← Back to archive

Daily update · Sep 24–25, 2026

Linux mainline update: Bluetooth and BPF security hardening, networking fixes, new hardware support

A sweeping set of Bluetooth vulnerability fixes, BPF verifier and privilege-gating improvements, network stack security patches, and driver additions highlight today's mainline activity.

In brief

Today's mainline update is dominated by security and stability work across Bluetooth, BPF, and the networking stack. The Bluetooth subsystem received fixes for raw HCI socket filter bypass, BNEP/RFCOMM frame processing, mgmt heap out-of-bounds writes, and SMP disconnect issues affecting popular dual-mode headphones. BPF saw extensive verifier hardening—including CO-RE relocation poisoning, packet pointer range pruning, sleepability context verification, and new CAP_PERFMON requirements for memory-reading kfuncs—alongside numerous runtime bug fixes. The network stack addresses a TCP Fast Open use-after-free, RDS InfiniBand privilege escalation, DHCP client buffer overflow, OVS conntrack use-after-free, and several out-of-bounds access vectors. New hardware support includes the Solarflare sfc X4D controller, Quectel EG120K-EA LTE module, and MeiG Smart SRM821 5G module. sched_ext fixes prevent DSQ self-deadlock and task dispatch races, while NFC receives a cluster of input-validation and use-after-free fixes.

Bluetooth: Security and Stability

Raw HCI socket security filter bypass via out-of-range OCF

The raw HCI socket security filter masked the 10-bit OCF with 127, allowing an unprivileged socket to submit a reserved OCF that aliases an allowlisted command modulo 128. The fix rejects OCF values the filter cannot represent.

Why it matters: An unprivileged process with raw HCI socket access could bypass the security filter to send commands that should be blocked.

e93fad891c72

SMP Security Request mishandled on BR/EDR causing headphone disconnects

Dual-mode devices such as Bose QC Ultra headphones can send an LE-style SMP Security Request over the BR/EDR fixed channel, which the kernel mistakenly processes as an LE link, causing the controller to reject LE_START_ENC and disconnect with authentication failure.

Why it matters: Users of certain Bluetooth dual-mode headphones may experience unexpected disconnections on BR/EDR links.

f033482d76a9

BNEP and RFCOMM frame processing out-of-bounds reads and crashes

Fixes multiple out-of-bounds reads and a control-frame fallthrough in BNEP processing that could leak heap memory on short frames, and fixes a NULL dereference and short-frame handling in RFCOMM.

Why it matters: Users of Bluetooth PAN (BNEP) and serial-port-over-Bluetooth (RFCOMM) profiles are protected against potential information leaks and crashes from malformed frames.

f0ca020cbb9b46f8ffd0a1f16d91041bb38b

mgmt race causes heap out-of-bounds write during controller setup

read_unconf_index_list() could count controllers before a flag transition makes them eligible, then write past the allocated response buffer during the fill pass. The fix allocates space for every device on the list.

Why it matters: Rapid controller setup could trigger a kernel heap out-of-bounds write.

b5dbb41b212c

Intel PCIe Bluetooth driver validates DMA-supplied indices

The btintel_pcie driver now bounds-checks device-controlled frbd_tag and cr_hia values used as array indices and loop counters, preventing out-of-bounds accesses from a malicious or malfunctioning device.

Why it matters: Systems with Intel Bluetooth PCIe adapters are protected against potential memory corruption from rogue firmware or device behavior.

37a111293453

L2CAP and HCI socket out-of-bounds reads from malformed frames/events

Short ERTM or streaming-mode L2CAP frames could cause out-of-bounds reads of control and FCS fields, and malformed HCI events could trigger OOB reads in the packet filter before event header validation.

Why it matters: A malicious or buggy Bluetooth controller or vhci device could trigger kernel memory reads past buffer boundaries.

6c78a213d907b0a6cf99afd5

BPF: Verifier Hardening and Privilege Gating

Memory-reading kfuncs now require CAP_PERFMON

Tracing-related kfuncs such as bpf_rdonly_cast() and probe-read helpers were accessible with plain CAP_BPF, unlike their old-style BPF helper equivalents which require CAP_PERFMON. A new KF_PERFMON flag gates these kfuncs.

Why it matters: Unprivileged or CAP_BPF-only BPF programs can no longer read kernel memory via kfuncs that should require perfmon-level privileges.

88ce88e933e481c975aae375f9191460cd80

Unsound pruning of packet pointer ranges could allow out-of-bounds access

regsafe() did not preserve the displacement between registers sharing a packet pointer ID, so two individually narrower ranges could prune an explored path even when their relative displacement had changed, potentially accepting an out-of-bounds packet access.

Why it matters: A crafted BPF program could bypass verifier bounds checks and access packet data out of bounds.

fd16449a9b3b

CO-RE relocation ordering and poisoning hardening

CO-RE relocations are now applied before subprogram validation to prevent unresolved relocations from creating invalid control flow that breaks verifier invariants and can write past per-subprogram arrays. Poisoning is also restricted to valid relocatable instruction forms.

Why it matters: Closes a class of BPF verifier bugs where crafted CO-RE metadata could corrupt verifier state or bypass validation.

c26e97721b17394ae398337c

Global subprograms verified in wrong sleepability context

Global subprograms were always verified with the main program's sleepability state, but workqueue and task-work callbacks run in a sleepable context even when the program is not. This allowed RCU-protected kptrs to produce trusted pointers in non-RCU contexts.

Why it matters: A BPF program could retain RCU-protected kernel pointers outside of a valid RCU read-side critical section, leading to use-after-free.

40c2096961b4

Self-referential local kptrs could exhaust kernel stack

A self-referential or deeply chained local kptr type could cause bpf_obj_free_fields() to recurse arbitrarily deep and exhaust the kernel stack. The BTF checker now bounds ownership depth and rejects cycles with -ELOOP.

Why it matters: Prevents a local user with BPF access from crashing the kernel through crafted BTF type definitions.

bfc888f04588

Verifier fixes for stack offsets, dynptrs, arenas, and sockmap

Fixes non-negative stack offsets accepted for iterator state, skb-backed dynptr bounds underflow, arena ALU operations producing wrong results across code paths, and sockmap max_entries values causing signed integer overflow during cleanup.

Why it matters: These fixes prevent crafted BPF programs from corrupting or reading out-of-bounds memory, closing potential privilege-escalation vectors.

79a9172f3ab4ed6eec97b534f85f5917aa2f814a81c842bd

Dev-bound-only programs could run on unrelated devices

A bound-only BPF program with NULL offdev could match an unrelated netdev in __bpf_offload_dev_match(), allowing a veth-bound program to run on a tun device and read beyond tun's bare-stack xdp_buff as a veth_xdp_buff.

Why it matters: A privileged BPF user could crash the kernel by running driver-specific XDP metadata kfuncs against an incompatible device.

6db1ce73e985

BPF: Runtime and JIT Bug Fixes

Hash map batch lookup could lock CPU for over 77 seconds

__htab_map_lookup_and_delete_batch() lacked any rescheduling point, so a single batch call against a large LRU hash map (16M buckets) on a 144-CPU arm64 host held a CPU for 77+ seconds and tripped the soft lockup watchdog.

Why it matters: Systems using large BPF hash maps with batch operations can avoid soft lockup panics and CPU stalls.

85136bf22404

SRv6 seg6local programs could trigger dangling pointer writes

An LWT_SEG6LOCAL program could invalidate its cached SRH pointer with bpf_lwt_seg6_adjust_srh() and then reallocate skb->head via bpf_skb_pull_data(), leaving a dangling per-CPU SRH pointer that post-program validation writes through.

Why it matters: A BPF SRv6 program could trigger kernel memory corruption through a dangling pointer.

e4a62833adff

Sockmap self-redirect double-counts copied_seq causing TCP warnings

When a BPF stream_verdict program redirects an skb back to the same socket, tcp_eat_skb() and the later copied_from_self path both advance copied_seq, doubling the offset and triggering a TCP recvmsg seq bug warning.

Why it matters: Users of BPF sockmap self-redirect may see TCP sequence mismatch warnings and potential data corruption.

490a83d6386e

Map batch operations overflow on maps exceeding 4GB

Several batch operation implementations used u32 arithmetic for offset calculations, which overflowed when map sizes exceeded 4GB, corrupting values in userspace memory or failing to delete/update keys.

Why it matters: Applications using large BPF maps (>4GB) with batch operations could silently corrupt data or miss key updates.

953824e508b2

Arm64 BPF JIT exception callback uses wrong frame pointer from subprogram

The arm64 JIT did not set up BPF_REG_FP for exception callbacks because the exception_cb path skipped push_callee_regs(), so if bpf_throw() was called from a subprogram with its own BPF stack, the callback read from the subprogram's frame instead of the callback's own frame.

Why it matters: BPF exception callbacks on arm64 could read incorrect stack data when thrown from subprograms using their own BPF stack.

ef1fb82f1218

Memalloc use-after-free from concurrent ttrace list consumption

Syzkaller found a UAF in alloc_bulk() where concurrent consumption of waiting_for_gp_ttrace lists freed nodes still referenced by llist_del_first(). The fix adds proper synchronization to the RCU tasks trace free path.

Why it matters: Concurrent BPF memory allocator operations could trigger a use-after-free under specific timing conditions.

1c21452d02ee

btf_struct_walk() divides by zero on flexible array of empty structs

When a struct's last member is a flexible array of zero-sized elements, btf_struct_walk() computed (off - moff) % t->size with t->size == 0, causing a kernel divide error at program load time.

Why it matters: Loading a BPF program whose BTF type ends with a flexible array of empty structs could crash the kernel.

b0b3dc665296

Post-verification instruction rewrites made killable

Post-verification rewrite passes such as bpf_opt_remove_nops() had quadratic complexity and neither checked for signals nor rescheduled, so a privileged loader submitting 131K jumps could pin a CPU and block SIGKILL until the rewrite finished.

Why it matters: A privileged BPF program loader can no longer pin a CPU in verifier rewrites, improving system responsiveness.

261b61d3735b

Networking: Security Fixes

TCP Fast Open use-after-free via retransmit hint

An unprivileged TFO client can arm a dangling retransmit_skb_hint using an attacker-supplied ICMP fragmentation-needed message, then trigger a use-after-free when a simultaneous open frees the armed SYN skb.

Why it matters: A local unprivileged user could corrupt kernel memory or potentially escalate privileges on systems using TCP Fast Open.

fe99bbeee5c5

RDS IB scatterlist use-after-free enables local privilege escalation

rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA mapping can succeed; on failure the MR is returned to the pool with a stale pointer, leading to a use-after-free.

Why it matters: A local user could leverage this memory corruption bug to escalate privileges on systems using RDS over InfiniBand.

58eb1b3325ed

Kernel DHCP client buffer overflow in hostname/vendor-class options

ic_dhcp_init_options() appended hostname (option 12) and vendor-class (option 60) into a fixed 312-byte buffer without bounds checking; a long hostname plus a 252-byte dhcpclass identifier overflows the buffer.

Why it matters: Systems using kernel-level DHCP (ipconfig) with long hostnames or dhcpclass identifiers could fail to boot or panic during network configuration.

e47a1958e12a

Open vSwitch and act_ct conntrack helper use-after-free via extension reallocation

When helpers wire a raw pointer into the expectations list for an unconfirmed connection, subsequent extension additions can reallocate the extension space, leaving a dangling pointer that is later accessed during expectation removal.

Why it matters: Systems using Open vSwitch or TC act_ct with conntrack helpers could be vulnerable to use-after-free memory corruption.

26b2bd70d2241a4151e6be57f85009dfcd65dad19b59da05

VXLAN neighbour reply out-of-bounds write via headroom TOCTOU race

vxlan_na_create() samples needed_headroom twice; a concurrent vxlan_changelink() can increase it between reads, causing the second value to exceed the skb allocation and write the Ethernet header out of bounds.

Why it matters: A local user could trigger an out-of-bounds memory write on systems using VXLAN, potentially leading to corruption or crashes.

481506a756dc

GUE remote checksum offload out-of-bounds write

Invalid REMCSUM offsets where the checksum field offset is less than the start offset could underflow a u16 and cause a NETIF_F_HW_CSUM driver to write two bytes about 64 KiB beyond the destination buffer.

Why it matters: Prevents a crafted forwarded packet from corrupting kernel memory via the GUE encapsulation path.

2566866fc309

IPv6 extension header parsing out-of-bounds via ipv6_find_hdr()

ipv6_find_hdr() could return an offset past the end of the packet because header lengths were not checked against skb->len, causing Open vSwitch to read and write transport checksums out of bounds.

Why it matters: Fixes a slab-use-after-free triggered through OVS on IPv6 packets with crafted extension headers.

ee319bd3a0e9

ARP ioctl and seg6 netlink out-of-bounds reads leak kernel memory

The ARP ioctl could read past a stack object due to unterminated device names, and SEG6_ATTR_DST short attributes triggered a 16-byte out-of-bounds read past skb->tail, leaking uninitialized head memory to userspace.

Why it matters: Unprivileged users could read uninitialized kernel memory through the ARP ioctls or segment routing netlink interface.

d8b6529e80bc2d959c75c27f

ip_gre changelink can hijack another tunnel's metadata receive entry

Enabling collect_md mode via changelink on an existing GRE/ERSPAN device is not subject to the uniqueness check enforced during newlink, so it can replace another device's metadata receive entry in the same netns.

Why it matters: Misconfigured or malicious GRE tunnel changes could disrupt metadata-based tunneling for other devices in the same network namespace.

a3f315be9d30

net/sched em_text_dump leaks kernel stack memory

em_text_dump() allocated struct tcf_em_text on the stack without zeroing it, then used strscpy which left trailing bytes uninitialized; nla_put_nohdr copied the full struct to the netlink response.

Why it matters: An unprivileged user could read uninitialized kernel stack memory through the traffic-control text-match filter dump interface.

9c572a83037a

TCP skb collapsing across device encryption boundaries

Retransmission or SACK shifting could merge a TCP skb queued after a switch to device encryption (such as PSP) into an earlier skb queued before the switch, bypassing the intended encryption fence.

Why it matters: Prevents potential data corruption or security gaps where network traffic meant to be encrypted by hardware could be transmitted unencrypted due to TCP internal merging behavior.

fc6d80eb5044

Networking: Driver and Protocol Bug Fixes

UDP 4-tuple hash table not updated on re-connect or disconnect

A connected UDP socket that reconnects to a different peer was not re-filed in the 4-tuple hash table, and a disconnected socket kept its stale entry, causing incoming packets to miss fast-path lookup.

Why it matters: Applications that repeatedly connect or disconnect UDP sockets (e.g., some DNS or media servers) will see more correct and efficient packet delivery.

5fd0783b99d49e95b1a94c9c

Netfilter flowtable use-after-free in HW_DEAD publication

The flow offload worker published NF_FLOW_HW_DEAD before clearing NF_FLOW_HW_PENDING, allowing concurrent garbage collection to RCU-free the flow while the worker still accessed it.

Why it matters: Prevents a use-after-free crash on systems using hardware flow offload under connection teardown.

d644b23afe1e

act_ct panic from benign flow_offload_alloc failure

flow_offload_alloc() can fail when a conntrack entry is dying or under memory pressure, both expected conditions, but the code WARNed on this path. With panic_on_warn=1 an unprivileged user could panic the box.

Why it matters: Removes a kernel panic vector exploitable by unprivileged users on systems using tc conntrack action with panic_on_warn enabled.

47abe7a5c4eb

HFSC qdisc soft lockup from infinite classify walk

hfsc_classify() could loop forever between two interior classes whose levels were raised after binding, holding the qdisc lock with BH disabled and triggering a soft lockup from a single packet.

Why it matters: Fixes a soft lockup that could hang a CPU on systems using the HFSC traffic-control qdisc.

8a60ade2277e

virtio_net zerocopy deadlock in non-NAPI transmit path

Without NAPI, virtio-net frees completed skbs lazily on the next transmit, so senders using zerocopy (e.g. PACKET_TX_RING) can deadlock if they cannot send more packets.

Why it matters: Users of PACKET_TX_RING or vhost_net zerocopy on virtio-net devices can avoid transmit deadlocks and ring slot exhaustion.

07e1a9408b6c

SCTP use-after-free on stale-cookie bundled DATA

When an SCTP association is in COOKIE-ECHOED state and a bundled ERROR(Stale Cookie)+DATA packet arrives from a non-primary address, the stale-cookie handler removes non-primary transports including the one the arriving packet references.

Why it matters: SCTP peers could trigger a kernel crash via a crafted packet, affecting any system using the SCTP protocol.

4498467a8af0

veth use-after-free of XDP program pointers during channel resize

veth_set_channels() tore down XDP resources for removed RX queues without clearing rq->xdp_prog; if the program was detached, a later channel increase re-enabled NAPI and ran the freed BPF program.

Why it matters: Resizing veth channels while XDP programs are attached no longer risks executing freed BPF code, a common scenario in container networking.

7104a3707143

IPv6 lwtunnel massive heap corruption on VLAN interfaces

seg6, ioam6, and rpl lwtunnels sized skb_cow_head() using dst_dev_overhead() which left LL_RESERVED_SPACE (16 bytes for Ethernet), but mac header rebuild needed skb->mac_len bytes. On VLAN devices with longer mac headers the memmove wrote about 64 KB past the skb buffer.

Why it matters: Routing IPv6 traffic through seg6/ioam6/rpl lwtunnels on VLAN interfaces no longer risks massive heap corruption.

87cd6b717e40

Stranded skbs on offline CPUs cause page_pool stalls and netdev teardown hangs

dev_cpu_dead() did not flush skb_defer_nodes when a CPU went offline, leaving skbs stranded. If those skbs held page_pool fragments, page_pool_destroy() could stall indefinitely waiting for inflight pages.

Why it matters: Systems with hotpluggable CPUs may experience indefinite hangs when unregistering network devices while a CPU is offline.

06e3f54e8b22

Hardware timestamping via PHY broken after legacy ioctl removal

Removing the legacy hardware timestamping ioctl fallback made the NDO callbacks mandatory, but devices that only timestamp in their PHY implement neither, causing SIOCSHWTSTAMP to fail and PTP to stop working.

Why it matters: Network devices relying on PHY-level timestamping for PTP regain working hardware timestamping configuration.

31995571219c

ovpn driver fixes for endpoint handling, routing, and peer validation

Multiple fixes to the in-tree ovpn VPN driver: preserve IPv6 scope IDs for link-local peers, skip UDP source validation for unspecified addresses, track mutable socket route keys for dst cache validity, prevent torn reads of RCU-published bind addresses, and reject invalid or duplicate peer VPN addresses.

Why it matters: Users of the kernel's native OpenVPN-compatible driver get more reliable IPv6 connectivity, correct routing after socket changes, and clearer configuration errors.

7a6d08ee0f0e77393b4d72df7c66b7a4ae80fa603710bdb9aea934a221ec7d8104988f42b43beccb3713d25e885b31a0025af3a0a8925940f3407b78

Hardware Support

sfc: add X4D PF support

Adds support for the X4D controller, which is an X4 controller instance implemented as an IP block in an SoC, with the same feature set as the standalone X4.

Why it matters: Enables the Solarflare sfc driver on SoC platforms incorporating the X4D network controller IP block.

24fedc7a569b

Quectel EG120K-EA LTE and MeiG Smart SRM821 5G module support

The qmi_wwan driver gains support for the Quectel EG120K-EA LTE Cat.12 module, and the cdc_mbim driver adds the MeiG Smart SRM821 5G module to its ZLP conformance whitelist to prevent firmware crashes.

Why it matters: Users of these cellular modules can now use them for data connectivity without firmware crashes or unbound interfaces.

0f2fd31f63c6f75f21ef3628

Intel XWAY PHY 100BASE-TX link-up failure workaround

MaxLinear GSW1xx switches incorporating Intel XWAY PHYs can sporadically fail to link up in 100BASE-TX mode after power-on. The workaround enables then disables Cable Diagnostic Mode on all ports after power-on, as specified in the errata.

Why it matters: Users of Intel XWAY / MaxLinear GSW1xx Ethernet PHYs may experience faster or more reliable link-up at 100 Mbps after power-on.

b94773dc4df7

sched_ext: Deadlock and Race Fixes

ops.dequeue() could self-deadlock by holding DSQ lock

ops.dequeue() was invoked with the source user DSQ's lock still held, so a BPF scheduler that iterated that DSQ from within ops.dequeue() would self-deadlock with IRQs disabled, wedging the system.

Why it matters: Custom BPF schedulers using sched_ext can avoid system-locking deadlocks when iterating DSQs from ops.dequeue().

cb86607ada73

Task reenqueue race during SCX_OPSS_DISPATCHING window

A task could be found on a DSQ while still in the DISPATCHING state; reenqueueing it in that window ran ops.enqueue() and set QUEUED before the dispatcher's final store overwrote it with NONE, dropping all later dispatches of the task.

Why it matters: sched_ext users may see tasks that silently stop being dispatched under specific timing conditions.

7de9a6fb44eadf5cdc2c832c

Pass initial CPU mask to cid-form ops.enable()

The cid-form scheduler API now provides a task's initial CPU mask through a new struct scx_enable_args passed to ops.enable(), closing a gap where schedulers had no reliable way to obtain the mask on fork, sub-sched enable, or re-home paths.

Why it matters: Improves the sched_ext BPF scheduler API so that custom schedulers correctly receive CPU affinity information when a task enters the scheduler.

3bd46666cfe5

NFC: Input Validation Hardening

Multiple NFC input-validation and use-after-free fixes

Multiple NFC drivers and the LLCP core had missing length checks allowing OOB reads, use-after-free on accept-queue races, WKS SAP hijacking via prefix match, and list corruption on DM handling.

Why it matters: Malformed NFC frames from a malicious peer or device could crash the kernel or bypass service-name access control; these fixes harden the NFC subsystem against a cluster of security-relevant bugs.

686f942332b1a653c01ce447bf1460acdf8c092c6a605cbdc3eef2f988a3dcab71a70119273f9d667cde66f4300206b8408cff6bd6067dcf371a3563b61732f47316

Other Notable Fixes

Atheros atl1c/atl1e/atl1 soft lockup during PCIe link reset

During PCIe link or MAC resets, the hardware can report an out-of-range consumer index (0xffff), causing the TX cleanup loop to spin forever and trigger a soft lockup. The fix treats out-of-range values as nothing to clean.

Why it matters: Users of Atheros AR8151 and related NICs may experience system hangs or watchdog timeouts during link flap events.

36c2009d90f2374bf9e4b90f43e746821f5f

cgroup pids.events notifications lost in local event accounting mode

When local event accounting is selected, pids_event() returns after notifying only events_local_file, leaving pids.events pollers asleep so that forks rejected by the pids controller do not generate notifications on the shared pids.events file.

Why it matters: Users monitoring cgroup PID limits via pids.events may miss notifications when local event mode is enabled.

1765a153d985

Landlock tracepoint improvements for ptrace, signals, and ruleset versioning

Landlock denial tracepoints now report the actual ptrace tracer and effective signal number, and the ruleset version counter was widened to 64 bits to prevent trace identity collision from counter wrapping.

Why it matters: Tooling that consumes Landlock audit or tracing events gets more complete and reliable information for debugging and monitoring sandbox policies.

7ad69ac633150889db596a25e7e0a54300a8

Restore keepalived compatibility for IFLA_INET_CONF netlink messages

A previous validation change required NLA_F_NESTED to be set on IFLA_INET_CONF attributes, breaking userspace tools like keepalived that did not set the flag when configuring macvlans.

Why it matters: Fixes keepalived and other userspace tools that stopped working after a stricter netlink attribute validation was introduced.

6c096bb08de9

Source commits269 entries +
bd3a19800dd1

landlock: Add counted_by in landlock_domain

Tingmao Wang · Feb 8, 2026 · 1 files

092c6a605cbd

nfc: port100: reject frames whose declared length exceeds the received data

Doruk Tan Ozturk · Jul 11, 2026 · 1 files

686f942332b1

nfc: nfcmrvl: validate helper command length before pull

Pengpeng Hou · Jul 15, 2026 · 1 files

a653c01ce447

nfc: st21nfca: validate received frame size

Pengpeng Hou · Jul 15, 2026 · 1 files

bf1460acdf8c

nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()

Aldo Ariel Panzardo · Jul 16, 2026 · 1 files

3d8afc5243ea

selftests: nci: Correct pthread_create return value check

Lei Zhu · Jul 29, 2026 · 1 files

d644b23afe1e

netfilter: flowtable: publish HW_DEAD after worker is done

Jérémy Jean · Aug 18, 2026 · 1 files

b43beccb3713

ovpn: always unhash old VPN addresses before rehashing

Ralf Lici · Aug 28, 2026 · 1 files

d25e885b31a0

ovpn: reject duplicate peer VPN addresses

Ralf Lici · Aug 28, 2026 · 3 files

025af3a0a892

ovpn: reject multipeer peers without VPN addresses

Ralf Lici · Aug 28, 2026 · 1 files

5940f3407b78

ovpn: reject invalid peer VPN addresses

Ralf Lici · Aug 28, 2026 · 1 files

006208026819

selftests: ovpn: validate peer VPN addresses

Ralf Lici · Aug 28, 2026 · 3 files

7a6d08ee0f0e

ovpn: preserve IPv6 scope id for netlink peer endpoints

Ralf Lici · Aug 28, 2026 · 1 files

77393b4d72df

ovpn: skip UDP source validation for unspecified addresses

Ralf Lici · Aug 28, 2026 · 1 files

7c66b7a4ae80

ovpn: track UDP socket route key for peer dst cache

Ralf Lici · Aug 28, 2026 · 3 files

fa603710bdb9

ovpn: validate peer state before caching UDP dst

Ralf Lici · Aug 28, 2026 · 1 files

aea934a221ec

ovpn: replace bind when learning local endpoint

Ralf Lici · Aug 28, 2026 · 1 files

7d8104988f42

ovpn: replace bind when clearing stale local source

Ralf Lici · Aug 28, 2026 · 1 files

7f2ea5ed588c

nfc: st21nfca: validate ISO15693 inventory length

Pengpeng Hou · Aug 30, 2026 · 1 files

eda518d2cdb6

selftests: nci: Fix uninitialized family ID on missing attribute

Chaithanya Lagisetty · Sep 1, 2026 · 1 files

c3eef2f988a3

nfc: llcp: Fix race condition in accept_queue lifecycle

Lee Jones · Sep 2, 2026 · 3 files

0d7823cd4cda

bpf: Allow terminal gotox instructions

Siddharth Chintamaneni · Sep 2, 2026 · 1 files

ac781acaef49

selftests/bpf: Test terminal gotox instructions

Siddharth Chintamaneni · Sep 2, 2026 · 1 files

9461613afc59

netfilter: nfnetlink_queue: hold nfnl mutex in event notifier

Florian Westphal · Sep 3, 2026 · 1 files

953824e508b2

bpf: Fix u32 overflow issue in map batch operations

Masoud Aghasi · Sep 3, 2026 · 2 files

75f8cf22463d

bpf: Fix out-of-bounds read of rtt_min in sock_ops

Jiayuan Chen · Sep 3, 2026 · 1 files

7d70a0b02d26

bpf: Use kvfree() in xdp_test_run_teardown()

Zhixing Chen · Sep 3, 2026 · 1 files

6be581aeffc2

selftests/nci: Fix out-of-bounds store on thread join

Chris Gellermann · Sep 4, 2026 · 1 files

51814683e28f

nfc: virtual_ncidev: Add missing ioctl compat handler

Chris Gellermann · Sep 4, 2026 · 1 files

1c21452d02ee

bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk

Pu Lehui · Sep 5, 2026 · 1 files

1b9b5323725e

netfilter: ip6t_rpfilter: reject routes without inet6_dev

Weiming Shi · Sep 6, 2026 · 1 files

82313c169edd

netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read

Luxiao Xu · Sep 6, 2026 · 1 files

3b55f350c68a

bpf: Fix bpf_skb_change_tail wrt csum partial skbs

Daniel Borkmann · Sep 7, 2026 · 1 files

15e2565f1c43

selftests/bpf: Add test for bpf_skb_change_tail on csum partial skbs

Daniel Borkmann · Sep 7, 2026 · 2 files

ef1fb82f1218

bpf, arm64: set up the frame pointer for the exception callback

Donggeun Yoo · Sep 7, 2026 · 1 files

26a43a5f8c31

selftests/bpf: cover the exception callback using its own BPF stack

Donggeun Yoo · Sep 7, 2026 · 2 files

490a83d6386e

bpf, sockmap: Fix self-redirect copied_seq double-counting

Geliang Tang · Sep 8, 2026 · 1 files

7dcf371a3563

nfc: llcp: fix slab-out-of-bounds reads when logging service names

Ömer Mete Kaya · Sep 8, 2026 · 2 files

e4a62833adff

bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL

Weiming Shi · Sep 9, 2026 · 1 files

dcab71a70119

nfc: fix use-after-free in nfc_get_local_general_bytes

Luxiao Xu · Sep 9, 2026 · 12 files

408cff6bd606

nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()

Ömer Mete Kaya · Sep 9, 2026 · 1 files

c04981e42d94

nfc: llcp: fix -ENOMEM on connect with zero-length service name

Ömer Mete Kaya · Sep 9, 2026 · 1 files

85136bf22404

bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()

Jose Fernandez (Anthropic) · Sep 9, 2026 · 1 files

01b245ba016d

bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()

Jiayuan Chen · Sep 10, 2026 · 1 files

eaab8cab451b

tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context

Jiayuan Chen · Sep 10, 2026 · 1 files

8036d3a5a658

selftests/bpf: Test bpf_sock_destroy() on TIME_WAIT and listener socks

Jiayuan Chen · Sep 10, 2026 · 2 files

b0b3dc665296

bpf: Fix divide-by-zero in btf_struct_walk()

Jiayuan Chen · Sep 10, 2026 · 1 files

f77d21245710

selftests/bpf: Test BTF walk into a flexible array of zero-sized elements

Jiayuan Chen · Sep 10, 2026 · 2 files

70504de0bb62

xsk: Use a 32-bit compare in xsk_map_gen_lookup

Zhiling Zou · Sep 10, 2026 · 1 files

2936aed9b021

bpf: Clear scalar delta on narrowing stack spill

Daniel Borkmann · Sep 10, 2026 · 1 files

a311a8981727

netfilter: nft_synproxy: use the family-aware checksum helper

Karl Mehltretter · Sep 10, 2026 · 1 files

88ce88e933e4

bpf: Add KF_PERFMON kfunc flag

Daniel Borkmann · Sep 10, 2026 · 3 files

81c975aae375

bpf: Require CAP_PERFMON for kfuncs reading memory

Daniel Borkmann · Sep 10, 2026 · 1 files

f9191460cd80

bpf: Require CAP_PERFMON for untrusted read-only memory reads

Daniel Borkmann · Sep 10, 2026 · 1 files

a903f145a891

selftests/bpf: Add tests for the KF_PERFMON gates

Daniel Borkmann · Sep 10, 2026 · 2 files

651010592bdc

net: txgbe: fix FDIR filter restore for VF rules

Zhang Yunfei · Sep 11, 2026 · 1 files

e29014556488

ipvs: revalidate ihl before icmp_send

Julian Anastasov · Sep 11, 2026 · 1 files

207d591c3532

netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name

Naman Gulati · Sep 12, 2026 · 1 files

d2acbde7e67d

nfc: trf7970a: power down on startup RX gain failure

Myeonghun Pak · Sep 13, 2026 · 1 files

99cc2a62e07a

tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow

Eric Dumazet · Sep 13, 2026 · 1 files

39c6580765da

octeontx2-af: use seq_file for rsrc_alloc debugfs

Heyang Tan · Sep 14, 2026 · 1 files

c82b797abe66

net/sched: reject IDR error pointers when deleting actions

Weiming Shi · Sep 14, 2026 · 1 files

70194dc37670

netfilter: nf_tables: skip expired catchall elements on insert and delete

Aohan Mei · Sep 14, 2026 · 1 files

66f4300206b8

nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure

Cong Nguyen · Sep 14, 2026 · 1 files

40c2096961b4

bpf: Verify global subprogs in each sleepability context

Kumar Kartikeya Dwivedi · Sep 14, 2026 · 2 files

a452e729b7be

selftests/bpf: Test global subprog callback contexts

Kumar Kartikeya Dwivedi · Sep 14, 2026 · 1 files

bfc888f04588

bpf: Bound ownership depth through local kptrs and graph roots

Kumar Kartikeya Dwivedi · Sep 14, 2026 · 2 files

0288ed67482b

selftests/bpf: Check local object ownership depth

Kumar Kartikeya Dwivedi · Sep 14, 2026 · 1 files

50e80e2bb5e2

bpf: Skip unsettled links in link iterator

Weiming Shi · Sep 14, 2026 · 1 files

1b82958f3f03

net: ethtool: keep rtnl_lock for the ioctl self test

Alexander Duyck · Sep 14, 2026 · 4 files

1f4c73064a50

eth: fbnic: Handle maximum standalone channels

Björn Töpel · Sep 14, 2026 · 1 files

b5d9e9d4d0c1

eth: fbnic: use the Rx queue napi pointer to find the napi vector

Alexander Duyck · Sep 14, 2026 · 1 files

4bcc4a92c603

eth: fbnic: reset num_napi when the napi vectors are freed

Alexander Duyck · Sep 14, 2026 · 1 files

8947f13e436a

eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox

Alexander Duyck · Sep 14, 2026 · 2 files

1b97a269a5bd

eth: fbnic: Handle FW mailbox completions flagged with an error

Alexander Duyck · Sep 14, 2026 · 4 files

9d565b6b72fe

net: usb: catc: bound the RX packet length in catc_rx_done()

Aamir Ahmed · Sep 14, 2026 · 1 files

37a111293453

Bluetooth: btintel_pcie: validate device-supplied DMA indices

Ravindra · Sep 15, 2026 · 1 files

ab888242fce4

vlan: require the MAC header to be present in __vlan_insert_inner_tag()

Xiang Mei · Sep 15, 2026 · 1 files

d2c31b837406

sctp: avoid livelock while updating retransmit path

Yiqi Sun · Sep 15, 2026 · 1 files

8e0b235bd918

eth: fbnic: Fix payload page pool error cleanup

Björn Töpel · Sep 15, 2026 · 1 files

d09e8f64653c

net/mlx5: devcom, Base component size on linked devices

Shay Drory · Sep 15, 2026 · 1 files

e1e29ada2b93

net/mlx5: SD, unload reps on shared FDB create error path

Shay Drory · Sep 15, 2026 · 1 files

bae23d1ae620

net/mlx5: LAG, reload IB reps of LAG master before the rest

Shay Drory · Sep 15, 2026 · 1 files

71af682ba469

Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel

Lee Jones · Sep 15, 2026 · 1 files

2566866fc309

net: gue: reject invalid REMCSUM offsets

Jérémy Jean · Sep 15, 2026 · 1 files

47abe7a5c4eb

net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure

Nguyen Ngoc Thang · Sep 15, 2026 · 1 files

b5dbb41b212c

Bluetooth: mgmt: fix race in read_unconf_index_list()

Aldo Ariel Panzardo · Sep 15, 2026 · 1 files

6c78a213d907

Bluetooth: L2CAP: validate frame length before control and FCS access

Aldo Ariel Panzardo · Sep 15, 2026 · 1 files

b0a6cf99afd5

Bluetooth: hci_sock: validate event length before filtering

Aldo Ariel Panzardo · Sep 15, 2026 · 1 files

4c94557dd025

Bluetooth: ISO: balance the parent hold in hci_bind_bis()

Aldo Ariel Panzardo · Sep 15, 2026 · 1 files

e93fad891c72

Bluetooth: hci_sock: reject out-of-range OCF values

Aldo Ariel Panzardo · Sep 15, 2026 · 1 files

e06d549fcd4a

Bluetooth: hci_conn: fix CIS hold ownership on reuse

Aldo Ariel Panzardo · Sep 15, 2026 · 1 files

0fcd4dad555c

Bluetooth: ISO: release unused CIS holds after channel attach

Aldo Ariel Panzardo · Sep 15, 2026 · 1 files

2ec28c09b320

vsock: ignore empty child namespace mode writes

Aldo Ariel Panzardo · Sep 15, 2026 · 1 files

daf677c2c644

net: pcs: rzn1-miic: Fix config array initialization

Kyle Hendry · Sep 15, 2026 · 1 files

273f9d667cde

nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()

Aamir Ahmed · Sep 15, 2026 · 1 files

c4e941bb7654

landlock: Work around gcc-16 -Wuninitialized warning

Arnd Bergmann · Sep 15, 2026 · 1 files

c0078f4d8c8f

mailmap: add entry for Wei Wang

Wei Wang · Sep 15, 2026 · 1 files

6c096bb08de9

net: allow IFLA_INET_CONF messages when NLA_F_NESTED unset

Quentin Armitage · Sep 15, 2026 · 1 files

7de9a6fb44ea

sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task

Tejun Heo · Sep 15, 2026 · 3 files

f2bbb3642658

Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()

Zijun Hu · Sep 16, 2026 · 1 files

d06f2ebf67ff

octeontx2-af: Fix memory scaling limitation in SR-IOV mode

Ratheesh Kannoth · Sep 16, 2026 · 1 files

0a5f5d9e94de

net/sched: cls_u32: fix manual hash table handle IDR aliasing

Jamal Hadi Salim · Sep 16, 2026 · 1 files

960ab631f3d8

selftests/tc-testing: add u32 manual table handle IDR tests

Jamal Hadi Salim · Sep 16, 2026 · 1 files

46bc52d13594

ipv4: fib: fix data-race and stale genid check around nh->nh_saddr

Linkui Xiao · Sep 16, 2026 · 1 files

24fedc7a569b

sfc: add X4D PF support

Andy Moreton · Sep 16, 2026 · 1 files

310d1ac61a4d

net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure

Lorenzo Bianconi · Sep 16, 2026 · 1 files

f033482d76a9

Bluetooth: SMP: reject Security Request over BR/EDR

Christiano Amora · Sep 16, 2026 · 1 files

ee319bd3a0e9

ipv6: do not let ipv6_find_hdr() return an offset past the packet end

Norbert Szetei · Sep 16, 2026 · 1 files

c774ec8f0a5d

selftests: cgroup: give the O_TMPFILE open in get_temp_fd() a mode

Eva Kurchatova · Sep 16, 2026 · 1 files

df5cdc2c832c

sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags

Tejun Heo · Sep 16, 2026 · 1 files

dd47bcf279f1

ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink().

Kuniyuki Iwashima · Sep 16, 2026 · 1 files

95c4d54ed022

net: phy: micrel: Advance register data pointer in write loop

Abhishek Ojha · Sep 16, 2026 · 1 files

cb86607ada73

sched_ext: Don't run ops.dequeue() with a DSQ lock held

fangqiurong · Sep 17, 2026 · 3 files

9ec7ba20c97d

selftests/sched_ext: Test that ops.dequeue() can iterate the consumed DSQ

fangqiurong · Sep 17, 2026 · 3 files

5fd0783b99d4

udp: relocate a connected socket in the 4-tuple hash table on re-connect

Shardul Bankar · Sep 17, 2026 · 1 files

9e95b1a94c9c

udp: remove a disconnected socket from the 4-tuple hash table

Shardul Bankar · Sep 17, 2026 · 1 files

8a60ade2277e

net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget

Jamal Hadi Salim · Sep 17, 2026 · 1 files

1e24c4f2ee44

selftests: tc-testing: add a lateral-drift hfsc classify-walk test

Jamal Hadi Salim · Sep 17, 2026 · 1 files

a644f09b2090

fsl/fman: Fix clk reference leak in read_dts_node()

Wentao Liang · Sep 17, 2026 · 1 files

999e8295bc41

net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy()

Wentao Liang · Sep 17, 2026 · 1 files

0bf6bb567f0e

net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()

Wentao Liang · Sep 17, 2026 · 1 files

10de7ed8ef48

net/mlx5e: fix swapped IPv6 IPsec policy masks

Andrea Parri · Sep 17, 2026 · 1 files

17741334d00b

net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs()

Wentao Liang · Sep 17, 2026 · 1 files

814a81c842bd

bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc

Zhao Gongyi · Sep 17, 2026 · 1 files

4581c3d2adc3

net/mlx5e: advertise MACsec offload only when supported

Ralf Lici · Sep 17, 2026 · 2 files

7cce782d8327

dpll: use exact lookup for reference sync pin id

Ivan Vecera · Sep 17, 2026 · 1 files

a92e1a412c53

tg3: clean up PHYLIB resources on probe failure

Myeonghun Pak · Sep 17, 2026 · 1 files

d68acbf93531

net: stmmac: selftests: Support running selftests on DSA conduits

Maxime Chevallier · Sep 17, 2026 · 1 files

c8c1795aa810

net: stmmac: selftests: Validate EEE based on the actual LPI timer value

Maxime Chevallier · Sep 17, 2026 · 1 files

ba804b23d76d

net: stmmac: selftests: Check the dev->features for S-TAG offload testing

Maxime Chevallier · Sep 17, 2026 · 1 files

960db6f65788

net: stmmac: selftests: Capture all packets for vlan checks

Maxime Chevallier · Sep 17, 2026 · 1 files

b42e7012773a

net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K

Maxime Chevallier · Sep 17, 2026 · 3 files

b8a26d46c0a4

net: stmmac: size the RX buffers from the frame length, not the MTU

Maxime Chevallier · Sep 17, 2026 · 1 files

c4ac6e94eb94

net: stmmac: selftests: Account for alignment shift on dwmac1000 for Jumbo test

Maxime Chevallier · Sep 17, 2026 · 1 files

261b61d3735b

bpf: Make post-verification instruction rewrites killable

Kumar Kartikeya Dwivedi · Sep 17, 2026 · 2 files

fd16449a9b3b

bpf: Preserve packet pointer class displacement in regsafe()

Kumar Kartikeya Dwivedi · Sep 17, 2026 · 1 files

2059d9af54f0

selftests/bpf: Test packet pointer class displacement pruning

Kumar Kartikeya Dwivedi · Sep 17, 2026 · 1 files

c26e97721b17

bpf: Apply CO-RE relocations before subprogram validation

Kumar Kartikeya Dwivedi · Sep 17, 2026 · 3 files

968ee7c06b62

selftests/bpf: Test early in-kernel CO-RE relocation

Kumar Kartikeya Dwivedi · Sep 17, 2026 · 1 files

394ae398337c

bpf: Restrict CO-RE poisoning to relocatable instructions

Kumar Kartikeya Dwivedi · Sep 17, 2026 · 1 files

3440505aca92

selftests/bpf: Test CO-RE instruction poisoning restrictions

Kumar Kartikeya Dwivedi · Sep 17, 2026 · 1 files

71919742c83c

bpf: Assign lock identity to callback map values

Kumar Kartikeya Dwivedi · Sep 17, 2026 · 3 files

04ae4ffc57a6

selftests/bpf: Check callback map value lock identity

Kumar Kartikeya Dwivedi · Sep 17, 2026 · 3 files

b4e875d397da

libbpf: Reject truncated ldimm64 CO-RE relocations

Kumar Kartikeya Dwivedi · Sep 17, 2026 · 1 files

c2cdef41e0b4

net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621

Aleksei Sviridkin · Sep 18, 2026 · 1 files

0d80ba0a204c

net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq

Aleksei Sviridkin · Sep 18, 2026 · 1 files

481506a756dc

vxlan: use one headroom snapshot for neighbour replies

Sanghyun Park · Sep 18, 2026 · 1 files

ac4334522e4b

net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error

bui duc phuc · Sep 18, 2026 · 1 files

0346ec2f080b

ipv6: Prevent rt6_insert_exception() for dying fib6_info.

Kuniyuki Iwashima · Sep 18, 2026 · 2 files

31995571219c

net: don't require the hwtstamp NDOs when a PHY provides timestamping

Nicolai Buchwitz · Sep 18, 2026 · 1 files

35e6f970f553

net/mlx5: Bridge, don't fail switchdev events of sibling eswitch ports

Bernardo Soares · Sep 18, 2026 · 3 files

2e51097c982b

net/mlx5: Bridge, don't fail unlink of untracked/unsupported peer ports

Bernardo Soares · Sep 18, 2026 · 1 files

0160953d8eec

eth: fbnic: Avoid rounding zero ring sizes

Björn Töpel · Sep 18, 2026 · 1 files

9c572a83037a

net/sched: fix potential stack infoleak in em_text_dump()

Bernard Ladenthin · Sep 18, 2026 · 1 files

be581d663557

selftests: net: fix CONFIG_SYSCTL sort order in configs

Yuya Kusakabe · Sep 18, 2026 · 2 files

f71ecaece401

landlock: Fix tracepoint fixed-width type names

Mickaël Salaün · Sep 18, 2026 · 1 files

0de33ca344fb

landlock: Fix filesystem denial blocker reporting

Mickaël Salaün · Sep 18, 2026 · 3 files

1a985d3890ed

landlock: Fix rule tracepoint context

Mickaël Salaün · Sep 18, 2026 · 9 files

98b04ab00f0e

landlock: Fix network denial trace context

Mickaël Salaün · Sep 18, 2026 · 6 files

7ad69ac63315

landlock: Report the actual ptrace tracer

Mickaël Salaün · Sep 18, 2026 · 4 files

0889db596a25

landlock: Report the effective signal number

Mickaël Salaün · Sep 18, 2026 · 4 files

c6dea91d846f

selftests/landlock: Test filesystem denial blockers

Mickaël Salaün · Sep 18, 2026 · 1 files

c8dcb17205a6

selftests/landlock: Test network denial context

Mickaël Salaün · Sep 18, 2026 · 1 files

3fa5aa398edf

landlock: Fix tracepoint contract documentation

Mickaël Salaün · Sep 18, 2026 · 2 files

23d42b9a3bcd

net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths

Théo Lebrun · Sep 18, 2026 · 1 files

00efbbd40bd5

bonding: crypto offload enabled, non-offload slave failover, rekey failed

David Dai · Sep 18, 2026 · 1 files

89a8a1eef2d4

net: mdio: realtek-rtl9300: fix RTL931x C22 extended page selection

Jonas Jelonek · Sep 18, 2026 · 1 files

261e8a37ecba

genetlink: report the real command id for dump-only ops in policy dumps

Jakub Kicinski · Sep 18, 2026 · 1 files

a87529034b9c

selftests: net: nl_nlctrl: check the op ids in the policy map

Jakub Kicinski · Sep 18, 2026 · 1 files

4eb3f195ef08

tg3: use random MAC address when tg3_get_device_address fails

Ivan Delalande · Sep 18, 2026 · 1 files

3bd46666cfe5

sched_ext: Pass the initial cmask to cid-form ops.enable()

Tejun Heo · Sep 19, 2026 · 3 files

07e1a9408b6c

virtio_net: copy zerocopy frags in start_xmit without NAPI

Willem de Bruijn · Sep 19, 2026 · 1 files

951840561386

packet: use ubuf_info completion for TX_RING packets

Willem de Bruijn · Sep 19, 2026 · 2 files

8901cee9316d

bpf: Compare stack frames in regs_exact()

Kumar Kartikeya Dwivedi · Sep 19, 2026 · 2 files

070587848985

selftests/bpf: Cover frame changes in bounded loops

Kumar Kartikeya Dwivedi · Sep 19, 2026 · 1 files

a11212910cf0

bpf: Check params size before reading reserved fields

Yuqi Xu · Sep 19, 2026 · 1 files

e47a1958e12a

net: ipconfig: bound DHCP option construction

Yuqi Xu · Sep 19, 2026 · 1 files

6d91041bb38b

Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()

Hui Peng · Sep 19, 2026 · 1 files

46f8ffd0a1f1

Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO

Hui Peng · Sep 19, 2026 · 1 files

3b4e0b0c008a

net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()

Shihuang Liu · Sep 19, 2026 · 1 files

d781d1b78acf

selftests/sched_ext: Check the cmask cid-form ops.enable() receives

Tejun Heo · Sep 19, 2026 · 3 files

9892d71cf0ce

net: pcs: xpcs: fix clock reference leak on xpcs_init_clks failure

Coia Prant · Sep 19, 2026 · 1 files

2d14720beb58

net: spacemit: clear TX descriptor on fragment mapping failure

Muhammad Bilal · Sep 19, 2026 · 1 files

f0ca020cbb9b

Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough

Hui Peng · Sep 19, 2026 · 2 files

c06bde80ae7a

net: usb: sr9700: include receive overhead in the length check

Pengpeng Hou · Sep 20, 2026 · 1 files

f75f21ef3628

net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist

Ming Wang · Sep 20, 2026 · 1 files

ab1404ac8115

net: bridge: mdb: restart port group walk after deletion

Fourie Zhang · Sep 20, 2026 · 1 files

6db1ce73e985

bpf: Reject dev-bound-only programs on other devices

Weiming Shi · Sep 20, 2026 · 1 files

cfa165cbfbed

net/sched: act_gate: budget the per-entry list in get_fill_size

Victor Nogueira · Sep 20, 2026 · 1 files

d8b6529e80bc

net: arp: terminate device name before lookup

Zijie Huang · Sep 20, 2026 · 1 files

be31fe6333f5

ipv6: Fix dst leak for uncached routes.

Kuniyuki Iwashima · Sep 20, 2026 · 2 files

79a9172f3ab4

bpf: Reject non-negative offsets in stack_slot_obj_get_spi()

Xu Yunxiang · Sep 20, 2026 · 1 files

8244668cbbff

selftests/bpf: Reject iterator destruction through fp+0

Xu Yunxiang · Sep 20, 2026 · 1 files

a940003f44e7

net: phylink: record the PHY only once bringup cannot fail

Aleksei Sviridkin · Sep 20, 2026 · 1 files

a3f315be9d30

ip_gre: Reject enabling collect metadata through changelink

Xuanqiang Luo · Sep 21, 2026 · 1 files

6b491af01aa5

net: dsa: mv88e6xxx: 88E6191X and 88E6193X have no PTP

Nicolo Giuliani · Sep 21, 2026 · 1 files

2d959c75c27f

ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST

Hui Peng · Sep 21, 2026 · 1 files

d22609f3d13f

fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT

Hui Peng · Sep 21, 2026 · 1 files

26cc0e69cce0

mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()

Hui Peng · Sep 21, 2026 · 1 files

3173cba11701

net: libwx: fix races in Tx timestamp handling

Jiawen Wu · Sep 21, 2026 · 4 files

36c2009d90f2

net: atl1c: fix soft lockup on out-of-range tpd_cons read

Gajdos Tamás · Sep 21, 2026 · 1 files

374bf9e4b90f

net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read

Gajdos Tamás · Sep 21, 2026 · 1 files

43e746821f5f

net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read

Gajdos Tamás · Sep 21, 2026 · 1 files

0f2fd31f63c6

net: usb: qmi_wwan: add Quectel EG120K-EA

Gilberto Conde · Sep 21, 2026 · 1 files

4498467a8af0

sctp: discard the rest of the packet on a stale-cookie error

Aohan Mei · Sep 21, 2026 · 1 files

d6ec384c87cc

net/sched: act_ife: validate metadata length before decoding

Fang Xieyan · Sep 21, 2026 · 4 files

0a7822e34a0b

net: stmmac: clear stale buf->page after recycling on skb build failure

Lorenzo Bianconi · Sep 21, 2026 · 1 files

26b2bd70d224

net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry

Ilya Maximets · Sep 21, 2026 · 2 files

5e6c14dd42a1

net: openvswitch: conntrack: remove 'add_helper' dead code

Ilya Maximets · Sep 21, 2026 · 1 files

1a4151e6be57

net: openvswitch: conntrack: fix helper UAF due to extensions realloc

Ilya Maximets · Sep 21, 2026 · 1 files

f85009dfcd65

net/sched: act_ct: avoid modifying shared unconfirmed ct entry

Ilya Maximets · Sep 21, 2026 · 1 files

00df72e39f30

net/sched: act_ct: remove 'add_helper' dead code

Ilya Maximets · Sep 21, 2026 · 1 files

dad19b59da05

net/sched: act_ct: fix helper UAF due to extensions realloc

Ilya Maximets · Sep 21, 2026 · 1 files

4da3b7b8b50f

net: xps: reject an out of range traffic class

Norbert Szetei · Sep 21, 2026 · 1 files

0958ea4355e2

net: ena: fix PHC cleanup on probe failure

Guangshuo Li · Sep 21, 2026 · 1 files

9476b4468862

net: ena: fix MMIO read buffer leak on probe failure

Guangshuo Li · Sep 21, 2026 · 1 files

7c9f391ec89c

net: emac: move setting of netops to fix crash

Christian Lamparter · Sep 21, 2026 · 1 files

cae23ae3f788

sctp: hold asoc or transport before mod_timer() in timer handlers

Xin Long · Sep 21, 2026 · 2 files

1a983a4e14c6

nfp: hold IPsec RX state under the XArray lock

Sang-Hoon Choi · Sep 21, 2026 · 1 files

73b3fc67a493

net: devmem: document that bind-tx is unprivileged by design

Mina Almasry · Sep 21, 2026 · 2 files

c2de369c5c5b

macsec: initialize SecY before registering the netdevice

Haseeb Malik · Sep 21, 2026 · 1 files

87cd6b717e40

net: ipv6: keep room for the mac header in dst_dev_overhead()

Yuya Kusakabe · Sep 21, 2026 · 1 files

ba3d1f480c7a

net/rds: size a connection's path set by the transport it ends up with

Allison Henderson · Sep 21, 2026 · 1 files

0e2bec77ea62

net: bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems

Florian Fainelli · Sep 21, 2026 · 1 files

3aeaa609fda1

net: bcmgenet: initialize u64 stats seq counter for all queues

Florian Fainelli · Sep 21, 2026 · 1 files

cbbc1aee7776

net: bcmgenet: do not skip WoL power up on GENET V1

Florian Fainelli · Sep 21, 2026 · 1 files

273941c85fc2

net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr

Florian Fainelli · Sep 21, 2026 · 1 files

d64e277b955b

net: bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT

Florian Fainelli · Sep 21, 2026 · 1 files

7104a3707143

veth: manage XDP program pointers during channel resize

Jakub Kicinski · Sep 21, 2026 · 1 files

4bdee8060d1e

net: airoha: npu: cancel wdt_work after releasing the WDT IRQ

Myeonghun Pak · Sep 22, 2026 · 1 files

77b1718e39e5

bna: prevent IOC timer rearm during teardown

Myeonghun Pak · Sep 22, 2026 · 1 files

58eb1b3325ed

rds: ib: Clear the sg list when mapping an MR fails

Dongliang Qin · Sep 22, 2026 · 1 files

fdfec06ac1eb

MAINTAINERS: add Nicolai Buchwitz as GENET maintainer

Nicolai Buchwitz · Sep 22, 2026 · 1 files

61cb282fe97b

net/smc: fix UAF on lgr list traversal in smcr_port_err()

Sidraya Jayagond · Sep 22, 2026 · 2 files

b94773dc4df7

net: phy: intel-xway: workaround 100BASE-TX Link-Up issue

Alexander Sverdlin · Sep 22, 2026 · 1 files

8e1937fed673

tipc: Fix a data race on mon->peer_cnt in mon_timeout()

Ginger Li · Sep 22, 2026 · 1 files

7e87508b5c4d

net: bcmgenet: stop Tx NAPI before disabling the queues

Nicolai Buchwitz · Sep 22, 2026 · 1 files

ab7aa05c06ae

vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets

Ido Schimmel · Sep 22, 2026 · 1 files

e7e0a54300a8

landlock: Widen ruleset versions to 64 bits

Mickaël Salaün · Sep 22, 2026 · 2 files

c6b51091caff

firewire: cdev: fix back-transition for iso_resource_auto client resource

Takashi Sakamoto · Sep 22, 2026 · 1 files

ed6eec97b534

bpf: Fix bounds check for skb-backed dynptrs

Emil Tsalapatis · Sep 22, 2026 · 1 files

4fd72eb9f1c9

selftests/bpf: Test dynptr slices past end of skb

Emil Tsalapatis · Sep 22, 2026 · 2 files

4a4852376e3a

bpf: Fix bpf_sock context code generation

Emil Tsalapatis · Sep 22, 2026 · 1 files

dec0c209a680

selftests/bpf: Add selftests for rx_queue_mapping context access

Emil Tsalapatis · Sep 22, 2026 · 1 files

a6c1edfbe240

bpf: Reject pkt arguments in mutating subprogs

Emil Tsalapatis · Sep 22, 2026 · 1 files

1ed69a54d318

selftests/bpf: Test rejection of pkt args to mutating subprogs

Emil Tsalapatis · Sep 22, 2026 · 1 files

f85f5917aa2f

bpf: Prevent variable arena/non-arena register contents

Emil Tsalapatis · Sep 22, 2026 · 2 files

a9e86dd9de4f

selftests/bpf: Test for mixed arena/nonarena code paths

Emil Tsalapatis · Sep 22, 2026 · 1 files

b61732f47316

nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()

Deepanshu Kartikey · Sep 23, 2026 · 1 files

56d82862a0a2

af_packet: fix integer overflow in prb_calc_retire_blk_tmo()

Dairui Zhang · Sep 23, 2026 · 1 files

db762fd96be2

bpf: Fix immediate JMP JEQ/JNE on MIPS32

Johan Almbladh · Sep 23, 2026 · 1 files

8110ba097778

bpf: Fix BSWAP 32 and 16 on MIPS64

Johan Almbladh · Sep 23, 2026 · 1 files

4409a85735cd

sched_ext: Count SCX_EV_SUB_BYPASS_DISPATCH in the dispatch fallback

Liang Luo · Sep 23, 2026 · 1 files

8db67bb6a1ff

net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails

Coia Prant · Sep 23, 2026 · 1 files

06e3f54e8b22

net: flush skb_defer_nodes in dev_cpu_dead()

Eric Dumazet · Sep 23, 2026 · 3 files

83769c23fb18

gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO

Eric Dumazet · Sep 23, 2026 · 1 files

3b430ea62340

gve: fix TX drop when GSO MSS is too small for hw

Eddie Phillips · Sep 24, 2026 · 1 files

296c83b5ccc8

gve: DQO: reject TSO packets with an out of range MSS

Eric Dumazet · Sep 24, 2026 · 2 files

72b5b9a28b99

llc: reserve device headroom for allocated frames

Zixuan Chai · Sep 24, 2026 · 1 files

fe99bbeee5c5

tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()

Yilin Zhang · Sep 24, 2026 · 1 files

72f9dd522f8d

llc: fix skb UAF and leaks on llc_mac_hdr_init() failure

Eric Dumazet · Sep 24, 2026 · 2 files

ac704ff08e51

bridge: check llc_mac_hdr_init() return value in br_send_bpdu()

Eric Dumazet · Sep 24, 2026 · 1 files

907b978e82cb

net/sched: sch_teql: fix shadowed err in __teql_resolve()

Eric Dumazet · Sep 24, 2026 · 1 files

cd5dd68267c4

vlan: ensure sufficient headroom in vlan_dev_hard_header()

Eric Dumazet · Sep 24, 2026 · 1 files

1765a153d985

cgroup/pids: Restore pids.events notifications in local mode

Guopeng Zhang · Sep 24, 2026 · 1 files

c3a66e5f5bab

bpf: Zero-fill other CPUs when BPF_F_CPU creates a per-cpu hash element

Donggeun Yoo · Sep 24, 2026 · 1 files

3422808f4e95

selftests/bpf: Test per-cpu initialization of a BPF_F_CPU created element

Donggeun Yoo · Sep 24, 2026 · 1 files

fc6d80eb5044

tcp: prevent collapsing skbs across boundary in rtx queue

Willem de Bruijn · Sep 24, 2026 · 1 files