← Back to archive

Daily update · Sep 20–21, 2026

Linux kernel mainline: security hardening, input fixes, and stability improvements

A roundup of meaningful changes from the latest Linux kernel development, including SELinux, input device support, and core kernel fixes.

In brief

This update brings a batch of security hardening fixes, including stack disclosure leaks in evdev and force-feedback, SELinux policy bypasses, and a use-after-free in exec/signal handling. Hardware support improves for gaming controllers, touchpads, keyboards, and MediaTek HDMI. Core kernel fixes address DMA engine refcounting, POSIX timer races, and Intel FRED signal handling.

Security fixes

Fix kernel stack disclosure in evdev EVIOCSABS ioctl

The ioctl handler copied a user-controlled number of bytes into an uninitialized on-stack struct, then stored the entire struct in the device, allowing stale stack data to be read back. It now zeroes the struct before copying.

Why it matters: Closes a local information leak that any user with access to input devices could exploit.

8b852965b8ea

Fix kernel stack disclosure in force-feedback compat path

The compat translation copied only the smaller compat structure into a full native struct, leaving the tail uninitialized; the full struct was later stored and could be read back by a force-feedback daemon. The struct is now zeroed first.

Why it matters: Prevents a kernel stack memory leak through the evdev/uinput force-feedback interface.

f84819ef8d66

Fix memory corruption in Cypress Gen5 touchscreen driver

The driver used a device-supplied size field directly as the memcpy length into a fixed-size buffer. It now clamps the report size to the buffer size before copying.

Why it matters: Prevents a faulty or malicious touchscreen controller from corrupting kernel memory, which could crash or compromise the system.

85f080fb87ed

SELinux: always return a fully initialized access decision

avc_has_perm_noaudit() left its decision output uninitialized when no permissions were requested, and callers later used those bytes for audit and caching. It now fills in a deny-all/audit-all decision.

Why it matters: Eliminates undefined behavior and incorrect SELinux audit results, improving security enforcement reliability.

8861db305103

SELinux: preserve original user SID across nested backing files

For stacked filesystems, the saved user file SID could be replaced by the mounter's SID, so mprotect() checked the wrong target. The original user SID is now preserved when the user_file is itself a backing file.

Why it matters: Fixes SELinux denials and wrong-target checks on nested overlayfs/FUSE setups, important for containers and desktop users.

8c0c602202b9

SELinux: recheck all backing layers on mprotect()

mprotect() only rechecked the top-level and lowest backing file, skipping intermediate layers that mmap() checks, enabling a policy bypass. It now rechecks every backing layer.

Why it matters: Closes a SELinux bypass that could allow executing code from a denied layer in stacked filesystems.

78fc54b934bf

futex: allocate private hash on vfork()

vfork() shares the address space, so private futexes can be used across the vforked child; without allocating the private hash, waiters could be left in an unsafe state. The private hash is now allocated for vfork as well.

Why it matters: Fixes a potential use-after-free/security issue with private futexes in vforked processes.

b61b6f95d672

Fix use-after-free race between exec and signal delivery

A race between exec and POSIX timer signal delivery could free a signal structure while still in use, causing a KASAN-detected UAF. The exec path now prevents the race.

Why it matters: Eliminates a kernel crash/security bug triggered by concurrent exec and signal/timer operations.

d2710c8d938a

Fix out-of-bounds read in Synaptics RMI4 SMBus driver

When chunking writes into SMBus blocks, the block length was calculated from the total length instead of the remaining length, causing reads past the end of the buffer on the final partial chunk. It now uses the remaining length.

Why it matters: Prevents a kernel memory over-read on laptops with Synaptics touchpads using SMBus.

51cfe54f815a

Input devices

Add support for Azeron gaming keypads/controllers

Adds USB IDs for the Azeron Cyro, Cyborg, Classic/Compact, Cyro Lefty, Cyborg II, and Keyzen devices, which present as Xbox 360 controllers.

Why it matters: These gaming devices are now recognized and work out of the box on Linux.

cba76c0f47af

Add support for Victrix Pro BFG controller over USB

Adds the missing USB ID for the Victrix Pro BFG controller, which previously did not respond when connected by USB cable.

Why it matters: Owners of this controller can now use it wired on Linux.

971fa7ea8621

Fix PDP Marvel Xbox 360 controller detection

The controller was incorrectly classified as an Xbox One device, so it produced no input and its LEDs blinked. It is now classified as an Xbox 360 controller.

Why it matters: Restores full functionality for this controller on Linux.

7bc369cb3d3f

Fix volume/power buttons on Microsoft Surface Pro 11

The soc_button_array probe raced with the GPIO driver and ignored EPROBE_DEFER, causing the button device to fail. It now propagates EPROBE_DEFER on non-Bay Trail/Cherry Trail platforms.

Why it matters: Volume and power buttons work reliably on Surface Pro 11.

ed22ad5fdbdb

Fix Synaptics touchpad unresponsiveness on ThinkPad T440p

The SMBus companion for this touchpad is slow to appear, leaving the touchpad and TrackPoint dead for about 200 seconds on many boots. InterTouch is now disabled for this model.

Why it matters: The T440p touchpad and TrackPoint work from boot instead of becoming unresponsive.

26eb3d92c7a4

Fix internal keyboard drop-out on Acer Aspire Go 15

The internal keyboard stops responding about five seconds after boot; an i8042 reset quirk now forces a reset at boot.

Why it matters: Keyboard remains functional on this laptop model.

25e424eb4ae1

Fix internal keyboard on Xiaomi Redmi Book Pro 16 2026

The atkbd deactivate command makes the embedded controller stop delivering scancodes. The init sequence now skips that command for this model.

Why it matters: The keyboard works on this laptop instead of being dead after probe.

aefbda23eeba

Hardware support

Fix MediaTek MT8195 HDMI PHY clocking for 4K@60 output

Fixed a PLL divisor overflow for high pixel clocks and corrected the TMDS clock ratio register value, allowing the PHY to output 3840x2160@60Hz within spec.

Why it matters: Enables reliable 4K@60 HDMI output on devices using the MT8195 SoC.

de7f29a1fe1d486a70ef8482

Resend QRTR HELLO on MHI resume to fix Qualcomm Wi-Fi suspend

On Qualcomm Wi-Fi cards like WCN7850, the QRTR HELLO handshake was only sent at registration, so after suspend/resume the firmware waited indefinitely for a new HELLO. This commit triggers the handshake during resume.

Why it matters: Fixes resume failures ('timeout while waiting for restart complete') on laptops with Qualcomm Wi-Fi 7, such as the Lenovo Slim 7x.

6a5719cc3ef2

Core kernel fixes

Clean up POSIX timers immediately after exec thread handoff

When a non-leader thread execs, the PID ownership changes and a per-thread CPU timer node could remain queued on the old task. The timers are now cleaned up right after de_thread().

Why it matters: Prevents potential timer misbehavior or use-after-free after exec, improving stability for multithreaded programs.

acb03d388181

Fix use-after-free and refcount bugs in DMA engine core

dma_chan_put() could drop a device reference on fast-path get/put, and device release could free memory while RCU readers or dma_chan_put() still accessed it. The commits fix the reference counting and lifetime handling.

Why it matters: Prevents kernel crashes and memory corruption in systems using DMA engine clients such as audio, SPI, and storage.

44dab659064ee873c74132f0dc750422170a

Fix signal context for rejected INT instructions on Intel FRED

FRED delivery didn't construct the #GP error code and rewound the IP incorrectly for user INT instructions, breaking Wine's handling of INT 0x2d and causing crashes in games. Now the IP is rewound and the error code synthesized.

Why it matters: Improves Wine/gaming compatibility on Intel CPUs with FRED, such as recent Core Ultra processors.

93f53499d0b9

Prevent native kernel builds from using APX extended registers

When CONFIG_X86_NATIVE_CPU is enabled, the kernel could be compiled with -march=native and inadvertently use Extended General Purpose Registers (EGPRs) on CPUs supporting APX. This commit disables that usage for C and Rust code because the kernel does not yet support context switching those registers.

Why it matters: Users who build their own kernels with '-march=native' on recent AMD/Intel CPUs avoid potential crashes or corruption from unsupported register usage.

63edf5a009ae

Fix race in POSIX CPU timer deletion

A race in the POSIX CPU timer code could free a timer that was still queued on the expiry list. The fix restores the distinction between a timer canceled before expiry and one still owned by the expiry handler.

Why it matters: This prevents a use-after-free that could cause kernel crashes or memory corruption in applications using POSIX CPU timers, such as profiling or timeout mechanisms.

c21eaa72f02f

Source commits65 entries +
48e97c59a49c

phy: renesas: rcar-gen3-usb2: Avoid long delay in atomic context

Claudiu Beznea · Jul 16, 2026 · 1 files

d1fc569fcbc7

dmaengine: mmp_pdma: fix wrong extended DRCMR base for SpacemiT K3

Troy Mitchell · Jul 27, 2026 · 1 files

51cfe54f815a

Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()

Dmitry Torokhov · Aug 5, 2026 · 1 files

fe10579b6dc3

Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound

Dmitry Torokhov · Aug 6, 2026 · 1 files

0294b6dd5152

dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()

Alexander Chesnokov · Aug 12, 2026 · 1 files

a7df136ec529

dmaengine: sprd: Fix runtime PM reference leak in probe

Ruoyu Wang · Aug 13, 2026 · 1 files

4d7fa28e151a

dt-bindings: input: mediatek,mt6779-keypad: add mt6572

Roman Vivchar · Aug 14, 2026 · 1 files

cee9c863ee68

dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order

Alex Bereza · Aug 17, 2026 · 1 files

c90b6973daa3

dmaengine: sun6i: fix non-atomic read of DMA position registers

Christian Lugnberg · Aug 17, 2026 · 1 files

9096bdc8d930

dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status

Christian Lugnberg · Aug 17, 2026 · 1 files

f6504be006aa

dmaengine: pxa: fix double counting of the hw descriptors

Sascha Hauer · Aug 17, 2026 · 1 files

7ed1e3070c9b

dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA

Alex Bereza · Aug 18, 2026 · 1 files

21efadc62272

Input: adp5588-keys - cache GPIO state before registering the gpiochip

Alvin Šipraga · Aug 18, 2026 · 1 files

7362a1553eb0

i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove()

Liu Zhenlong · Aug 18, 2026 · 1 files

424103642d00

dmaengine: add dma_device_get() helper

Shivank Garg · Aug 22, 2026 · 1 files

44dab659064e

dmaengine: Fix device kref underflow in dma_chan_put()

Shivank Garg · Aug 22, 2026 · 1 files

e873c74132f0

dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()

Shivank Garg · Aug 22, 2026 · 1 files

dc750422170a

dmaengine: wait for RCU readers before releasing dma_device

Shivank Garg · Aug 22, 2026 · 1 files

f7eeb1af8537

i2c: at91: release DMA channels on remove and probe error

Shengzhuo Wei · Aug 27, 2026 · 3 files

e9f03b9625e2

i2c: imx: release DMA channels on probe error

Shengzhuo Wei · Aug 27, 2026 · 1 files

268aacb2e2a5

i2c: qcom-geni: release DMA channels on probe error

Shengzhuo Wei · Aug 27, 2026 · 1 files

aefbda23eeba

Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026

Alexei Turtanov · Aug 28, 2026 · 1 files

8c0c602202b9

selinux: preserve user SID across nested backing files

Karl Mehltretter · Aug 29, 2026 · 2 files

78fc54b934bf

selinux: recheck intermediate backing files on mprotect()

Karl Mehltretter · Aug 29, 2026 · 2 files

6d49beec658f

soundwire: dmi-quirks: Disable ghost Realtek on Asus GX651AX

Ian Luites · Aug 31, 2026 · 1 files

55fc280e951a

Input: tsc2007 - read "ti,poll-period" as u32

Rob Herring (Arm) · Aug 31, 2026 · 1 files

aba7b41faeec

soundwire: cadence_master: wait and cancel cdns->work before clock stop

Bard Liao · Sep 1, 2026 · 1 files

85f080fb87ed

Input: cyttsp5 - clamp the HID report size before memcpy

Linkai Gong · Sep 1, 2026 · 1 files

8b852965b8ea

Input: evdev - zero absinfo before partial copy in EVIOCSABS

Iván Ezequiel Rodriguez · Sep 1, 2026 · 1 files

f84819ef8d66

Input: zero ff_effect before compat copy in input_ff_effect_from_user

Iván Ezequiel Rodriguez · Sep 1, 2026 · 1 files

309731e95917

Input: hp_sdc - shut down kicker timer on module exit

Runyu Xiao · Sep 2, 2026 · 1 files

971fa7ea8621

Input: xpad - add support for Victrix Pro BFG Controller

Erich Sartison · Sep 3, 2026 · 1 files

8861db305103

selinux: always fill AVC decision in avc_has_perm_noaudit()

Christian Göttsche · Sep 3, 2026 · 1 files

7e61560628d1

objtool: Validate disassembler headers in libopcodes probe

Ulises Mendez Martinez · Sep 4, 2026 · 1 files

88aed0422f39

perf: Fix null pointer access in is_include_guest_event()

Vinay Belgaumkar · Sep 4, 2026 · 1 files

45b003789970

Input: trackpoint - fix the inertia attribute name in the ABI document

Karl Mehltretter · Sep 5, 2026 · 1 files

a52ae68a937e

Input: eeti_ts - publish the OF module alias

hpp.iscas · Sep 5, 2026 · 1 files

cba76c0f47af

Input: xpad - add support for Azeron devices

Roberts Kursitis · Sep 6, 2026 · 1 files

ad34235808b6

i2c: atr: fix dangling adapter pointer on add failure

Linkai Gong · Sep 7, 2026 · 1 files

25e424eb4ae1

Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P

Chris Sommers · Sep 7, 2026 · 1 files

a5f7a5bb3b7f

x86/kprobes: Fix crash when probing CS CALL instructions

Jinke Han · Sep 8, 2026 · 3 files

ed22ad5fdbdb

Input: soc_button_array - fix MS Surface Pro 11 probe failure

Hans de Goede · Sep 9, 2026 · 1 files

fb5022278b6e

Input: soc_button_array - check btns_desc->package.count

Hans de Goede · Sep 9, 2026 · 1 files

930a7312c946

spi: spi-qpic-snand: avoid writing QPIC_EBI2_ECC_BUF_CFG register

Gabor Juhos · Sep 9, 2026 · 1 files

075bc7b1d3dd

dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()

Baineng Shou · Sep 10, 2026 · 1 files

26eb3d92c7a4

Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722)

Raphaël Larocque · Sep 10, 2026 · 1 files

e922bad8b2d5

spi: spi-zynqmp-gqspi: stop the controller on shutdown

Itai Handler · Sep 10, 2026 · 1 files

de7f29a1fe1d

phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow

AngeloGioacchino Del Regno · Sep 11, 2026 · 1 files

486a70ef8482

phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting

AngeloGioacchino Del Regno · Sep 11, 2026 · 2 files

b61b6f95d672

futex: Also allocate private hash on vfork()

Peter Zijlstra · Sep 11, 2026 · 1 files

d2710c8d938a

signal: Prevent exec() race

Thomas Gleixner · Sep 11, 2026 · 2 files

acb03d388181

exec: Cleanup POSIX timers right after de_thread()

Hyunwoo Kim · Sep 11, 2026 · 1 files

095858324f06

spi: virtio: Use the per-transfer bits per word

Hao-Qun Huang · Sep 12, 2026 · 1 files

ea48250a0dc9

Input: document that no new LED codes should be added

Dmitry Torokhov · Sep 14, 2026 · 1 files

7bc369cb3d3f

Input: xpad - fix PDP Marvel Xbox 360 controller

Jeremy Nyberg · Sep 14, 2026 · 1 files

e0c3e9d76adb

i2c: imx: disable autosuspend on remove

Guangshuo Li · Sep 14, 2026 · 1 files

fe3c73d7bc76

sched/core: Avoid false migration warning for proxy donors

Andrea Righi · Sep 15, 2026 · 1 files

c21eaa72f02f

posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list

Thomas Gleixner · Sep 16, 2026 · 1 files

e7d3e2f46dd5

x86/microcode/intel: Reject problematic loading on Granite Rapids systems

Chang S. Bae · Sep 16, 2026 · 1 files

63edf5a009ae

x86/build/64: Prevent native builds from generating EGPR use

Chang S. Bae · Sep 16, 2026 · 3 files

3d743adf090c

spi: fsl-qspi: Reprogram the clock rate when the operation frequency changes

Frieder Schrempf · Sep 17, 2026 · 1 files

93f53499d0b9

x86/fred: Reconstruct the #GP context for rejected INT instructions

Matthew Schwartz · Sep 17, 2026 · 1 files

96443a53bc3e

selftests/x86: Check signal state for rejected software interrupts

Matthew Schwartz · Sep 17, 2026 · 2 files

6a5719cc3ef2

net: qrtr: resend HELLO on MHI resume

Daniel J Blueman · Sep 20, 2026 · 3 files

93f51579e7df

Linux 7.3-rc4

Linus Torvalds · Sep 20, 2026 · 1 files