberman · Aug 31, 2026 · 1 files
rust: pci: reject IRQ vector indices that do not fit in u32
Sophon Zhang · Aug 31, 2026 · 1 files
MAINTAINERS: update nvme entry
Keith Busch · Sep 1, 2026 · 1 files
treewide: refresh kmalloc_obj() conversions
Kees Cook · Sep 2, 2026 · 304 files
drm/amd/display: Fix harmless type mismatch in allocation
Kees Cook · Sep 3, 2026 · 1 files
LoongArch: Do not select HAVE_RUST when KASAN is enabled
Nathan Chancellor · Sep 4, 2026 · 1 files
LoongArch: Fix typo "avaliable" in comment of vmlinux.lds.S
Hemanth Selam · Sep 4, 2026 · 1 files
LoongArch: BPF: Fix off-by-one error for insn_is_cast_user()
Tiezhu Yang · Sep 4, 2026 · 1 files
LoongArch: Remove unused setup_profiling_timer() function
Anthony Iliopoulos · Sep 4, 2026 · 1 files
LoongArch: Avoid preempt count underflow without probe
Jérémy Jean · Sep 4, 2026 · 1 files
LoongArch: Do not save/restore percpu base register in rethook trampoline
Wentao Guan · Sep 4, 2026 · 1 files
LoongArch: KVM: Add unregister helpers for the KVM interrupt devices
Chaithanya Lagisetty · Sep 4, 2026 · 8 files
LoongArch: KVM: Free init resources if kvm_init() fails
Chaithanya Lagisetty · Sep 4, 2026 · 1 files
LoongArch: KVM: Remove unused function kvm_arch_flush_remote_tlbs_memslot()
Bibo Mao · Sep 4, 2026 · 2 files
LoongArch: KVM: Fix resource leak in kvm_loongarch_env_init() error path
Chaithanya Lagisetty · Sep 4, 2026 · 1 files
LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY
Zeng Chi · Sep 4, 2026 · 1 files
LoongArch: KVM: Validate MSI data before routing it to EIOINTC
Zeng Chi · Sep 4, 2026 · 1 files
LoongArch: KVM: Fix TOCTOU race on pv_features
Tao Cui · Sep 4, 2026 · 3 files
perf build: Add clang and rust target flags for LoongArch
Haiyong Sun · Sep 4, 2026 · 1 files