Daily update · Sep 24–25, 2026
Linux mainline update: Bluetooth and BPF security hardening, networking fixes, new hardware support
A sweeping set of Bluetooth vulnerability fixes, BPF verifier and privilege-gating improvements, network stack security patches, and driver additions highlight today's mainline activity.
In brief
Today's mainline update is dominated by security and stability work across Bluetooth, BPF, and the networking stack. The Bluetooth subsystem received fixes for raw HCI socket filter bypass, BNEP/RFCOMM frame processing, mgmt heap out-of-bounds writes, and SMP disconnect issues affecting popular dual-mode headphones. BPF saw extensive verifier hardening—including CO-RE relocation poisoning, packet pointer range pruning, sleepability context verification, and new CAP_PERFMON requirements for memory-reading kfuncs—alongside numerous runtime bug fixes. The network stack addresses a TCP Fast Open use-after-free, RDS InfiniBand privilege escalation, DHCP client buffer overflow, OVS conntrack use-after-free, and several out-of-bounds access vectors. New hardware support includes the Solarflare sfc X4D controller, Quectel EG120K-EA LTE module, and MeiG Smart SRM821 5G module. sched_ext fixes prevent DSQ self-deadlock and task dispatch races, while NFC receives a cluster of input-validation and use-after-free fixes.
Bluetooth: Security and Stability
Raw HCI socket security filter bypass via out-of-range OCF
The raw HCI socket security filter masked the 10-bit OCF with 127, allowing an unprivileged socket to submit a reserved OCF that aliases an allowlisted command modulo 128. The fix rejects OCF values the filter cannot represent.
Why it matters: An unprivileged process with raw HCI socket access could bypass the security filter to send commands that should be blocked.
SMP Security Request mishandled on BR/EDR causing headphone disconnects
Dual-mode devices such as Bose QC Ultra headphones can send an LE-style SMP Security Request over the BR/EDR fixed channel, which the kernel mistakenly processes as an LE link, causing the controller to reject LE_START_ENC and disconnect with authentication failure.
Why it matters: Users of certain Bluetooth dual-mode headphones may experience unexpected disconnections on BR/EDR links.
BNEP and RFCOMM frame processing out-of-bounds reads and crashes
Fixes multiple out-of-bounds reads and a control-frame fallthrough in BNEP processing that could leak heap memory on short frames, and fixes a NULL dereference and short-frame handling in RFCOMM.
Why it matters: Users of Bluetooth PAN (BNEP) and serial-port-over-Bluetooth (RFCOMM) profiles are protected against potential information leaks and crashes from malformed frames.
mgmt race causes heap out-of-bounds write during controller setup
read_unconf_index_list() could count controllers before a flag transition makes them eligible, then write past the allocated response buffer during the fill pass. The fix allocates space for every device on the list.
Why it matters: Rapid controller setup could trigger a kernel heap out-of-bounds write.
Intel PCIe Bluetooth driver validates DMA-supplied indices
The btintel_pcie driver now bounds-checks device-controlled frbd_tag and cr_hia values used as array indices and loop counters, preventing out-of-bounds accesses from a malicious or malfunctioning device.
Why it matters: Systems with Intel Bluetooth PCIe adapters are protected against potential memory corruption from rogue firmware or device behavior.
L2CAP and HCI socket out-of-bounds reads from malformed frames/events
Short ERTM or streaming-mode L2CAP frames could cause out-of-bounds reads of control and FCS fields, and malformed HCI events could trigger OOB reads in the packet filter before event header validation.
Why it matters: A malicious or buggy Bluetooth controller or vhci device could trigger kernel memory reads past buffer boundaries.
BPF: Verifier Hardening and Privilege Gating
Memory-reading kfuncs now require CAP_PERFMON
Tracing-related kfuncs such as bpf_rdonly_cast() and probe-read helpers were accessible with plain CAP_BPF, unlike their old-style BPF helper equivalents which require CAP_PERFMON. A new KF_PERFMON flag gates these kfuncs.
Why it matters: Unprivileged or CAP_BPF-only BPF programs can no longer read kernel memory via kfuncs that should require perfmon-level privileges.
Unsound pruning of packet pointer ranges could allow out-of-bounds access
regsafe() did not preserve the displacement between registers sharing a packet pointer ID, so two individually narrower ranges could prune an explored path even when their relative displacement had changed, potentially accepting an out-of-bounds packet access.
Why it matters: A crafted BPF program could bypass verifier bounds checks and access packet data out of bounds.
CO-RE relocation ordering and poisoning hardening
CO-RE relocations are now applied before subprogram validation to prevent unresolved relocations from creating invalid control flow that breaks verifier invariants and can write past per-subprogram arrays. Poisoning is also restricted to valid relocatable instruction forms.
Why it matters: Closes a class of BPF verifier bugs where crafted CO-RE metadata could corrupt verifier state or bypass validation.
Global subprograms verified in wrong sleepability context
Global subprograms were always verified with the main program's sleepability state, but workqueue and task-work callbacks run in a sleepable context even when the program is not. This allowed RCU-protected kptrs to produce trusted pointers in non-RCU contexts.
Why it matters: A BPF program could retain RCU-protected kernel pointers outside of a valid RCU read-side critical section, leading to use-after-free.
Self-referential local kptrs could exhaust kernel stack
A self-referential or deeply chained local kptr type could cause bpf_obj_free_fields() to recurse arbitrarily deep and exhaust the kernel stack. The BTF checker now bounds ownership depth and rejects cycles with -ELOOP.
Why it matters: Prevents a local user with BPF access from crashing the kernel through crafted BTF type definitions.
Verifier fixes for stack offsets, dynptrs, arenas, and sockmap
Fixes non-negative stack offsets accepted for iterator state, skb-backed dynptr bounds underflow, arena ALU operations producing wrong results across code paths, and sockmap max_entries values causing signed integer overflow during cleanup.
Why it matters: These fixes prevent crafted BPF programs from corrupting or reading out-of-bounds memory, closing potential privilege-escalation vectors.
Dev-bound-only programs could run on unrelated devices
A bound-only BPF program with NULL offdev could match an unrelated netdev in __bpf_offload_dev_match(), allowing a veth-bound program to run on a tun device and read beyond tun's bare-stack xdp_buff as a veth_xdp_buff.
Why it matters: A privileged BPF user could crash the kernel by running driver-specific XDP metadata kfuncs against an incompatible device.
BPF: Runtime and JIT Bug Fixes
Hash map batch lookup could lock CPU for over 77 seconds
__htab_map_lookup_and_delete_batch() lacked any rescheduling point, so a single batch call against a large LRU hash map (16M buckets) on a 144-CPU arm64 host held a CPU for 77+ seconds and tripped the soft lockup watchdog.
Why it matters: Systems using large BPF hash maps with batch operations can avoid soft lockup panics and CPU stalls.
SRv6 seg6local programs could trigger dangling pointer writes
An LWT_SEG6LOCAL program could invalidate its cached SRH pointer with bpf_lwt_seg6_adjust_srh() and then reallocate skb->head via bpf_skb_pull_data(), leaving a dangling per-CPU SRH pointer that post-program validation writes through.
Why it matters: A BPF SRv6 program could trigger kernel memory corruption through a dangling pointer.
Sockmap self-redirect double-counts copied_seq causing TCP warnings
When a BPF stream_verdict program redirects an skb back to the same socket, tcp_eat_skb() and the later copied_from_self path both advance copied_seq, doubling the offset and triggering a TCP recvmsg seq bug warning.
Why it matters: Users of BPF sockmap self-redirect may see TCP sequence mismatch warnings and potential data corruption.
Map batch operations overflow on maps exceeding 4GB
Several batch operation implementations used u32 arithmetic for offset calculations, which overflowed when map sizes exceeded 4GB, corrupting values in userspace memory or failing to delete/update keys.
Why it matters: Applications using large BPF maps (>4GB) with batch operations could silently corrupt data or miss key updates.
Arm64 BPF JIT exception callback uses wrong frame pointer from subprogram
The arm64 JIT did not set up BPF_REG_FP for exception callbacks because the exception_cb path skipped push_callee_regs(), so if bpf_throw() was called from a subprogram with its own BPF stack, the callback read from the subprogram's frame instead of the callback's own frame.
Why it matters: BPF exception callbacks on arm64 could read incorrect stack data when thrown from subprograms using their own BPF stack.
Memalloc use-after-free from concurrent ttrace list consumption
Syzkaller found a UAF in alloc_bulk() where concurrent consumption of waiting_for_gp_ttrace lists freed nodes still referenced by llist_del_first(). The fix adds proper synchronization to the RCU tasks trace free path.
Why it matters: Concurrent BPF memory allocator operations could trigger a use-after-free under specific timing conditions.
btf_struct_walk() divides by zero on flexible array of empty structs
When a struct's last member is a flexible array of zero-sized elements, btf_struct_walk() computed (off - moff) % t->size with t->size == 0, causing a kernel divide error at program load time.
Why it matters: Loading a BPF program whose BTF type ends with a flexible array of empty structs could crash the kernel.
Post-verification instruction rewrites made killable
Post-verification rewrite passes such as bpf_opt_remove_nops() had quadratic complexity and neither checked for signals nor rescheduled, so a privileged loader submitting 131K jumps could pin a CPU and block SIGKILL until the rewrite finished.
Why it matters: A privileged BPF program loader can no longer pin a CPU in verifier rewrites, improving system responsiveness.
Networking: Security Fixes
TCP Fast Open use-after-free via retransmit hint
An unprivileged TFO client can arm a dangling retransmit_skb_hint using an attacker-supplied ICMP fragmentation-needed message, then trigger a use-after-free when a simultaneous open frees the armed SYN skb.
Why it matters: A local unprivileged user could corrupt kernel memory or potentially escalate privileges on systems using TCP Fast Open.
RDS IB scatterlist use-after-free enables local privilege escalation
rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA mapping can succeed; on failure the MR is returned to the pool with a stale pointer, leading to a use-after-free.
Why it matters: A local user could leverage this memory corruption bug to escalate privileges on systems using RDS over InfiniBand.
Kernel DHCP client buffer overflow in hostname/vendor-class options
ic_dhcp_init_options() appended hostname (option 12) and vendor-class (option 60) into a fixed 312-byte buffer without bounds checking; a long hostname plus a 252-byte dhcpclass identifier overflows the buffer.
Why it matters: Systems using kernel-level DHCP (ipconfig) with long hostnames or dhcpclass identifiers could fail to boot or panic during network configuration.
Open vSwitch and act_ct conntrack helper use-after-free via extension reallocation
When helpers wire a raw pointer into the expectations list for an unconfirmed connection, subsequent extension additions can reallocate the extension space, leaving a dangling pointer that is later accessed during expectation removal.
Why it matters: Systems using Open vSwitch or TC act_ct with conntrack helpers could be vulnerable to use-after-free memory corruption.
VXLAN neighbour reply out-of-bounds write via headroom TOCTOU race
vxlan_na_create() samples needed_headroom twice; a concurrent vxlan_changelink() can increase it between reads, causing the second value to exceed the skb allocation and write the Ethernet header out of bounds.
Why it matters: A local user could trigger an out-of-bounds memory write on systems using VXLAN, potentially leading to corruption or crashes.
GUE remote checksum offload out-of-bounds write
Invalid REMCSUM offsets where the checksum field offset is less than the start offset could underflow a u16 and cause a NETIF_F_HW_CSUM driver to write two bytes about 64 KiB beyond the destination buffer.
Why it matters: Prevents a crafted forwarded packet from corrupting kernel memory via the GUE encapsulation path.
IPv6 extension header parsing out-of-bounds via ipv6_find_hdr()
ipv6_find_hdr() could return an offset past the end of the packet because header lengths were not checked against skb->len, causing Open vSwitch to read and write transport checksums out of bounds.
Why it matters: Fixes a slab-use-after-free triggered through OVS on IPv6 packets with crafted extension headers.
ARP ioctl and seg6 netlink out-of-bounds reads leak kernel memory
The ARP ioctl could read past a stack object due to unterminated device names, and SEG6_ATTR_DST short attributes triggered a 16-byte out-of-bounds read past skb->tail, leaking uninitialized head memory to userspace.
Why it matters: Unprivileged users could read uninitialized kernel memory through the ARP ioctls or segment routing netlink interface.
ip_gre changelink can hijack another tunnel's metadata receive entry
Enabling collect_md mode via changelink on an existing GRE/ERSPAN device is not subject to the uniqueness check enforced during newlink, so it can replace another device's metadata receive entry in the same netns.
Why it matters: Misconfigured or malicious GRE tunnel changes could disrupt metadata-based tunneling for other devices in the same network namespace.
net/sched em_text_dump leaks kernel stack memory
em_text_dump() allocated struct tcf_em_text on the stack without zeroing it, then used strscpy which left trailing bytes uninitialized; nla_put_nohdr copied the full struct to the netlink response.
Why it matters: An unprivileged user could read uninitialized kernel stack memory through the traffic-control text-match filter dump interface.
TCP skb collapsing across device encryption boundaries
Retransmission or SACK shifting could merge a TCP skb queued after a switch to device encryption (such as PSP) into an earlier skb queued before the switch, bypassing the intended encryption fence.
Why it matters: Prevents potential data corruption or security gaps where network traffic meant to be encrypted by hardware could be transmitted unencrypted due to TCP internal merging behavior.
Networking: Driver and Protocol Bug Fixes
UDP 4-tuple hash table not updated on re-connect or disconnect
A connected UDP socket that reconnects to a different peer was not re-filed in the 4-tuple hash table, and a disconnected socket kept its stale entry, causing incoming packets to miss fast-path lookup.
Why it matters: Applications that repeatedly connect or disconnect UDP sockets (e.g., some DNS or media servers) will see more correct and efficient packet delivery.
Netfilter flowtable use-after-free in HW_DEAD publication
The flow offload worker published NF_FLOW_HW_DEAD before clearing NF_FLOW_HW_PENDING, allowing concurrent garbage collection to RCU-free the flow while the worker still accessed it.
Why it matters: Prevents a use-after-free crash on systems using hardware flow offload under connection teardown.
act_ct panic from benign flow_offload_alloc failure
flow_offload_alloc() can fail when a conntrack entry is dying or under memory pressure, both expected conditions, but the code WARNed on this path. With panic_on_warn=1 an unprivileged user could panic the box.
Why it matters: Removes a kernel panic vector exploitable by unprivileged users on systems using tc conntrack action with panic_on_warn enabled.
HFSC qdisc soft lockup from infinite classify walk
hfsc_classify() could loop forever between two interior classes whose levels were raised after binding, holding the qdisc lock with BH disabled and triggering a soft lockup from a single packet.
Why it matters: Fixes a soft lockup that could hang a CPU on systems using the HFSC traffic-control qdisc.
virtio_net zerocopy deadlock in non-NAPI transmit path
Without NAPI, virtio-net frees completed skbs lazily on the next transmit, so senders using zerocopy (e.g. PACKET_TX_RING) can deadlock if they cannot send more packets.
Why it matters: Users of PACKET_TX_RING or vhost_net zerocopy on virtio-net devices can avoid transmit deadlocks and ring slot exhaustion.
SCTP use-after-free on stale-cookie bundled DATA
When an SCTP association is in COOKIE-ECHOED state and a bundled ERROR(Stale Cookie)+DATA packet arrives from a non-primary address, the stale-cookie handler removes non-primary transports including the one the arriving packet references.
Why it matters: SCTP peers could trigger a kernel crash via a crafted packet, affecting any system using the SCTP protocol.
veth use-after-free of XDP program pointers during channel resize
veth_set_channels() tore down XDP resources for removed RX queues without clearing rq->xdp_prog; if the program was detached, a later channel increase re-enabled NAPI and ran the freed BPF program.
Why it matters: Resizing veth channels while XDP programs are attached no longer risks executing freed BPF code, a common scenario in container networking.
IPv6 lwtunnel massive heap corruption on VLAN interfaces
seg6, ioam6, and rpl lwtunnels sized skb_cow_head() using dst_dev_overhead() which left LL_RESERVED_SPACE (16 bytes for Ethernet), but mac header rebuild needed skb->mac_len bytes. On VLAN devices with longer mac headers the memmove wrote about 64 KB past the skb buffer.
Why it matters: Routing IPv6 traffic through seg6/ioam6/rpl lwtunnels on VLAN interfaces no longer risks massive heap corruption.
Stranded skbs on offline CPUs cause page_pool stalls and netdev teardown hangs
dev_cpu_dead() did not flush skb_defer_nodes when a CPU went offline, leaving skbs stranded. If those skbs held page_pool fragments, page_pool_destroy() could stall indefinitely waiting for inflight pages.
Why it matters: Systems with hotpluggable CPUs may experience indefinite hangs when unregistering network devices while a CPU is offline.
Hardware timestamping via PHY broken after legacy ioctl removal
Removing the legacy hardware timestamping ioctl fallback made the NDO callbacks mandatory, but devices that only timestamp in their PHY implement neither, causing SIOCSHWTSTAMP to fail and PTP to stop working.
Why it matters: Network devices relying on PHY-level timestamping for PTP regain working hardware timestamping configuration.
ovpn driver fixes for endpoint handling, routing, and peer validation
Multiple fixes to the in-tree ovpn VPN driver: preserve IPv6 scope IDs for link-local peers, skip UDP source validation for unspecified addresses, track mutable socket route keys for dst cache validity, prevent torn reads of RCU-published bind addresses, and reject invalid or duplicate peer VPN addresses.
Why it matters: Users of the kernel's native OpenVPN-compatible driver get more reliable IPv6 connectivity, correct routing after socket changes, and clearer configuration errors.
7a6d08ee0f0e77393b4d72df7c66b7a4ae80fa603710bdb9aea934a221ec7d8104988f42b43beccb3713d25e885b31a0025af3a0a8925940f3407b78
Hardware Support
sfc: add X4D PF support
Adds support for the X4D controller, which is an X4 controller instance implemented as an IP block in an SoC, with the same feature set as the standalone X4.
Why it matters: Enables the Solarflare sfc driver on SoC platforms incorporating the X4D network controller IP block.
Quectel EG120K-EA LTE and MeiG Smart SRM821 5G module support
The qmi_wwan driver gains support for the Quectel EG120K-EA LTE Cat.12 module, and the cdc_mbim driver adds the MeiG Smart SRM821 5G module to its ZLP conformance whitelist to prevent firmware crashes.
Why it matters: Users of these cellular modules can now use them for data connectivity without firmware crashes or unbound interfaces.
Intel XWAY PHY 100BASE-TX link-up failure workaround
MaxLinear GSW1xx switches incorporating Intel XWAY PHYs can sporadically fail to link up in 100BASE-TX mode after power-on. The workaround enables then disables Cable Diagnostic Mode on all ports after power-on, as specified in the errata.
Why it matters: Users of Intel XWAY / MaxLinear GSW1xx Ethernet PHYs may experience faster or more reliable link-up at 100 Mbps after power-on.
sched_ext: Deadlock and Race Fixes
ops.dequeue() could self-deadlock by holding DSQ lock
ops.dequeue() was invoked with the source user DSQ's lock still held, so a BPF scheduler that iterated that DSQ from within ops.dequeue() would self-deadlock with IRQs disabled, wedging the system.
Why it matters: Custom BPF schedulers using sched_ext can avoid system-locking deadlocks when iterating DSQs from ops.dequeue().
Task reenqueue race during SCX_OPSS_DISPATCHING window
A task could be found on a DSQ while still in the DISPATCHING state; reenqueueing it in that window ran ops.enqueue() and set QUEUED before the dispatcher's final store overwrote it with NONE, dropping all later dispatches of the task.
Why it matters: sched_ext users may see tasks that silently stop being dispatched under specific timing conditions.
Pass initial CPU mask to cid-form ops.enable()
The cid-form scheduler API now provides a task's initial CPU mask through a new struct scx_enable_args passed to ops.enable(), closing a gap where schedulers had no reliable way to obtain the mask on fork, sub-sched enable, or re-home paths.
Why it matters: Improves the sched_ext BPF scheduler API so that custom schedulers correctly receive CPU affinity information when a task enters the scheduler.
NFC: Input Validation Hardening
Multiple NFC input-validation and use-after-free fixes
Multiple NFC drivers and the LLCP core had missing length checks allowing OOB reads, use-after-free on accept-queue races, WKS SAP hijacking via prefix match, and list corruption on DM handling.
Why it matters: Malformed NFC frames from a malicious peer or device could crash the kernel or bypass service-name access control; these fixes harden the NFC subsystem against a cluster of security-relevant bugs.
686f942332b1a653c01ce447bf1460acdf8c092c6a605cbdc3eef2f988a3dcab71a70119273f9d667cde66f4300206b8408cff6bd6067dcf371a3563b61732f47316
Other Notable Fixes
Atheros atl1c/atl1e/atl1 soft lockup during PCIe link reset
During PCIe link or MAC resets, the hardware can report an out-of-range consumer index (0xffff), causing the TX cleanup loop to spin forever and trigger a soft lockup. The fix treats out-of-range values as nothing to clean.
Why it matters: Users of Atheros AR8151 and related NICs may experience system hangs or watchdog timeouts during link flap events.
cgroup pids.events notifications lost in local event accounting mode
When local event accounting is selected, pids_event() returns after notifying only events_local_file, leaving pids.events pollers asleep so that forks rejected by the pids controller do not generate notifications on the shared pids.events file.
Why it matters: Users monitoring cgroup PID limits via pids.events may miss notifications when local event mode is enabled.
Landlock tracepoint improvements for ptrace, signals, and ruleset versioning
Landlock denial tracepoints now report the actual ptrace tracer and effective signal number, and the ruleset version counter was widened to 64 bits to prevent trace identity collision from counter wrapping.
Why it matters: Tooling that consumes Landlock audit or tracing events gets more complete and reliable information for debugging and monitoring sandbox policies.
Restore keepalived compatibility for IFLA_INET_CONF netlink messages
A previous validation change required NLA_F_NESTED to be set on IFLA_INET_CONF attributes, breaking userspace tools like keepalived that did not set the flag when configuring macvlans.
Why it matters: Fixes keepalived and other userspace tools that stopped working after a stricter netlink attribute validation was introduced.
Source commits269 entries +
landlock: Add counted_by in landlock_domain
Tingmao Wang · Feb 8, 2026 · 1 files
nfc: port100: reject frames whose declared length exceeds the received data
Doruk Tan Ozturk · Jul 11, 2026 · 1 files
nfc: nfcmrvl: validate helper command length before pull
Pengpeng Hou · Jul 15, 2026 · 1 files
nfc: st21nfca: validate received frame size
Pengpeng Hou · Jul 15, 2026 · 1 files
nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
Aldo Ariel Panzardo · Jul 16, 2026 · 1 files
selftests: nci: Correct pthread_create return value check
Lei Zhu · Jul 29, 2026 · 1 files
netfilter: flowtable: publish HW_DEAD after worker is done
Jérémy Jean · Aug 18, 2026 · 1 files
ovpn: always unhash old VPN addresses before rehashing
Ralf Lici · Aug 28, 2026 · 1 files
ovpn: reject duplicate peer VPN addresses
Ralf Lici · Aug 28, 2026 · 3 files
ovpn: reject multipeer peers without VPN addresses
Ralf Lici · Aug 28, 2026 · 1 files
ovpn: reject invalid peer VPN addresses
Ralf Lici · Aug 28, 2026 · 1 files
selftests: ovpn: validate peer VPN addresses
Ralf Lici · Aug 28, 2026 · 3 files
ovpn: preserve IPv6 scope id for netlink peer endpoints
Ralf Lici · Aug 28, 2026 · 1 files
ovpn: skip UDP source validation for unspecified addresses
Ralf Lici · Aug 28, 2026 · 1 files
ovpn: track UDP socket route key for peer dst cache
Ralf Lici · Aug 28, 2026 · 3 files
ovpn: validate peer state before caching UDP dst
Ralf Lici · Aug 28, 2026 · 1 files
ovpn: replace bind when learning local endpoint
Ralf Lici · Aug 28, 2026 · 1 files
ovpn: replace bind when clearing stale local source
Ralf Lici · Aug 28, 2026 · 1 files
nfc: st21nfca: validate ISO15693 inventory length
Pengpeng Hou · Aug 30, 2026 · 1 files
selftests: nci: Fix uninitialized family ID on missing attribute
Chaithanya Lagisetty · Sep 1, 2026 · 1 files
nfc: llcp: Fix race condition in accept_queue lifecycle
Lee Jones · Sep 2, 2026 · 3 files
bpf: Allow terminal gotox instructions
Siddharth Chintamaneni · Sep 2, 2026 · 1 files
selftests/bpf: Test terminal gotox instructions
Siddharth Chintamaneni · Sep 2, 2026 · 1 files
netfilter: nfnetlink_queue: hold nfnl mutex in event notifier
Florian Westphal · Sep 3, 2026 · 1 files
bpf: Fix u32 overflow issue in map batch operations
Masoud Aghasi · Sep 3, 2026 · 2 files
bpf: Fix out-of-bounds read of rtt_min in sock_ops
Jiayuan Chen · Sep 3, 2026 · 1 files
bpf: Use kvfree() in xdp_test_run_teardown()
Zhixing Chen · Sep 3, 2026 · 1 files
selftests/nci: Fix out-of-bounds store on thread join
Chris Gellermann · Sep 4, 2026 · 1 files
nfc: virtual_ncidev: Add missing ioctl compat handler
Chris Gellermann · Sep 4, 2026 · 1 files
bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk
Pu Lehui · Sep 5, 2026 · 1 files
netfilter: ip6t_rpfilter: reject routes without inet6_dev
Weiming Shi · Sep 6, 2026 · 1 files
netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
Luxiao Xu · Sep 6, 2026 · 1 files
bpf: Fix bpf_skb_change_tail wrt csum partial skbs
Daniel Borkmann · Sep 7, 2026 · 1 files
selftests/bpf: Add test for bpf_skb_change_tail on csum partial skbs
Daniel Borkmann · Sep 7, 2026 · 2 files
bpf, arm64: set up the frame pointer for the exception callback
Donggeun Yoo · Sep 7, 2026 · 1 files
selftests/bpf: cover the exception callback using its own BPF stack
Donggeun Yoo · Sep 7, 2026 · 2 files
bpf, sockmap: Fix self-redirect copied_seq double-counting
Geliang Tang · Sep 8, 2026 · 1 files
nfc: llcp: fix slab-out-of-bounds reads when logging service names
Ömer Mete Kaya · Sep 8, 2026 · 2 files
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
Weiming Shi · Sep 9, 2026 · 1 files
nfc: fix use-after-free in nfc_get_local_general_bytes
Luxiao Xu · Sep 9, 2026 · 12 files
nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
Ömer Mete Kaya · Sep 9, 2026 · 1 files
nfc: llcp: fix -ENOMEM on connect with zero-length service name
Ömer Mete Kaya · Sep 9, 2026 · 1 files
bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()
Jose Fernandez (Anthropic) · Sep 9, 2026 · 1 files
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
Jiayuan Chen · Sep 10, 2026 · 1 files
tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context
Jiayuan Chen · Sep 10, 2026 · 1 files
selftests/bpf: Test bpf_sock_destroy() on TIME_WAIT and listener socks
Jiayuan Chen · Sep 10, 2026 · 2 files
bpf: Fix divide-by-zero in btf_struct_walk()
Jiayuan Chen · Sep 10, 2026 · 1 files
selftests/bpf: Test BTF walk into a flexible array of zero-sized elements
Jiayuan Chen · Sep 10, 2026 · 2 files
xsk: Use a 32-bit compare in xsk_map_gen_lookup
Zhiling Zou · Sep 10, 2026 · 1 files
bpf: Clear scalar delta on narrowing stack spill
Daniel Borkmann · Sep 10, 2026 · 1 files
netfilter: nft_synproxy: use the family-aware checksum helper
Karl Mehltretter · Sep 10, 2026 · 1 files
bpf: Add KF_PERFMON kfunc flag
Daniel Borkmann · Sep 10, 2026 · 3 files
bpf: Require CAP_PERFMON for kfuncs reading memory
Daniel Borkmann · Sep 10, 2026 · 1 files
bpf: Require CAP_PERFMON for untrusted read-only memory reads
Daniel Borkmann · Sep 10, 2026 · 1 files
selftests/bpf: Add tests for the KF_PERFMON gates
Daniel Borkmann · Sep 10, 2026 · 2 files
net: txgbe: fix FDIR filter restore for VF rules
Zhang Yunfei · Sep 11, 2026 · 1 files
ipvs: revalidate ihl before icmp_send
Julian Anastasov · Sep 11, 2026 · 1 files
netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name
Naman Gulati · Sep 12, 2026 · 1 files
nfc: trf7970a: power down on startup RX gain failure
Myeonghun Pak · Sep 13, 2026 · 1 files
tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
Eric Dumazet · Sep 13, 2026 · 1 files
octeontx2-af: use seq_file for rsrc_alloc debugfs
Heyang Tan · Sep 14, 2026 · 1 files
net/sched: reject IDR error pointers when deleting actions
Weiming Shi · Sep 14, 2026 · 1 files
netfilter: nf_tables: skip expired catchall elements on insert and delete
Aohan Mei · Sep 14, 2026 · 1 files
nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure
Cong Nguyen · Sep 14, 2026 · 1 files
bpf: Verify global subprogs in each sleepability context
Kumar Kartikeya Dwivedi · Sep 14, 2026 · 2 files
selftests/bpf: Test global subprog callback contexts
Kumar Kartikeya Dwivedi · Sep 14, 2026 · 1 files
bpf: Bound ownership depth through local kptrs and graph roots
Kumar Kartikeya Dwivedi · Sep 14, 2026 · 2 files
selftests/bpf: Check local object ownership depth
Kumar Kartikeya Dwivedi · Sep 14, 2026 · 1 files
bpf: Skip unsettled links in link iterator
Weiming Shi · Sep 14, 2026 · 1 files
net: ethtool: keep rtnl_lock for the ioctl self test
Alexander Duyck · Sep 14, 2026 · 4 files
eth: fbnic: Handle maximum standalone channels
Björn Töpel · Sep 14, 2026 · 1 files
eth: fbnic: use the Rx queue napi pointer to find the napi vector
Alexander Duyck · Sep 14, 2026 · 1 files
eth: fbnic: reset num_napi when the napi vectors are freed
Alexander Duyck · Sep 14, 2026 · 1 files
eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox
Alexander Duyck · Sep 14, 2026 · 2 files
eth: fbnic: Handle FW mailbox completions flagged with an error
Alexander Duyck · Sep 14, 2026 · 4 files
net: usb: catc: bound the RX packet length in catc_rx_done()
Aamir Ahmed · Sep 14, 2026 · 1 files
Bluetooth: btintel_pcie: validate device-supplied DMA indices
Ravindra · Sep 15, 2026 · 1 files
vlan: require the MAC header to be present in __vlan_insert_inner_tag()
Xiang Mei · Sep 15, 2026 · 1 files
sctp: avoid livelock while updating retransmit path
Yiqi Sun · Sep 15, 2026 · 1 files
eth: fbnic: Fix payload page pool error cleanup
Björn Töpel · Sep 15, 2026 · 1 files
net/mlx5: devcom, Base component size on linked devices
Shay Drory · Sep 15, 2026 · 1 files
net/mlx5: SD, unload reps on shared FDB create error path
Shay Drory · Sep 15, 2026 · 1 files
net/mlx5: LAG, reload IB reps of LAG master before the rest
Shay Drory · Sep 15, 2026 · 1 files
Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
Lee Jones · Sep 15, 2026 · 1 files
net: gue: reject invalid REMCSUM offsets
Jérémy Jean · Sep 15, 2026 · 1 files
net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure
Nguyen Ngoc Thang · Sep 15, 2026 · 1 files
Bluetooth: mgmt: fix race in read_unconf_index_list()
Aldo Ariel Panzardo · Sep 15, 2026 · 1 files
Bluetooth: L2CAP: validate frame length before control and FCS access
Aldo Ariel Panzardo · Sep 15, 2026 · 1 files
Bluetooth: hci_sock: validate event length before filtering
Aldo Ariel Panzardo · Sep 15, 2026 · 1 files
Bluetooth: ISO: balance the parent hold in hci_bind_bis()
Aldo Ariel Panzardo · Sep 15, 2026 · 1 files
Bluetooth: hci_sock: reject out-of-range OCF values
Aldo Ariel Panzardo · Sep 15, 2026 · 1 files
Bluetooth: hci_conn: fix CIS hold ownership on reuse
Aldo Ariel Panzardo · Sep 15, 2026 · 1 files
Bluetooth: ISO: release unused CIS holds after channel attach
Aldo Ariel Panzardo · Sep 15, 2026 · 1 files
vsock: ignore empty child namespace mode writes
Aldo Ariel Panzardo · Sep 15, 2026 · 1 files
net: pcs: rzn1-miic: Fix config array initialization
Kyle Hendry · Sep 15, 2026 · 1 files
nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
Aamir Ahmed · Sep 15, 2026 · 1 files
landlock: Work around gcc-16 -Wuninitialized warning
Arnd Bergmann · Sep 15, 2026 · 1 files
mailmap: add entry for Wei Wang
Wei Wang · Sep 15, 2026 · 1 files
net: allow IFLA_INET_CONF messages when NLA_F_NESTED unset
Quentin Armitage · Sep 15, 2026 · 1 files
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task
Tejun Heo · Sep 15, 2026 · 3 files
Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()
Zijun Hu · Sep 16, 2026 · 1 files
octeontx2-af: Fix memory scaling limitation in SR-IOV mode
Ratheesh Kannoth · Sep 16, 2026 · 1 files
net/sched: cls_u32: fix manual hash table handle IDR aliasing
Jamal Hadi Salim · Sep 16, 2026 · 1 files
selftests/tc-testing: add u32 manual table handle IDR tests
Jamal Hadi Salim · Sep 16, 2026 · 1 files
ipv4: fib: fix data-race and stale genid check around nh->nh_saddr
Linkui Xiao · Sep 16, 2026 · 1 files
sfc: add X4D PF support
Andy Moreton · Sep 16, 2026 · 1 files
net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure
Lorenzo Bianconi · Sep 16, 2026 · 1 files
Bluetooth: SMP: reject Security Request over BR/EDR
Christiano Amora · Sep 16, 2026 · 1 files
ipv6: do not let ipv6_find_hdr() return an offset past the packet end
Norbert Szetei · Sep 16, 2026 · 1 files
selftests: cgroup: give the O_TMPFILE open in get_temp_fd() a mode
Eva Kurchatova · Sep 16, 2026 · 1 files
sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags
Tejun Heo · Sep 16, 2026 · 1 files
ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink().
Kuniyuki Iwashima · Sep 16, 2026 · 1 files
net: phy: micrel: Advance register data pointer in write loop
Abhishek Ojha · Sep 16, 2026 · 1 files
sched_ext: Don't run ops.dequeue() with a DSQ lock held
fangqiurong · Sep 17, 2026 · 3 files
selftests/sched_ext: Test that ops.dequeue() can iterate the consumed DSQ
fangqiurong · Sep 17, 2026 · 3 files
udp: relocate a connected socket in the 4-tuple hash table on re-connect
Shardul Bankar · Sep 17, 2026 · 1 files
udp: remove a disconnected socket from the 4-tuple hash table
Shardul Bankar · Sep 17, 2026 · 1 files
net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget
Jamal Hadi Salim · Sep 17, 2026 · 1 files
selftests: tc-testing: add a lateral-drift hfsc classify-walk test
Jamal Hadi Salim · Sep 17, 2026 · 1 files
fsl/fman: Fix clk reference leak in read_dts_node()
Wentao Liang · Sep 17, 2026 · 1 files
net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy()
Wentao Liang · Sep 17, 2026 · 1 files
net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
Wentao Liang · Sep 17, 2026 · 1 files
net/mlx5e: fix swapped IPv6 IPsec policy masks
Andrea Parri · Sep 17, 2026 · 1 files
net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs()
Wentao Liang · Sep 17, 2026 · 1 files
bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc
Zhao Gongyi · Sep 17, 2026 · 1 files
net/mlx5e: advertise MACsec offload only when supported
Ralf Lici · Sep 17, 2026 · 2 files
dpll: use exact lookup for reference sync pin id
Ivan Vecera · Sep 17, 2026 · 1 files
tg3: clean up PHYLIB resources on probe failure
Myeonghun Pak · Sep 17, 2026 · 1 files
net: stmmac: selftests: Support running selftests on DSA conduits
Maxime Chevallier · Sep 17, 2026 · 1 files
net: stmmac: selftests: Validate EEE based on the actual LPI timer value
Maxime Chevallier · Sep 17, 2026 · 1 files
net: stmmac: selftests: Check the dev->features for S-TAG offload testing
Maxime Chevallier · Sep 17, 2026 · 1 files
net: stmmac: selftests: Capture all packets for vlan checks
Maxime Chevallier · Sep 17, 2026 · 1 files
net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K
Maxime Chevallier · Sep 17, 2026 · 3 files
net: stmmac: size the RX buffers from the frame length, not the MTU
Maxime Chevallier · Sep 17, 2026 · 1 files
net: stmmac: selftests: Account for alignment shift on dwmac1000 for Jumbo test
Maxime Chevallier · Sep 17, 2026 · 1 files
bpf: Make post-verification instruction rewrites killable
Kumar Kartikeya Dwivedi · Sep 17, 2026 · 2 files
bpf: Preserve packet pointer class displacement in regsafe()
Kumar Kartikeya Dwivedi · Sep 17, 2026 · 1 files
selftests/bpf: Test packet pointer class displacement pruning
Kumar Kartikeya Dwivedi · Sep 17, 2026 · 1 files
bpf: Apply CO-RE relocations before subprogram validation
Kumar Kartikeya Dwivedi · Sep 17, 2026 · 3 files
selftests/bpf: Test early in-kernel CO-RE relocation
Kumar Kartikeya Dwivedi · Sep 17, 2026 · 1 files
bpf: Restrict CO-RE poisoning to relocatable instructions
Kumar Kartikeya Dwivedi · Sep 17, 2026 · 1 files
selftests/bpf: Test CO-RE instruction poisoning restrictions
Kumar Kartikeya Dwivedi · Sep 17, 2026 · 1 files
bpf: Assign lock identity to callback map values
Kumar Kartikeya Dwivedi · Sep 17, 2026 · 3 files
selftests/bpf: Check callback map value lock identity
Kumar Kartikeya Dwivedi · Sep 17, 2026 · 3 files
libbpf: Reject truncated ldimm64 CO-RE relocations
Kumar Kartikeya Dwivedi · Sep 17, 2026 · 1 files
net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621
Aleksei Sviridkin · Sep 18, 2026 · 1 files
net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq
Aleksei Sviridkin · Sep 18, 2026 · 1 files
vxlan: use one headroom snapshot for neighbour replies
Sanghyun Park · Sep 18, 2026 · 1 files
net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error
bui duc phuc · Sep 18, 2026 · 1 files
ipv6: Prevent rt6_insert_exception() for dying fib6_info.
Kuniyuki Iwashima · Sep 18, 2026 · 2 files
net: don't require the hwtstamp NDOs when a PHY provides timestamping
Nicolai Buchwitz · Sep 18, 2026 · 1 files
net/mlx5: Bridge, don't fail switchdev events of sibling eswitch ports
Bernardo Soares · Sep 18, 2026 · 3 files
net/mlx5: Bridge, don't fail unlink of untracked/unsupported peer ports
Bernardo Soares · Sep 18, 2026 · 1 files
eth: fbnic: Avoid rounding zero ring sizes
Björn Töpel · Sep 18, 2026 · 1 files
net/sched: fix potential stack infoleak in em_text_dump()
Bernard Ladenthin · Sep 18, 2026 · 1 files
selftests: net: fix CONFIG_SYSCTL sort order in configs
Yuya Kusakabe · Sep 18, 2026 · 2 files
landlock: Fix tracepoint fixed-width type names
Mickaël Salaün · Sep 18, 2026 · 1 files
landlock: Fix filesystem denial blocker reporting
Mickaël Salaün · Sep 18, 2026 · 3 files
landlock: Fix rule tracepoint context
Mickaël Salaün · Sep 18, 2026 · 9 files
landlock: Fix network denial trace context
Mickaël Salaün · Sep 18, 2026 · 6 files
landlock: Report the actual ptrace tracer
Mickaël Salaün · Sep 18, 2026 · 4 files
landlock: Report the effective signal number
Mickaël Salaün · Sep 18, 2026 · 4 files
selftests/landlock: Test filesystem denial blockers
Mickaël Salaün · Sep 18, 2026 · 1 files
selftests/landlock: Test network denial context
Mickaël Salaün · Sep 18, 2026 · 1 files
landlock: Fix tracepoint contract documentation
Mickaël Salaün · Sep 18, 2026 · 2 files
net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths
Théo Lebrun · Sep 18, 2026 · 1 files
bonding: crypto offload enabled, non-offload slave failover, rekey failed
David Dai · Sep 18, 2026 · 1 files
net: mdio: realtek-rtl9300: fix RTL931x C22 extended page selection
Jonas Jelonek · Sep 18, 2026 · 1 files
genetlink: report the real command id for dump-only ops in policy dumps
Jakub Kicinski · Sep 18, 2026 · 1 files
selftests: net: nl_nlctrl: check the op ids in the policy map
Jakub Kicinski · Sep 18, 2026 · 1 files
tg3: use random MAC address when tg3_get_device_address fails
Ivan Delalande · Sep 18, 2026 · 1 files
sched_ext: Pass the initial cmask to cid-form ops.enable()
Tejun Heo · Sep 19, 2026 · 3 files
virtio_net: copy zerocopy frags in start_xmit without NAPI
Willem de Bruijn · Sep 19, 2026 · 1 files
packet: use ubuf_info completion for TX_RING packets
Willem de Bruijn · Sep 19, 2026 · 2 files
bpf: Compare stack frames in regs_exact()
Kumar Kartikeya Dwivedi · Sep 19, 2026 · 2 files
selftests/bpf: Cover frame changes in bounded loops
Kumar Kartikeya Dwivedi · Sep 19, 2026 · 1 files
bpf: Check params size before reading reserved fields
Yuqi Xu · Sep 19, 2026 · 1 files
net: ipconfig: bound DHCP option construction
Yuqi Xu · Sep 19, 2026 · 1 files
Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
Hui Peng · Sep 19, 2026 · 1 files
Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
Hui Peng · Sep 19, 2026 · 1 files
net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
Shihuang Liu · Sep 19, 2026 · 1 files
selftests/sched_ext: Check the cmask cid-form ops.enable() receives
Tejun Heo · Sep 19, 2026 · 3 files
net: pcs: xpcs: fix clock reference leak on xpcs_init_clks failure
Coia Prant · Sep 19, 2026 · 1 files
net: spacemit: clear TX descriptor on fragment mapping failure
Muhammad Bilal · Sep 19, 2026 · 1 files
Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough
Hui Peng · Sep 19, 2026 · 2 files
net: usb: sr9700: include receive overhead in the length check
Pengpeng Hou · Sep 20, 2026 · 1 files
net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist
Ming Wang · Sep 20, 2026 · 1 files
net: bridge: mdb: restart port group walk after deletion
Fourie Zhang · Sep 20, 2026 · 1 files
bpf: Reject dev-bound-only programs on other devices
Weiming Shi · Sep 20, 2026 · 1 files
net/sched: act_gate: budget the per-entry list in get_fill_size
Victor Nogueira · Sep 20, 2026 · 1 files
net: arp: terminate device name before lookup
Zijie Huang · Sep 20, 2026 · 1 files
ipv6: Fix dst leak for uncached routes.
Kuniyuki Iwashima · Sep 20, 2026 · 2 files
bpf: Reject non-negative offsets in stack_slot_obj_get_spi()
Xu Yunxiang · Sep 20, 2026 · 1 files
selftests/bpf: Reject iterator destruction through fp+0
Xu Yunxiang · Sep 20, 2026 · 1 files
net: phylink: record the PHY only once bringup cannot fail
Aleksei Sviridkin · Sep 20, 2026 · 1 files
ip_gre: Reject enabling collect metadata through changelink
Xuanqiang Luo · Sep 21, 2026 · 1 files
net: dsa: mv88e6xxx: 88E6191X and 88E6193X have no PTP
Nicolo Giuliani · Sep 21, 2026 · 1 files
ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
Hui Peng · Sep 21, 2026 · 1 files
fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
Hui Peng · Sep 21, 2026 · 1 files
mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()
Hui Peng · Sep 21, 2026 · 1 files
net: libwx: fix races in Tx timestamp handling
Jiawen Wu · Sep 21, 2026 · 4 files
net: atl1c: fix soft lockup on out-of-range tpd_cons read
Gajdos Tamás · Sep 21, 2026 · 1 files
net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
Gajdos Tamás · Sep 21, 2026 · 1 files
net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
Gajdos Tamás · Sep 21, 2026 · 1 files
net: usb: qmi_wwan: add Quectel EG120K-EA
Gilberto Conde · Sep 21, 2026 · 1 files
sctp: discard the rest of the packet on a stale-cookie error
Aohan Mei · Sep 21, 2026 · 1 files
net/sched: act_ife: validate metadata length before decoding
Fang Xieyan · Sep 21, 2026 · 4 files
net: stmmac: clear stale buf->page after recycling on skb build failure
Lorenzo Bianconi · Sep 21, 2026 · 1 files
net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
Ilya Maximets · Sep 21, 2026 · 2 files
net: openvswitch: conntrack: remove 'add_helper' dead code
Ilya Maximets · Sep 21, 2026 · 1 files
net: openvswitch: conntrack: fix helper UAF due to extensions realloc
Ilya Maximets · Sep 21, 2026 · 1 files
net/sched: act_ct: avoid modifying shared unconfirmed ct entry
Ilya Maximets · Sep 21, 2026 · 1 files
net/sched: act_ct: remove 'add_helper' dead code
Ilya Maximets · Sep 21, 2026 · 1 files
net/sched: act_ct: fix helper UAF due to extensions realloc
Ilya Maximets · Sep 21, 2026 · 1 files
net: xps: reject an out of range traffic class
Norbert Szetei · Sep 21, 2026 · 1 files
net: ena: fix PHC cleanup on probe failure
Guangshuo Li · Sep 21, 2026 · 1 files
net: ena: fix MMIO read buffer leak on probe failure
Guangshuo Li · Sep 21, 2026 · 1 files
net: emac: move setting of netops to fix crash
Christian Lamparter · Sep 21, 2026 · 1 files
sctp: hold asoc or transport before mod_timer() in timer handlers
Xin Long · Sep 21, 2026 · 2 files
nfp: hold IPsec RX state under the XArray lock
Sang-Hoon Choi · Sep 21, 2026 · 1 files
net: devmem: document that bind-tx is unprivileged by design
Mina Almasry · Sep 21, 2026 · 2 files
macsec: initialize SecY before registering the netdevice
Haseeb Malik · Sep 21, 2026 · 1 files
net: ipv6: keep room for the mac header in dst_dev_overhead()
Yuya Kusakabe · Sep 21, 2026 · 1 files
net/rds: size a connection's path set by the transport it ends up with
Allison Henderson · Sep 21, 2026 · 1 files
net: bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems
Florian Fainelli · Sep 21, 2026 · 1 files
net: bcmgenet: initialize u64 stats seq counter for all queues
Florian Fainelli · Sep 21, 2026 · 1 files
net: bcmgenet: do not skip WoL power up on GENET V1
Florian Fainelli · Sep 21, 2026 · 1 files
net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr
Florian Fainelli · Sep 21, 2026 · 1 files
net: bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT
Florian Fainelli · Sep 21, 2026 · 1 files
veth: manage XDP program pointers during channel resize
Jakub Kicinski · Sep 21, 2026 · 1 files
net: airoha: npu: cancel wdt_work after releasing the WDT IRQ
Myeonghun Pak · Sep 22, 2026 · 1 files
bna: prevent IOC timer rearm during teardown
Myeonghun Pak · Sep 22, 2026 · 1 files
rds: ib: Clear the sg list when mapping an MR fails
Dongliang Qin · Sep 22, 2026 · 1 files
MAINTAINERS: add Nicolai Buchwitz as GENET maintainer
Nicolai Buchwitz · Sep 22, 2026 · 1 files
net/smc: fix UAF on lgr list traversal in smcr_port_err()
Sidraya Jayagond · Sep 22, 2026 · 2 files
net: phy: intel-xway: workaround 100BASE-TX Link-Up issue
Alexander Sverdlin · Sep 22, 2026 · 1 files
tipc: Fix a data race on mon->peer_cnt in mon_timeout()
Ginger Li · Sep 22, 2026 · 1 files
net: bcmgenet: stop Tx NAPI before disabling the queues
Nicolai Buchwitz · Sep 22, 2026 · 1 files
vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets
Ido Schimmel · Sep 22, 2026 · 1 files
landlock: Widen ruleset versions to 64 bits
Mickaël Salaün · Sep 22, 2026 · 2 files
firewire: cdev: fix back-transition for iso_resource_auto client resource
Takashi Sakamoto · Sep 22, 2026 · 1 files
bpf: Fix bounds check for skb-backed dynptrs
Emil Tsalapatis · Sep 22, 2026 · 1 files
selftests/bpf: Test dynptr slices past end of skb
Emil Tsalapatis · Sep 22, 2026 · 2 files
bpf: Fix bpf_sock context code generation
Emil Tsalapatis · Sep 22, 2026 · 1 files
selftests/bpf: Add selftests for rx_queue_mapping context access
Emil Tsalapatis · Sep 22, 2026 · 1 files
bpf: Reject pkt arguments in mutating subprogs
Emil Tsalapatis · Sep 22, 2026 · 1 files
selftests/bpf: Test rejection of pkt args to mutating subprogs
Emil Tsalapatis · Sep 22, 2026 · 1 files
bpf: Prevent variable arena/non-arena register contents
Emil Tsalapatis · Sep 22, 2026 · 2 files
selftests/bpf: Test for mixed arena/nonarena code paths
Emil Tsalapatis · Sep 22, 2026 · 1 files
nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
Deepanshu Kartikey · Sep 23, 2026 · 1 files
af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
Dairui Zhang · Sep 23, 2026 · 1 files
bpf: Fix immediate JMP JEQ/JNE on MIPS32
Johan Almbladh · Sep 23, 2026 · 1 files
bpf: Fix BSWAP 32 and 16 on MIPS64
Johan Almbladh · Sep 23, 2026 · 1 files
sched_ext: Count SCX_EV_SUB_BYPASS_DISPATCH in the dispatch fallback
Liang Luo · Sep 23, 2026 · 1 files
net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails
Coia Prant · Sep 23, 2026 · 1 files
net: flush skb_defer_nodes in dev_cpu_dead()
Eric Dumazet · Sep 23, 2026 · 3 files
gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO
Eric Dumazet · Sep 23, 2026 · 1 files
gve: fix TX drop when GSO MSS is too small for hw
Eddie Phillips · Sep 24, 2026 · 1 files
gve: DQO: reject TSO packets with an out of range MSS
Eric Dumazet · Sep 24, 2026 · 2 files
llc: reserve device headroom for allocated frames
Zixuan Chai · Sep 24, 2026 · 1 files
tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
Yilin Zhang · Sep 24, 2026 · 1 files
llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
Eric Dumazet · Sep 24, 2026 · 2 files
bridge: check llc_mac_hdr_init() return value in br_send_bpdu()
Eric Dumazet · Sep 24, 2026 · 1 files
net/sched: sch_teql: fix shadowed err in __teql_resolve()
Eric Dumazet · Sep 24, 2026 · 1 files
vlan: ensure sufficient headroom in vlan_dev_hard_header()
Eric Dumazet · Sep 24, 2026 · 1 files
cgroup/pids: Restore pids.events notifications in local mode
Guopeng Zhang · Sep 24, 2026 · 1 files
bpf: Zero-fill other CPUs when BPF_F_CPU creates a per-cpu hash element
Donggeun Yoo · Sep 24, 2026 · 1 files
selftests/bpf: Test per-cpu initialization of a BPF_F_CPU created element
Donggeun Yoo · Sep 24, 2026 · 1 files
tcp: prevent collapsing skbs across boundary in rtx queue
Willem de Bruijn · Sep 24, 2026 · 1 files