Daily update · Sep 17–18, 2026

Linux kernel daily: networking, WiFi, Bluetooth, and USB audio fixes

A roundup of today's mainline kernel changes, covering memory-safety fixes, wireless and Bluetooth reliability, USB audio stability, and more.

Hardware support Security and hardening

#bluetooth #hardware-support #networking #security #usb-audio #wifi

207 meaningful commitsDaily snapshot

In brief

Today's mainline kernel updates bring a broad set of fixes: memory-safety hardening across IPsec, TCP, netlink, and packet sockets; WiFi scanning and authentication reliability; Bluetooth LE privacy and security fixes; USB audio stability and device quirks; plus DMA and platform hardware corrections.

Networking & security

Fix multiple IPsec/XFRM memory-safety bugs

A series of fixes addresses out-of-bounds reads, use-after-free, and memory corruption in the XFRM IPsec stack, including IP-TFS, compat ALLOCSPI, bundle creation, and input paths.

Why it matters: IPsec VPN users get a more stable and secure kernel, with fewer potential crash or exploit vectors.

d042487dc118 dc33262be1fe 6973a21ee73c d1ebd9081879 9fa903b24b1f 3cf5cdecd99c 2afb8dc1f439 f89416eb3db1

Harden network protocol handling against races and malformed packets

Fixes memory-safety issues in TCP ACK validation, netlink group bitmap resizing, socket timestamp ioctls, WWAN modem parsing, AF_PACKET TPACKET rings, pskb_carve, the Unix socket garbage collector, and rejects too-low tcp_rmem values.

Why it matters: Reduces crash and memory-corruption risk from malicious or buggy network traffic and long-running socket usage.

f81e6c3fb063 ceac0de741bf 9ed55f3dbef4 5d063822ac51 31550d585589 c7ead9704249 33ff111d7ba3 37213e611202 a5117e1eccac 4a4263dfeaba 83a945a529d6

Fix MPTCP receive path and scheduler race

MPTCP recvmsg() could return 0 instead of an error when another thread disconnected the socket, and the scheduler could race with subflow state changes and use mss_now reset to zero in a division. Both paths are now handled explicitly.

Why it matters: Improves MPTCP connection stability and prevents spurious end-of-stream or potential divide-by-zero crashes.

60404266ef3e 42064de57fb8

Network scheduler, tunnel, and driver fixes

Prevents a soft lockup via tiny CoDel intervals, caps HHF flow limits to avoid memory exhaustion, fixes a kernel panic when adding Geneve tunnel options, and corrects Ethernet driver issues affecting ethtool filters, TSO with long IPv6 headers, and PTP timestamp accuracy.

Why it matters: More stable networking under load, with specific qdisc configurations, tunnel options, and on Broadcom/Synopsys/Cadence hardware.

7f4a5ec6258f 2cef2588c995 455ebeadf714 23ca4ddc4fce 15989abd74f1 9ca4ba242591

WiFi

WiFi scanning and regulatory fixes

Fixes scan probe handling, prevents a use-after-free when scans are cancelled, and reduces lock contention during regulatory updates.

Why it matters: More reliable WiFi scanning and fewer stalls when regulatory settings change.

f5dd0626d2b0 23c68b4aaf5e dab68a74e90b f4e72e375807

Broadcom WiFi authentication fixes

Fixes WPA3/SAE reassociation issues and delays in 802.1x authentication on Broadcom chips.

Why it matters: More reliable WPA2/WPA3 connections on Broadcom WiFi hardware.

e2de8d5eb298 621d90169cef

Bluetooth

Bluetooth connection and shutdown fixes

Corrects address type handling for LE privacy addresses and prevents dropped data during disconnects.

Why it matters: More reliable Bluetooth LE connections to privacy-focused devices and fewer transfer failures on shutdown.

4914c4998961 555cd2bd860e 6610c6fe4b89

Bluetooth security and MediaTek fixes

Hardens Bluetooth discovery and controller parsing against malformed data, and fixes MediaTek WMT handling.

Why it matters: Better security and stability for Bluetooth devices, especially with MediaTek controllers.

e8241766794c d0795cfd6f65 78b6abd6c7a7 8879e3e0a84a

USB audio & sound

USB audio stability fixes

Fixes memory corruption and crashes in USB audio handling, including buffer overflows and races during card release.

Why it matters: More stable USB audio devices, especially when disconnecting or restarting.

76a986c980bb fd95e68df6fe dbd9d1cbf970

USB audio device quirks

Adds support for the Behringer FCA1616 and removes a non-functional mute control on AVerMedia capture cards.

Why it matters: Better audio capture on these devices and cleaner mixer controls.

beb34fe8312e 5ab3dc647751

Hardware & core

DMA and memory allocation fixes

Corrects DMA bounce buffer handling and reserved memory assignment, and fixes allocation for IOMMU-backed devices on AMD SME/SEV systems.

Why it matters: Prevents silent data corruption and allocation failures on systems with specific DMA configurations.

b7d7914a9ae3 504981db4f69 55a8e1451869

Platform hardware support

Adds mute LED support for HP OmniBook 7 laptops and fixes GPIO hogs in device tree overlays.

Why it matters: Better laptop indicator support and correct GPIO behavior on embedded systems.

1c4f6202876a 1f1d0812f6a8

Source commits207 entries +

d042487dc118

xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()

Roshan Kumar · Jul 28, 2026 · 1 files

89fefad9f971

xfrm: serialize state GC with device state flush

Chengfeng Ye · Jul 30, 2026 · 1 files

2afb8dc1f439

xfrm: use hlist_del_init_rcu for state_cache and state_cache_input

Siwei Zhang · Jul 30, 2026 · 1 files

42d100f5232f

xfrm: add missing RCU read lock in xfrm_send_migrate_state()

Aleksandr Nogikh · Jul 31, 2026 · 1 files

820b8cff81c7

wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()

Nicolas Escande · Jul 31, 2026 · 1 files

dc33262be1fe

xfrm: iptfs: fix runt reassembly panic from short inner tot_len

Henry Martin · Aug 3, 2026 · 1 files

6973a21ee73c

ipv6: xfrm: use full sockets in local error paths

Zhiling Zou · Aug 3, 2026 · 1 files

d1ebd9081879

xfrm: fix compat ALLOCSPI request use-after-free

Kyle Zeng · Aug 4, 2026 · 1 files

ba6cb7c0868a

wifi: wilc1000: fix out-of-bounds read in P2P public action frames

Ali Ahmet Memis · Aug 7, 2026 · 1 files

e2de8d5eb298

wifi: brcmfmac: cyw: pass PMKID to firmware if present

Bogdan Nicolae · Aug 7, 2026 · 1 files

d2f5082f9e84

xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()

Eric Dumazet · Aug 7, 2026 · 1 files

da2ca406f45a

wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver

Rik van Riel · Aug 8, 2026 · 1 files

f9edf7cf63b9

wifi: virt_wifi: free skb when disconnected

Mariano Baragiola · Aug 9, 2026 · 1 files

621d90169cef

wifi: brcmfmac: fix lost 802.1x TX completion wakeup

Karl Mehltretter · Aug 11, 2026 · 1 files

5ce5721e8cbe

wifi: libipw: reject too-short beacon and probe responses

Shmulik Cohen · Aug 12, 2026 · 1 files

adb7118b7d2c

wifi: libipw: reject too-short association responses

Shmulik Cohen · Aug 12, 2026 · 1 files

c46cfaf8db42

wifi: ipw2x00: bound management frame length to the receive buffer

Shmulik Cohen · Aug 12, 2026 · 2 files

16b10f64c63f

gpiolib: Put fwnode reference on failure

Michail Tatas · Aug 13, 2026 · 1 files

e667aee1c192

wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length

Doruk Tan Ozturk · Aug 14, 2026 · 1 files

bbb9a0ab96d4

wifi: libertas_tf: fix UAF in lbtf_free_adapter()

Jiangshan Yi · Aug 15, 2026 · 1 files

1eeca1d5e092

wifi: brcmsmac: fix UAF in brcms_free_timer()

Jiangshan Yi · Aug 15, 2026 · 1 files

3687d7d48070

wifi: mwifiex: validate scan response extents

Pengpeng Hou · Aug 15, 2026 · 1 files

1f1d0812f6a8

gpiolib: of: don't mark hog nodes OF_POPULATED before a chip is found

Abdurrahman Hussain · Aug 15, 2026 · 1 files

f89416eb3db1

esp: downgrade zerocopy managed frags before mutating skb frags

Maher Azzouzi · Aug 17, 2026 · 2 files

4e93c65f8782

Bluetooth: hci_qca: Do not write to the serial port after it is closed

Ibrahim Abdelkader · Aug 19, 2026 · 1 files

fa00193eb991

wifi: mwifiex: prevent authentication frame length truncation

Linmao Li · Aug 20, 2026 · 1 files

b5526b780f8b

wifi: iwlegacy: fix broadcast stations deallocation

Stanislaw Gruszka · Aug 20, 2026 · 1 files

8a1f3cf89ddc

wifi: wlcore: release runtime PM ref on regdomain config failure

Runyu Xiao · Aug 20, 2026 · 1 files

2725ab3f5ad1

keys: fix lost wakeup when reaping a dead key type

Karl Mehltretter · Aug 21, 2026 · 1 files

0d6a4268b060

keys: translate request_key_auth pid for the reading procfs instance

Maoyi Xie · Aug 21, 2026 · 2 files

9a10987a2f16

Bluetooth: hci_sync: Serialize local codec list cleanup

Chengfeng Ye · Aug 21, 2026 · 1 files

d0795cfd6f65

Bluetooth: hci_codec: validate vendor codec count length

Laxman Acharya Padhya · Aug 24, 2026 · 1 files

ce9d5197d651

wifi: ath12k: ahb: Revert undocumented ABI and dead code

Krzysztof Kozlowski · Aug 25, 2026 · 1 files

d313499df661

netfilter: nft_nat: fully initialise new_addr in netmap setup

Theodor Arsenij Larionov Trichkine · Aug 25, 2026 · 1 files

1c25bfad93e6

wifi: mwifiex: validate action frame fixed fields

Zhao Li · Aug 25, 2026 · 1 files

3b54dbd11980

power: sequencing: Fix build issue with COMPILE_TEST

Biju Das · Aug 26, 2026 · 1 files

9fa903b24b1f

xfrm: hold net_device reference under RCU in bundle creation

Cen Zhang (Microsoft Security FORGE Labs) · Aug 26, 2026 · 1 files

af72b5946d49

wifi: mac80211: include TIM bitmap control for buffered S1G mcast traffic

Lachlan Hodges · Aug 27, 2026 · 1 files

444e4c88c9c6

netfilter: nf_tables: fix device name and prefix match in hook lookup

Fernando Fernandez Mancera · Aug 27, 2026 · 1 files

a3d722190cde

wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path

Peng Hao · Aug 28, 2026 · 1 files

3cf5cdecd99c

xfrm: save input state data before secpath resets

Zhiling Zou · Aug 29, 2026 · 1 files

96f01b53c2d0

net: xfrm: reject unrepresentable espintcp transport headers

Wyatt Feng · Aug 29, 2026 · 1 files

ce858fa6b8a2

wifi: p54: validate curve data length in the calibration curve converters

Shengzhuo Wei · Aug 30, 2026 · 1 files

d8efd84f4937

wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST

Shengzhuo Wei · Aug 30, 2026 · 1 files

114f00d738f1

KEYS: trusted: Fix tpm2_load_cmd() boundary check

Jarkko Sakkinen · Sep 1, 2026 · 1 files

cbdd39ce4253

netfilter: nf_nat: unregister and release hooks on error

Pablo Neira Ayuso · Sep 2, 2026 · 1 files

e6031f02269c

wifi: mac80211: avoid out-of-bounds read for empty PREQ elements

Ivan Pustogarov · Sep 3, 2026 · 1 files

c1ba7f7f1846

wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()

Tianchu Chen · Sep 4, 2026 · 1 files

e6c5ed7a98d7