Daily update · Sep 13–14, 2026
Linux kernel: MADV_FREE data-loss fix, x86 hardening, and laptop WiFi/camera fixes
Stability and security fixes across memory management, scheduler, boot, and hardware support.
In brief
This batch of mainline patches closes memory-management races that could corrupt data or crash x86 systems, corrects scheduler accounting, hardens initrd handling, and restores WiFi/camera support on affected laptops.
Core memory and x86 fixes
Fix user-space data loss with MADV_FREE and THP
A bug in x86 page table handling stripped the hardware dirty bit from huge pages, so pmd_mksaveddirty() could not preserve data when write-protecting pages during reclaim. This caused silent data loss for applications using MADV_FREE on systems with Transparent Huge Pages.
Why it matters: Prevents silent data corruption that could affect production workloads, especially data analytics applications.
Fix bootconfig initrd overflow that could crash the kernel
A crafted initrd with a huge bootconfig size could wrap pointer arithmetic and bypass bounds checks, leading to a kernel page fault during early boot.
Why it matters: Hardens the boot path against malicious initrds, preventing a denial-of-service at boot time.
Fix kernel crash in x86 alternatives patching
A race between text poking and change_page_attr() could trigger a BUG in __text_poke, causing a kernel crash during module loading or static call updates.
Why it matters: Eliminates a rare but serious crash on x86 systems, particularly during boot or driver loading.
Fix use-after-free races in x86 page attribute changes
Concurrent page table collapse and attribute changes could free page tables while still in use, leading to use-after-free. The fixes add proper locking for CPA operations.
Why it matters: Prevents potential memory corruption and security vulnerabilities on x86 systems.
Scheduler and timekeeping fixes
Fix EEVDF scheduler augmented tree bugs
The EEVDF runqueue's augmented fields (min/max slice) were not correctly initialized or propagated during tree rotations, which could mislead scheduling decisions.
Why it matters: Improves scheduler correctness and fairness, potentially benefiting all workloads.
Fix CPU time and workqueue accounting with proxy execution
Proxy execution charged cgroup CPU usage and workqueue ticks to the donor task instead of the actual executing task, leading to incorrect accounting and potential workqueue delays.
Why it matters: Ensures accurate cgroup CPU usage and avoids delayed kernel work when proxy execution is used, important for container resource management.
Fix race in tick broadcast device replacement
A race when replacing a broadcast clockevent device could arm a detached device, triggering a BUG during CPU hotplug.
Why it matters: Prevents a kernel crash during CPU hotplug operations on systems using broadcast timers.
Hardware support fixes
Fix MediaTek WiFi probe failures
Two MediaTek wireless fixes: the mt7921 driver now accepts newer CLC firmware records instead of rejecting them, and mt76 ACPI SAR power initialization is corrected to avoid dereferencing uninitialized ranges.
Why it matters: Prevents WiFi probe failures after linux-firmware updates and avoids a NULL pointer crash on laptops with MediaTek wireless.
Fix missing internal camera on Intel IVSC laptops
A prior CVS device lookup change broke camera detection on laptops where the sensor is behind Intel IVSC, such as Dell XPS 16 9640, so no sensor subdevice or media entity was registered. The fix stops using the CVS lookup for IVSC, restoring sensor detection.
Why it matters: Users of affected Intel IPU6 laptops will see their internal camera in Linux again instead of no camera at all.
Source commits59 entries +
tick/broadcast: Plug clockevents replacement race
Thomas Gleixner · Aug 12, 2024 · 3 files
EDAC/altera: Use parent device for devres in altr_portb_setup()
Dinh Nguyen · Jun 17, 2026 · 1 files
x86/div64: Fix addition of large constants in mul_u64_add_u64_div_u64()
David Laight · Aug 3, 2026 · 1 files
perf/x86/intel: Prevent drain_pebs() reentry
Dapeng Mi · Aug 13, 2026 · 3 files
x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF
Lorenzo Stoakes (ARM) · Aug 13, 2026 · 2 files
x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF
Lorenzo Stoakes (ARM) · Aug 13, 2026 · 1 files
x86/alternatives: Exclude text poking against change_page_attr()
Pedro Falcato · Aug 13, 2026 · 1 files
x86/mm/pat: Allocate split page tables as kernel page tables
Lorenzo Stoakes (ARM) · Aug 13, 2026 · 1 files
klp-build: Fix wrong index in funcs cleanup error path
Yafang Shao · Aug 16, 2026 · 1 files
wifi: mt76: mt7921: skip unknown CLC firmware records
Laxman Acharya Padhya · Aug 16, 2026 · 1 files
ftrace: fork: Initialize function graph state before copy_exec_state()
Jérémy Jean · Aug 22, 2026 · 1 files
wifi: mt76: mt792x: fix NULL dereference in ACPI SAR init during probe
Devin Wittmayer · Aug 25, 2026 · 1 files
drm/panic: clean new `clippy::needless_range_loop` lint for Rust 1.100.0
Miguel Ojeda · Aug 26, 2026 · 1 files
rust: samples: add missing newlines in rust_print_main
Mehmet Koseoglu · Aug 28, 2026 · 1 files
rust: pin-init: use irrefutable pattern for `stack_pin_init`
Gary Guo · Aug 28, 2026 · 1 files
objtool/klp: Fix checksums for constant pool references
Josh Poimboeuf · Aug 28, 2026 · 1 files
x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()
Soheil Hassas Yeganeh · Aug 31, 2026 · 1 files
sched/core: Call wq_worker_tick() for the execution context
Hui Su · Sep 2, 2026 · 1 files
media: ipu-bridge: do not use the CVS device lookup for IVSC
Sergey Zagursky · Sep 2, 2026 · 1 files
x86/mm: Fix user-space data loss with MADV_FREE and THP
Vernon Yang · Sep 3, 2026 · 1 files
x86/amd_node: Fix PCI device reference counting in amd_smn_init()
Yazen Ghannam · Sep 3, 2026 · 1 files
sched: Account cgroup CPU time to the execution context
Hui Su · Sep 4, 2026 · 1 files
tracing/user_events: Don't destroy fields when event removal fails
Henry Martin · Sep 4, 2026 · 1 files
entry: Guard syscall_enter_audit() invocation with CONFIG_AUDITSYSCALL
Thomas Gleixner · Sep 5, 2026 · 1 files
rust: num: seal Integer
Younes Akhouayri · Sep 5, 2026 · 1 files
fgraph: Remove unused FGRAPH_MAX_INDEX
Donggeun Yoo · Sep 5, 2026 · 1 files
function_graph: Use the saved entry's size when reprinting it
Donggeun Yoo · Sep 6, 2026 · 1 files
tracing: Free histogram var refs regardless of how often they are referenced
Donggeun Yoo · Sep 6, 2026 · 1 files
tracing: Free histogram the var ref when its initialization fails
Donggeun Yoo · Sep 6, 2026 · 1 files
rust: allow `clippy::as_underscore` in the generated bindings
John Hubbard · Sep 6, 2026 · 2 files
tracing: Free histogram the field rejected for a bad modifier
Donggeun Yoo · Sep 7, 2026 · 1 files
tracing: Let histogram values keep the percent and graph modifiers
Donggeun Yoo · Sep 7, 2026 · 1 files
tracing: Keep the entry count when the histogram stats allocation fails
Donggeun Yoo · Sep 7, 2026 · 1 files
tracing: Fix typo "availabe" in comment
Hemanth Selam · Sep 7, 2026 · 1 files
tracing: Fix typo "preceeded" in comment
Hemanth Selam · Sep 7, 2026 · 1 files
tracing: Set the trace clock before registering the histogram trigger
Donggeun Yoo · Sep 7, 2026 · 1 files
sched/eevdf: Fix augmented max_slice
Vincent Guittot · Sep 7, 2026 · 1 files
tracing: Take the reference before publishing the named histogram trigger
Donggeun Yoo · Sep 7, 2026 · 1 files
tracing: Undo the registration when enabling the histogram trigger fails
Donggeun Yoo · Sep 7, 2026 · 1 files
tracing: Fix memory corruption from the histogram stacktrace modifier
Donggeun Yoo · Sep 7, 2026 · 1 files
tracing: Fix memory corruption from a "STACKTRACE" histogram key
Donggeun Yoo · Sep 7, 2026 · 1 files
irqchip/gic-v5: Preserve ICC_CR0_EL1 state
Sascha Bischoff · Sep 7, 2026 · 2 files
tracing: Restore :mod: trailer after parsing in ftrace_set_clr_event()
Thomas Weißschuh · Sep 8, 2026 · 1 files
perf/x86/intel: Correct pt_regs->flags update for PEBS path
Dapeng Mi · Sep 8, 2026 · 1 files
perf/core: Allow list_del during perf_event_overflow()
Thomas Richter · Sep 8, 2026 · 1 files
rust: allow `unknown_lints` in generated bindings for Rust < 1.88
Miguel Ojeda · Sep 8, 2026 · 2 files
tracing: Fix ring_buffer_read_page_size() kernel-doc
Karl Mehltretter · Sep 9, 2026 · 1 files
sched/eevdf: Fix rb augmented with multi fields
Vincent Guittot · Sep 9, 2026 · 2 files
hrtimer: Use hard expiry when updating timers on the same base
Andrea Parri · Sep 10, 2026 · 1 files
tools/bootconfig: Fix integer overflow and truncation in size checks
Masami Hiramatsu (Google) · Sep 10, 2026 · 1 files
bootconfig: Fix integer overflow in initrd size check
Masami Hiramatsu (Google) · Sep 10, 2026 · 1 files
tracing: Take trace_array reference when opening a tracer options file
Steven Rostedt · Sep 11, 2026 · 2 files
ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters()
Sebastian Andrzej Siewior · Sep 11, 2026 · 1 files
ftrace: Use rcu_assign_pointer() for tmp_ops filter hash
Leon Hwang · Sep 11, 2026 · 1 files
tracing: Don't dereference trace_event_file in deferred trigger free
Ali Ahmet Memiş · Sep 11, 2026 · 2 files
tracing/remotes: Account for ring buffer page header in size calculation
Vincent Donnefort · Sep 11, 2026 · 2 files
tracing/remotes: Catch nr_page_va overflow in ring_buffer_desc sizing
Vincent Donnefort · Sep 11, 2026 · 2 files
ring-buffer: Check resize_disabled before publishing the new subbuf order
David Carlier · Sep 12, 2026 · 1 files
Linux 7.3-rc3
Linus Torvalds · Sep 13, 2026 · 1 files