Daily update · Sep 20–21, 2026
Linux kernel mainline: security hardening, input fixes, and stability improvements
A roundup of meaningful changes from the latest Linux kernel development, including SELinux, input device support, and core kernel fixes.
In brief
This update brings a batch of security hardening fixes, including stack disclosure leaks in evdev and force-feedback, SELinux policy bypasses, and a use-after-free in exec/signal handling. Hardware support improves for gaming controllers, touchpads, keyboards, and MediaTek HDMI. Core kernel fixes address DMA engine refcounting, POSIX timer races, and Intel FRED signal handling.
Security fixes
Fix kernel stack disclosure in evdev EVIOCSABS ioctl
The ioctl handler copied a user-controlled number of bytes into an uninitialized on-stack struct, then stored the entire struct in the device, allowing stale stack data to be read back. It now zeroes the struct before copying.
Why it matters: Closes a local information leak that any user with access to input devices could exploit.
Fix kernel stack disclosure in force-feedback compat path
The compat translation copied only the smaller compat structure into a full native struct, leaving the tail uninitialized; the full struct was later stored and could be read back by a force-feedback daemon. The struct is now zeroed first.
Why it matters: Prevents a kernel stack memory leak through the evdev/uinput force-feedback interface.
Fix memory corruption in Cypress Gen5 touchscreen driver
The driver used a device-supplied size field directly as the memcpy length into a fixed-size buffer. It now clamps the report size to the buffer size before copying.
Why it matters: Prevents a faulty or malicious touchscreen controller from corrupting kernel memory, which could crash or compromise the system.
SELinux: always return a fully initialized access decision
avc_has_perm_noaudit() left its decision output uninitialized when no permissions were requested, and callers later used those bytes for audit and caching. It now fills in a deny-all/audit-all decision.
Why it matters: Eliminates undefined behavior and incorrect SELinux audit results, improving security enforcement reliability.
SELinux: preserve original user SID across nested backing files
For stacked filesystems, the saved user file SID could be replaced by the mounter's SID, so mprotect() checked the wrong target. The original user SID is now preserved when the user_file is itself a backing file.
Why it matters: Fixes SELinux denials and wrong-target checks on nested overlayfs/FUSE setups, important for containers and desktop users.
SELinux: recheck all backing layers on mprotect()
mprotect() only rechecked the top-level and lowest backing file, skipping intermediate layers that mmap() checks, enabling a policy bypass. It now rechecks every backing layer.
Why it matters: Closes a SELinux bypass that could allow executing code from a denied layer in stacked filesystems.
futex: allocate private hash on vfork()
vfork() shares the address space, so private futexes can be used across the vforked child; without allocating the private hash, waiters could be left in an unsafe state. The private hash is now allocated for vfork as well.
Why it matters: Fixes a potential use-after-free/security issue with private futexes in vforked processes.
Fix use-after-free race between exec and signal delivery
A race between exec and POSIX timer signal delivery could free a signal structure while still in use, causing a KASAN-detected UAF. The exec path now prevents the race.
Why it matters: Eliminates a kernel crash/security bug triggered by concurrent exec and signal/timer operations.
Fix out-of-bounds read in Synaptics RMI4 SMBus driver
When chunking writes into SMBus blocks, the block length was calculated from the total length instead of the remaining length, causing reads past the end of the buffer on the final partial chunk. It now uses the remaining length.
Why it matters: Prevents a kernel memory over-read on laptops with Synaptics touchpads using SMBus.
Input devices
Add support for Azeron gaming keypads/controllers
Adds USB IDs for the Azeron Cyro, Cyborg, Classic/Compact, Cyro Lefty, Cyborg II, and Keyzen devices, which present as Xbox 360 controllers.
Why it matters: These gaming devices are now recognized and work out of the box on Linux.
Add support for Victrix Pro BFG controller over USB
Adds the missing USB ID for the Victrix Pro BFG controller, which previously did not respond when connected by USB cable.
Why it matters: Owners of this controller can now use it wired on Linux.
Fix PDP Marvel Xbox 360 controller detection
The controller was incorrectly classified as an Xbox One device, so it produced no input and its LEDs blinked. It is now classified as an Xbox 360 controller.
Why it matters: Restores full functionality for this controller on Linux.
Fix volume/power buttons on Microsoft Surface Pro 11
The soc_button_array probe raced with the GPIO driver and ignored EPROBE_DEFER, causing the button device to fail. It now propagates EPROBE_DEFER on non-Bay Trail/Cherry Trail platforms.
Why it matters: Volume and power buttons work reliably on Surface Pro 11.
Fix Synaptics touchpad unresponsiveness on ThinkPad T440p
The SMBus companion for this touchpad is slow to appear, leaving the touchpad and TrackPoint dead for about 200 seconds on many boots. InterTouch is now disabled for this model.
Why it matters: The T440p touchpad and TrackPoint work from boot instead of becoming unresponsive.
Fix internal keyboard drop-out on Acer Aspire Go 15
The internal keyboard stops responding about five seconds after boot; an i8042 reset quirk now forces a reset at boot.
Why it matters: Keyboard remains functional on this laptop model.
Fix internal keyboard on Xiaomi Redmi Book Pro 16 2026
The atkbd deactivate command makes the embedded controller stop delivering scancodes. The init sequence now skips that command for this model.
Why it matters: The keyboard works on this laptop instead of being dead after probe.
Hardware support
Fix MediaTek MT8195 HDMI PHY clocking for 4K@60 output
Fixed a PLL divisor overflow for high pixel clocks and corrected the TMDS clock ratio register value, allowing the PHY to output 3840x2160@60Hz within spec.
Why it matters: Enables reliable 4K@60 HDMI output on devices using the MT8195 SoC.
Resend QRTR HELLO on MHI resume to fix Qualcomm Wi-Fi suspend
On Qualcomm Wi-Fi cards like WCN7850, the QRTR HELLO handshake was only sent at registration, so after suspend/resume the firmware waited indefinitely for a new HELLO. This commit triggers the handshake during resume.
Why it matters: Fixes resume failures ('timeout while waiting for restart complete') on laptops with Qualcomm Wi-Fi 7, such as the Lenovo Slim 7x.
Core kernel fixes
Clean up POSIX timers immediately after exec thread handoff
When a non-leader thread execs, the PID ownership changes and a per-thread CPU timer node could remain queued on the old task. The timers are now cleaned up right after de_thread().
Why it matters: Prevents potential timer misbehavior or use-after-free after exec, improving stability for multithreaded programs.
Fix use-after-free and refcount bugs in DMA engine core
dma_chan_put() could drop a device reference on fast-path get/put, and device release could free memory while RCU readers or dma_chan_put() still accessed it. The commits fix the reference counting and lifetime handling.
Why it matters: Prevents kernel crashes and memory corruption in systems using DMA engine clients such as audio, SPI, and storage.
Fix signal context for rejected INT instructions on Intel FRED
FRED delivery didn't construct the #GP error code and rewound the IP incorrectly for user INT instructions, breaking Wine's handling of INT 0x2d and causing crashes in games. Now the IP is rewound and the error code synthesized.
Why it matters: Improves Wine/gaming compatibility on Intel CPUs with FRED, such as recent Core Ultra processors.
Prevent native kernel builds from using APX extended registers
When CONFIG_X86_NATIVE_CPU is enabled, the kernel could be compiled with -march=native and inadvertently use Extended General Purpose Registers (EGPRs) on CPUs supporting APX. This commit disables that usage for C and Rust code because the kernel does not yet support context switching those registers.
Why it matters: Users who build their own kernels with '-march=native' on recent AMD/Intel CPUs avoid potential crashes or corruption from unsupported register usage.
Fix race in POSIX CPU timer deletion
A race in the POSIX CPU timer code could free a timer that was still queued on the expiry list. The fix restores the distinction between a timer canceled before expiry and one still owned by the expiry handler.
Why it matters: This prevents a use-after-free that could cause kernel crashes or memory corruption in applications using POSIX CPU timers, such as profiling or timeout mechanisms.
Source commits65 entries +
phy: renesas: rcar-gen3-usb2: Avoid long delay in atomic context
Claudiu Beznea · Jul 16, 2026 · 1 files
dmaengine: mmp_pdma: fix wrong extended DRCMR base for SpacemiT K3
Troy Mitchell · Jul 27, 2026 · 1 files
Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
Dmitry Torokhov · Aug 5, 2026 · 1 files
Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
Dmitry Torokhov · Aug 6, 2026 · 1 files
dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()
Alexander Chesnokov · Aug 12, 2026 · 1 files
dmaengine: sprd: Fix runtime PM reference leak in probe
Ruoyu Wang · Aug 13, 2026 · 1 files
dt-bindings: input: mediatek,mt6779-keypad: add mt6572
Roman Vivchar · Aug 14, 2026 · 1 files
dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order
Alex Bereza · Aug 17, 2026 · 1 files
dmaengine: sun6i: fix non-atomic read of DMA position registers
Christian Lugnberg · Aug 17, 2026 · 1 files
dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status
Christian Lugnberg · Aug 17, 2026 · 1 files
dmaengine: pxa: fix double counting of the hw descriptors
Sascha Hauer · Aug 17, 2026 · 1 files
dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA
Alex Bereza · Aug 18, 2026 · 1 files
Input: adp5588-keys - cache GPIO state before registering the gpiochip
Alvin Šipraga · Aug 18, 2026 · 1 files
i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove()
Liu Zhenlong · Aug 18, 2026 · 1 files
dmaengine: add dma_device_get() helper
Shivank Garg · Aug 22, 2026 · 1 files
dmaengine: Fix device kref underflow in dma_chan_put()
Shivank Garg · Aug 22, 2026 · 1 files
dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()
Shivank Garg · Aug 22, 2026 · 1 files
dmaengine: wait for RCU readers before releasing dma_device
Shivank Garg · Aug 22, 2026 · 1 files
i2c: at91: release DMA channels on remove and probe error
Shengzhuo Wei · Aug 27, 2026 · 3 files
i2c: imx: release DMA channels on probe error
Shengzhuo Wei · Aug 27, 2026 · 1 files
i2c: qcom-geni: release DMA channels on probe error
Shengzhuo Wei · Aug 27, 2026 · 1 files
Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026
Alexei Turtanov · Aug 28, 2026 · 1 files
selinux: preserve user SID across nested backing files
Karl Mehltretter · Aug 29, 2026 · 2 files
selinux: recheck intermediate backing files on mprotect()
Karl Mehltretter · Aug 29, 2026 · 2 files
soundwire: dmi-quirks: Disable ghost Realtek on Asus GX651AX
Ian Luites · Aug 31, 2026 · 1 files
Input: tsc2007 - read "ti,poll-period" as u32
Rob Herring (Arm) · Aug 31, 2026 · 1 files
soundwire: cadence_master: wait and cancel cdns->work before clock stop
Bard Liao · Sep 1, 2026 · 1 files
Input: cyttsp5 - clamp the HID report size before memcpy
Linkai Gong · Sep 1, 2026 · 1 files
Input: evdev - zero absinfo before partial copy in EVIOCSABS
Iván Ezequiel Rodriguez · Sep 1, 2026 · 1 files
Input: zero ff_effect before compat copy in input_ff_effect_from_user
Iván Ezequiel Rodriguez · Sep 1, 2026 · 1 files
Input: hp_sdc - shut down kicker timer on module exit
Runyu Xiao · Sep 2, 2026 · 1 files
Input: xpad - add support for Victrix Pro BFG Controller
Erich Sartison · Sep 3, 2026 · 1 files
selinux: always fill AVC decision in avc_has_perm_noaudit()
Christian Göttsche · Sep 3, 2026 · 1 files
objtool: Validate disassembler headers in libopcodes probe
Ulises Mendez Martinez · Sep 4, 2026 · 1 files
perf: Fix null pointer access in is_include_guest_event()
Vinay Belgaumkar · Sep 4, 2026 · 1 files
Input: trackpoint - fix the inertia attribute name in the ABI document
Karl Mehltretter · Sep 5, 2026 · 1 files
Input: eeti_ts - publish the OF module alias
hpp.iscas · Sep 5, 2026 · 1 files
Input: xpad - add support for Azeron devices
Roberts Kursitis · Sep 6, 2026 · 1 files
i2c: atr: fix dangling adapter pointer on add failure
Linkai Gong · Sep 7, 2026 · 1 files
Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P
Chris Sommers · Sep 7, 2026 · 1 files
x86/kprobes: Fix crash when probing CS CALL instructions
Jinke Han · Sep 8, 2026 · 3 files
Input: soc_button_array - fix MS Surface Pro 11 probe failure
Hans de Goede · Sep 9, 2026 · 1 files
Input: soc_button_array - check btns_desc->package.count
Hans de Goede · Sep 9, 2026 · 1 files
spi: spi-qpic-snand: avoid writing QPIC_EBI2_ECC_BUF_CFG register
Gabor Juhos · Sep 9, 2026 · 1 files
dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
Baineng Shou · Sep 10, 2026 · 1 files
Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722)
Raphaël Larocque · Sep 10, 2026 · 1 files
spi: spi-zynqmp-gqspi: stop the controller on shutdown
Itai Handler · Sep 10, 2026 · 1 files
phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow
AngeloGioacchino Del Regno · Sep 11, 2026 · 1 files
phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting
AngeloGioacchino Del Regno · Sep 11, 2026 · 2 files
futex: Also allocate private hash on vfork()
Peter Zijlstra · Sep 11, 2026 · 1 files
signal: Prevent exec() race
Thomas Gleixner · Sep 11, 2026 · 2 files
exec: Cleanup POSIX timers right after de_thread()
Hyunwoo Kim · Sep 11, 2026 · 1 files
spi: virtio: Use the per-transfer bits per word
Hao-Qun Huang · Sep 12, 2026 · 1 files
Input: document that no new LED codes should be added
Dmitry Torokhov · Sep 14, 2026 · 1 files
Input: xpad - fix PDP Marvel Xbox 360 controller
Jeremy Nyberg · Sep 14, 2026 · 1 files
i2c: imx: disable autosuspend on remove
Guangshuo Li · Sep 14, 2026 · 1 files
sched/core: Avoid false migration warning for proxy donors
Andrea Righi · Sep 15, 2026 · 1 files
posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list
Thomas Gleixner · Sep 16, 2026 · 1 files
x86/microcode/intel: Reject problematic loading on Granite Rapids systems
Chang S. Bae · Sep 16, 2026 · 1 files
x86/build/64: Prevent native builds from generating EGPR use
Chang S. Bae · Sep 16, 2026 · 3 files
spi: fsl-qspi: Reprogram the clock rate when the operation frequency changes
Frieder Schrempf · Sep 17, 2026 · 1 files
x86/fred: Reconstruct the #GP context for rejected INT instructions
Matthew Schwartz · Sep 17, 2026 · 1 files
selftests/x86: Check signal state for rejected software interrupts
Matthew Schwartz · Sep 17, 2026 · 2 files
net: qrtr: resend HELLO on MHI resume
Daniel J Blueman · Sep 20, 2026 · 3 files
Linux 7.3-rc4
Linus Torvalds · Sep 20, 2026 · 1 files